Certified Information Systems Auditor
Last Update Jun 14, 2025
Total Questions : 1404
We are offering FREE CISA Isaca exam questions. All you do is to just go and sign up. Give your details, prepare CISA free exam questions and then go for complete pool of Certified Information Systems Auditor test questions that will help you more.
An IS auditor finds that a key Internet-facing system is vulnerable to attack and that patches are not available. What should the auditor recommend be done FIRST?
Which of the following is the MOST effective method of destroying sensitive data stored on electronic media?
Which of the following provides the MOST useful information regarding an organization's risk appetite and tolerance?
The IS auditor has recommended that management test a new system before using it in production mode. The BEST approach for management in developing a test plan is to use processing parameters that are:
Which of the following is the MOST important determining factor when establishing appropriate timeframes for follow-up activities related to audit findings?
The BEST way to determine whether programmers have permission to alter data in the production environment is by reviewing:
An organization has assigned two now IS auditors to audit a now system implementation. One of the auditors has an IT-related degree, and one has a business degree. Which ol the following is MOST important to meet the IS audit standard for proficiency?
What is the PRIMARY purpose of documenting audit objectives when preparing for an engagement?
Which of the following concerns is BEST addressed by securing production source libraries?
Which of the following is the BEST indicator of the effectiveness of an organization's incident response program?
What is the Most critical finding when reviewing an organization’s information security management?
In a RAO model, which of the following roles must be assigned to only one individual?
An IS auditor is reviewing the release management process for an in-house software development solution. In which environment Is the software version MOST likely to be the same as production?
An organization with many desktop PCs is considering moving to a thin client architecture. Which of the following is the MAJOR advantage?
After the merger of two organizations, which of the following is the MOST important task for an IS auditor to perform?
Which of the following is the GREATEST security risk associated with data migration from a legacy human resources (HR) system to a cloud-based system?
Which of the following is the BEST evidence that an organization's IT strategy is aligned lo its business objectives?
Which of the following is the MOST appropriate and effective fire suppression method for an unstaffed computer room?
Which of the following should be of MOST concern to an IS auditor reviewing the public key infrastructure (PKI) for enterprise email?
Which of the following is MOST helpful for measuring benefits realization for a new system?
With regard to resilience, which of the following is the GREATEST risk to an organization that has implemented a new critical system?
During an exit interview, senior management disagrees with some of me facts presented m the draft audit report and wants them removed from the report. Which of the following would be the auditor's BEST course of action?
Which of the following business continuity activities prioritizes the recovery of critical functions?
During an IT governance audit, an IS auditor notes that IT policies and procedures are not regularly reviewed and updated. The GREATEST concern to the IS auditor is that policies and procedures might not:
When determining whether a project in the design phase will meet organizational objectives, what is BEST to compare against the business case?
In an environment that automatically reports all program changes, which of the following is the MOST efficient way to detect unauthorized changes to production programs?
Which of the following is the MOST effective control to mitigate unintentional misuse of authorized access?
During an ongoing audit, management requests a briefing on the findings to date. Which of the following is the IS auditor's BEST course of action?
Spreadsheets are used to calculate project cost estimates. Totals for each cost category are then keyed into the job-costing system. What is the BEST control to ensure that data is accurately entered into the system?
Which of the following should an IS auditor be MOST concerned with during a post-implementation review?
Which of the following is the MOST important reason to implement version control for an end-user computing (EUC) application?
What should be the PRIMARY basis for selecting which IS audits to perform in the coming year?
When implementing Internet Protocol security (IPsec) architecture, the servers involved in application delivery:
Which of the following is the MOST important consideration for an IS auditor when assessing the adequacy of an organization's information security policy?
An IS auditor is reviewing an organization's information asset management process. Which of the following would be of GREATEST concern to the auditor?
During the implementation of an upgraded enterprise resource planning (ERP) system, which of the following is the MOST important consideration for a go-live decision?
Due to limited storage capacity, an organization has decided to reduce the actual retention period for media containing completed low-value transactions. Which of the following is MOST important for the organization to ensure?
Which of the following should be an IS auditor's PRIMARY focus when developing a risk-based IS audit program?
Which of the following is the BEST way to determine whether a test of a disaster recovery plan (DRP) was successful?
Which of the following is an executive management concern that could be addressed by the implementation of a security metrics dashboard?
An IS auditor wants to determine who has oversight of staff performing a specific task and is referencing the organization's RACI chart. Which of the following roles within the chart would provide this information?
Which of the following is the PRIMARY role of the IS auditor m an organization's information classification process?
A third-party consultant is managing the replacement of an accounting system. Which of the following should be the IS auditor's GREATEST concern?
An organization has recently implemented a Voice-over IP (VoIP) communication system. Which ot the following should be the IS auditor's PRIMARY concern?
Which of the following is the BEST reason for an organization to use clustering?
An organization has established hiring policies and procedures designed specifically to ensure network administrators are well qualified Which type of control is in place?
Which of the following is the BEST approach for determining the overall IT risk appetite of an organization when business units use different methods formanaging IT risks?
An organization has outsourced the development of a core application. However, the organization plans to bring the support and future maintenance of the application back in-house. Which of the following findings should be the IS auditor's GREATEST concern?
A system administrator recently informed the IS auditor about the occurrence of several unsuccessful intrusion attempts from outside the organization. Which of the following is MOST effective in detecting such an intrusion?
During an incident management audit, an IS auditor finds that several similar incidents were logged during the audit period. Which of the following is the auditor's MOST important course of action?
