Certified Information Systems Auditor Questions and Answers
What is the GREATEST concern for an IS auditor reviewing contracts for licensed software that executes a critical business process?
Which of the following is the MOST significant risk that IS auditors are required to consider for each engagement?
Which of the following is the BEST way to ensure that an application is performing according to its specifications?
Which of the following is the BEST metric to measure the alignment of IT and business strategy?
An IS auditor follows up on a recent security incident and finds the incident response was not adequate. Which of the following findings should be considered MOST critical?
Which of the following is a challenge in developing a service level agreement (SLA) for network services?
During an audit of an organization's risk management practices, an IS auditor finds several documented IT risk acceptances have not been renewed in a timely manner after the assigned expiration date When assessing the seventy of this finding, which mitigating factor would MOST significantly minimize the associated impact?
Which of the following BEST enables the effectiveness of an agile project for the rapid development of a new software application?
Which of the following is the BEST way to enforce the principle of least privilege on a server containing data with different security classifications?
An organization has virtualized its server environment without making any other changes to the network or security infrastructure. Which of the following is the MOST significant risk?
Which of the following should be the FIRST step in the incident response process for a suspected breach?
Which of the following features of a library control software package would protect against unauthorized updating of source code?
Which of the following is MOST important to ensure that electronic evidence collected during a forensic investigation will be admissible in future legal proceedings?
An audit identified that a computer system is not assigning sequential purchase order numbers to order requests. The IS auditor is conducting an audit follow-up to determine if management has reserved this finding. Which of two following is the MOST reliable follow-up procedure?
An IS auditor is reviewing processes for importing market price data from external data providers. Which of the following findings should the auditor consider MOST critical?
During an exit meeting, an IS auditor highlights that backup cycles
are being missed due to operator error and that these exceptions
are not being managed. Which of the following is the BEST way to
help management understand the associated risk?
Which of the following would be MOST effective to protect information assets in a data center from theft by a vendor?
An IS auditor has found that a vendor has gone out of business and the escrow has an older version of the source code. What is the auditor's BEST recommendation for the organization?
In response to an audit finding regarding a payroll application, management implemented a new automated control. Which of the following would be MOST helpful to the IS auditor when evaluating the effectiveness of the new control?
When reviewing a data classification scheme, it is MOST important for an IS auditor to determine if.
Which of the following is the MOST effective way for an organization to help ensure agreed-upon action plans from an IS audit will be implemented?
What should an IS auditor do FIRST upon discovering that a service provider did not notify its customers of a security breach?
During an IT general controls audit of a high-risk area where both internal and external audit teams are reviewing the same approach to optimize resources?
Which of the following would provide an IS auditor with the GREATEST assurance that data disposal controls support business strategic objectives?
Which of the following should an IS auditor ensure is classified at the HIGHEST level of sensitivity?
An IS auditor notes that the previous year's disaster recovery test was not completed within the scheduled time frame due to insufficient hardware allocated by a third-party vendor. Which of the following provides the BEST evidence that adequate resources are now allocated to successfully recover the systems?
Which of the following documents would be MOST useful in detecting a weakness in segregation of duties?
Which of the following is an audit reviewer's PRIMARY role with regard to evidence?
During the design phase of a software development project, the PRIMARY responsibility of an IS auditor is to evaluate the:
Which of the following strategies BEST optimizes data storage without compromising data retention practices?
The PRIMARY benefit lo using a dry-pipe fire-suppression system rather than a wet-pipe system is that a dry-pipe system:
Which of the following would BEST demonstrate that an effective disaster recovery plan (DRP) is in place?
Which of the following should be GREATEST concern to an IS auditor reviewing data conversion and migration during the implementation of a new application system?
An IS auditor wants to determine who has oversight of staff performing a specific task and is referencing the organization's RACI chart. Which of the following roles within the chart would provide this information?
Which of the following is the MOST effective control to mitigate unintentional misuse of authorized access?
An IS auditor finds the log management system is overwhelmed with false positive alerts. The auditor's BEST recommendation would be to:
Which of the following is the MOST important benefit of involving IS audit when implementing governance of enterprise IT?
During the evaluation of controls over a major application development project, the MOST effective use of an IS auditor's time would be to review and evaluate:
Which of the following BEST indicates the effectiveness of an organization's risk management program?
Which of the following should an IS auditor be MOST concerned with during a post-implementation review?
From an IS auditor's perspective, which of the following would be the GREATEST risk associated with an incomplete inventory of deployed software in an organization?
Coding standards provide which of the following?
An organization allows employees to retain confidential data on personal mobile devices. Which of the following is the BEST recommendation to mitigate the risk of data leakage from lost or stolen devices?
Which of the following is the BEST source of information for assessing the effectiveness of IT process monitoring?
What is MOST important to verify during an external assessment of network vulnerability?
When an IS audit reveals that a firewall was unable to recognize a number of attack attempts, the auditor's BEST recommendation is to place an intrusion detection system (IDS) between the firewall and:
Which of the following is MOST important for an effective control self-assessment (CSA) program?
During an audit of a reciprocal disaster recovery agreement between two companies, the IS auditor would be MOST concerned with the:
Which of the following is the BEST way to mitigate the impact of ransomware attacks?
