Free ISACA CISA Practice Exams - Page 9 of 62

Question #81

Management has learned the implementation of a new IT system will not be completed on time and has requested an audit.

Which of the following audit findings should be of GREATEST concern?

A . The actual start times of some activities were later than originally scheduled.
B . Tasks defined on the critical path do not have resources allocated.
C . The project manager lacks formal certification.
D . Milestones have not been defined for all project products.

Reveal Solution Hide Solution

Question #82

Which of the following recommendations would BEST prevent the implementation of IT projects without collaborating with the business?

A . Partner with the business units to evaluate IT projects.
B . Review the projects to identify similarities and eliminate duplication.
C . Periodically review the projects’ return on investment (ROI).
D . Prioritize protects based on business and IT resource availability.

Reveal Solution Hide Solution

Question #83

An IS auditor has been asked to review the integrity of data transfer between two business-critical systems that have not been tested since implementation.

Which of the following would provide the MOST useful information to plan an audit?

A . Quality assurance (QA) testing
B . System change logs
C . IT testing policies and procedures
D . Previous system interface testing records

Reveal Solution Hide Solution

Question #84

Which of the following is the MAIN purpose of an information security management system?

A . To identify and eliminate the root causes of information security incidents
B . To enhance the impact of reports used to monitor information security incidents
C . To keep information security policies and procedures up-to-date
D . To reduce the frequency and impact of information security incidents

Reveal Solution Hide Solution

Question #85

Which of the following BEST demonstrates alignment of the IT department with the corporate mission?

A . Analysis of IT department functionality
B . Biweekly reporting to senior management
C . Annual board meetings
D . Quarterly steering committee meetings

Reveal Solution Hide Solution

Question #86

Which of the following features of a library control software package would protect against unauthorized updating of source code?

A . Required approvals at each life cycle step
B . Date and time stamping of source and object code
C . Access controls for source libraries
D . Release-to-release comparison of source code

Reveal Solution Hide Solution

Question #87

Which of the following BEST enables an IS auditor to confirm the batch processing to post transactions from an input source is successful?

A . Error log review
B . Total number of items
C . Hash totals
D . Aggregate monetary amount

Reveal Solution Hide Solution

Question #88

Which of the following should an IS auditor consider FIRST when evaluating firewall rules?

A . The organization’s security policy
B . The number of remote nodes
C . The firewalls’ default settings
D . The physical location of the firewalls

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

This should be the first thing that an IS auditor considers when evaluating firewall rules, because it defines the objectives, standards, and guidelines for securing the organization’s network and information assets. The firewall rules should be aligned with the organization’s security policy, and reflect the level of risk and protection required for each type of network traffic, system, or data. The IS auditor should compare the firewall rules with the security policy, and identify any discrepancies, gaps, or conflicts that could compromise the security or performance of the network.

The other options are not as important as the organization’s security policy when evaluating firewall rules:

The number of remote nodes. This is a factor that may affect the complexity and scalability of the firewall rules, but it is not a primary consideration for the IS auditor. Remote nodes are devices or systems that connect to the network from outside locations, such as teleworkers, mobile users, or branch offices. The IS auditor should ensure that the firewall rules provide adequate security and access control for remote nodes, but this depends on the organization’s security policy and business needs.

The firewalls’ default settings. These are the predefined configurations that come with the firewall devices or software, and that determine how they handle network traffic by default. The IS auditor should review the firewalls’ default settings, and verify that they are appropriate and secure for the organization’s network environment. However, the firewalls’ default settings may not match the organization’s security policy or specific requirements, and may need to be customized or overridden by firewall rules.

The physical location of the firewalls. This is a factor that may affect the placement and design of the

firewall rules, but it is not a critical consideration for the IS auditor. The physical location of the firewalls refers to where they are installed or deployed in relation to the network topology, such as at the network perimeter, between network segments, or on individual hosts. The IS auditor should ensure that the firewall rules are consistent and coordinated across different locations, but this depends on the organization’s security policy and network architecture.

Question #89

An IS auditor reviewing the throat assessment for a data cantor would be MOST concerned if:

A . some of the identified threats are unlikely to occur.
B . all identified threats relate to external entities.
C . the exercise was completed by local management.
D . neighboring organizations’ operations have been included.

Reveal Solution Hide Solution

Question #90

When auditing IT organizational structure, which of the following findings presents the GREATEST risk to an organization?

A . Significantly higher turnover
B . Lack of customer satisfaction surveys
C . Aging staff
D . Increase in the frequency of software upgrades

Reveal Solution Hide Solution