The BEST way for an IS auditor to validate that separation of duties has been implemented is to perform:

A walk-through of job functions.

An analysis of documented job descriptions.

A review of the organizational chart.

A walk-through of job functions.

When conducting an audit of an organization's use of AI in its customer service chatbots, an IS auditor should PRIMARILY focus on the:

Safeguarding of personal data processing by the AI system.

AI system's compliance with industry security standards.

Speed and accuracy of chatbot responses to customer queries.

AI system's ability to handle multiple customer queries at once.

How would an IS auditor BEST determine the effectiveness of a security awareness program?

Review the results of social engineering tests.

Evaluate management survey results.

Interview employees to assess their security awareness.

Review security awareness training quiz results.

Which of the following is the STRONGEST indication of a mature risk management program?

Risk assessment results are used for informed decision-making.

All attributes of risk are evaluated by the risk owner.

A metrics dashboard has been approved by senior management.

The risk register is regularly updated by risk practitioners.

Which of the following should be of GREATEST concern to an IS auditor reviewing an organization's mobile device policies and controls in its corporate environment?

Not all active devices are enrolled in mobile device management (MDM).

The mobile authentication policy requires biometrics.

The virtual private network (VPN) policy is not enabled for the internal corporate network.

Not all active devices are enrolled in mobile device management (MDM).

Remote wipe and lock features are only available with access to the internet.

An organization is planning to implement a control self-assessment (CSA) program for selected business processes. Which of the following should be the role of the internal audit team for this program?

Perform testing to validate the accuracy of management's self-assessment.

Advise management on the self-assessment process.

Design testing procedures for management to assess process controls effectively.

De-scope business processes to be covered by CSAs from future audit plans.

Which of the following should be an IS auditor's GREATEST concern when an international organization intends to roll out a global data privacy policy?

Local regulations may contradict the policy.

Requirements may become unreasonable.

Local regulations may contradict the policy.

The policy may conflict with existing application requirements.

Local management may not accept the policy.

Data Loss Prevention (DLP) tools provide the MOST protection against:

The downloading of sensitive information to devices by employees.

The installation of unknown malware.

Malicious programs running on organizational systems.

The downloading of sensitive information to devices by employees.

The sending of corrupt data files to external parties via email.

Which of the following would be of GREATEST concern to an IS auditor reviewing an IT strategy document?

Strategic IT goals are derived solely from the latest market trends.

The previous year's IT strategic goals were not achieved.

Target architecture is defined at a technical level.

Financial estimates of new initiatives are disclosed within the document.

Strategic IT goals are derived solely from the latest market trends.

An IS auditor is reviewing an organization's incident management processes. Which of the following observations should be the auditor's GREATEST concern?

Ineffective incident classification

Ineffective post-incident review

The following findings are the result of an IS auditor's post-implementation review of a newly implemented system. Which of the following findings is of GREATEST significance?

Measurable benefits were not defined.

A lessons learned session was never conducted.

Monthly dashboards did not always contain deliverables.

The project's 10% budget overrun was not reported to senior management.

Measurable benefits were not defined.

Which of the following protocols should be used when transferring data via the internet?

Secure File Transfer Protocol (SFTP)

Hypertext Transfer Protocol (HTTP)

Secure File Transfer Protocol (SFTP)

Which of the following should be of GREATEST concern for an IS auditor when reviewing user account policies?

There is no policy to revoke an employee's system access upon termination.

There is no policy in place for ongoing security awareness training.

There is no policy requiring employees to sign nondisclosure agreements (NDAs).

There is no policy to revoke previous access rights when employees change roles.

Which of the following is the PRIMARY advantage of using an automated security log monitoring tool over a manual review to monitor the use of privileged access?

Increased likelihood of detecting suspicious activity

Reduced costs associated with automating the review

Improved incident response time

Reduced manual effort of reviewing logs

Which of the following should be the GREATEST concern for an IS auditor reviewing recent disaster recovery operations?

The recovery point objective (RPO) was not defined.

Test data was lost during a recovery operation.

A warm site was used as a recovery strategy.

A full backup was only performed once a week.

Which of the following is an IS auditor's BEST approach when low-risk anomalies have been identified?

