During the forensic investigation of a cyberattack involving credit card data, which of the following is MOST important to ensure?

Proper chain of custody is maintained.

Adequate card security features are activated.

The company's payment platforms are blocked.

Proper chain of custody is maintained.

All staff in the payment card unit are interviewed.

What is the MAIN purpose of an organization's internal IS audit function?

Provide assurance to management about the effectiveness of the organization's risk management and internal controls.

Identify and initiate necessary changes in the control environment to help ensure sustainable improvement.

Independently attest the organization's compliance with applicable legal and regulatory requirements.

Review the organization's policies and procedures against industry best practices and standards.

Provide assurance to management about the effectiveness of the organization's risk management and internal controls.

Which of the following is the MOST important course of action to ensure a cloud access security broker (CASB) effectively detects and responds to threats?

Implementing a long-term CASB contract

Reviewing the information security policy

Evaluating firewall effectiveness

Which of the following is the MAIN objective of enterprise architecture (EA) governance?

To ensure new processes and technologies harmonize with existing processes

To ensure the EA can adapt to emerging technology trends

To ensure the EA is compliant with local laws and regulations

To ensure new initiatives produce an acceptable return on investment (ROI)

Which of the following observations should be of GREATEST concern to an IS auditor reviewing an organization's enterprise architecture (EA) program?

IT application owners have sole responsibility for architecture approval.

The architecture review board is chaired by the CIO.

Information security requirements are reviewed by the EA program.

The EA program governs projects that are not IT-related.

The PRIMARY advantage of using open-source-based solutions is that they:

Have well-defined support levels.

Offer better security features.

Which of the following is the MOST important consideration to facilitate prosecution of a perpetrator after a cybercrime?

Professional collection of unaltered evidence

An active intrusion detection system (IDS)

Professional collection of unaltered evidence

Reporting to the internal legal department

Immediate law enforcement involvement

Aligning IT strategy with business strategy PRIMARILY helps an organization to:

Increase involvement of senior management in IT.

Create risk awareness across business units.

Monitor the effectiveness of IT.

An IS auditor is assessing backup performance and observes that the system administrator manually initiates backups during unexpected peak usage. Which of the following is the auditor's BEST course of action?

Inspect logs to verify timely execution of backups.

Review separation of duties documentation.

Verify the load balancer configuration.

Recommend using cloud-based backups.

Inspect logs to verify timely execution of backups.

Which of the following should be of GREATEST concern to an IS auditor reviewing system interfaces used to transfer publicly available information?

The data from the originating system differs from the downloaded data.

A system interface tracking program is not enabled.

The data has not been encrypted.

Data is intercepted while in transit between systems.

The data from the originating system differs from the downloaded data.

Which of the following controls BEST provides confidentiality and nonrepudiation for an online business looking for digital payment data security?

Public Key Infrastructure (PKI)

Advanced Encryption Standard (AES)

Public Key Infrastructure (PKI)

Which of the following would present the GREATEST risk within a release management process for a new application?

Code is deployed to production without authorization.

Procedures are not updated to coincide with the production release schedule.

Code is deployed to production without authorization.

A newly added program may overwrite existing production files.

An identified bug was not resolved.

Which of the following will be the MOST effective method to verify that a service vendor keeps control levels as required by the client?

Conduct periodic onsite assessments using agreed-upon criteria.

Conduct an unannounced vulnerability assessment of the vendor's IT systems.

Periodically review the service level agreement (SLA) with the vendor.

Obtain evidence of the vendor's control self-assessment (CSA).

Which of the following is the MOST important regulatory consideration for an organization determining whether to use its customer data to train AI algorithms?

Collection of data and obtaining data subject consent

Documentation of AI algorithm accuracy during the training process

Ethical and optimal utilization of data computing resources

Collection of data and obtaining data subject consent

Continuous monitoring of AI algorithm performance

An IS auditor is reviewing a decision to consolidate processing for multiple applications onto a single large server. Which of the following is the MOST significant impact from this decision?

More applications affected by a server outage

Higher operating system license fees

More applications affected by a server outage

Fewer application servers requiring vulnerability scans

The GREATEST concern for an IS auditor reviewing vulnerability assessments by the auditee would be if the assessments are:

Conducted once per year just before system audits are scheduled.

