Last Updated on December 13, 2021 by Admin 3

CISA : Certified Information Systems Auditor : Part 71

  1. Which of the following is the GREATEST cause for concern when an organization is planning to migrate business-critical applications to the cloud using a Platform as a Service (PaaS) model?

    • The organization will not manage operating system patches.
    • The cloud provider does not offer regional redundancy.
    • Compliance requirements are not being validated.
    • Application data will not be encrypted at rest.
  2. Due to limited storage capacity, an organization has decided to reduce the actual retention period for media containing completed low-value transactions. Which of the following is MOST important for the organization to ensure?

    • The policy includes a strong risk-based approach.
    • The retention period allows for review during the year-end audit.
    • The total transaction amount has no impact on financial reporting.
    • The retention period complies with data owner responsibilities.
  3. During a review of operations, it is noted that during a batch update, an error was detected and the database initiated a roll-back. An IT operator stopped the roll-back and re-initiated the update. What should the operator have done PRIOR to re-initiating the update?

    • Determined the cause of the error
    • Obtained approval before re-initiating the update
    • Allowed the roll-back to complete
    • Scheduled the roll-back for a later time
  4. Which of the following would provide the MOST important input during the planning phase for an audit on the implementation of a bring your own device (BYOD) program?

    • Policies including BYOD acceptable use statements
    • Results of a risk assessment 
    • An inventory of personal devices to be connected to the corporate network
    • Findings from prior audits
  5. Which of the following would present the GREATEST risk to the effectiveness of a security operations center for a global financial institution processing transactions 24×7?

    • Incident response reporting is based on open source software.
    • Incident response is conducted from a single location during normal business hours. 
    • Correlation of events excludes logs for pre-production systems.
    • The incident response function is outsourced to a third-party provider.
  6. Which of the following functions is MOST likely to be performed by an operating system utility residing on a web server?

    • Generating control totals for terminal devices such as point-of-sale devices.
    • Configuring network protocols.
    • Sending and receiving terminal warnings and error messages.
    • Monitoring utilization activity and traffic patterns.
  7. Which of the following will provide the GREATEST assurance to IT management that a quality management system (QMS) is effective?

    • A high percentage of incidents being quickly resolved 
    • A high percentage of stakeholders satisfied with the quality of IT
    • A high percentage of IT processes reviewed by quality assurance
    • A high percentage of IT employees attending quality training
  8. A transaction processing system interfaces with the general ledger. Data analytics has identified that some transactions are being recorded twice in the general ledger. While management states a system fix has been implemented, what should the IS auditor recommend to validate the interface is working in the future?

    • Perform periodic reconciliations. 
    • Ensure system owner sign-off for the system fix.
    • Conduct functional testing.
    • Improve user acceptance testing (UAT).
  9. Which of the following is the GREATEST risk of using a reciprocal site for disaster recovery?

    • Inability to utilize the site when required
    • Inability to test the recovery plans onsite 
    • Mismatched organizational security policies
    • Equipment compatibility issues at the site
  10. A financial institution suspects that a manager has been crediting customer accounts without authorization. Which of the following is the MOST effective method to validate this concern?

    • Variable sampling
    • Stop or go sampling
    • Attribute sampling
    • Discovery sampling
  11. Which of the following is MOST likely to improve the portability of an application connected to a database?

    • Analyzing stored procedures and triggers
    • Optimizing the database physical schema
    • Verifying database import and export procedures
    • Using a structured query language (SQL) 
  12. An organization is planning to outsource its customer relationship management (CRM) system to a Software as a Service (SaaS) provider. Which of the following is MOST important to include in the contract?

    • Service levels for change management
    • CRM system intellectual property rights 
    • Nondisclosure agreement
    • Maximum number of licenses allowed
  13. Which of the following would BEST determine whether a post implementation review (PIR) performed by the project management office (PMO) was effective?

    • The review was performed by an external provider.
    • Management approved the PIR report.
    • Lessons learned were implemented.
    • Project outcomes have been realized.
  14. Using swipe cards to limit employee access to restricted areas requires implementing which additional control?

    • Physical sign-in of all employees for access to restricted areas
    • Initial escort of all new hires by a current employee 
    • Periodic review of access profiles by management
    • Employee-access criteria determined on the basis of IS experience
  15. An accounts receivable data entry routine prevents the entry of the same customer with different account numbers. Which of the following is the BEST way to test if this programmed control is effective?

    • Compare source code against authorized software.
    • Implement a computer-assisted audit technique (CAAT).
    • Attempt to create a duplicate customer. 
    • Review a sorted customer list for duplicates.
  16. When reviewing user access to an application containing sensitive company data, which of the following should be the GREATEST concern with regard to segregation of duties?

    • The help desk performs application backups.
    • The application programmer performs quality assurance functions.
    • The network administrator performs security administrator functions. 
    • The database administrator performs system analyst functions
  17. Which of the following would be the MOST effective method for detecting duplicate payments?

    • Enciphering and deciphering the message digest
    • Reviewing sequence numbers and time stamps for each transaction 
    • Assessing payment history for reasonableness and approval
    • Using a cryptographic hashing algorithm
  18. Which of the following sampling methods is the BEST approach for drawing conclusions based on frequency of occurrence?

    • Attribute sampling 
    • Monetary estimation sampling
    • Stratified sampling
    • Difference estimation sampling
  19. What is the purpose of using a write blocker during the acquisition phase of a digital forensics investigation?

    • To preserve chain of custody
    • To protect against self-destruct utilities
    • To prevent the activation of installed malware
    • To prevent evidence alteration
  20. Which of the following is the BEST indicator of a mature quality management system (QMS)?

    • Projects are showing continuous improvement.
    • Continuous improvement has been integrated into business processes.
    • End users are satisfied with the outcome of IT projects.
    • Most IT projects have been completed on time and within budget.