During a new system implementation, an IS auditor has been assigned to review risk management at each milestone. The auditor finds that several risks to project benefits have not been addressed. Who should be accountable for managing these risks?
An IS auditor found that a company executive is encouraging employee use of social networking sites for business purposes. Which of the following recommendations would BEST help to reduce the risk of data leakage?
Management is concerned about sensitive information being intentionally or unintentionally emailed as attachments outside the organization by employees. What is the MOST important task before implementing any associated email controls?
Secure code reviews as part of a continuous deployment program are which type of control?
An IS auditor is examining a front-end subledger and a main ledger. Which of the following would be the GREATEST concern if there are flaws in the mapping of accounts between the two systems?
An IS auditor notes the transaction processing times in an order processing system have significantly increased after a major release. Which of the following should the IS auditor review FIRST?
Which of the following is the BEST compensating control when segregation of duties is lacking in a small IS department?
Which of the following BEST ensures the quality and integrity of test procedures used in audit analytics?
An IS auditor finds the log management system is overwhelmed with false positive alerts. The auditor's BEST recommendation would be to:
An IS auditor is evaluating an organization's IT strategy and plans. Which of the following would be of GREATEST concern?
An IS auditor suspects an organization's computer may have been used to commit a crime. Which of the following is the auditor's BEST course of action?
An incorrect version of the source code was amended by a development team. This MOST likely indicates a weakness in:
While executing follow-up activities, an IS auditor is concerned that management has implemented corrective actions that are different from those originally discussed and agreed with the audit function. In order to resolve the situation, the IS auditor's BEST course of action would be to:
During a follow-up audit, an IS auditor learns that some key management personnel have been replaced since the original audit, and current management has decided not to implement some previously accepted recommendations. What is the auditor's BEST course of action?
When auditing the security architecture of an online application, an IS auditor should FIRST review the:
An IS auditor discovers an option in a database that allows the administrator to directly modify any table. This option is necessary to overcome bugs in the software, but is rarely used. Changes to tables are automatically logged. The IS auditor's FIRST action should be to:
Which of the following is MOST useful for determining whether the goals of IT are aligned with the organization's goals?
An IS audit reveals that an organization is not proactively addressing known vulnerabilities. Which of the following should the IS auditor recommend the organization do FIRST?
Which of the following is the MOST effective way for an organization to project against data loss?
When evaluating the design of controls related to network monitoring, which of the following is MOST important for an IS auditor to review?
Which of the following application input controls would MOST likely detect data input errors in the customer account number field during the processing of an accounts receivable transaction?
Which of the following is the BEST recommendation to prevent fraudulent electronic funds transfers by accounts payable employees?
Which of the following tests would provide the BEST assurance that a health care organization is handling patient data appropriately?
What would be an IS auditor's BEST recommendation upon finding that a third-party IT service provider hosts the organization's human resources (HR) system in a foreign country?
Which of the following is the PRIMARY concern when negotiating a contract for a hot site?
An organization's security policy mandates that all new employees must receive appropriate security awareness training. Which of the following metrics would BEST assure compliance with this policy?
Which of the following would BEST facilitate the successful implementation of an IT-related framework?
Which of the following documents would be MOST useful in detecting a weakness in segregation of duties?
Which of the following is the BEST control to prevent the transfer of files to external parties through instant messaging (IM) applications?
Which audit approach is MOST helpful in optimizing the use of IS audit resources?
Which of the following would be to MOST concern when determine if information assets are adequately safequately safeguarded during transport and disposal?
Which of the following is the BEST way to mitigate the impact of ransomware attacks?
An organization's enterprise architecture (EA) department decides to change a legacy system's components while maintaining its original functionality. Which of the following is MOST important for an IS auditor to understand when reviewing this decision?
When reviewing an organization's information security policies, an IS auditor should verify that the policies have been defined PRIMARILY on the basis of:
An organization allows employees to retain confidential data on personal mobile devices. Which of the following is the BEST recommendation to mitigate the risk of data leakage from lost or stolen devices?
During a review of a production schedule, an IS auditor observes that a staff member is not complying with mandatory operational procedures. The auditor's NEXT step should be to:
Which of the following is an audit reviewer's PRIMARY role with regard to evidence?
Which of the following will be the MOST effective method to verify that a service vendor keeps control levels as required by the client?
When an intrusion into an organization network is deleted, which of the following should be done FIRST?
The decision to accept an IT control risk related to data quality should be the responsibility of the:
Management receives information indicating a high level of risk associated with potential flooding near the organization's data center within the next few years. As a result, a decision has been made to move data center operations to another facility on higher ground. Which approach has been adopted?
An IS auditor is reviewing the installation of a new server. The IS auditor's PRIMARY objective is to ensure that
During an audit of a reciprocal disaster recovery agreement between two companies, the IS auditor would be MOST concerned with the:
A system development project is experiencing delays due to ongoing staff shortages. Which of the following strategies would provide the GREATEST assurance of system quality at implementation?
Which of the following BEST guards against the risk of attack by hackers?
Which of the following should be GREATEST concern to an IS auditor reviewing data conversion and migration during the implementation of a new application system?
An IS auditor is planning an audit of an organization's accounts payable processes. Which of the following controls is MOST important to assess in the audit?
Which of the following audit procedures would be MOST conclusive in evaluating the effectiveness of an e-commerce application system's edit routine?
Which of the following is the BEST metric to measure the alignment of IT and business strategy?