Document the anomalies in audit workpapers

Reprioritize further testing of the anomalies and refocus on issues with higher risk

Update the audit plan to include the information collected during the audit

Ask auditees to promptly remediate the anomalies

Document the anomalies in audit workpapers

Which of the following technologies BEST assists in protection of digital evidence as part of forensic investigation acquisition?

Hardware-based media write blocker

Which of the following is the MOST likely root cause of shadow IT in an organization?

Approved software not meeting user requirements

Lengthy approval for technology investment

The opportunity to reduce software license fees

Ease of use for cloud-based applications and services

Approved software not meeting user requirements

Which of the following is an IS auditor's BEST recommendation after identifying that HR staff create new employees in the payroll system as well as process payroll due to limited staffing?

Implement independent periodic review of payroll transactions.

Document roles and responsibilities of payroll staff.

Implement a payroll system user awareness training program.

Implement independent periodic review of payroll transactions.

Rotate payroll responsibilities within HR.

Which of the following should be of MOST concern to an IS auditor reviewing an organization's business impact analysis (BIA)?

System criticality information was only provided by the IT manager.

A risk assessment was not conducted prior to completing the BIA.

System criticality information was only provided by the IT manager.

A questionnaire was used to gather information as opposed to in-person interviews.

The BIA was not signed off by executive management.

When reviewing whether IT investments are meeting business objectives, which of the following evaluations would be MOST useful?

Realized return on investment (ROI) versus projected ROI

Budgeted spend versus actual spend

Actual return on investment (ROI) versus industry average ROI

Control self-assessments (CSAs) can be used to:

Evaluate strategic business goals.

A national bank recently migrated a large number of business-critical applications to the cloud. Which of the following is MOST important to ensuring the resiliency of the applications?

Creating restore points for critical applications

Negotiating a nondisclosure agreement (NDA) with the provider

Conducting periodic system stress testing

Creating restore points for critical applications

Using a monitoring tool to assess uptime

Which of the following is the PRIMARY purpose of batch processing monitoring?

To prevent an incident that may result from batch failure

To comply with security standards

To summarize the batch processing reporting

To log error events in batch processing

To prevent an incident that may result from batch failure

Which of the following is an organization's BEST defense against malware?

Intrusion detection system (IDS)

Intrusion prevention system (IPS)

Intrusion detection system (IDS)

One advantage of managing an entire collection of projects as a portfolio is that it highlights the need to:

Identify dependencies between projects.

Inform users about all ongoing projects.

Manage the quality of each project.

Identify dependencies between projects.

Manage the risk of each individual project.

Which of the following security measures is MOST important for protecting Internet of Things (IoT) devices from potential cyberattacks?

Logging and monitoring network traffic

Confirming firmware compliance to current security requirements

Reviewing and updating the network diagram on a regular basis

Which of the following would BEST reduce the risk of application programming interface (API) unavailability?

Limiting the rate of incoming requests

Establishing dedicated servers for incoming API requests

Implementing a continuous integration and deployment process

Conducting periodic stress testing

Limiting the rate of incoming requests

Which of the following establishes the PRIMARY difference between a business continuity plan (BCP) and a disaster recovery plan (DRP)?

The timeframe for plan activation

The annual testing requirements

The timeframe for plan activation

The involvement of senior management

Which of the following is the GREATEST advantage of utilizing guest operating systems m a virtual environment?

They are easier to containerize with minimal impact to the rest of the environment .

They can be logged into and monitored from any location.

They prevent access to the greater environment via Transmission Control Protocol/Internet Protocol (TCP/IP).

They are easier to containerize with minimal impact to the rest of the environment .

They can be wiped quickly in the event of a security breach.

Which of the following should be of GREATEST concern to an IS auditor reviewing project documentation for a client relationship management (CRM) system migration project?

A single implementation phase is planned and the legacy system will be immediately decommissioned.

The technical migration is planned for a holiday weekend and end users may not be available.

Five weeks prior to the target date, there are still numerous defects in the printing functionality.

A single implementation phase is planned and the legacy system will be immediately decommissioned.

Employees are concerned that data representation in the new system is completely different from the old system.

Isaca CISA Practice Test 34 - Free Online Exam Questions 1321-1360

The PRIMARY reason to perform internal quality assurance (QA) for an internal audit function is to ensure:

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 34

Question

Isaca CISA Practice Tests

Practice Tests