An IS auditor is reviewing an organization's information asset management process. Which of the following would be of GREATEST concern to the auditor?
Which of the following is the PRIMARY reason for an IS auditor to conduct post-implementation reviews?
Which of the following tests would provide the BEST assurance that a health care organization is handling patient data appropriately?
A disaster recovery plan (DRP) should include steps for:
Which of the following is the MOST effective way to identify exfiltration of sensitive data by a malicious insider?
The PRIMARY benefit of automating application testing is to:
Which of the following findings should be of GREATEST concern to an IS auditor assessing the risk associated with end-user computing (EUC) in an organization?
Afire alarm system has been installed in the computer room The MOST effective location for the fire alarm control panel would be inside the
Which of the following would be of GREATEST concern to an IS auditor reviewing an IT strategy document?
The following findings are the result of an IS auditor's post-implementation review of a newly implemented system. Which of the following findings is of GREATEST significance?
Which of the following should be of GREATEST concern to an IS auditor performing a review of information security controls?
Which of the following is the GREATEST benefit of adopting an international IT governance framework rather than establishing a new framework based on the actual situation of a specific organization1?
Which of the following is the BEST performance indicator for the effectiveness of an incident management program?
Which of the following analytical methods would be MOST useful when trying to identify groups with similar behavior or characteristics in a large population?
Which of the following should be the FIRST consideration when deciding whether data should be moved to a cloud provider for storage?
A checksum is classified as which type of control?
An IS auditor is analyzing a sample of accounts payable transactions for a specific vendor and identifies one transaction with a value five times as high as the average transaction. Which of the following should the auditor do NEXT?
A core system fails a week after a scheduled update, causing an outage that impacts service. Which of the following is MOST important for incident management to focus on when addressing the issue?
Which of the following methods will BEST reduce the risk associated with the transition to a new system using
technologies that are not compatible with the old system?
Which of the following provides the BEST audit evidence that a firewall is configured in compliance with the organization's security policy?
Which of the following methods BEST enforces data leakage prevention in a multi-tenant cloud environment?
Due to advancements in technology and electronic records, an IS auditor has completed an engagement by email only. Which of the following did the IS auditor potentially compromise?
in a post-implantation Nation review of a recently purchased system it is MOST important for the iS auditor to determine whether the:
Which of the following is the PRIMARY objective of implementing privacy-related controls within an organization?
Which of the following provides a new IS auditor with the MOST useful information to evaluate overall IT performance?
Which of the following is the PRIMARY reason for an IS audit manager to review the work performed by a senior IS auditor prior to presentation of a report?
Which of the following is the BEST point in time to conduct a post-implementation review?
An organization has engaged a third party to implement an application to perform business-critical calculations. Which of the following is the MOST important process to help ensure the application provides accurate calculations?
Which of the following should be the PRIMARY role of an internal audit function in the management of identified business risks?
During an audit of a multinational bank's disposal process, an IS auditor notes several findings. Which of the following should be the auditor's GREATEST concern?
An IS auditor is conducting a review of a data center. Which of the following observations could indicate an access control Issue?
During an audit of a financial application, it was determined that many terminated users' accounts were not disabled. Which of the following should be the IS auditor's NEXT step?
Which of the following is MOST important for an IS auditor to do during an exit meeting with an auditee?
What is the MAIN reason to use incremental backups?
An IS auditor should ensure that an application's audit trail:
Capacity management enables organizations to:
Which of the following BEST demonstrates that IT strategy Is aligned with organizational goals and objectives?
Which of the following observations would an IS auditor consider the GREATEST risk when conducting an audit of a virtual server farm tor potential software vulnerabilities?
Which of the following is the PRIMARY role of the IS auditor m an organization's information classification process?
Which of the following represents the HIGHEST level of maturity of an information security program?
Which of the following is the BEST source of information tor an IS auditor to use when determining whether an organization's information security policy is adequate?
While auditing a small organization's data classification processes and procedures, an IS auditor noticed that data is often classified at the incorrect level. What is the MOST effective way for the organization to improve this situation?
An IS auditor Is reviewing a recent security incident and is seeking information about me approval of a recent modification to a database system's security settings Where would the auditor MOST likely find this information?
In order to be useful, a key performance indicator (KPI) MUST
Which of the following would provide the MOST important input during the planning phase for an audit on the implementation of a bring your own device (BYOD) program?
An IS auditor finds a high-risk vulnerability in a public-facing web server used to process online customer payments. The IS auditor should FIRST
After the merger of two organizations, which of the following is the MOST important task for an IS auditor to perform?
In an online application which of the following would provide the MOST information about the transaction audit trail?
A third-party consultant is managing the replacement of an accounting system. Which of the following should be the IS auditor's GREATEST concern?
The performance, risks, and capabilities of an IT infrastructure are BEST measured using a:
Which of the following would BEST manage the risk of changes in requirements after the analysis phase of a business application development project?
Due to limited storage capacity, an organization has decided to reduce the actual retention period for media containing completed low-value transactions. Which of the following is MOST important for the organization to ensure?
Which of the following is the MOST important reason to classify a disaster recovery plan (DRP) as confidential?
A manager Identifies active privileged accounts belonging to staff who have left the organization. Which of the following is the threat actor In this scenario?