An IS auditor is reviewing documentation of application systems change control and identifies several patches that were not tested before being put into production. Which of the following is the MOST significant risk from this situation?
Which of the following BEST helps to ensure data integrity across system interfaces?
An IS auditor finds that the process for removing access for terminated employees is not documented What is the MOST significant risk from this observation?
An externally facing system containing sensitive data is configured such that users have either read-only or administrator rights. Most users of the system have administrator access. Which of the following is the GREATEST risk associated with this situation?
An IS auditor reviewing security incident processes realizes incidents are resolved and closed, but root causes are not investigated. Which of the following should be the MAJOR concern with this situation?
Which of the following is MOST important for an IS auditor to confirm when reviewing an organization's plans to implement robotic process automation (RPA> to automate routine business tasks?
During the planning phase of a data loss prevention (DLP) audit, management expresses a concern about mobile computing. Which of the following should the IS auditor identity as the associated risk?
An organization has made a strategic decision to split into separate operating entities to improve profitability. However, the IT infrastructure remains shared between the entities. Which of the following would BEST help to ensure that IS audit still covers key risk areas within the IT environment as part of its annual plan?
Which of the following should an IS auditor ensure is classified at the HIGHEST level of sensitivity?
An organization allows its employees lo use personal mobile devices for work. Which of the following would BEST maintain information security without compromising employee privacy?
Which of the following is the BEST control lo mitigate attacks that redirect Internet traffic to an unauthorized website?
Which of the following would BEST detect that a distributed denial of service (DDoS) attack is occurring?
During an IT general controls audit of a high-risk area where both internal and external audit teams are reviewing the same approach to optimize resources?
Which task should an IS auditor complete FIRST during the preliminary planning phase of a database security review?
Which of the following should an IS auditor expect to see in a network vulnerability assessment?
in a controlled application development environment, the MOST important segregation of duties should be between the person who implements changes into the production environment and the:
What should an IS auditor do FIRST when management responses
to an in-person internal control questionnaire indicate a key internal
control is no longer effective?
An IS auditor has completed the fieldwork phase of a network security review and is preparing the initial following findings should be ranked as the HIGHEST risk?
Which of the following would BEST enable an organization to address the security risks associated with a recently implemented bring your own device (BYOD) strategy?
Which of the following is the BEST way to ensure that business continuity plans (BCPs) will work effectively in the event of a major disaster?
An IS auditor has found that a vendor has gone out of business and the escrow has an older version of the source code. What is the auditor's BEST recommendation for the organization?
An IS auditor is reviewing processes for importing market price data from external data providers. Which of the following findings should the auditor consider MOST critical?
During an audit of an organization's risk management practices, an IS auditor finds several documented IT risk acceptances have not been renewed in a timely manner after the assigned expiration date When assessing the seventy of this finding, which mitigating factor would MOST significantly minimize the associated impact?
Which of the following is a challenge in developing a service level agreement (SLA) for network services?
Which of the following activities would allow an IS auditor to maintain independence while facilitating a control sell-assessment (CSA)?
An IS auditor learns the organization has experienced several server failures in its distributed environment. Which of the following is the BEST recommendation to limit the potential impact of server failures in the future?
Which of the following would MOST effectively help to reduce the number of repealed incidents in an organization?
Which of the following should be of GREATEST concern for an IS auditor reviewing an organization's disaster recovery plan (DRP)?
An IS auditor has discovered that a software system still in regular use is years out of date and no longer supported the auditee has stated that it will take six months until the software is running on the current version. Which of the following is the BEST way to reduce the immediate risk associated with using an unsupported version of the software?
An IS auditor discovers that an IT organization serving several business units assigns equal priority to all initiatives, creating a risk of delays in securing project funding Which of the following would be MOST helpful in matching demand for projects and services with available resources in a way that supports business objectives?
Which of the following types of environmental equipment will MOST likely be deployed below the floor tiles of a data center?
Which of the following would BEST determine whether a post-implementation review (PIR) performed by the project management office (PMO) was effective?
An organization plans to receive an automated data feed into its enterprise data warehouse from a third-party service provider. Which of the following would be the BEST way to prevent accepting bad data?
Which of the following would MOST effectively ensure the integrity of data transmitted over a network?
Which of the following components of a risk assessment is MOST helpful to management in determining the level of risk mitigation to apply?
An organization is disposing of a system containing sensitive data and has deleted all files from the hard disk. An IS auditor should be concerned because:
Which of the following is the BEST way to mitigate the risk associated with unintentional modifications of complex calculations in end-user computing (EUC)?
In response to an audit finding regarding a payroll application, management implemented a new automated control. Which of the following would be MOST helpful to the IS auditor when evaluating the effectiveness of the new control?
A review of an organization’s IT portfolio revealed several applications that are not in use. The BEST way to prevent this situation from recurring would be to implement.
Which of the following BEST protects an organization's proprietary code during a joint-development activity involving a third party?
Which of the following would be an appropriate role of internal audit in helping to establish an organization’s privacy program?
An audit identified that a computer system is not assigning sequential purchase order numbers to order requests. The IS auditor is conducting an audit follow-up to determine if management has reserved this finding. Which of two following is the MOST reliable follow-up procedure?
Which of the following is MOST important to determine during the planning phase of a cloud-based messaging and collaboration platform acquisition?
An IS auditor notes that the previous year's disaster recovery test was not completed within the scheduled time frame due to insufficient hardware allocated by a third-party vendor. Which of the following provides the BEST evidence that adequate resources are now allocated to successfully recover the systems?
