Which of the following is the MOST important consideration when defining an operational log management strategy?
Which of the following BEST ensures the quality and integrity of test procedures used in audit analytics?
Who is PRIMARILY responsible for the design of IT controls to meet control objectives?
Which of the following provides the BEST assurance that vendor-supported software remains up to date?
When designing metrics for information security, the MOST important consideration is that the metrics:
While reviewing the effectiveness of an incident response program, an IS auditor notices a high number of reported incidents involving malware originating from removable media found by employees. Which of the following is the MOST appropriate recommendation to management?
An IS auditor learns that a business owner violated the organization's security policy by creating a web page with access to production data. The auditor's NEXT step should be to:
Management has decided to accept a risk in response to a draft audit recommendation. Which of the following should be the IS auditor’s NEXT course of action?
Which of the following is the BEST indicator that a third-party vendor adheres to the controls required by the organization?
When determining whether a project in the design phase will meet organizational objectives, what is BEST to compare against the business case?
During the implementation of an upgraded enterprise resource planning (ERP) system, which of the following is the MOST important consideration for a go-live decision?
Which of the following is the BEST justification for deferring remediation testing until the next audit?
During a follow-up audit, an IS auditor learns that some key management personnel have been replaced since the original audit, and current management has decided not to implement some previously accepted recommendations. What is the auditor's BEST course of action?
During an ongoing audit, management requests a briefing on the findings to date. Which of the following is the IS auditor's BEST course of action?
In a small IT web development company where developers must have write access to production, the BEST recommendation of an IS auditor would be to:
Management has requested a post-implementation review of a newly implemented purchasing package to determine to what extent business requirements are being met. Which of the following is MOST likely to be assessed?
Which of the following is MOST important with regard to an application development acceptance test?
Which of the following is the MOST important benefit of involving IS audit when implementing governance of enterprise IT?
Which of the following is the BEST source of information for assessing the effectiveness of IT process monitoring?
A system administrator recently informed the IS auditor about the occurrence of several unsuccessful intrusion attempts from outside the organization. Which of the following is MOST effective in detecting such an intrusion?
Which of the following is MOST important to include in forensic data collection and preservation procedures?
An IS audit reveals that an organization is not proactively addressing known vulnerabilities. Which of the following should the IS auditor recommend the organization do FIRST?
Which of the following is the BEST method to safeguard data on an organization's laptop computers?
Which of the following is the BEST method to prevent wire transfer fraud by bank employees?
Which of the following is the BEST control to mitigate the malware risk associated with an instant messaging (IM) system?
Which of the following is MOST important for an effective control self-assessment (CSA) program?
An IS auditor is planning an audit of an organization's accounts payable processes. Which of the following controls is MOST important to assess in the audit?
Which of the following is the PRIMARY advantage of parallel processing for a new system implementation?
IS management has recently disabled certain referential integrity controls in the database management system (DBMS) software to provide users increased query performance. Which of the following controls will MOST effectively compensate for the lack of referential integrity?
Which of the following would MOST likely impair the independence of the IS auditor when performing a post-implementation review of an application system?
Which of the following would be to MOST concern when determine if information assets are adequately safequately safeguarded during transport and disposal?
Which of the following will be the MOST effective method to verify that a service vendor keeps control levels as required by the client?
Which of the following strategies BEST optimizes data storage without compromising data retention practices?
What is BEST for an IS auditor to review when assessing the effectiveness of changes recently made to processes and tools related to an organization's business continuity plan (BCP)?
Which of the following BEST indicates the effectiveness of an organization's risk management program?
An organization plans to receive an automated data feed into its enterprise data warehouse from a third-party service provider. Which of the following would be the BEST way to prevent accepting bad data?
An organization's enterprise architecture (EA) department decides to change a legacy system's components while maintaining its original functionality. Which of the following is MOST important for an IS auditor to understand when reviewing this decision?
During the evaluation of controls over a major application development project, the MOST effective use of an IS auditor's time would be to review and evaluate:
When an intrusion into an organization network is deleted, which of the following should be done FIRST?
During the design phase of a software development project, the PRIMARY responsibility of an IS auditor is to evaluate the:
Which of the following is the MOST effective control to mitigate unintentional misuse of authorized access?
Which of the following is the BEST way to address segregation of duties issues in an organization with budget constraints?
