Which of the following is the PRIMARY objective of cyber resiliency?

To limit the severity of security breaches and maintain continuous operations

To resume normal operations after service disruptions

To prevent potential attacks or disruptions in operations

To efficiently and effectively recover from an incident with limited operational impact

To limit the severity of security breaches and maintain continuous operations

Which of the following is the BEST control to help ensure that security requirements are considered throughout the life cycle of an agile software development project?

Including project team members who can provide security expertise

Documenting security control requirements and obtaining internal audit sign off

Including project team members who can provide security expertise

Reverting to traditional waterfall software development life cycle (SDLC) techniques

Requiring the project to go through accreditation before release into production

An IS auditor is preparing for a review of controls associated with a manufacturing plant's implementation of industrial Internet of Things (loT) infrastructure Which of the following vulnerabilities would present the GREATEST security risk to the organization?

Use of open-source software components within the loT devices

Insufficient physical security around the lo I devices for theft prevention

Use of open-source software components within the loT devices

Constraints in loT device firmware storage space for code upgrades

loT devices that are not using wireless network connectivity

An organization wants to classify database tables according to its data classification scheme From an IS auditor's perspective the tables should be classified based on the:

specific functional contents of each single table.

frequency of updates to the table.

descriptions of column names in the table.

number of end users with access to the table.

Which of the following is the GREATEST advantage of utilizing guest operating systems m a virtual environment?

They are easier to containerize with minimal impact to the rest of the environment .

They can be logged into and monitored from any location.

They prevent access to the greater environment via Transmission Control Protocol/Internet Protocol (TCP/IP).

They are easier to containerize with minimal impact to the rest of the environment .

They can be wiped quickly in the event of a security breach.

Which of the following should be of GREATEST concern to an IS auditor reviewing project documentation for a client relationship management (CRM) system migration project?

A single implementation phase is planned and the legacy system will be immediately decommissioned.

The technical migration is planned for a holiday weekend and end users may not be available.

Five weeks prior to the target date, there are still numerous defects in the printing functionality.

A single implementation phase is planned and the legacy system will be immediately decommissioned.

Employees are concerned that data representation in the new system is completely different from the old system.

Which of the following is the BEST reason for software developers to use automated testing versus manual testing?

Ease of maintaining automated test scripts

Reduces the scope of acceptance testing

An organization that has decided to approve the use of end-user computing (EUC) should FIRST ensure:

a business impact analysis (BIA) is conducted.

EUC use cases are assessed and documented.

Which of the following is an example of shadow IT?

An employee using a cloud based order management tool without approval from IT

An employee using a company provided laptop to access personal banking information

An employee using personal email to communicate with clients without approval from IT

An employee using a company-provided tablet to access social media during work hours

Which of the following BEST enables an organization to determine the effectiveness of its information security awareness program?

Evaluating the results of a social engineering exercise

Measuring user satisfaction with the quality of the training

Evaluating the results of a social engineering exercise

Reviewing security staff performance evaluations

Performing an analysis of the number of help desk calls

An organization has decided to reengineer business processes to improve the performance of overall IT service delivery. Which of the following recommendations from the project team should be the GREATEST concern to the IS auditor?

Disable operational logging to enhance the processing speed and save storage.

Adopt a service delivery model based on insights from peer organizations.

Delegate business decisions to the chief risk officer (CRO).

Eliminate certain reports and key performance indicators (KPIs)

An IS auditor has been tasked with analyzing an organization's capital expenditures against its repair and maintenance costs. Which of the following is the BEST reason to use a data analytics tool for this purpose?

It enables the auditor to work with 100% of the transactions.

It improves the reliability of the data.

It enables the auditor to work with 100% of the transactions.

It reduces the sample size required to perform the audit.

A post-implementation audit has been completed for the deployment of a sophisticated job scheduling tool Which of the following observations would be of GREATEST concern?

The data encryption setting is not enabled in the scheduling tool.

The IT learn customized tool settings without seeking approval from the provider.

The overall project took longer to complete than planned.

The data encryption setting is not enabled in the scheduling tool.

The IT team accesses the scheduler admin panel via a generic account.

An IS auditor is reviewing desktop software profiles and notes that a user has downloaded and installed several games that are not approved by the company. Which of the following is the MOST significant risk that could result from this situation?

Noncompliance with the acceptable use policy

Interoperability issues with company software

Which of the following is the MOST effective control when granting access to a service provider for a ctoud-6ased application?

