Which of the following is the BEST source of information for an IS auditor to use as a baseline to assess the adequacy of an organization's privacy policy?

Local privacy standards and regulations

Historical privacy breaches and related root causes

Globally accepted privacy best practices

Local privacy standards and regulations

Benchmark studies of similar organizations

Which of the following would lead an IS auditor to conclude that the evidence collected during a digital forensic investigation would not be admissible in court?

The logs failed to identify the person handling the evidence.

The person who collected the evidence is not qualified to represent the case.

The logs failed to identify the person handling the evidence.

The evidence was collected by the internal forensics team.

The evidence was not fully backed up using a cloud-based solution prior to the trial.

An IS auditor performs a follow-up audit and learns the approach taken by the auditee to fix the findings differs from the agreed-upon approach confirmed during the last audit. Which of the following should be the auditor's NEXT course of action?

Evaluate the appropriateness of the remedial action taken.

Conduct a risk analysis incorporating the change.

Report results of the follow-up to the audit committee.

Inform senior management of the change in approach.

Which of the following metrics would BEST measure the agility of an organization's IT function?

Average time to turn strategic IT objectives into an agreed upon and approved initiative

Average number of learning and training hours per IT staff member

Frequency of security assessments against the most recent standards and guidelines

Average time to turn strategic IT objectives into an agreed upon and approved initiative

Percentage of staff with sufficient IT-related skills for the competency required of their roles

An employee loses a mobile device resulting in loss of sensitive corporate data. Which o( the following would have BEST prevented data leakage?

Data encryption on the mobile device

Complex password policy for mobile devices

The triggering of remote data wipe capabilities

Awareness training for mobile device users

Which of the following should an IS auditor review FIRST when planning a customer data privacy audit?

Organizational policies and procedures

Legal and compliance requirements

Organizational policies and procedures

A third-party consultant is managing the replacement of an accounting system. Which of the following should be the IS auditor's GREATEST concern?

The user department will manage access rights.

Data migration is not part of the contracted activities.

The replacement is occurring near year-end reporting

The user department will manage access rights.

Testing was performed by the third-party consultant

In an environment that automatically reports all program changes, which of the following is the MOST efficient way to detect unauthorized changes to production programs?

Reviewing the last compile date of production programs

Manually comparing code in production programs to controlled copies

Periodically running and reviewing test data against production programs

Verifying user management approval of modifications

Due to system limitations, segregation of duties (SoD) cannot be enforced in an accounts payable system. Which of the following is the IS auditor's BEST recommendation for a compensating control?

Require written authorization for all payment transactions

Restrict payment authorization to senior staff members.

Reconcile payment transactions with invoices.

Review payment transaction history

An organization has assigned two now IS auditors to audit a now system implementation. One of the auditors has an IT-related degree, and one has a business degree. Which ol the following is MOST important to meet the IS audit standard for proficiency?

Team member assignments must be based on individual competencies.

The standard is met as long as one member has a globally recognized audit certification.

Technical co-sourcing must be used to help the new staff.

Team member assignments must be based on individual competencies.

The standard is met as long as a supervisor reviews the new auditors' work.

Which of the following is the MOST important activity in the data classification process?

Determining accountability of data owners

Labeling the data appropriately

Identifying risk associated with the data

Determining accountability of data owners

Determining the adequacy of privacy controls

Which of the following represents the HIGHEST level of maturity of an information security program?

A framework is in place to measure risks and track effectiveness.

A training program is in place to promote information security awareness.

A framework is in place to measure risks and track effectiveness.

Information security policies and procedures are established.

The program meets regulatory and compliance requirements.

Which of the following findings should be of GREATEST concern for an IS auditor when auditing the effectiveness of a phishing simu-lation test administered for staff members?

Staff members who failed the test did not receive follow-up education

Test results were not communicated to staff members.

Staff members were not notified about the test beforehand.

Security awareness training was not provided prior to the test.

Which of the following is the MOST important determining factor when establishing appropriate timeframes for follow-up activities related to audit findings?

Remediation dates included in management responses

Availability of IS audit resources

Remediation dates included in management responses

Peak activity periods for the business

Complexity of business processes identified in the audit

Which of the following is the MOST important reason to classify a disaster recovery plan (DRP) as confidential?

