Which of the following should be the PRIMARY concern for the it department head when implementing operational log management?

Retention and storage issues due to log volume

Diversity of log formats generated by different IT resources

Retention and storage issues due to log volume

Resistance by operational users

Impact on performance of IT resources

Which of the following would MOST likely jeopardize the independence of a quality assurance (QA} team and could lead to conflict of interest?

Correcting coding errors during the testing process

Cross checking testing assumptions with the solution design

Inspecting code to ensure proper documentation

Ensuring compliance with development methodologies

Correcting coding errors during the testing process

Which of the following is the MOST important task of an IS auditor during an application post-implementation review?

Conduct a business impact analysis (BIA)

Attribute sampling is BEST suited to estimate:

the degree of compliance with approved procedures

the true monetary value of a population.

the total error amount in the population.

the degree of compliance with approved procedures

standard deviation from the mean.

Which of the following controls helps to reduce fraud risk associated with robotic process automation (RPA)?

Inclusion of robots in business impact assessments (BIAs)

Recertification process for robots

What is the purpose of hashing a document?

To compress the size of the file

To prevent unauthorized disclosure of the contents

To validate the integrity of the file contents

To classify the file for internal use only

To compress the size of the file

Which of the following is the BEST indication that a software development project is on track to meet its completion deadline?

Issues identified during user acceptance testing (UAT) have been addressed prior to the original implementation date.

Technical specifications and development requirements have been agreed upon and formally recorded.

Project plan due dates have been documented for each phase of the software development life cycle.

Issues identified during user acceptance testing (UAT) have been addressed prior to the original implementation date.

The planned software go-live date has been communicated in advance to end users and stakeholders.

An IS auditor observes that an organization's systems are being used for cryptocurrency mining on a regular basis. Which of the following is the auditor's FIRST course of action?

Consult the organization's acceptable use policy.

Report the incident immediately.

Recommend changing the organization's firewall settings.

Consult the organization's acceptable use policy.

Require mining software to be uninstalled.

Which of the following risk scenarios is BEST mitigated through the use of a data loss prevention (DLP) tool?

An employee uses production data in a test environment.

An employee is sending company documents to an external email to increase productivity.

A former employee retains access to an application that authenticates via single sign-on <SSO).

An employee uses production data in a test environment.

An employee selects the incorrect data classification on documents.

Which of the following is the PRIMARY objective of a control self-assessment (CSA)?

To improve the audit rating process

To shift some control monitoring responsibilities to functional areas

To create cohesive teams through employee involvement

To improve the audit rating process

To reduce control costs associated with a specific function

Which of the following is the PRIMARY objective of performing quality assurance (QA) in a system development process?

To ensure the developed system meets business requirements

To ensure that expected benefits have been realized

To ensure the developed system meets business requirements

To ensure the developed system integrates well with another system

To help determine high-level requirements for the new system

A cloud access security broker (CASB) administers the user access of a Software as a Service {SaaS) on behalf of the customer organization. When conducting an audit of the service, which of the following is MOST important for the IS auditor to confirm?

The CASB manages secure access to the federated directory service used by the SaaS application.

The CASB logs the access request as a service record that is reviewed after granting access.

The CASB verifies the access request from a named customer contact before granting access.

The CASB manages secure access to the federated directory service used by the SaaS application.

The CASB conducts periodic audits of access requests to ensure compliance with customer policy.

Which of the following is the BEST way to determine the adequacy of controls for detecting inappropriate network activity in an organization?

Reviewing SIEM reports of suspicious events in a timely manner

Reviewing business application logs on a regular basis

Troubleshooting connectivity issues routinely

Installing a packet filtering firewall to block malicious traffic

When reviewing an organization's finalized risk assessment process, what would be the MAIN reason for an IS auditor to compare acceptable risk level with residual risk?

To recommend control enhancements for further risk reduction

To identify omissions made in the completed risk assessment

To identify new risks the organization may have to address

To recommend control enhancements for further risk reduction

To advise management on risk appetite levels

When an organization conducts business process improvements, the IS auditor should be MOST concerned with the:

adequacy of reporting to senior management.

metrics used to evaluate key operating segments.

adequacy of the controls in the redesigned process.

adequacy of reporting to senior management.

lack of version control over process documentation.