An IS auditor has been asked to advise on measures to improve IT governance within the organization. Which at the following is the BEST recommendation?
What Is the BEST method to determine if IT resource spending is aligned with planned project spending?
Which of the following is the BEST reason to implement a data retention policy?
Which of the following would be MOST effective to protect information assets in a data center from theft by a vendor?
The PRIMARY objective of value delivery in reference to IT governance is to:
An IS auditor finds that one employee has unauthorized access to confidential data. The IS auditor's BEST recommendation should be to:
An IS auditor assessing the controls within a newly implemented call center would First
Which of the following would BEST ensure that a backup copy is available for restoration of mission critical data after a disaster''
What is the GREATEST concern for an IS auditor reviewing contracts for licensed software that executes a critical business process?
When verifying the accuracy and completeness of migrated data for a new application system replacing a legacy system. It is MOST effective for an IS auditor to review;
During a security audit, an IS auditor is tasked with reviewing log entries obtained from an enterprise intrusion prevention system (IPS). Which type of risk would be associated with the potential for the auditor to miss a sequence of logged events that could indicate an error in the IPS configuration?
A credit card company has decided to outsource the printing of customer statements It Is MOST important for the company to verify whether:
Which of the following is the GREATEST advantage of vulnerability scanning over penetration testing?
Which of the following is the BEST way to detect unauthorized copies of licensed software on systems?
Which of the following provides the MOST assurance of the integrity of a firewall log?
What is the MOST effective way to detect installation of unauthorized software packages by employees?
The PRIMARY purpose of requiring source code escrow in a contractual agreement is to:
Which of the following findings should be of GREATEST concern to an IS auditor assessing the risk associated with end-user computing (EUC) in an organization?
Which of the following information security requirements BE ST enables the tracking of organizational data in a bring your own device (BYOD) environment?
Which of the following should be the FIRST step in the incident response process for a suspected breach?
Which of the following would be the MOST useful metric for management to consider when reviewing a project portfolio?
Which of the following BEST enables the effectiveness of an agile project for the rapid development of a new software application?
Which of the following should be the FRST step when developing a data toes prevention (DIP) solution for a large organization?
Which of the following should be the IS auditor's PRIMARY focus, when evaluating an organization's offsite storage facility?
Which of the following is the BEST way to ensure that an application is performing according to its specifications?
Due to a recent business divestiture, an organization has limited IT resources to deliver critical projects Reviewing the IT staffing plan against which of the following would BEST guide IT management when estimating resource requirements for future projects?
Which of the following is MOST important for an IS auditor to consider when performing the risk assessment poor to an audit engagement?
A project team has decided to switch to an agile approach to develop a replacement for an existing business application. Which of the following should an IS auditor do FIRST to ensure the effectiveness of the protect audit?
A manager Identifies active privileged accounts belonging to staff who have left the organization. Which of the following is the threat actor In this scenario?
Which of the following is the BEST audit procedure to determine whether a firewall is configured in compliance with the organization's security policy?
Which of the following activities provides an IS auditor with the MOST insight regarding potential single person dependencies that might exist within the organization?
Which of the following is the BEST source of information tor an IS auditor to use when determining whether an organization's information security policy is adequate?
Which of the following will MOST likely compromise the control provided By a digital signature created using RSA encryption?
While auditing a small organization's data classification processes and procedures, an IS auditor noticed that data is often classified at the incorrect level. What is the MOST effective way for the organization to improve this situation?
When auditing the alignment of IT to the business strategy, it is MOST Important for the IS auditor to:
The GREATEST benefit of using a polo typing approach in software development is that it helps to:
Which of the following environments is BEST used for copying data and transformation into a compatible data warehouse format?
In an online application, which of the following would provide the MOST information about the transaction audit trail?
Which of the following findings from an IT governance review should be of GREATEST concern?
In which phase of penetration testing would host detection and domain name system (DNS) interrogation be performed?
Which of the following security risks can be reduced by a property configured network firewall?
Providing security certification for a new system should include which of the following prior to the system's implementation?
Following a security breach in which a hacker exploited a well-known vulnerability in the domain controller, an IS audit has been asked to conduct a control assessment. the auditor's BEST course of action would be to determine if:
Which of the following BEST enables the timely identification of risk exposure?
The PRIMARY reason for an IS auditor to use data analytics techniques is to reduce which type of audit risk?
Which of the following provides the BEST providence that outsourced provider services are being properly managed?
Which of the following is MOST important to ensure that electronic evidence collected during a forensic investigation will be admissible in future legal proceedings?
Which of the following is MOST important for an IS auditor to determine during the detailed design phase of a system development project?
An IS auditor reviewing the threat assessment tor a data center would be MOST concerned if:
Which of the following should be performed FIRST before key performance indicators (KPIs) can be implemented?
An IS auditor Is renewing the deployment of a new automated system Which of the following findings presents the MOST significant risk?
Which of the following indicates that an internal audit organization is structured to support the independence and clarity of the reporting process?
Which of the following would be MOST impacted if an IS auditor were to assist with the implementation of recommended control enhancements?
An IS auditor is reviewing the security of a web-based customer relationship management (CRM) system that is directly accessed by customers via the Internet, which of the following should be a concern for the auditor?
An IS auditor is reviewing an organization's business continuity plan (BCP) following a change in organizational structure with significant impact to business processes. Which of the following findings should be the auditor's GREATEST concern?
