The PRIMARY role of a control self-assessment (CSA) facilitator is to:

focus the team on internal controls.

conduct interviews to gain background information.

focus the team on internal controls.

report on the internal control weaknesses.

provide solutions for control weaknesses.

Which of the following is the PRIMARY advantage of using visualization technology for corporate applications?

Better utilization of resources

Increased application performance

A warehouse employee of a retail company has been able to conceal the theft of inventory items by entering adjustments of either damaged or lost stock items lo the inventory system. Which control would have BEST prevented this type of fraud in a retail environment?

Separate authorization for input of transactions

Statistical sampling of adjustment transactions

Unscheduled audits of lost stock lines

An edit check for the validity of the inventory transaction

An organization allows its employees lo use personal mobile devices for work. Which of the following would BEST maintain information security without compromising employee privacy?

Partitioning the work environment from personal space on devices

Installing security software on the devices

Partitioning the work environment from personal space on devices

Preventing users from adding applications

Restricting the use of devices for personal purposes during working hours

An IS auditor has been asked to advise on measures to improve IT governance within the organization. Which at the following is the BEST recommendation?

Implement key performance indicators (KPIs)

Implement annual third-party audits.

Benchmark organizational performance against industry peers.

Require executive management to draft IT strategy

An IS auditor reviewing the threat assessment tor a data center would be MOST concerned if:

the exercise was completed by local management.

some of the identified throats are unlikely to occur.

all identified throats relate to external entities.

the exercise was completed by local management.

neighboring organizations operations have been included.

Which of the following features of a library control software package would protect against unauthorized updating of source code?

Access controls for source libraries

Required approvals at each life cycle step

Date and time stamping of source and object code

Access controls for source libraries

Release-to-release comparison of source code

What Is the BEST method to determine if IT resource spending is aligned with planned project spending?

Return on investment (ROI) analysis

An organization has made a strategic decision to split into separate operating entities to improve profitability. However, the IT infrastructure remains shared between the entities. Which of the following would BEST help to ensure that IS audit still covers key risk areas within the IT environment as part of its annual plan?

Developing a risk-based plan considering each entity's business processes

Increasing the frequency of risk-based IS audits for each business entity

Developing a risk-based plan considering each entity's business processes

Conducting an audit of newly introduced IT policies and procedures

Revising IS audit plans to focus on IT changes introduced after the split

An audit has identified that business units have purchased cloud-based applications without IPs support. What is the GREATEST risk associated with this situation?

The applications may not reasonably protect data.

The applications are not included in business continuity plans (BCFs)

The applications may not reasonably protect data.

The application purchases did not follow procurement policy.

The applications could be modified without advanced notice.

Which of the following would BEST enable an organization to address the security risks associated with a recently implemented bring your own device (BYOD) strategy?

Mobile device awareness program

Which of the following is MOST important to determine during the planning phase of a cloud-based messaging and collaboration platform acquisition?

Types of data that can be uploaded to the platform

Role-based access control policies

Types of data that can be uploaded to the platform

Processes for on-boarding and off-boarding users to the platform

Processes for reviewing administrator activity

An IS auditor has found that a vendor has gone out of business and the escrow has an older version of the source code. What is the auditor's BEST recommendation for the organization?

Bring the escrow version up to date.

Analyze a new application that moots the current re

Perform an analysis to determine the business risk

Bring the escrow version up to date.

Develop a maintenance plan to support the application using the existing code

In response to an audit finding regarding a payroll application, management implemented a new automated control. Which of the following would be MOST helpful to the IS auditor when evaluating the effectiveness of the new control?

Written procedures defining processes and controls

Approved test scripts and results prior to implementation

Written procedures defining processes and controls

Approved project scope document

A review of tabletop exercise results

Which of the following BEST facilitates the legal process in the event of an incident?

Preserving the chain of custody

Results of a root cause analysis

Which of the following is MOST important to ensure that electronic evidence collected during a forensic investigation will be admissible in future legal proceedings?

Documenting evidence handling by personnel throughout the forensic investigation

Restricting evidence access to professionally certified forensic investigators

Documenting evidence handling by personnel throughout the forensic investigation

Performing investigative procedures on the original hard drives rather than images of the hard drives

Engaging an independent third party to perform the forensic investigation

An IS auditor finds that one employee has unauthorized access to confidential data. The IS auditor's BEST recommendation should be to:

require the business owner to conduct regular access reviews.

reclassify the data to a lower level of confidentiality

require the business owner to conduct regular access reviews.

implement a strong password schema for users.

recommend corrective actions to be taken by the security administrator.

Which of the following is necessary for effective risk management in IT governance?

Risk evaluation is embedded in management processes.

Local managers are solely responsible for risk evaluation.

IT risk management is separate from corporate risk management.

