Isaca CISA Practice Test - Questions Answers, Page 118
Question list
List of questions
Related questions
An IS auditor finds that a new network connection allows communication between the Internet and the internal enterprise resource planning (ERP) system. Which of the following is the PRIMARY business impact to include when presenting this observation to management?
An increase to the threat landscape
A decrease in data quality in the ERP system
A decrease in network performance
An increase in potential fines from regulators
Which of the following is the PRIMARY benefit of effective implementation of appropriate data classification?
Ability to meet business requirements
Assurance that sensitive data is encrypted
Increased accuracy of sensitive data
Management of business risk to sensitive data
A network analyst is monitoring the network after hours and detects activity that appears to be a brute-force attempt to compromise a critical server. After reviewing the alerts to ensure their accuracy, what should be done NEXT?
Perform a root cause analysis.
Document all steps taken in a written report.
Isolate the affected system.
Invoke the incident response plan.
During an IS audit of a data center, it was found that programmers are allowed to make emergency fixes to operational programs. Which of the following should be the IS auditor's PRIMARY recommendation?
Programmers should be allowed to implement emergency fixes only after obtaining verbal agreement from the application owner.
Emergency program changes should be subject to program migration and testing procedures before they are applied to operational systems.
Bypass user ID procedures should be put in place to ensure that the changes are subject to after-the-event approval and testing.
What should be an IS auditor's PRIMARY focus when reviewing a patch management procedure in an environment where availability is a top priority?
Deployment automation to all servers
Technical skills of the deployment team
Comprehensive testing prior to deployment
Validity certification prior to deployment
Which of the following observations should be of GREATEST concern to an IS auditor assessing access controls for the accounts payable module of a finance system?
Payment files are stored on a shared drive in a writable format prior to processing.
Accounts payable staff have access to update vendor bank account details.
The IS auditor was granted access to create purchase orders.
Configured delegation limits do not align to the organization's delegation's policy.
An IS auditor determines elevated administrator accounts for servers that are not properly checked out and then back in after each use. Which of the following is the MOST appropriate sampling technique to determine the scope of the problem?
Haphazard sampling
Random sampling
Statistical sampling
Stratified sampling
To help determine whether a controls-reliant approach to auditing financial systems in a company should be used, which sequence of IS audit work is MOST appropriate?
Review of the general IS controls followed by a review of the application controls
Detailed examination of financial transactions followed by review of the general ledger
Review of major financial applications followed by a review of IT governance processes
Review of application controls followed by a test of key business process controls
While reviewing the effectiveness of an incident response program, an IS auditor notices a high number of reported incidents involving malware originating from removable media found by employees. Which of the following is the MOST appropriate recommendation to management?
Restrict access to removable media ports on company devices.
Install an additional antivirus program to increase protection.
Ensure the antivirus program contains up-to-date signature files for all company devices.
Implement an organization-wide removable media policy.
An IS auditor is reviewing a network diagram. Which of the following would be the BEST location for placement of a firewall?
Between each host and the local network switch/hub
Between virtual local area networks (VLANs)
Inside the demilitarized zone (DMZ)
At borders of network segments with different security levels
Question