During a database management evaluation an IS auditor discovers that some accounts with database administrator (DBA) privileges have been assigned a default password with an unlimited number of failed login attempts Which of the following is the auditor's BEST course of action?
What is the PRIMARY purpose of performing a parallel run of a now system?
Which of the following is the MOST important outcome of an information security program?
To mitigate the risk of exposing data through application programming interface (API) queries. which of the following design considerations is MOST important?
Which of the following should be the FIRST step m managing the impact of a recently discovered zero-day attack?
Afire alarm system has been installed in the computer room The MOST effective location for the fire alarm control panel would be inside the
An IS auditor is reviewing a data conversion project Which of the following is the auditor's BEST recommendation prior to go-live?
Which of the following is the GREATEST risk if two users have concurrent access to the same database record?
Which of the following is the BEST source of information to determine the required level of data protection on a file server?
Which of the following would provide the BEST evidence of an IT strategy corrections effectiveness?
An IS auditor reviewing the throat assessment for a data cantor would be MOST concerned if:
An organization has replaced all of the storage devices at its primary data center with new higher-capacity units The replaced devices have been installed at the disaster recovery site to replace older units An IS auditor s PRIMARY concern would be whether
During a follow-up audit, an IS auditor finds that senior management has implemented a different remediation action plan than what was previously agreed upon. Which of the following is the auditor's BEST course of action?
Which of the following is MOST effective for controlling visitor access to a data center?
Which of the following is the BEST way to verify the effectiveness of a data restoration process?
Which of the following methods will BEST reduce the risk associated with the transition to a new system using technologies that are not compatible with the old system?
An internal audit team is deciding whether to use an audit management application hosted by a third party in a different country.
What should be the MOST important consideration related to the uploading of payroll audit documentation in the hosted
application?
Which of the following findings should be of GREATEST concern to an IS auditor reviewing an organization s newly implemented online security awareness program'?
An organization outsourced its IS functions to meet its responsibility for disaster recovery, the organization should:
Which of the following concerns is MOST effectively addressed by implementing an IT framework for alignment between IT and business objectives?
After delivering an audit report, the audit manager discovers that evidence was overlooked during the audit This evidence indicates that a procedural control may have failed and could contradict a conclusion of the audit Which of the following risks is MOST affected by this oversight?
Which of the following is the MAJOR advantage of automating internal controls?
Which of the following is the MOST effective control to mitigate against the risk of inappropriate activity by employees?
Which of the following is the MOST important factor when an organization is developing information security policies and procedures?
During a routine internal software licensing review, an IS auditor discovers instances where employees shared license keys to critical pieces of business software. Which of the following would be the auditor's BEST course of action?
An organization has recently moved to an agile model for deploying custom code to its in-house accounting software system. When reviewing the procedures in place for production code deployment, which of the following is the MOST significant security concern to address?
An organization has engaged a third party to implement an application to perform business-critical calculations. Which of the following is the MOST important process to help ensure the application provides accurate calculations?
An online retailer is receiving customer complaints about receiving different items from what they ordered on the organization's website. The root cause has been traced to poor data quality. Despite efforts to clean erroneous data from the system, multiple data quality issues continue to occur. Which of the following recommendations would be the BEST way to reduce the likelihood of future occurrences?
The BEST way to prevent fraudulent payments is to implement segregation of duties between the vendor setup and:
Which of the following is MOST important for an IS auditor to verify when evaluating an organization's data conversion andinfrastructure migration plan?
Which of the following is the BEST way to address potential data privacy concerns associated with inadvertent disclosure of machine identifier information contained within security logs?
During a project assessment, an IS auditor finds that business owners have been removed from the project initiation phase. Which of the following should be the auditor's GREATEST concern with this situation?
Which of the following is the BEST reason for an IS auditor to emphasize to management the importance of using an IT governance framework?
Which of following areas is MOST important for an IS auditor to focus on when reviewing the maturity model for a technology organization?
An IS auditor is evaluating the access controls for a shared customer relationship management (CRM) system. Which of the following would be the GREATEST concern?
Which of the following is the BEST performance indicator for the effectiveness of an incident management program?
Which of the following should be the PRIMARY role of an internal audit function in the management of identified business risks?
An IS auditor is performing a follow-up audit for findings identified in an organization's user provisioning process Which of the following is the MOST appropriate population to sample from when testing for remediation?
Which of the following is MOST important to define within a disaster recovery plan (DRP)?
Which of the following would be the BEST process for continuous auditing to a large financial Institution?
An incident response team has been notified of a virus outbreak in a network subnet. Which of the following should be the NEXT step?
Which of the following risk scenarios is BEST addressed by implementing policies and procedures related to full disk encryption?
Which of the following is a method to prevent disclosure of classified documents printed on a shared printer?
When reviewing the functionality of an intrusion detection system (IDS), the IS auditor should be MOST concerned if:
A firewall between internal network segments improves security and reduces risk by:
When classifying information, it is MOST important to align the classification to:
Transaction records from a business database were inadvertently deleted, and system operators decided to restore from a snapshot copy. Which of the following provides assurance that the BEST transactions were recovered successfully?
Which of the following is the BEST indication that there are potential problems within an organization's IT service desk function?
An organization plans to receive an automated data feed into its enterprise data warehouse from a third-party service provider. Which of the following would be the BEST way to prevent accepting bad data?
Which of the following should be the FIRST consideration when deciding whether data should be moved to a cloud provider for storage?