Risk management strategy is approved by the audit committee.

Risk evaluation is embedded in management processes.

Which of the following will BEST ensure that a proper cutoff has been established to reinstate transactions and records to their condition just prior to a computer system failure?

Using a database management system (DBMS) to dynamically back-out partially processed transactions

Rotating backup copies of transaction files offsite

Using a database management system (DBMS) to dynamically back-out partially processed transactions

Maintaining system console logs in electronic formal

Ensuring bisynchronous capabilities on all transmission lines

Which of the following is MOST important when planning a network audit?

Identification of existing nodes

Determination of IP range in use

Isolation of rogue access points

Identification of existing nodes

Which of the following BEST describes an audit risk?

The financial report may contain undetected material errors.

The company is being sued for false accusations.

The financial report may contain undetected material errors.

Employees have been misappropriating funds.

Key employees have not taken vacation for 2 years.

An IS auditor notes that the previous year's disaster recovery test was not completed within the scheduled time frame due to insufficient hardware allocated by a third-party vendor. Which of the following provides the BEST evidence that adequate resources are now allocated to successfully recover the systems?

Hardware change management policy

Vendor memo indicating problem correction

An organization is disposing of a system containing sensitive data and has deleted all files from the hard disk. An IS auditor should be concerned because:

deleting the files logically does not overwrite the files' physical data.

deleted data cannot easily be retrieved.

deleting the files logically does not overwrite the files' physical data.

backup copies of files were not deleted as well.

deleting all files separately is not as efficient as formatting the hard disk.

An IS auditor finds that the process for removing access for terminated employees is not documented What is the MOST significant risk from this observation?

Access rights may not be removed in a timely manner.

Procedures may not align with best practices

Human resources (HR) records may not match system access.

Unauthorized access cannot he identified.

Access rights may not be removed in a timely manner.

What should an IS auditor do FIRST upon discovering that a service provider did not notify its customers of a security breach?

Notify audit management of the finding.

Notify law enforcement of the finding.

Require the third party to notify customers.

The audit report with a significant finding.

Notify audit management of the finding.

Which of the following is a challenge in developing a service level agreement (SLA) for network services?

Finding performance metrics that can be measured properly

Establishing a well-designed framework for network servirces.

Finding performance metrics that can be measured properly

Ensuring that network components are not modified by the client

Reducing the number of entry points into the network

A system administrator recently informed the IS auditor about the occurrence of several unsuccessful intrusion attempts from outside the organization. Which of the following is MOST effective in detecting such an intrusion?

Periodically reviewing log files

Using smart cards with one-time passwords

Periodically reviewing log files

Configuring the router as a firewall

Installing biometrics-based authentication

An organization has virtualized its server environment without making any other changes to the network or security infrastructure. Which of the following is the MOST significant risk?

Inability of the network intrusion detection system (IDS) to monitor virtual server-lo-server communications

Vulnerability in the virtualization platform affecting multiple hosts

Data center environmental controls not aligning with new configuration

System documentation not being updated to reflect changes in the environment

Which of the following should be of GREATEST concern to an IS auditor reviewing a network printer disposal process?

Evidence is not available to verify printer hard drives have been sanitized prior to disposal.

Disposal policies and procedures are not consistently implemented

Evidence is not available to verify printer hard drives have been sanitized prior to disposal.

Business units are allowed to dispose printers directly to

Inoperable printers are stored in an unsecured area.

During an IT general controls audit of a high-risk area where both internal and external audit teams are reviewing the same approach to optimize resources?

Leverage the work performed by external audit for the internal audit testing.

Ensure both the internal and external auditors perform the work simultaneously.

Request that the external audit team leverage the internal audit work.

Roll forward the general controls audit to the subsequent audit year.

Which of the following is a corrective control?

Executing emergency response plans

Separating equipment development testing and production

Verifying duplicate calculations in data processing

Reviewing user access rights for segregation

Executing emergency response plans

An IS auditor finds that capacity management for a key system is being performed by IT with no input from the business The auditor's PRIMARY concern would be:

unanticipated increase in business s capacity needs.

failure to maximize the use of equipment

unanticipated increase in business s capacity needs.

cost of excessive data center storage capacity

impact to future business project funding.

The PRIMARY benefit of information asset classification is that it:

enables risk management decisions.

helps to align organizational objectives.

facilitates budgeting accuracy.

enables risk management decisions.

Which of the following is MOST important for an IS auditor to determine during the detailed design phase of a system development project?

Acceptance test criteria have been developed

Program coding standards have been followed

Acceptance test criteria have been developed

Data conversion procedures have been established.

The design has been approved by senior management.

Isaca CISA Practice Test 9 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Isaca CISA Practice Test 9

Question

Isaca CISA Practice Tests

Practice Tests