CISA Exam Training Practice Tests (ISACA Certified Information Systems Auditor)]

Question 1

During which IT project phase is it MOST appropriate to conduct a benefits realization analysis?

A. Final implementation phase B. User acceptance testing (UAT) phase C. Post-implementation review phase D. Design review phase

Correct Answer: C

Question 2

Which of the following is the MOST efficient way to identify segregation of duties violations in a new system?

A. Examine recent system access rights violations. B. Observe the performance of business processes. C. Develop a process to identify authorization conflicts. D. Review a report of security rights in the system.

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 3

Which of the following would BEST protect the confidentiality of sensitive data in transit between multiple offices?

A. Public key infrastructure (PKI) B. Kerberos C. Digital signatures D. Hash algorithms

Correct Answer: A

Question 4

Which of the following is a social engineering attack method?

A. A hacker walks around an office building using scanning tools to search for a wireless network to gain access. B. An unauthorized person attempts to gam access to secure premises by following an authonzed person through a secure door. C. An employee is induced to reveal confidential IP addresses and passwords by answering questions over the phone. D. An intruder eavesdrops and collects sensitive information flowing through the network and sells it to third parties.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 5

Which of the following is the BEST way to help ensure new IT implementations align with enterprise architecture (EA) principles and requirements?

A. Consider stakeholder concerns when defining the EA B. Document the security view as part of the EA C. Perform mandatory post-implementation reviews of IT implementations D. Conduct EA reviews as part of the change advisory board

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 6

Which of the following is the GREATEST concern when applying emergency patches?

A. A change record may not be properly maintained. B. Patch-related risk may not be adequately assessed. C. Documented approvals may not be required before applying the emergency patch. D. Temporary administrative permissions may be needed to apply patches.

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 7

Which of the following is MOST important to verify when determining the completeness of the vulnerability scanning process?

A. The organization's systems inventory is kept up to date. B. Vulnerability scanning results are reported to the CISO. C. Access to the vulnerability scanning tool is periodically reviewed. D. The organization is using a cloud-hosted scanning tool for identification of vulnerabilities.

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 8

When auditing the feasibility study of a system development project, the IS auditor should:

A. ensure that vendor contracts are reviewed by legal counsel. B. review cost-benefit documentation for reasonableness. C. review the request for proposal (RFP) to ensure that it covers the scope of work. D. review qualifications of key members of the project team.

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 9

Audit observations should be FIRST communicated with the auditee:

A. when drafting the report. B. within the audit report C. during fieldwork. D. at the end of fieldwork.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 10

In a 24/7 processing environment, a database contains several privileged application accounts with passwords set to never expire. Which of the following recommendations would BEST address the risk with minimal disruption to the business?

A. Modify applications to no longer require direct access to the database. B. Modify the access management policy to make allowances for application accounts. C. Introduce database access monitoring into the environment D. Schedule downtime to implement password changes.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 11

An organization is concerned with meeting new regulations for protecting data confidentiality and asks an IS auditor to evaluate their procedures for transporting data. Which of the following would BEST support the organization ' s objectives?

A. Dedicated lines B. Cryptographic hashes C. Encryption D. Virtual local area network (VLAN)

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 12

An IS auditor notes the transaction processing times in an order processing system have significantly increased after a major release. Which of the following should the IS auditor review FIRST?

A. Database conversion results B. Training plans C. Stress testing results D. Capacity management plan

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

ISACA Certified Information Systems Auditor - CISA Exam Practice Test