Isaca CISA Practice Test - Questions Answers, Page 53

The best approach to determine whether IT service delivery is based on consistently effective processes is to evaluate key performance indicators (KPIs). KPIs are measurable values that demonstrate how effectively an organization is achieving its key objectives. KPIs can help the IT governance body to monitor and assess the performance, quality, and efficiency of the IT service delivery processes. KPIs can also help to identify areas for improvement and benchmark against best practices or industry standards.Reference:

CISA Review Manual (Digital Version), Chapter 1, Section 1.3.21

CISA Online Review Course, Domain 5, Module 2, Lesson 22

The type of control that is in place when an organization has established hiring policies and procedures designed specifically to ensure network administrators are well qualified is directive. Directive controls are those that guide or direct the actions of individuals or groups to achieve a desired outcome. Directive controls can also help to prevent or reduce the occurrence of undesirable events. Hiring policies and procedures are examples of directive controls that aim to ensure that only qualified and competent personnel are employed to perform IT-related tasks.Reference:

CISA Review Manual (Digital Version), Chapter 4, Section 4.11

CISA Online Review Course, Domain 1, Module 2, Lesson 12

The auditor should first escalate to audit management to discuss the audit plan. This is because the audit plan should be based on a risk assessment and aligned with the organization's objectives and strategies. The auditor should not accept the CIO's request without proper justification and approval from the audit management, who are responsible for ensuring the audit plan's quality and independence. The auditor should also communicate the potential risks and implications of not conducting IS audits in the upcoming year, such as missing new or emerging threats, vulnerabilities, or compliance issues.Reference:

CISA Review Manual (Digital Version), Chapter 2, Section 2.11

CISA Online Review Course, Domain 1, Module 1, Lesson 22

The auditor should be most concerned about the security policy documents being available on a public domain website. This is because this exposes the organization's security posture and strategy to potential attackers, who can exploit the information to launch targeted attacks or bypass the security controls. The security policy documents should be classified as confidential and protected from unauthorized access or disclosure. The other options are less severe than exposing the security policy documents to the public, although they may also indicate some gaps or weaknesses in the security policy development, implementation, or maintenance process.Reference:

CISA Review Manual (Digital Version), Chapter 5, Section 5.31

CISA Online Review Course, Domain 3, Module 1, Lesson 12

The auditor's best recommendation prior to go-live is to conduct a mock conversion test. This is because a mock conversion test can help to verify the accuracy, completeness, and validity of the data conversion process. A mock conversion test can also help to identify and resolve any issues or errors before the actual conversion takes place. A mock conversion test can also provide assurance that the converted data meets the business requirements and expectations.Reference:

CISA Review Manual (Digital Version), Chapter 3, Section 3.3.21

CISA Online Review Course, Domain 2, Module 2, Lesson 22

The most important thing to assess when conducting a business impact analysis (BIA) is the completeness of critical asset inventory. This is because the critical asset inventory is the basis for identifying and prioritizing the business processes, functions, and resources that are essential for the continuity of operations. The critical asset inventory should include both tangible and intangible assets, such as hardware, software, data, personnel, facilities, contracts, and reputation. The critical asset inventory should also be updated regularly to reflect any changes in the business environment or needs.Reference:

CISA Review Manual (Digital Version), Chapter 5, Section 5.41

CISA Online Review Course, Domain 3, Module 3, Lesson 12

The only thing that can be provided by asymmetric encryption is nonrepudiation. Nonrepudiation is the ability to prove that a message or transaction was originated or authorized by a specific party. Asymmetric encryption uses a pair of keys: a public key and a private key. The public key can be shared with anyone, while the private key is kept secret by the owner. If a message is encrypted with the sender's private key, only the sender's public key can decrypt it. This proves that the message was sent by the sender and not by anyone else. This is called digital signature and it provides nonrepudiation. Asymmetric encryption can also provide information privacy by encrypting a message with the receiver's public key, so that only the receiver's private key can decrypt it. However, information privacy can also be provided by symmetric encryption, which uses a single key to encrypt and decrypt messages.Reference:

CISA Review Manual (Digital Version), Chapter 5, Section 5.21

CISA Online Review Course, Domain 3, Module 2, Lesson 12

The primary role of key performance indicators (KPIs) in supporting business process effectiveness is to enable conclusions about the performance of the processes and target variances for follow-up analysis. KPIs are measurable values that demonstrate how effectively an organization is achieving its key objectives. KPIs can help to monitor and evaluate the performance, quality, and efficiency of the business processes. KPIs can also help to identify areas for improvement and benchmark against best practices or industry standards. KPIs can also provide feedback and guidance for decision making and corrective actions.Reference:

CISA Review Manual (Digital Version), Chapter 1, Section 1.3.21

CISA Online Review Course, Domain 5, Module 2, Lesson 22

The best control for detecting unauthorized data changes in an IT organization where many responsibilities are shared is to have data changes independently reviewed by another group. This is because an independent review can provide an objective and unbiased verification of the data changes and ensure that they are authorized, accurate, and complete. An independent review can also help to detect any errors, fraud, or malicious activities that may have occurred during the data changes. An independent review can also provide assurance that the data integrity and security are maintained.Reference:

CISA Review Manual (Digital Version), Chapter 4, Section 4.31

CISA Online Review Course, Domain 1, Module 4, Lesson 22