Get CISA Products Practice Material for CISA Exam Question Preparation
Most Reliable ISACA CISA Training Materials
NEW QUESTION # 121
Which of the following is MOST important for an IS auditor to assess during a post-implementation review of a newly modified IT application developed in-house?
- A. Updates required for end-user manuals
- B. Resource management plan
- C. Sufficiency of implemented controls
- D. Rollback plans for changes
Answer: C
Explanation:
A post-implementation review (PIR) of a newly modified IT application focuses on ensuring that the system meets business and security requirements effectively. The sufficiency of implemented controls (A) is the most critical aspect because it ensures that security, operational, and compliance controls are functioning correctly.
These controls include access controls, data integrity checks, and audit logs to prevent unauthorized access, data corruption, or security breaches.
Other options:
Resource management plan (B) is important for project management but is not the primary concern for an IS auditor in a post-implementation review.
Updates required for end-user manuals (C) are necessary for usability but do not impact the security or operational integrity of the system.
Rollback plans for changes (D) are important for change management but are typically assessed before deployment, not in a PIR.
Reference: ISACA CISA Review Manual, IT Governance and Management of IT
NEW QUESTION # 122
Which of the following is the MOST important reason to periodically review data that has already been classified?
- A. Older data may need to be archived on removable media.
- B. The classification nomenclature has changed.
- C. The associated risk may change over time.
- D. Additional data may have been added to the inventory.
Answer: C
NEW QUESTION # 123
A hot site should be implemented as a recovery strategy when the:
- A. disaster tolerance is high.
- B. disaster tolerance is low.
- C. recovery time objective (RTO) is high.
- D. recovery point objective (RPO) is high.
Answer: B
Explanation:
Disaster tolerance is the time gap during which the business can accept nonavailability of IT facilities. If this time gap is low, recovery strategies that can be implemented within a short period of time, such as a hot site, should be used. The RPO is the earliest point in time at which it is acceptable to recover the datA . A high RPO means that the process can wait for a longer time. In such cases, other recovery alternatives, such as warm or cold sites, should be considered. A high RTO means that additional time would be available for the recovery strategy, thus making other recovery alternatives-such as warm or cold sites-viable alternatives.
NEW QUESTION # 124
An organization has recently implemented additional application programming interfaces (APIs) to enhance data exchange with vendors. Which of the following is MOST important to ensure coverage of API-related risks during the next API management process audit?
- A. Testing the authorization mechanisms in place to secure API endpoints
- B. Reviewing the process of API documentation and version control to ensure accuracy and consistency
- C. Evaluating the compliance of APIs with the organization's standards and best practices
- D. Verifying the adequacy of disaster recovery and business continuity plans for critical APIs
Answer: A
Explanation:
Authorization controls are critical in API security because they ensure that only authenticated and properly authorized users or systems can access specific data or functions. Weak or missing authorization can lead to data breaches or unauthorized data manipulation, making this the most important focus area for an API management process audit.
NEW QUESTION # 125
An IS auditor is reviewing an organization's primary router access control list. Which of the following should result in a finding?
- A. Individual permissions are overriding group permissions.
- B. There are conflicting permit and deny rules for the IT group.
- C. The network security group can change network address translation (NAT).
- D. There is only one rule per group with access privileges.
Answer: A
Explanation:
This should result in a finding because it violates the best practice of setting rules for groups rather than users. According to one of the web search results1, using group permissions instead of individual permissions can simplify the management and maintenance of ACLs, reduce the risk of human errors, and ensure consistency and compliance. Individual permissions can create conflicts, confusion, and security gaps in the ACLs. Therefore, the IS auditor should report this as a finding and recommend using group permissions instead.
NEW QUESTION # 126
Which of the following is MOST useful for matching records of incoming and outgoing personnel to identify tailgating in physical security logs?
- A. Discovery sampling methodology
- B. Continuous auditing
- C. Reconciliation with HR records
- D. Data analytics tools
Answer: C
NEW QUESTION # 127
Which of the following is the PRIMARY reason for an airline's IT management to continuously monitor the controls for a critical integrated flight schedule and payment application?
- A. To ensure payments for flight bookings are processed
- B. To ensure policies and procedures are followed
- C. To ensure risks are effectively identified and mitigated
- D. To detect and respond to possible attacks
Answer: D
Explanation:
The primary reason for an airline's IT management to continuously monitor the controls for a critical integrated flight schedule and payment application is to detect and respond to possible attacks. Continuous monitoring helps identify and mitigate security threats in real-time, protecting sensitive data and ensuring the integrity of the application.
NEW QUESTION # 128
What is the PRIMARY reason to include a business management review at the end of each IT project phase?
- A. To obtain funding to continue to the next phase
- B. To obtain approval from stakeholders to proceed to the next phase
- C. To obtain sign-off that user acceptance testing (UAT) has been completed
- D. To obtain approval for the IT solution design
Answer: B
NEW QUESTION # 129
An organization is deciding whether to move on-premise workloads to a third-party Infrastructure as a Service (IaaS) platform. Which of the following is MOST important for an IS auditor to consider when evaluating the potential risks?
