Which of the following would BEST determine whether a post-implementation review (PIR) performed by the project management office (PMO) was effective?

Project outcomes have been realized.

Lessons learned were implemented.

Management approved the PIR report.

The review was performed by an external provider.

Project outcomes have been realized.

Which of the following is MOST important for an IS auditor to examine when reviewing an organization's privacy policy?

The organization's legitimate purpose for collecting personal data

Whether there is explicit permission from regulators to collect personal data

The organization's legitimate purpose for collecting personal data

Whether sharing of personal information with third-party service providers is prohibited

The encryption mechanism selected by the organization for protecting personal data

Which of the following is the GREATEST concern associated with a high number of IT policy exceptions approved by management?

The exceptions may result in noncompliance.

The exceptions are likely to continue indefinitely.

The exceptions may result in noncompliance.

The exceptions may elevate the level of operational risk.

The exceptions may negatively impact process efficiency.

Which of the following will be the MOST effective method to verify that a service vendor keeps control levels as required by the client?

Conduct periodic on-site assessments using agreed-upon criteria.

Periodically review the service level agreement (SLA) with the vendor.

Conduct an unannounced vulnerability assessment of vendor's IT systems.

Obtain evidence of the vendor's control self-assessment (CSA).

While executing follow-up activities, an IS auditor is concerned that management has implemented corrective actions that are different from those originally discussed and agreed with the audit function. In order to resolve the situation, the IS auditor's BEST course of action would be to:

determine whether the alternative controls sufficiently mitigate the risk.

re-prioritize the original issue as high risk and escalate to senior management.

schedule a follow-up audit in the next audit cycle.

postpone follow-up activities and escalate the alternative controls to senior audit management.

determine whether the alternative controls sufficiently mitigate the risk.

During an ongoing audit, management requests a briefing on the findings to date. Which of the following is the IS auditor's BEST course of action?

Present observations for discussion only.

Review working papers with the auditee.

Request the auditee provide management responses.

Request management wait until a final report is ready for discussion.

Present observations for discussion only.

Which of the following is the PRIMARY concern when negotiating a contract for a hot site?

Availability of the site in the event of multiple disaster declarations

Coordination with the site staff in the event of multiple disaster declarations

Reciprocal agreements with other organizations

Complete testing of the recovery plan

Which of the following is MOST important for an IS auditor to review when evaluating the accuracy of a spreadsheet that contains several macros?

Reconciliation of key calculations

Which of the following is the BEST recommendation to prevent fraudulent electronic funds transfers by accounts payable employees?

Engage an external security incident response expert for incident handling.

A new regulation requires organizations to report significant security incidents to the regulator within 24 hours of identification. Which of the following is the IS auditor's BEST recommendation to facilitate compliance with the regulation?

Include the requirement in the incident management response plan.

Establish key performance indicators (KPIs) for timely identification of security incidents.

Enhance the alert functionality of the intrusion detection system (IDS).

Engage an external security incident response expert for incident handling.

An IS auditor has found that an organization is unable to add new servers on demand in a cost-efficient manner. Which of the following is the auditor's BEST recommendation?

Increase the capacity of existing systems.

Upgrade hardware to newer technology.

Hire temporary contract workers for the IT function.

An IS auditor who was instrumental in designing an application is called upon to review the application. The auditor should:

inform audit management of the earlier involvement.

refuse the assignment to avoid conflict of interest.

use the knowledge of the application to carry out the audit.

inform audit management of the earlier involvement.

Which of the following is the BEST method to prevent wire transfer fraud by bank employees?

Re-keying of wire dollar amounts

Two-factor authentication control

In a small IT web development company where developers must have write access to production, the BEST recommendation of an IS auditor would be to:

remove production access from the developers.

hire another person to perform migration to production.

implement continuous monitoring controls.

remove production access from the developers.

perform a user access review for the development team

Which of the following is the PRIMARY reason for an IS auditor to conduct post-implementation reviews?

To determine whether project objectives in the business case have been achieved

To ensure key stakeholder sign-off has been obtained

To align project objectives with business needs

To document lessons learned to improve future project delivery

In a 24/7 processing environment, a database contains several privileged application accounts with passwords set to never expire. Which of the following recommendations would BEST address the risk with minimal disruption to the business?

Introduce database access monitoring into the environment

Modify applications to no longer require direct access to the database.

Introduce database access monitoring into the environment

Modify the access management policy to make allowances for application accounts.

