Which of the following responsibilities associated with a disaster recovery plan (DRP) can be outsourced to a Disaster Recovery as a Service (DRaaS) provider?

Stakeholder communications during a disaster

Processes for maintaining currency of data

Which of the following would be the GREATEST concern for an IS auditor conducting a pre-implementation review of a data loss prevention (DLP) tool?

The tool is implemented in monitor mode rather than block mode.

Crawlers are used to discover sensitive data.

Deep packet inspection opens data packets in transit.

Encryption keys are not centrally managed.

Which of the following is the BEST metric to measure the quality of software developed in an organization?

Number of defects discovered in production

Amount of successfully migrated software changes

Reduction in the help desk budget

Number of defects discovered in production

Increase in quality assurance (QA) activities

Which of the following is an IS auditor's BEST recommendation to help an organization increase the efficiency of computing resources?

Overclocking the central processing unit (CPU)

An organization is permanently transitioning from onsite to fully remote business operations. When should the existing business impact analysis (BIA) be reviewed?

As soon as the new operating model is in place

During the next scheduled review

At least one year after the transition

As soon as the decision about the transition is announced

As soon as the new operating model is in place

Which of the following should be of GREATEST concern to an IS auditor reviewing an organization's IT process performance reports over the last quarter?

Key performance indicators (KPIs) were met in only one month

Metrics are not aligned with industry benchmarks

Performance reporting includes too many technical terms

Key performance indicators (KPIs) were met in only one month

Metrics were defined without stakeholder review

Which of the following is the MOST important consideration when relying on the work of the prior auditor?

Qualifications of the prior auditor

Management agreement with recommendations

Number of findings identified by the prior auditor

An IS auditor finds that irregularities have occurred and that auditee management has chosen to ignore them. If reporting to external authorities is required which of the following is the BEST action for the IS auditor to take?

Obtain approval from audit management to submit the report.

Submit the report to appropriate regulators immediately.

Obtain approval from audit management to submit the report.

Obtain approval from auditee management to release the report.

Obtain approval from both audit and auditee management to release the report.

When drafting a disaster recovery strategy, what should be the MOST important outcome of a business impact analysis (BIA)?

Determining recovery priorities

Establishing recovery point objectives (RPOs)

Determining recovery priorities

Establishing recovery time objectives (RTOs)

Which of the following is the BEST way to ensure email confidentiality in transit?

Encryption of corporate network traffic

Which of the following is the MOST reliable way for an IS auditor to evaluate the operational effectiveness of an organization's data loss prevention (DLP) controls?

Verify that confidential files cannot be transmitted to a personal USB device.

Conduct interviews to identify possible data protection vulnerabilities.

Review data classification levels based on industry best practice.

Verify that current DLP software is installed on all computer systems.

Which of the following is MOST important for an IS auditor to validate when reviewing the controls for an organization's quality management system (QMS)?

Whether there is a process to monitor continuous improvement areas and necessary targets

Whether root cause analysis is performed on all failed and rejected changes

Whether critical services are delivered in a timely and sustainable manner

Whether there is a process to monitor continuous improvement areas and necessary targets

Whether the organization follows an industry-recognized service management framework

Which of the following is the MOST important task of an IS auditor during an application post-implementation review?

Conduct a business impact analysis (BIA)

An organization saves confidential information in a file with password protection and the file is placed in a shared folder. An attacker has stolen this information by obtaining the password through social engineering. Implementing which of the following would BEST enable the organization to prevent this type of incident in the future?

Security awareness programs for employees

Multi-factor authentication (MFA)

Security awareness programs for employees

Access history log review by the business manager

File encryption along with password protection

An organization wants to use virtual desktops to deliver corporate applications to its end users. Which of the following should an IS auditor recommend to prevent domain name system (DNS) poisoning in their cloud environment?

Enable verification of administrators to protect against impersonators modifying DNS tables.

Configure ONS servers to create appropriately sized responses to domain resolution requests.

Ensure DNS changes are propagated across all servers in the organization's cloud account.

Provide corporate laptops to end users with built-in antivirus tools that scan for DNS vulnerabilities.

Which of the following is MOST important to consider when assessing the scope of privacy concerns for an IT project?

Applicable laws and regulations

Business requirements and data flows

Which of the following is the PRIMARY purpose of conducting a control self-assessment (CSA)?

To replace audit responsibilities

To enable early detection of risks

Which of the following provides re BEST evidence that outsourced provider services are being properly managed?

Adequate action is taken for noncompilance with the service level agreement (SLA).

The service level agreement (SLA) includes penalties tor non-performance.

Internal performance standards align with corporate strategy.

The vendor provides historical data to demonstrate its performance.