Which of the following should be done FIRST following an incident that has caused internal servers to be inaccessible, disrupting normal business operations?

Make a bit-level copy of the affected servers and calculate the hash value of the copy.

Document the servers' dates, times, and locations, as well as the individual who last used them

Make a bit-level copy of the affected servers and calculate the hash value of the copy.

Copy all key directories and files on the affected servers and generate the hash value of the copy.

Unplug all power cables immediately to prevent further actions of the attacker on the servers.

Which of the following job scheduling schemes for operating system updates is MOST likely to adequately balance protection of workstations with user requirements?

Automated patching jobs followed by a scheduled restart outside of business hours

Automated patching jobs and immediate restart

Automated patching jobs followed by a scheduled restart outside of business hours

End users can initiate patching including subsequent system restarts

Applying only those patches not requiring a system restart

Which of the following is the MOST important reason for an organization to automate data purging?

Protection against privacy breaches

Which of the following operational log management considerations is MOST important for an organization undergoing a digital transformation?

Centralization of current log management

Changes in operating costs for log management

Centralization of current log management

Tuning of log reviews to provide enhanced oversight

IT resource capability to manage application uptime

Which of the following MOST effectively enables consistency across high-volume software changes'?

The use of continuous integration and deployment pipelines

Management reviews of detailed exception reports for released code

Publication of a refreshed policy on development and release management

An ongoing awareness campaign for software deployment best practices

Which of the following should be the PRIMARY focus for any network design that deploys a Zero Trust architecture?

Protecting technology resources

Maintaining network router operating system versions

Ensuring a vendor-agnostic environment

Which of the following poses the GREATEST potential concern for an organization that decides to consolidate mission-critical applications on a large server as part of IT capacity management?

More applications may be negatively affected by outages on the server.

Continuous monitoring efforts for server capacity may be costly.

Network bandwidth may be degraded during peak hours.

Accurate server capacity forecasting may be more difficult.

An organization has moved all of its infrastructure to the cloud. Which of the following would be an IS auditor's GREATEST concern related to the organization's ability to continue operations in case of a disaster?

There is no evidence that disaster recovery plan (DRP) testing was performed after the migration.

Only business-critical servers were configured with redundancy services on the cloud service provider.

The previous infrastructure was not retained to support business operations in case of a disaster.

The step-by-step recovery process was not updated in the disaster recovery plan (DRP) after the migration.

Which of the following is MOST important to consider when determining the usefulness of audit evidence?

Overall objectives of the review

An organization has introduced a capability maturity model to the system development life cycle (SDLC) to measure improvements. Which of the following is the BEST indication of successful process improvement?

Evaluation results align with defined business goals

Process maturity reaches the highest state of process optimization.

Evaluation results exceed process maturity benchmarks against competitors.

Processes demonstrate the mitigation of inherent business risk.

During a follow-up audit, an IS auditor finds that some critical recommendations have not been addressed, as management has decided to accept the risk. Which of the following is the IS auditors BEST course of action?

Adjust the annual risk assessment accordingly.

Require the auditee to address the recommendations in full.

Update the audit program based on management's acceptance of risk.

Evaluate senior management's acceptance of the risk.

Adjust the annual risk assessment accordingly.

Which of the following is the GREATEST risk associated with utilizing spreadsheets for financial reporting in end-user computing (EUC)?

Increase in regulatory violations

Increase in operational incidents

Which of the following is the GREATEST benefit of an effective data classification process?

Data is protected according to its sensitivity

Data custodians are identified.

Data retention periods are well defined

Data is protected according to its sensitivity

Appropriate ownership over data is assigned

Isaca CISA Practice Test 35 - Free Online Exam Prep & Questions

Which of the following is the MOST efficient way to identify fraudulent activity on a set of transactions?

Become a Premium Member for full access

Unlock Premium Member

Isaca CISA Practice Test 35

Question

Isaca CISA Practice Tests

Practice Tests