Isaca CISA Practice Test - Questions Answers, Page 117
Question list
List of questions
Related questions
An IS auditor is evaluating an enterprise resource planning (ERP) migration from local systems to the cloud. Who should be responsible for the data classification in this project?
An IS auditor finds that the cost of developing an application is now projected to significantly exceed the budget. Which of the following is the GREATEST risk to communicate to senior management?
Noncompliance with project methodology
Inability to achieve expected benefits
Increased staff turnover
Project abandonment
Which of the following is the PRIMARY reason to involve IS auditors in the software acquisition process?
To help ensure hardware and operating system requirements are considered
To help ensure proposed contracts and service level agreements (SLAs) address key elements
To help ensure the project management process complies with policies and procedures
To help ensure adequate controls to address common threats and risks are considered
Which of the following BEST indicates to an IS auditor that an organization handles emergency changes appropriately and transparently?
The application operations manual contains procedures to ensure emergency fixes do not compromise system integrity.
Special logon IDs are used to grant programmers permanent access to the production environment.
Change management controls are retroactively applied.
Emergency changes are applied to production libraries immediately.
An organization produces control reports with a desktop application that accesses data in the central production database. Which of the following would give an IS auditor concern about the reliability of these reports?
The reports are printed by the same person who reviews them.
The reports are available to all end users.
The report definitions file is not included in routine backups.
The report definitions can be modified by end users.
During a pre-implementation review, an IS auditor notes that some scenarios have not been tested. Management has indicated that the project is critical and cannot be postponed. Which of the following is the auditor's BEST course of action?
Determine whether the tested scenarios covered the most significant project risks.
Help management complete remaining scenario testing before implementation.
Recommend project implementation be postponed until all scenarios have been tested.
Perform remaining scenario testing in the production environment post implementation.
During the course of fieldwork, an internal IS auditor observes a critical vulnerability within a newly deployed application. What is the auditor's BEST course of action?
Document the finding in the report.
Identify other potential vulnerabilities.
Notify IT management.
Report the finding to the external auditors.
Which of the following should be an IS auditor's GREATEST concern when assessing an IT service configuration database?
The database is read-accessible for all users.
The database is write-accessible for all users.
The database is not encrypted at rest.
The database is executable for all users.
Which of the following is the MOST important privacy consideration for an organization that uses a cloud service provider to process customer data?
Data privacy must be managed in accordance with the regulations applicable to the organization.
Data privacy must be monitored in accordance with industry standards and best practices.
No personal information may be transferred to the service provider without notifying the customer.
Customer data transferred to the service provider must be reported to the regulatory authority.
Which of the following findings would be of GREATEST concern when reviewing project risk management practices?
There are no formal milestone sign-offs.
Qualitative risk analyses have not been updated.
Ongoing issues are not formally tracked.
Project management software is not being used.
Question