Schedule downtime to implement password changes.

Management is concerned about sensitive information being intentionally or unintentionally emailed as attachments outside the organization by employees. What is the MOST important task before implementing any associated email controls?

Develop an information classification scheme.

Require all employees to sign nondisclosure agreements (NDAs).

Develop an acceptable use policy for end-user computing (EUC).

Develop an information classification scheme.

Provide notification to employees about possible email monitoring.

An IS auditor will be testing accounts payable controls by performing data analytics on the entire population of transactions. Which of the following is MOST important for the auditor to confirm when sourcing the population data?

The data is taken directly from the system.

There is no privacy information in the data.

The data can be obtained in a timely manner.

The data analysis tools have been recently updated.

Which of the following is the BEST source of information for assessing the effectiveness of IT process monitoring?

Participative management techniques

Which of the following is the MOST effective way to maintain network integrity when using mobile devices?

Implement network access control.

Implement outbound firewall rules.

Which of the following is the BEST detective control for a job scheduling process involving data transmission?

Job failure alerts are automatically generated and routed to support personnel.

Metrics denoting the volume of monthly job failures are reported and reviewed by senior management.

Jobs are scheduled to be completed daily and data is transmitted using a Secure File Transfer Protocol (SFTP).

Jobs are scheduled and a log of this activity is retained for subsequent review.

Job failure alerts are automatically generated and routed to support personnel.

Which of the following should be an IS auditor's GREATEST consideration when scheduling follow-up activities for agreed-upon management responses to remediate audit observations?

Risk rating of original findings

Business interruption due to remediation

Availability of responsible IT personnel

Risk rating of original findings

Which of the following is MOST important to include in forensic data collection and preservation procedures?

Assuring the physical security of devices

Which of the following is a social engineering attack method?

An employee is induced to reveal confidential IP addresses and passwords by answering questions over the phone.

An unauthorized person attempts to gam access to secure premises by following an authonzed person through a secure door.

An employee is induced to reveal confidential IP addresses and passwords by answering questions over the phone.

A hacker walks around an office building using scanning tools to search for a wireless network to gain access.

An intruder eavesdrops and collects sensitive information flowing through the network and sells it to third parties.

When an intrusion into an organization network is deleted, which of the following should be done FIRST?

Identity nodes that have been compromised.

Block all compromised network nodes.

Identity nodes that have been compromised.

Which of the following should be GREATEST concern to an IS auditor reviewing data conversion and migration during the implementation of a new application system?

Unauthorized data modifications occurred during conversion.

Data conversion was performed using manual processes.

Backups of the old system and data are not available online.

Unauthorized data modifications occurred during conversion.

The change management process was not formally documented

Which of the following would be to MOST concern when determine if information assets are adequately safequately safeguarded during transport and disposal?

Lack of appropriate data classification

Lack of recent awareness training.

Lack of appropriate data classification

During the design phase of a software development project, the PRIMARY responsibility of an IS auditor is to evaluate the:

Controls incorporated into the system specifications.

Future compatibility of the application.

Proposed functionality of the application.

Controls incorporated into the system specifications.

Development methodology employed.

Which of the following is the MOST important reason to implement version control for an end-user computing (EUC) application?

To ensure that only the latest approved version of the application is used

To ensure that older versions are availability for reference

To ensure that only the latest approved version of the application is used

To ensure compatibility different versions of the application

To ensure that only authorized users can access the application

Which of the following is the MOST effective way for an organization to project against data loss?

Conduct periodic security awareness training.

Limit employee internet access.

Implement data classification procedures.

Review firewall logs for anomalies.

Conduct periodic security awareness training.

Management has requested a post-implementation review of a newly implemented purchasing package to determine to what extent business requirements are being met. Which of the following is MOST likely to be assessed?

Purchasing guidelines and policies

The implementation of an IT governance framework requires that the board of directors of an organization:

Be informed of all IT initiatives.

Isaca CISA Practice Test 4 - Free Online Exam Prep & Questions

Question 1 / 40

During a follow-up audit, an IS auditor learns that some key management personnel have been replaced since the original audit, and current management has decided not to implement some previously accepted recommendations. What is the auditor's BEST course of action?

Notify the chair of the audit committee.

Notify the audit manager.

Retest the control.

Close the audit finding.

Comment (0)

Isaca CISA Practice Test 4

Question

Isaca CISA Practice Tests

Practice Tests