Updated CISA Practice Exam DumpsBase – Pass Certified Information Systems Auditor Exam Quickly

1. Which of the following would be to MOST concern when determine if information assets are adequately safequately safeguarded during transport and disposal?

2. When reviewing an organization's information security policies, an IS auditor should verify that the policies have been defined PRIMARILY on the basis of:

3. During an ongoing audit, management requests a briefing on the findings to date .

Which of the following is the IS auditor's BEST course of action?

4. Which of the following is the BEST recommendation to prevent fraudulent electronic funds transfers by accounts payable employees?

5. The implementation of an IT governance framework requires that the board of directors of an organization:

6. An organization's enterprise architecture (EA) department decides to change a legacy system's components while maintaining its original functionality .

Which of the following is MOST important for an IS auditor to understand when reviewing this decision?

7. IS management has recently disabled certain referential integrity controls in the database

management system (DBMS) software to provide users increased query performance .

Which of the following controls will MOST effectively compensate for the lack of referential integrity?

8. Which of the following is MOST useful for determining whether the goals of IT are aligned with the organization's goals?

9. During the design phase of a software development project, the PRIMARY responsibility of an IS auditor is to evaluate the:

10. To confirm integrity for a hashed message, the receiver should use:

11. Which of the following would BEST demonstrate that an effective disaster recovery plan (DRP) is in place?

12. An IT balanced scorecard is the MOST effective means of monitoring:

13. Cross-site scripting (XSS) attacks are BEST prevented through:

14. Which of the following is the BEST control to mitigate the malware risk associated with an instant messaging (IM) system?

15. Management is concerned about sensitive information being intentionally or unintentionally emailed as attachments outside the organization by employees .

What is the MOST important task before implementing any associated email controls?

16. Spreadsheets are used to calculate project cost estimates. Totals for each cost category are then keyed into the job-costing system .

What is the BEST control to ensure that data is accurately entered into the system?

17. During a disaster recovery audit, an IS auditor finds that a business impact analysis (BIA) has not been performed. The auditor should FIRST

18. Management has requested a post-implementation review of a newly implemented purchasing package to determine to what extent business requirements are being met .

Which of the following is MOST likely to be assessed?

19. An IS auditor finds that a key Internet-facing system is vulnerable to attack and that patches are not available .

What should the auditor recommend be done FIRST?

20. During an audit of a reciprocal disaster recovery agreement between two companies, the

IS auditor would be MOST concerned with the:

21. An IS auditor is evaluating an organization's IT strategy and plans .

Which of the following would be of GREATEST concern?

22. An organization conducted an exercise to test the security awareness level of users by sending an email offering a cash reward 10 those who click on a link embedded in the body of the email .

Which of the following metrics BEST indicates the effectiveness of awareness training?

23. During the implementation of an upgraded enterprise resource planning (ERP) system, which of the following is the MOST important consideration for a go-live decision?

24. What should be the PRIMARY basis for selecting which IS audits to perform in the coming year?

25. Which of the following is the BEST way to determine whether a test of a disaster recovery plan (DRP) was successful?

26. An IS auditor found that a company executive is encouraging employee use of social networking sites for business purposes .

Which of the following recommendations would BEST help to reduce the risk of data leakage?

27. Which of the following is MOST important to include in forensic data collection and preservation procedures?

28. An IS auditor finds that firewalls are outdated and not supported by vendors .

Which of the following should be the auditor's NEXT course of action?

29. An IS auditor is following up on prior period items and finds management did not address an audit finding .

Which of the following should be the IS auditor's NEXT course of action?

30. What is MOST important to verify during an external assessment of network vulnerability?

31. An incorrect version of source code was amended by a development team. This MOST likely indicates a weakness in:

32. Which of the following is the BEST control to prevent the transfer of files to external parties through instant messaging (IM) applications?

33. When an intrusion into an organization network is deleted, which of the following should be done FIRST?

34. An organization's security policy mandates that all new employees must receive appropriate security awareness training .

Which of the following metrics would BEST assure compliance with this policy?

35. While executing follow-up activities, an IS auditor is concerned that management has implemented corrective actions that are different from those originally discussed and agreed with the audit function. In order to resolve the situation, the IS auditor's BEST course of action would be to:

36. An organization's software developers need access to personally identifiable information (Pll) stored in a particular data format .

Which of the following is the BEST way to protect this sensitive information while allowing the developers to use it in development and test environments?

37. Which of the following tests would provide the BEST assurance that a health care organization is handling patient data appropriately?