Conducted by the internal technical team instead of external experts.

Performed for critical systems, not for the entire infrastructure.

Performed using open-source testing tools.

Which of the following is the MOST significant risk to an organization migrating its onsite application servers to a public cloud service provider?

Service provider access to organizational data

Account hacking from other clients using the same provider

Increased dependency on an external provider

Service provider limiting the right to audit

A contract for outsourcing IS functions should always include:

A provision for an independent audit of the contractor's operations.

Full details of security procedures to be observed by the contractor.

A provision for an independent audit of the contractor's operations.

The names and roles of staff to be employed in the operation.

Which of the following controls would BEST help a forensic investigator prevent modifications in digital evidence?

Write-protecting media that contains evidence

Creating digital images of the media that contains evidence

Generating hash values of evidence files on media

Maintaining the chain of custody for digital evidence

Which of the following approaches would present the GREATEST concern for the implementation of a quality assurance (QA) function?

Developers introducing the changes will review the work, as they are most familiar with them.

Peer developers from the same development team who are unfamiliar with the changes will review them.

Developers from a separate development team in the organization will review the submitted changes.

Reviewers outside the development group who do not have development roles will review the changes.

An organization is concerned about duplicate vendor payments on a complex system with a high volume of transactions. Which of the following would be MOST helpful to an IS auditor to determine whether duplicate vendor payments exist?

Computer-assisted audit technique (CAAT)

Which of the following encryption methods offers the BEST wireless security?

Wi-Fi Protected Access 3 (WPA3)

Which of the following is the MOST important consideration when implementing a Zero Trust strategy for mobile, wireless, and Internet of Things (IoT) devices?

Validating the identity of all devices and users before granting access to resources

Ensuring the latest firmware updates are applied regularly to all devices

Validating the identity of all devices and users before granting access to resources

Focusing on user training and awareness to prevent phishing attacks

Implementing strong encryption protocols for data in transit and at rest

An IS auditor wants to verify alignment of the organization's business continuity plan (BCP) with the business strategy. Which of the following would be MOST helpful to review?

Disaster recovery plan (DRP) testing results

Corporate risk management policy

Key performance indicators (KPIs)

Which of the following should be the PRIMARY consideration when incorporating user training and awareness into a data loss prevention (DLP) strategy?

Promoting secure data handling practices

Avoiding financial penalties and reputational risk

Promoting secure data handling practices

Adhering to data governance policies

Which of the following key performance indicators (KPIs) provides stakeholders with the MOST useful information about whether information security risk is being managed?

Time from identifying security threats to implementing solutions

The number of security controls audited

Time from security log capture to log analysis

The number of entries in the security risk register

Which of the following provides an IS auditor the BEST evidence that a third-party service provider's information security controls are effective?

An audit report of the controls by an external auditor

Documentation of the service provider's security configuration controls

A review of the service provider's policies and procedures

An audit report of the controls by an external auditor

An interview with the service provider's senior management

Which of the following is the GREATEST risk associated with lack of IT involvement in the organization's strategic planning initiatives?

IT strategies may not align with business strategies.

Business strategies may not align with IT capabilities.

Business strategies may not consider emerging technologies.

IT strategies may not align with business strategies.

IT strategic goals may not be considered by the business.

Which of the following is the BEST control to help ensure the completeness of outbound transactions?

Maintain a log of the number of messages sent and validate periodically.

Perform edit checks to identify erroneous, unusual, or invalid transactions.

Verify transactions are sequentially numbered in the header record.

Ensure the validity of the recipient ID and use auto-numbered reports.

Maintain a log of the number of messages sent and validate periodically.

Before the release of a new application into an organization's production environment, which of the following should be in place to ensure that proper testing has occurred and rollback plans are in place?

Independent third-party approval

Isaca CISA Practice Test 33 - Free Online Exam Prep & Questions

Which of the following control measures is the MOST effective against unauthorized access of confidential information on stolen or lost laptops?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 33

Question

Isaca CISA Practice Tests

Practice Tests