Free ISACA CISA Practice Exams - Page 5 of 62

Question #41

When an intrusion into an organization network is deleted, which of the following should be done FIRST?

A . Block all compromised network nodes.
B . Contact law enforcement.
C . Notify senior management.
D . Identity nodes that have been compromised.

Reveal Solution Hide Solution

Question #42

What is the PRIMARY benefit of using one-time passwords?

A . An intercepted password cannot be reused
B . Security for applications can be automated
C . Users do not have to memorize complex passwords
D . Users cannot be locked out of an account

Reveal Solution Hide Solution

Question #43

Which of the following is the BEST method to prevent wire transfer fraud by bank employees?

A . Independent reconciliation
B . Re-keying of wire dollar amounts
C . Two-factor authentication control
D . System-enforced dual control

Reveal Solution Hide Solution

Question #44

Which of the following would be an IS auditor’s GREATEST concern when reviewing the organization’s business continuity plan (BCP)?

A . The recovery plan does not contain the process and application dependencies.
B . The duration of tabletop exercises is longer than the recovery point objective (RPO).
C . The duration of tabletop exercises is longer than the recovery time objective (RTO).
D . The recovery point objective (RPO) and recovery time objective (R TO) are not the same.

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

A business continuity plan (BCP) is a document that outlines how an organization will continue its critical functions in the event of a disruption or disaster. A BCP should include the following elements1:

Business impact analysis: This is the process of identifying and prioritizing the key business processes and assets that are essential for the organization’s survival and recovery.

Risk assessment: This is the process of identifying and evaluating the potential threats and vulnerabilities that could affect the organization’s business continuity.

Recovery strategies: These are the actions and procedures that the organization will implement to restore its normal operations as quickly and effectively as possible after a disruption or disaster.

Recovery objectives: These are the metrics that define the acceptable level of recovery for the organization’s business processes and assets.

The two main recovery objectives are:

Recovery point objective (RPO): This is the maximum amount of data loss that the organization can tolerate in terms of time. For example, an RPO of one hour means that the organization can afford to lose up to one hour’s worth of data after a disruption or disaster.

Recovery time objective (RTO): This is the maximum amount of time that the organization can tolerate to restore its normal operations after a disruption or disaster. For example, an RTO of four hours means that the organization must resume its normal operations within four hours after a disruption or disaster.

Testing and validation: This is the process of verifying and evaluating the effectiveness and efficiency of the BCP and its components.

Testing and validation can include various methods, such as:

Tabletop exercises: These are discussion-based sessions where team members meet in an informal setting to review and discuss their roles and responsibilities during a disruption or disaster scenario. A facilitator guides participants through a discussion of one or more scenarios2.

Simulation exercises: These are more realistic and interactive sessions where team members perform their roles and responsibilities during a simulated disruption or disaster scenario. A

facilitator controls and monitors the simulation and injects events and challenges3.

Full-scale exercises: These are the most complex and realistic sessions where team members perform their roles and responsibilities during a real-life disruption or disaster scenario. A facilitator coordinates and evaluates the exercise with external stakeholders, such as emergency services, media, or customers4.

As an IS auditor, your greatest concern when reviewing the organization’s BCP would be A. The recovery plan does not contain the process and application dependencies.

Question #45

The PRIMARY purpose of a configuration management system is to:

A . track software updates.
B . define baselines for software.
C . support the release procedure.
D . standardize change approval.

Reveal Solution Hide Solution

Question #46

While executing follow-up activities, an IS auditor is concerned that management has implemented corrective actions that are different from those originally discussed and agreed with the audit function.

In order to resolve the situation, the IS auditor’s BEST course of action would be to:

A . re-prioritize the original issue as high risk and escalate to senior management.
B . schedule a follow-up audit in the next audit cycle.
C . postpone follow-up activities and escalate the alternative controls to senior audit management.
D . determine whether the alternative controls sufficiently mitigate the risk.

Reveal Solution Hide Solution

Question #47

Which of the following is an IS auditor’s BEST recommendation to help an organization increase the efficiency of computing resources?

A . Virtualization
B . Hardware upgrades
C . Overclocking the central processing unit (CPU)
D . Real-time backups

Reveal Solution Hide Solution

Question #48

Which of the following applications has the MOST inherent risk and should be prioritized during

audit planning?

A . A decommissioned legacy application
B . An onsite application that is unsupported
C . An outsourced accounting application
D . An internally developed application

Reveal Solution Hide Solution

Question #49

During an IS audit of a data center, it was found that programmers are allowed to make emergency fixes to operational programs.

Which of the following should be the IS auditor’s PRIMARY recommendation?

A . Programmers should be allowed to implement emergency fixes only after obtaining verbal agreement from the application owner.
B . Emergency program changes should be subject to program migration and testing procedures before they are applied to operational systems.
C . Bypass user ID procedures should be put in place to ensure that the changes are subject to after-the-event approval and testing.

Reveal Solution Hide Solution

Question #50

In which phase of the internal audit process is contact established with the individuals responsible for the business processes in scope for review?

A . Planning phase
B . Execution phase
C . Follow-up phase
D . Selection phase

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

The planning phase is the stage of the internal audit process where contact is established with the individuals responsible for the business processes in scope for review. The planning phase involves defining the objectives, scope, and criteria of the audit, as well as identifying the key risks and controls related to the audited area. The planning phase also involves communicating with the auditee to obtain relevant information, documents, and data, as well as to schedule interviews, walkthroughs, and meetings. The planning phase aims to ensure that the audit team has a clear understanding of the audited area and its context, and that the audit plan is aligned with the expectations and needs of the auditee and other stakeholders.

The execution phase is the stage of the internal audit process where the audit team performs the audit procedures according to the audit plan. The execution phase involves testing the design and operating effectiveness of the controls, collecting and analyzing evidence, documenting the audit work and results, and identifying any issues or findings. The execution phase aims to provide sufficient and appropriate evidence to support the audit conclusions and recommendations.

The follow-up phase is the stage of the internal audit process where the audit team monitors and verifies the implementation of the corrective actions agreed upon by the auditee in response to the audit findings. The follow-up phase involves reviewing the evidence provided by the auditee, conducting additional tests or interviews if necessary, and evaluating whether the corrective actions have adequately addressed the root causes of the findings. The follow-up phase aims to ensure that the auditee has taken timely and effective actions to improve its processes and controls.

The selection phase is not a standard stage of the internal audit process, but it may refer to the process of selecting which areas or functions to audit based on a risk assessment or an annual audit plan. The selection phase involves evaluating the inherent and residual risks of each potential auditable area, considering the impact, likelihood, and frequency of those risks, as well as other factors such as regulatory requirements, stakeholder expectations, previous audit results, and available resources. The selection phase aims to prioritize and allocate the audit resources to those areas that present the highest risks or opportunities for improvement.

Therefore, option A is the correct answer.

References:

Stages and phases of internal audit – piranirisk.com

Step-by-Step Internal Audit Checklist | AuditBoard

Audit Process | The Office of Internal Audit – University of Oregon