38. Which of the following is the PRIMARY concern when negotiating a contract for a hot site?

39. Which of the following is the MOST important benefit of involving IS audit when implementing governance of enterprise IT?

40. An online retailer is receiving customer complaints about receiving different items from what they ordered on the organization's website. The root cause has been traced to poor data quality. Despite efforts to clean erroneous data from the system, multiple data quality issues continue to occur .

Which of the following recommendations would be the BEST way to reduce the likelihood of future occurrences?

41. Which of the following MOST effectively minimizes downtime during system conversions?

42. An IS auditor will be testing accounts payable controls by performing data analytics on the entire population of transactions .

Which of the following is MOST important for the auditor to confirm when sourcing the population data?

43. During a new system implementation, an IS auditor has been assigned to review risk management at each milestone. The auditor finds that several risks to project benefits have not been addressed.

Who should be accountable for managing these risks?

44. In a 24/7 processing environment, a database contains several privileged application accounts with passwords set to never expire .

Which of the following recommendations would BEST address the risk with minimal disruption to the business?

45. When implementing Internet Protocol security (IPsec) architecture, the servers involved in application delivery:

46. During the discussion of a draft audit report. IT management provided suitable evidence fiat a process has been implemented for a control that had been concluded by the IS auditor as Ineffective .

Which of the following is the auditor's BEST action?

47. Which of the following is MOST important for an effective control self-assessment (CSA) program?

48. Which of the following is the BEST method to safeguard data on an organization's laptop computers?

49. Which of the following is MOST important to ensure when planning a black box penetration test?

50. Which of the following should an IS auditor recommend as a PRIMARY area of focus when an organization decides to outsource technical support for its external customers?

51. An IS auditor notes the transaction processing times in an order processing system have significantly increased after a major release .

Which of the following should the IS auditor review FIRST?

52. A proper audit trail of changes to server start-up procedures would include evidence of:

53. Which of the following should be the PRIMARY basis for prioritizing follow-up audits?

54. Which of the following data would be used when performing a business impact analysis (BIA)?

55. An organization has outsourced its data processing function to a service provider .

Which of the following would BEST determine whether the service provider continues to meet the organization s objectives?

56. Which of the following is the BEST detective control for a job scheduling process involving data transmission?

57. Which of the following is the MOST effective way for an organization to project against data loss?

58. Documentation of workaround processes to keep a business function operational during recovery of IT systems is a core part of a:

59. An organizations audit charier PRIMARILY:

60. Which of the following demonstrates the use of data analytics for a loan origination process?

61. A data breach has occurred due lo malware .

Which of the following should be the FIRST course of action?

62. Which of the following is MOST important with regard to an application development acceptance test?

63. An IS auditor is reviewing an organization's information asset management process .

Which of the following would be of GREATEST concern to the auditor?

64. What is BEST for an IS auditor to review when assessing the effectiveness of changes recently made to processes and tools related to an organization's business continuity plan (BCP)?

65. Which of the following is the BEST method to prevent wire transfer fraud by bank employees?

66. A new regulation requires organizations to report significant security incidents to the regulator within 24 hours of identification .

Which of the following is the IS auditor's BEST recommendation to facilitate compliance with the regulation?

67. Which of the following is the BEST source of information for assessing the effectiveness of IT process monitoring?

68. Which of the following should be an IS auditor's PRIMARY focus when developing a risk-based IS audit program?

69. Which of the following should be the MOST important consideration when conducting a review of IT portfolio management?

70. Which of the following should be done FIRST when planning a penetration test?

71. An IS auditor has found that an organization is unable to add new servers on demand in a cost-efficient manner .

Which of the following is the auditor's BEST recommendation?

72. Which of the following is the MOST important prerequisite for the protection of physical information assets in a data center?

73. The PRIMARY advantage of object-oriented technology is enhanced:

74. An IS auditor who was instrumental in designing an application is called upon to review the application. The auditor should:

75. Which of the following components of a risk assessment is MOST helpful to management in determining the level of risk mitigation to apply?

76. During an incident management audit, an IS auditor finds that several similar incidents

were logged during the audit period .

Which of the following is the auditor's MOST important course of action?

77. Which of the following will be the MOST effective method to verify that a service vendor keeps control levels as required by the client?

78. During an external review, an IS auditor observes an inconsistent approach in classifying system criticality within the organization .

Which of the following should be recommended as the PRIMARY factor to determine system criticality?

79. Which of the following access rights presents the GREATEST risk when granted to a new member of the system development staff?

80. A system development project is experiencing delays due to ongoing staff shortages .

Which of the following strategies would provide the GREATEST assurance of system quality at implementation?