Access has been provided on a need-to-know basis.

Administrator access is provided for a limited period with an expiration date.

Access has been provided on a need-to-know basis.

User IDs are deleted when work is completed.

Access is provided to correspond with the service level agreement (SLA).

which of the following is a core functionality of a configuration and release management system?

Identifying other configuration items that will be impacted by a given change

Managing privileged access to databases servers and infrastructure

Identifying vulnerabilities in configuration settings

Deploying a configuration change to the sandbox environment

Identifying other configuration items that will be impacted by a given change

An organization is modernizing its technology policy framework to demonstrate compliance with external industry standards. Which of the following would be MOST useful to an IS auditor for validating the outcome?

Mapping of relevant standards against the organization's controls

Benchmarking of internal standards against peer organizations

Inventory of the organization's approved policy exceptions

Policy recommendations from a leading external consulting agency

Mapping of relevant standards against the organization's controls

An IS auditor is reviewing an organization's cloud access security broker (CASB) solution. Which ofthe following is MOST important for the auditor to verify?

Users are periodically recertified.

An IS auditor observes that a large number of departed employees have not been removed from the accounts payable system. Which of the following is MOST important to determine in order to assess the risk1?

The ability of departed employees to actually access the system

The frequency of user access reviews performed by management

The frequency of intrusion attempts associated with the accounts payable system

The process for terminating access of departed employees

The ability of departed employees to actually access the system

Which of the following is the BEST preventive control to protect the confidentiality of data on a corporate smartphone in the event it is lost?

Encryption of the data stored on the device

Biometric authentication for the device

Encryption of the data stored on the device

Password for device authentication

Which of the following is the PRIMARY benefit of operational log management?

It improves security with real-time monitoring of network data.

It enhances user experience via predictive analysis.

It improves security with real-time monitoring of network data.

It organizes data to identify performance issues.

It supports data aggregation using unified storage.

Which of the following is an IS auditor's BEST course of action when the auditee indicates that a corrective action plan for a high-risk finding will take longer than expected?

Determine if an interim compensating control has been implemented.

Accept the longer target date and document it in the audit system.

Determine if an interim compensating control has been implemented.

Escalate the overdue finding to the audit committee.

Require that remediation is completed in the agreed timeframe.

Which of the following is MOST important for an IS auditor to verify when reviewing the planned use of Benford's law as a data analytics technique to detect fraud in a set of credit card transactions?

The transactions are all in the same currency.

The transactions are in double integer format.

The transaction amounts are selected randomly without restriction.

The transaction analysis is limited to transactions within standard deviation.

The transactions are all in the same currency.

Which of the following would BEST protect the confidentiality of sensitive data in transit between multiple offices?

Public key infrastructure (PKI)

An IS auditor has been asked to review the integrity of data transfer between two business-critical systems that have not been tested since implementation. Which of the following would provide the MOST useful information to plan an audit?

Previous system interface testing records

IT testing policies and procedures

Previous system interface testing records

An IS auditor is reviewing an organization's system development life cycle (SDLC) Which of the following MUST be included in the review?

Utilization of standards in the system development processes and procedures

Ownership of the system quality management plan

Utilization of standards in the system development processes and procedures

Validation that system development processes adhere to quality standards

Definition of quality attributes to be associated with the system

Which of the following is the MOST efficient way to identify fraudulent activity on a set of transactions?

Control self-assessments (CSAs)

Which of the following should be the PRIMARY concern for the it department head when implementing operational log management?

Retention and storage issues due to log volume

Diversity of log formats generated by different IT resources

Retention and storage issues due to log volume

Resistance by operational users

Impact on performance of IT resources

A business application's database is copied to a replication server within minutes. Which of the following processes taking place during business hours will MOST benefit from this architecture?

Ad hoc batch reporting jobs from the replication server

Rolling forward of transactions when a production server fails

Ad hoc batch reporting jobs from the replication server

Analysis of application performance degradation

Hardware replacement work involving databases

An organization is enhancing the security of a client-facing web application following a proposal to acquire personal information for a business purpose. Which of the following is MOST important to review before implementing this initiative?

Regulatory compliance requirements

Customer notification procedures

Isaca CISA Practice Test 31 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Isaca CISA Practice Test 31

Question

Isaca CISA Practice Tests

Practice Tests