Reduce the risk of data leakage that could lead to an attack.

Ensure compliance with the data classification policy.

Protect the plan from unauthorized alteration.

Comply with business continuity best practice.

Reduce the risk of data leakage that could lead to an attack.

A now regulation requires organizations to report significant security incidents to the regulator within 24 hours of identification. Which of the following is the IS auditor's BEST recommendation to facilitate compliance with the regulation?

Include the requirement in the incident management response plan.

Establish key performance indicators (KPls) for timely identification of security incidents.

Engage an external security incident response expert for incident handling.

Enhance the alert functionality of the intrusion detection system (IDS).

Include the requirement in the incident management response plan.

After the merger of two organizations, which of the following is the MOST important task for an IS auditor to perform?

Verifying that access privileges have been reviewed

investigating access rights for expiration dates

Updating the continuity plan for critical resources

An IS auditor is reviewing an organization's primary router access control list. Which of the following should result in a finding?

Individual permissions are overriding group permissions.

There are conflicting permit and deny rules for the IT group.

The network security group can change network address translation (NAT).

Individual permissions are overriding group permissions.

There is only one rule per group with access privileges.

While auditing a small organization's data classification processes and procedures, an IS auditor noticed that data is often classified at the incorrect level. What is the MOST effective way for the organization to improve this situation?

Have IT security staff conduct targeted training for data owners.

Use automatic document classification based on content.

Have IT security staff conduct targeted training for data owners.

Publish the data classification policy on the corporate web portal.

Conduct awareness presentations and seminars for information classification policies.

An organization recently implemented a cloud document storage solution and removed the ability for end users to save data to their local workstation hard drives. Which of the following findings should be the IS auditor's GREATEST concern?

The business continuity plan (BCP) was not updated.

Users are not required to sign updated acceptable use agreements.

Users have not been trained on the new system.

The business continuity plan (BCP) was not updated.

Mobile devices are not encrypted.

Which of the following must be in place before an IS auditor initiates audit follow-up activities?

A management response in the final report with a committed implementation date

Available resources for the activities included in the action plan

A management response in the final report with a committed implementation date

A heal map with the gaps and recommendations displayed in terms of risk

Supporting evidence for the gaps and recommendations mentioned in the audit report

Which of the following should an IS auditor consider FIRST when evaluating firewall rules?

The organization's security policy

The firewalls' default settings

The physical location of the firewalls

Which of the following issues associated with a data center's closed-circuit television (CCTV) surveillance cameras should be of MOST concern to an IS auditor?

CCTV recordings are not regularly reviewed.

CCTV cameras are not installed in break rooms

CCTV records are deleted after one year.

CCTV footage is not recorded 24 x 7.

Which of the following is the BEST way to ensure that business continuity plans (BCPs) will work effectively in the event of a major disaster?

Involve staff at all levels in periodic paper walk-through exercises.

Prepare detailed plans for each business function.

Involve staff at all levels in periodic paper walk-through exercises.

Regularly update business impact assessments.

Make senior managers responsible for their plan sections.

Which of the following is the MOST important consideration for an IS auditor when assessing the adequacy of an organization's information security policy?

Alignment with the IT tactical plan

Compliance with industry best practice

An organization has outsourced the development of a core application. However, the organization plans to bring the support and future maintenance of the application back in-house. Which of the following findings should be the IS auditor's GREATEST concern?

The data model is not clearly documented.

The cost of outsourcing is lower than in-house development.

The vendor development team is located overseas.

A training plan for business users has not been developed.

The data model is not clearly documented.

Which of the following provides the BEST providence that outsourced provider services are being properly managed?

Adequate action is taken for noncompliance with the service level agreement (SLA).

The service level agreement (SLA) includes penalties for non-performance.

Adequate action is taken for noncompliance with the service level agreement (SLA).

The vendor provides historical data to demonstrate its performance.

Internal performance standards align with corporate strategy.

Isaca CISA Practice Test 8 - Free Online Exam Prep & Questions

Question 1 / 40

Which of the following is the BEST indicator of the effectiveness of an organization's incident response program?

Number of successful penetration tests

Percentage of protected business applications

Financial impact per security event

Number of security vulnerability patches

Comment (0)

Isaca CISA Practice Test 8

Question

Isaca CISA Practice Tests

Practice Tests