Which of the following is MOST important for an IS auditor to review when determining whether IT investments are providing value to tie business?
An organization is shifting to a remote workforce In preparation the IT department is performing stress and capacity testing of remote access infrastructure and systems What type of control is being implemented?
To enable the alignment of IT staff development plans with IT strategy, which of the following should be done FIRST?
In an online application which of the following would provide the MOST information about the transaction audit trail?
For an organization that has plans to implement web-based trading, it would be MOST important for an IS auditor to verify the organization's information security plan includes:
Which of the following would be of MOST concern for an IS auditor evaluating the design of an organization's incident management processes?
The due date of an audit project is approaching, and the audit manager has determined that only 60% of the audit has been completed. Which of the following should the audit manager do FIRST?
Which of the following documents should specify roles and responsibilities within an IT audit organization?
Which of the following should an IS auditor consider the MOST significant risk associated with a new health records system that replaces a legacy system?
Which of the following BEST demonstrates that IT strategy Is aligned with organizational goals and objectives?
An IS auditor performs a follow-up audit and learns the approach taken by the auditee to fix the findings differs from the agreed-upon approach confirmed during the last audit. Which of the following should be the auditor's NEXT course of action?
An organization is planning an acquisition and has engaged an IS auditor lo evaluate the IT governance framework of the target company. Which of the following would be MOST helpful In determining the effectiveness of the framework?
Which of the following BEST Indicates that an incident management process is effective?
During the planning stage of a compliance audit, an IS auditor discovers that a bank's inventory of compliance requirements does not include recent regulatory changes related to managing data risk. What should the auditor do FIRST?
Which of the following would be an appropriate rote of internal audit in helping to establish an organization's privacy program?
Which of the following controls BEST ensures appropriate segregation of dudes within an accounts payable department?
Which of the following would lead an IS auditor to conclude that the evidence collected during a digital forensic investigation would not be admissible in court?
Which of the following is an example of a preventative control in an accounts payable system?
An IS audit learn is evaluating the documentation related to the most recent application user-access review performed by IT and business management It is determined that the user list was not system-generated. Which of the following should be the GREATEST concern?
During an audit of a financial application, it was determined that many terminated users' accounts were not disabled. Which of the following should be the IS auditor's NEXT step?
Which of the following should be an IS auditor's GREATEST concern when an international organization intends to roll out a global data privacy policy?
In data warehouse (DW) management, what is the BEST way to prevent data quality issues caused by changes from a source system?
Which of the following should an IS auditor recommend be done FIRST when an organization is planning to implement an IT compliance program?
What should be the PRIMARY focus during a review of a business process improvement project?
An organization's information security policies should be developed PRIMARILY on the basis of:
Which of the following is the PRIMARY reason for using a digital signature?
Which of the following would be the GREATEST concern during a financial statement audit?
An IS auditor finds that a number of key patches have not been applied in a timely manner due to re-source constraints. Which of the following is the GREATEST risk to the organization in this
situation?
Which of the following is the MAIN risk associated with adding a new system functionality during the development phase without following a project change management process?
Which of the following provides the BEST evidence of effective IT portfolio managements?
During an organization's implementation of a data loss prevention (DLP) solution, which of the following activities should be completed FIRST?
Which of the following should be of MOST concern to an IS auditor reviewing an organization’s business impact analysis (BIA)?
How is nonrepudiation supported within a public key infrastructure (PKI) environment?
Which of the following security testing techniques is MOST effective for confirming that inputs to a web application have been properly sanitized?
Which of the following features would BEST address risk associated with data at rest when evaluating a data loss prevention (DLP) solution?
Which of the following is the PRIMARY advantage of using an automated security log monitoring tool instead of conducting a manual review to monitor the use of privileged access?
Which of the following is an IS auditor’s BEST approach when low-risk anomalies have been identified?
An organization establishes capacity utilization thresholds and monitors for instances when thresholds are exceeded. Which of the following is BEST supported by this activity?
A cloud access security broker (CASB) administers the user access of a Software as a Service {SaaS) on behalf of the customer organization. When conducting an audit of the service, which of the following is MOST important for the IS auditor to confirm?
The PRIMARY reason to assign data ownership for protection of data is to establish:
Which of the following is the MOST important course of action to ensure a cloud access security broker (CASB) effectively detects and responds to threats?
An IS auditor wants to gain a better understanding of an organization’s selected IT operating system software. Which of the following would be MOST helpful to review?
Which of the following encryption methods offers the BEST wireless security?
Which of the following is MOST likely to be reduced when implementing optimal risk management strategies?
Which of the following should an IS auditor be MOST concerned with when a system uses RFID?
Which of the following types of firewalls provides the GREATEST degree of control against hacker intrusion?
An organization is implementing a new system that supports a month-end business process. Which of the following implementation strategies would be MOST efficient to decrease business downtime?
Which of the following system attack methods is executed by entering malicious code into the search box of a vulnerable website, causing the server to reveal restricted information?
Which of the following controls helps to reduce fraud risk associated with robotic process automation (RPA)?
Which of the following is MOST appropriate to review when determining if the work completed on an IT project is in alignment with budgeted costs?
Which of the following is the BEST way to prevent social engineering incidents?
Which of the following is MOST important to the effectiveness of smoke detectors installed in a data processing facility?
During a review, an IS auditor discovers that corporate users are able to access cloud-based applications and data from any Internet-connected web browser. Which of the following is the
auditor's BEST recommendation to help prevent unauthorized access?
