CISA Online Practice Questions and Answers
An information systems security officer's PRIMARY responsibility for business process applications is to:
A. authorize secured emergency access
B. approve the organization's security policy
C. ensure access rules agree with policies
D. create role-based rules for each business process
During an audit of an organization's risk management practices, an IS auditor finds several documented IT risk acceptances have not been renewed in a timely manner after the assigned expiration date When assessing the seventy of this finding, which mitigating factor would MOST significantly minimize the associated impact?
A. There are documented compensating controls over the business processes.
B. The risk acceptances were previously reviewed and approved by appropriate senior management
C. The business environment has not significantly changed since the risk acceptances were approved.
D. The risk acceptances with issues reflect a small percentage of the total population
Which of the following is the GREATEST advantage of vulnerability scanning over penetration testing?
A. The testing produces a lower number of false positive results
B. Network bandwidth is utilized more efficiently
C. Custom-developed applications can be tested more accurately
D. The testing process can be automated to cover large groups of assets
When auditing the closing stages of a system development protect which of the following should be the MOST important consideration?
A. Control requirements
B. Rollback procedures
C. Functional requirements documentation
D. User acceptance lest (UAT) results
Which of the following observations regarding change management should be considered the MOST serious risk by an IS auditor?
A. There is no software used to track change management.
B. The change is not approved by the business owners.
C. The change is deployed two weeks after approval.
D. The development of the change is not cost-effective.
When an organization introduces virtualization into its architecture, which of the following should be an IS auditor's PRIMARY area of focus to verify adequate protection?
A. Shared storage space
B. Host operating system configuration
C. Maintenance cycles
D. Multiple versions of the same operating system
A new application will require multiple interfaces. Which of the following testing methods can be used to detect interface errors early in the development life cycle1?
A. Bottom up
B. Acceptance
C. Top down
D. Sociability
An IS auditor reviewing the acquisition of new equipment would consider which of the following to be a significant weakness?
A. Staff involved in the evaluation were aware of the vendors being evaluated.
B. Independent consultants prepared the request for proposal (RFP) documents.
C. Evaluation criteria were finalized after the initial assessment of responses.
D. The closing date for responses was extended after a request from potential vendors.
Which of the following provides the BEST evidence of successfully completed batch uploads?
A. Sign-off on the batch journal
B. Using sequence controls
C. Enforcing batch cut-off times
D. Reviewing process logs
Which of the following should be of GREATEST concern to an IS auditor reviewing the controls for a continuous software release process?
A. Release documentation is not updated to reflect successful deployment.
B. Test libraries have not been reviewed in over six months.
C. Developers are able to approve their own releases.
D. Testing documentation is not attached to production releases.