CISA Exam Training Practice Tests (ISACA Certified Information Systems Auditor)]

Question 1

The PRIMARY purpose of a configuration management system is to:

A. support the release procedure. B. standardize change approval. C. define baselines for software. D. track software updates.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 2

Which of the following is the BEST indicator for measuring performance of IT help desk function?

A. Number of reopened tickets B. Number 0t incidents reported C. Percentage of problems raised from incidents D. Mean time to categorize tickets

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 3

An IS auditor evaluating the change management process must select a sample from the change log. What is the BEST way to the auditor to confirm the change log is complete?

A. Take an item from the log and trace it back to the system. B. Interview change management personnel about completeness. C. Take the last change from the system and trace it back to the log. D. Obtain management attestation of completeness.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 4

Which of the following is the MOST effective way for an organization to help ensure agreed-upon action plans from an IS audit will be implemented?

A. Communicate audit results organization-wide. B. Ensure sufficient audit resources are allocated, C. Ensure ownership is assigned. D. Test corrective actions upon completion.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 5

When planning a review of IT governance, an IS auditor is MOST likely to:

A. obtain information about the control framework adopted by management. B. assess whether business process owner responsibilities are consistent. C. examine audit committee minutes for IT-related controls. D. define key performance indicators (KPIs).

Correct Answer: A

Question 6

An organization outsourced its IS functions to meet its responsibility for disaster recovery, the organization should:

A. coordinate disaster recovery administration with the outsourcing vendor B. discontinue maintenance of the disaster recovery plan (DRP > C. delegate evaluation of disaster recovery to internal audit D. delegate evaluation of disaster recovery to a third party

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 7

An IS auditor is reviewing an organization ' s incident management processes and procedures. Which of the following observations should be the auditor ' s GREATEST concern?

A. Ineffective incident detection B. Ineffective incident prioritization C. Ineffective incident classification D. Ineffective post-incident review

Correct Answer: A

Question 8

A project team has decided to switch to an agile approach to develop a replacement for an existing business application. Which of the following should an IS auditor do FIRST to ensure the effectiveness of the protect audit?

A. Compare the agile process with previous methodology. B. Understand the specific agile methodology that will be followed. C. Identify and assess existing agile process control D. Interview business process owners to compile a list of business requirements

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 9

What would be an IS auditor ' s BEST recommendation upon finding that a third-party IT service provider hosts the organization ' s human resources (HR) system in a foreign country?

A. Conduct a privacy impact analysis. B. Implement change management review. C. Perform background verification checks. D. Review third-party audit reports.

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 10

A firewall between internal network segments improves security and reduces risk by:

A. ensuring all connecting systems have appropriate security controls enabled. B. monitoring and reporting on sessions between network participants C. Jogging all packets passing through network segments D. inspecting all traffic flowing between network segments and applying security policies

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 11

Which of the following BEST facilitates strategic program management?

A. Tracking key project milestones B. Implementing stage gates C. Establishing a quality assurance (QA) process D. Aligning projects with business portfolios

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 12

During a pre-implementation review, an IS auditor notes that some scenarios have not been tested.
Management has indicated that the project is critical and cannot be postponed. Which of the following is the auditor ' s BEST course of action?

A. Recommend project implementation be postponed until all scenarios have been tested. B. Perform remaining scenario testing in the production environment post implementation. C. Help management complete remaining scenario testing before implementation. D. Determine whether the tested scenarios covered the most significant project risks.

Correct Answer: D

Question 13

During an organization ' s implementation of a data loss prevention (DLP) solution, which of the following activities should be completed FIRST?

A. Establishing exceptions workflow B. Configuring rule sets C. Enabling detection points D. Configuring reports

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 14

Following a discussion on the results of a recent audit engagement, the process owner of the audited area has provided an action plan addressing the gaps and recommendations. The auditor disagrees with some of the responses where the process owner is accepting a level of residual risk that is not within the organization ' s risk appetite. What is the auditor ' s BEST course of action?

A. Include the issue in the next report to the audit committee. B. Inform executive management of the residual risk. C. Escalate the situation to audit management. D. Accept the action plan proposed by the process owner.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

ISACA Certified Information Systems Auditor - CISA Exam Practice Test