Which of the following approaches BEST enables an IS auditor to detect security vulnerabilities within an application?
Which of the following responsibilities associated with a disaster recovery plan (DRP) can be outsourced to a Disaster Recovery as a Service (DRaaS) provider?
Which of the following would be of GREATEST concern to an IS auditor reviewing the feasibility study for a new application system?
Which of the following is the PRIMARY advantage of using an automated security log monitoring tool over a manual review to monitor the use of privileged access?
Which of the following would be MOST useful to an IS auditor when making recommendations to enable continual improvement of IT processes over time?
An organization's strategy to source certain IT functions from a Software as a Service (SaaS) provider should be approved by the:
An organization requires the use of a key card to enter its data center. Recently, a control was implemented that requires biometric authentication for each employee.
Which type of control has been added?
When designing metrics for information security, the MOST important consideration is that the metrics:
Which of the following BEST addresses the availability of an online store?
Which of the following applications has the MOST inherent risk and should be prioritized during audit planning?
Which of the following procedures for testing a disaster recovery plan (DRP) is MOST effective?
As part of an audit response, an auditee has concerns with the recommendations and is hesitant to implement them. Which of the following is the BEST course of action for the IS auditor?
Which of the following would present the GREATEST risk within a release management process for a new application?
Which of the following is the MOST effective control when granting access to a service provider for a ctoud-6ased application?
Which of the following should be the PRIMARY focus for any network design that deploys a Zero Trust architecture?
Which of the following is the BEST review for an IS auditor to conduct when a vulnerability has been exploited by an employee?
Which of the following roles is PRIMARILY responsible for mitigating the risk of benefits not being realized in an IT project?
When an IS audit reveals that a firewall was unable to recognize a number of attack attempts, the auditor's BEST recommendation is to place an intrusion detection system (IDS) between the
firewall and:
Which of the following key performance indicators (KPIs) provides stakeholders with the MOST useful information about whether information security risk is being managed?
An IS auditor would MOST likely recommend that IT management use a balanced scorecard to:
An IS auditor has been asked to review an event log aggregation system to ensure risk management practices have been applied. Which of the following should be of MOST concern to the auditor?
An IS auditor is reviewing desktop software profiles and notes that a user has downloaded and installed several games that are not approved by the company. Which of the following is the MOST significant risk that could result from this situation?
The waterfall life cycle model of software development is BEST suited for which of the following situations?
Which of the following controls is the BEST recommendation to prevent the skimming of debit or credit card data in point of sale (POS) systems?
The business case for an information system investment should be available for review until the:
If concurrent update transactions to an account are not processed properly, which of the following will be affected?
Which of the following will provide the GREATEST assurance to IT management that a quality management system (QMS) is effective?
An IS auditor has been asked to review the quality of data in a general ledger system. Which of the following would provide the auditor with the MOST meaningful results?
Which of the following technologies BEST assists in protection of digital evidence as part of forensic investigation acquisition?
Which of the following cloud capabilities BEST enables an organization to meet unexpectedly high service demand?
An external audit firm was engaged to perform a validation and verification review for a systems implementation project. The IS auditor identifies that regression testing is not part of the project plan and was not performed by the systems implementation team. According to the team, the parallel testing being performed is sufficient, making regression testing unnecessary. What should be the auditor’s NEXT step?
A global bank plans to use a cloud provider for backup of customer financial data. Which of the following should be the PRIMARY focus of this project?
An organization allows programmers to change production systems in emergency situations without seeking prior approval. Which of the following controls should an IS auditor consider MOST
important?
Which of the following metrics is the BEST indicator of the performance of a web application?
Which of the following would be MOST important to include in an IS audit report?
Which of the following issues identified during a formal review of an organization's information security policies presents the GREATEST potential risk to the organization?
Which of the following findings would be of GREATEST concern to an IS auditor reviewing the security architecture of an organization that has just implemented a Zero Trust solution?
An organization uses public key infrastructure (PKI) to provide email security. Which of the following would be the MOST efficient method to determine whether email messages have been modified in transit?
An IS audit manager is reviewing workpapers for a recently completed audit of the corporate disaster recovery test. Which of the following should the IS audit manager specifically review to substantiate the conclusions?
An IT strategic plan that BEST leverages IT in achieving organizational goals will include:
The BEST way to provide assurance that a project is adhering to the project plan is to:
An IS audit manager was temporarily tasked with supervising a project manager assigned to the organization's payroll application upgrade. Upon returning to the audit department, the audit manager has been asked to perform an audit to validate the implementation of the payroll application. The audit manager is the only one in the audit department with IT project management
experience. What is the BEST course of action?
Which of the following observations should be of GREATEST concern to an IS auditor performing an audit of change and release management controls for a new complex system developed by a small in-house IT team?
Which of the following is the PRIMARY reason for an IS auditor to perform a risk assessment?
An IS auditor is reviewing a contract for the outsourcing of IT facilities. If missing, which of the following should present the GREATEST concern to the auditor?
Which of the following is MOST critical to the success of an information security program?
Which of the following would BEST guide an IS auditor when determining an appropriate time to schedule the follow-up of agreed corrective actions for reported audit issues?
Which of the following is the BEST compensating control against segregation of duties conflicts in new code development?
Which of the following would be an auditor's GREATEST concern when reviewing data inputs from spreadsheets into the core finance system?
When reviewing a business case for a proposed implementation of a third-party system, which of the following should be an IS auditor's GREATEST concern?
Which of the following should be done FIRST when planning to conduct internal and external penetration testing for a client?