- A. Security clauses documented within cloud service agreements
- B. The organization's risk appetite and risk tolerance
- C. The organization's external business environment
- D. The provider's risk assessment and risk mitigation procedures
Answer: B
Explanation:
Before adopting an IaaS platform, it is essential for the IS auditor to ensure that the risks associated with cloud migration align with the organization's defined risk appetite and tolerance.
This determines whether the organization can accept or mitigate the potential risks inherent in using third-party infrastructure services.
NEW QUESTION # 130
Which of the following is the PRIMARY objective of implementing privacy-related controls within an organization"?
- A. To identify data at rest and data in transit for encryption
- B. To provide options to individuals regarding use of their data
- C. To comply with legal and regulatory requirements
- D. To prevent confidential data loss
Answer: B
NEW QUESTION # 131
When reviewing IS strategies, an IS auditor can BEST assess whether IS strategy supports the organizations' business objectives by determining if IS:
- A. uses its equipment and personnel efficiently and effectively.
- B. has sufficient excess capacity to respond to changing directions.
- C. has all the personnel and equipment it needs.
- D. plans are consistent with management strategy.
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Determining if the IS plan is consistent with management strategy relates IS/IT planning to business plans.
Choices A, C and D are effective methods for determining the alignment of IS plans with business objectives and the organization's strategies.
NEW QUESTION # 132
Audit frameworks cart assist the IS audit function by:
- A. outlining the specific steps needed to complete audits
- B. defining the authority and responsibility of the IS audit function.
- C. providing direction and information regarding the performance of audits.
- D. providing details on how to execute the audit program.
Answer: C
NEW QUESTION # 133
What type of risk is associated with authorized program exits (trap doors)?
- A. Business risk
- B. Audit risk
- C. Inherent risk
- D. Detective risk
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Inherent risk is associated with authorized program exits (trap doors).
NEW QUESTION # 134
Which of the following is a PRIMARY responsibility of an IT steering committee?
- A. Establishing IT budgets for the business
- B. Prioritizing IT projects in accordance with business requirements
- C. Validating and monitoring the skill sets of IT department staff
- D. Reviewing periodic IT risk assessments
Answer: B
Explanation:
A primary responsibility of an IT steering committee is prioritizing IT projects in accordance with business requirements, as this ensures that IT resources are allocated to support the strategic objectives and needs of the organization. Reviewing periodic IT risk assessments, validating and monitoring the skill sets of IT department staff, and establishing IT budgets for the business are important activities, but they are not the primary responsibility of an IT steering committee. They may be delegated to other IT governance bodies or functions within the organization. References: CISA Review Manual (Digital Version), Chapter 1:
Information Systems Auditing Process, Section 1.2: IT Governance
NEW QUESTION # 135
Which of the following is MOST appropriate to prevent unauthorized retrieval of confidential information stored in a business application system?
- A. Apply single sign-on for access control
- B. Enforce the use of digital signatures.
- C. Enforce an internal data access policy.
- D. Implement segregation of duties.
Answer: C
Explanation:
The most appropriate control to prevent unauthorized retrieval of confidential information stored in a business application system is to enforce an internal data access policy. A data access policy defines who can access what data, under what conditions and for what purposes. It also specifies the roles and responsibilities of data owners, custodians and users, as well as the security measures and controls to protect data confidentiality, integrity and availability. By enforcing a data access policy, the organization can ensure that only authorized personnel can retrieve confidential information from the business application system. Applying single sign-on for access control, implementing segregation of duties and enforcing the use of digital signatures are also useful controls, but they are not sufficient to prevent unauthorized data retrieval without a clear and comprehensive data access policy. References:
* CISA Review Manual, 27th Edition, page 2301
* CISA Review Questions, Answers & Explanations Database - 12 Month Subscription2
NEW QUESTION # 136
Which of the following is the GREATEST advantage of outsourcing the development of an e-banking solution when in-house technical expertise is not available?
- A. Lower start-up costs
- B. Reduced risk of system downtime
- C. Direct oversight of risks
- D. Increased ability to adapt the system
Answer: A
Explanation:
Outsourcing the development of an e-banking solution when in-house technical expertise is not available can significantly reduce start-up costs. This is because the organization can avoid the expenses associated with hiring and training a full-time development team, purchasing necessary hardware and software, and maintaining the system1. While outsourcing can also potentially reduce the risk of system downtime, increase the ability to adapt the system, and provide direct oversight of risks, these benefits are not as immediate or guaranteed as the cost savings123.
References: Maxicus1, Forbes2, Strategy& - PwC3
NEW QUESTION # 137
......
LATEST CISA Exam Practice Material: https://www.testvalid.com/CISA-exam-collection.html
The Realest Study Materials CISA Dumps: https://drive.google.com/open?id=1-9AWAmTyoD3gYyRmhdTqgfTxpIGdSwMV