Which of the following should an IS auditor do FIRST when auditing a robotics process automation (RPA) implementation?

Identity the credentials used by the robot and where they are stored.

Evaluate the overall solution architecture.

Analyze the sequence of activities performed by the robot.

Understand the business processes automated by the robot.

Identity the credentials used by the robot and where they are stored.

An organization is planning to implement a control self-assessment (CSA) program tor selected business processes Which of the following should be the role of the internal audit team for this program?

Advise management on the self-assessment process.

De-scope business processes to be covered by CSAs from future audit plans.

Design testing procedures for management to assess process controls effectively.

Perform testing to validate the accuracy of management's self-assessment.

Advise management on the self-assessment process.

Which of the following provides the BEST evidence of effective IT portfolio managements?

The IT portfolio is updated as business strategy changes.

IT portfolio updates are communicated when approved.

Programs in the IT portfolio are prioritized by each business function.

The IT portfolio is updated as business strategy changes.

The IT portfolio is updated on the basis of current industry benchmarks.

Which of the following is the BEST indication that an information security awareness program is effective?

A reduction in the success rate of social engineering attacks

A reduction in the number of reported information security incidents

A reduction in the success rate of social engineering attacks

A reduction in the cost of maintaining the information security program

A reduction in the number of information security attacks

Which of the following technologies is BEST suited to fulfill a business requirement for nonrepudiation of business-to-business transactions with external parties without the need for a mutually trusted entity?

Public key infrastructure (PKI)

Which of the following is MOST important for an IS auditor to verify when evaluating tne upgrade of an organization's enterprise resource planning (ERP) application?

Security configurations were appropriately applied to the new version

Application related documentation was updated to reflect the changes in the new version

Security configurations were appropriately applied to the new version

Users were provided security training on the new version

Lessons teamed analysis was documented after the upgrade

Which of the following is the BEST approach to help organizations address risks associated with shadow IT?

Implementing policies that prohibit the use of unauthorized systems and solutions

Training employees on information security and conducting routine follow-ups

Providing employees with access to necessary systems and unlimited software licenses

Conducting regular security assessments to identify unauthorized systems and solutions

Which of the following issues identified during a formal review of an organization's information security policies presents the GREATEST potential risk to the organization?

The policies are not aligned with the information security risk appetite.

The policies are not available to key risk stakeholders.

The policies have not been reviewed by the risk management committee.

The policies are not aligned with the information security risk appetite.

The policies are not based on industry best practices for information security.

Which of the following would MOST likely jeopardize the independence of a quality assurance (QA} team and could lead to conflict of interest?

Correcting coding errors during the testing process

Cross checking testing assumptions with the solution design

Inspecting code to ensure proper documentation

Ensuring compliance with development methodologies

Correcting coding errors during the testing process

Which of the following is the BEST recommendation by an IS auditor to prevent unauthorized access to Internet of Things (loT) devices'?

IoT devices should require identification and authentication.

loT devices should only be accessible from the host network.

loT devices should log and alert on access attempts.

IoT devices should require identification and authentication.

loT devices should monitor the use of device system accounts.

An organization is implementing a data loss prevention (DLP) system in response to a new regulatory requirement Reviewing. which of the following would be MOST helpful in evaluating the system's design?

Historical record of data breaches

Which of the following is MOST useful for determining the strategy for IT portfolio management?

Life cycle cost-benefit analysis

Which of the following recommendations would BEST prevent the implementation of IT projects without collaborating with the business?

Partner with the business units to evaluate IT projects.

Review the projects to identify similarities and eliminate duplication.

Periodically review the projects' return on investment (ROI).

Prioritize protects based on business and IT resource availability.

Which of the following would be the GREATEST concern during a financial statement audit?

The procedures for generating key reports have not been approved.

A backup has not been identified for key approvers.

System capacity has not been tested.

The procedures for generating key reports have not been approved.

The financial management system is cloud based.

An IS auditor has validated that an organization's IT department runs several low-priority automated tasks Which of the following is the BEST recommendation for an automated job schedule?

Low-priority jobs should be scheduled subject to resource availability.

Low-priority jobs should be avoided.

Low-priority jobs should include the major functions.

Low-priority jobs should be provided with optimal resources.

Low-priority jobs should be scheduled subject to resource availability.

Isaca CISA Practice Test 32 - Free Online Exam Prep & Questions

A finance department has a two-year project to upgrade the enterprise resource planning (ERP) system hosting the general ledger in year one the system version upgrade will be applied and in year two business processes will be updated to implement new system functionality. Which of the following should be the PRIMARY focus of an IS auditor reviewing the second year of the implementation'?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 32

Question

Isaca CISA Practice Tests

Practice Tests