What should an IS auditor recommend to management as the MOST important action before selecting a Software as a Service (SaaS) vendor?
Which of the following is the MOST important advantage of participating in beta testing of software products?
Which of the following is MOST important to include in security awareness training?
During a pre-deployment assessment, what is the BEST indication that a business case will lead to the achievement of business objectives?
Which of the following should be the FIRST step when developing a data loss prevention (DLP) solution for a large organization?
During planning for a cloud service audit, audit management becomes aware that the assigned IS auditor is unfamiliar with the technologies in use and their associated risks to the business. To ensure audit quality, which of the following actions should audit management consider FIRST?
Which of the following would be the GREATEST concern to an IS auditor when reviewing the outsourcing contract for an organization's cloud service provider?
A core system fails a week after a scheduled update, causing an outage that impacts service. Which of the following is MOST important for incident management to focus on when addressing the issue?
An IS auditor discovers that validation controls in a web application have been moved from the server side into the browser to boost performance. This would MOST likely increase the risk of a successful attack by:
An organization's security team created a simulated production environment with multiple vulnerable applications. What would be the PRIMARY purpose of creating such an environment?
A global organization's policy states that all workstations must be scanned for malware each day. Which of the following would provide an IS auditor with the BEST evidence of continuous compliance with this policy?
Which of the following would BEST indicate the effectiveness of a security awareness training program?
Which of the following would present the GREATEST concern during a review of internal audit quality assurance (QA) and continuous improvement processes?
Which of the following BEST supports the effectiveness of a compliance program?
During an audit, the IS auditor finds that in many cases excessive rights were not removed from a system. Which of the following is the auditor's BEST recommendation?
In which of the following sampling methods is the entire sample considered to be irregular if a single error is found?
When physical destruction IS not practical, which of the following is the MOST effective means of disposing of sensitive data on a hard disk?
An organization has recently become aware of a pervasive chip-level security vulnerability that affects all of its processors. Which of the following is the BEST way to prevent this vulnerability from being exploited?
During a project audit, an IS auditor notes that project reporting does not accurately reflect current progress. Which of the following is the GREATEST resulting impact?
Which of the following is the BEST security control to validate the integrity of data communicated between production databases and a big data analytics
system?
The BEST way to evaluate the effectiveness of a newly developed application is to:
During the walk-through procedures for an upcoming audit, an IS auditor notes that the key application in scope is part of a Software as a Service (SaaS)
agreement. What should the auditor do NEXT?
Which of the following helps to ensure the integrity of data for a system interface?
Which of the following is the GREATEST risk when relying on reports generated by end-user computing (EUC)?
Which type of review is MOST important to conduct when an IS auditor is informed that a recent internal exploitation of a bug has been discovered in a business application?
Which of the following BEST contributes to the quality of an audit of a business-critical application?
Which of the following is MOST important to consider when assessing the scope of privacy concerns for an IT project?
When planning an internal penetration test, which of the following is the MOST important step prior to finalizing the scope of testing?
An organization's IT department and internal IS audit function all report to the chief information officer (CIO). Which of the following is the GREATEST concern associated with this reporting structure?
Which of the following is the BEST sampling method to use when relatively few errors are expected to be found in a population?
What should an IS auditor evaluate FIRST when reviewing an organization's response to new privacy legislation?
When a data center is attempting to restore computing facilities at an alternative site following a disaster, which of the following should be restored FIRST?
A bank performed minor changes to the interest calculation computer program. Which of the following techniques would provide the STRONGEST evidence to determine whether the interest calculations are correct?
An IS auditor found that a company executive is encouraging employee use of social networking sites for business purposes. Which of the following recommendations would BEST help to reduce the risk of data leakage?
Which of the following should be given GREATEST consideration when implementing the use of an open-source product?
Following the sale of a business division, employees will be transferred to a new organization, but they will retain access to IT equipment from the previous employer. An IS auditor has recommended that both organizations agree to and document an acceptable use policy for the equipment. What type of control has been recommended?
A national tax administration agency with a distributed network experiences service disruptions due to a large influx of traffic to a regional office near the end of each year. Which of the following would BEST enable the agency to improve the performance of its servers during the busy period?
When planning a follow-up, the IS auditor is informed by operational management that recent organizational changes have addressed the previously identified risk and implementing the action plan is no longer necessary. What should the auditor do NEXT?
An IS auditor is evaluating an enterprise resource planning (ERP) migration from local systems to the cloud. Who should be responsible for the data
classification in this project?
To reduce operational costs, IT management plans to reduce the number of servers currently used to run business applications. Which of the following is MOST helpful to review when identifying which servers are no longer required?
Which of the following is the MOST important area of focus for an IS auditor when developing a risk-based audit strategy?
An organization's security team created a simulated production environment with multiple vulnerable applications. What would be the PRIMARY purpose of creating such an environment?
An IS audit reveals an IT application is experiencing poor performance including data inconsistency and integrity issues. What is the MOST likely cause?
Which of the following should be the FIRST step in a data migration project?
Which of the following is the BEST indication of effective governance over IT infrastructure?
Which of the following is MOST critical to the success of an information security program?
In a high-volume, real-time system, the MOST effective technique by which to continuously monitor and analyze transaction processing is:
Which of the following would minimize the risk of losing transactions as a result of a disaster?
An organization has an acceptable use policy in place, but users do not formally acknowledge the policy. Which of the following is the MOST significant risk from this finding?
TESTED 14 Jun 2025