Which audit approach is MOST helpful in optimizing the use of IS audit resources?
Which of the following provides the MOST reliable audit evidence on the validity of transactions in a financial application?
Which of the following attack techniques will succeed because of an inherent security weakness in an Internet firewall?
The decision to accept an IT control risk related to data quality should be the responsibility of the:
During a review of a production schedule, an IS auditor observes that a staff member is not complying with mandatory operational procedures. The auditor's NEXT step should be to:
A new regulation requires organizations to report significant security incidents to the regulator within 24 hours of identification. Which of the following is the IS auditor's BEST recommendation to facilitate compliance with the regulation?
From an IS auditor's perspective, which of the following would be the GREATEST risk associated with an incomplete inventory of deployed software in an organization?
Which of the following is the MOST important prerequisite for the protection of physical information assets in a data center?
Which of the following is MOST important for an IS auditor to review when evaluating the accuracy of a spreadsheet that contains several macros?
In order for a firewall to effectively protect a network against external attacks, what fundamental practice must be followed?
During an audit of a reciprocal disaster recovery agreement between two companies, the IS auditor would be MOST concerned with the:
Which of the following is an executive management concern that could be addressed by the implementation of a security metrics dashboard?
An IS auditor wants to determine who has oversight of staff performing a specific task and is referencing the organization's RACI chart. Which of the following roles within the chart would provide this information?
An IS auditor discovers that validation controls m a web application have been moved from the server side into the browser to boost performance This would MOST likely increase the risk of a successful attack by.
Which of the following is the PRIMARY concern when negotiating a contract for a hot site?
Secure code reviews as part of a continuous deployment program are which type of control?
An IS auditor is following up on prior period items and finds management did not address an audit finding. Which of the following should be the IS auditor's NEXT course of action?
Which of the following should an IS auditor be MOST concerned with during a post-implementation review?
Which of the following demonstrates the use of data analytics for a loan origination process?
An IS auditor found that a company executive is encouraging employee use of social networking sites for business purposes. Which of the following recommendations would BEST help to reduce the risk of data leakage?
Which of the following are used in a firewall to protect the entity's internal resources?
Which of the following is the MOST important reason to implement version control for an end-user computing (EUC) application?
Which of the following tests would provide the BEST assurance that a health care organization is handling patient data appropriately?
Which of the following is the BEST recommendation to prevent fraudulent electronic funds transfers by accounts payable employees?
Which of the following management decisions presents the GREATEST risk associated with data leakage?
When testing the accuracy of transaction data, which of the following situations BEST justifies the use of a smaller sample size?
Which of the following is me GREATE ST impact as a result of the ongoing deterioration of a detective control?
Which of the following analytical methods would be MOST useful when trying to identify groups with similar behavior or characteristics in a large population?
When reviewing a project to replace multiple manual data entry systems with an artificial intelligence (Al) system, the IS auditor should be MOST concerned with the impact Al will have on
Which of the following is MOST important for an IS auditor to validate when auditing network device management?
Recovery facilities providing a redundant combination of Internet connections to the local communications loop is an example of which type of telecommunications continuity?
Which of the following should be the FIRST step when conducting an IT risk assessment?
An IS auditor notes that not all security tests were completed for an online sales system recently promoted to production. Which of the following is the auditor's BEST course of action?
Which of the following should an organization do to anticipate the effects of a disaster?
Which of the following is an IS auditor's BEST approach when prepanng to evaluate whether the IT strategy supports the organization's vision and mission?
The PRIMARY purpose of requiring source code escrow in a contractual agreement is to:
An IS auditor engaged in developing the annual internal audit plan learns that the chief information officer (CIO) has requested there be no IS audits in the upcoming year as more time is needed to address a large number of recommendations from the previous year. Which of the following should the auditor do FIRST
Which of the following is the BEST testing approach to facilitate rapid identification of application interface errors?
Which of the following should an IS auditor review when evaluating information systems governance for a large organization?
An IS auditor learns a server administration team regularly applies workarounds to address repeated failures of critical data processing services Which of the following would BEST enable the organization to resolve this issue?
Which of the following risk scenarios is BEST addressed by implementing policies and procedures related to full disk encryption?
During which phase of the software development life cycle is it BEST to initiate the discussion of application controls?
Which of the following is the BEST way to help ensure new IT implementations align with enterprise architecture (EA) principles and requirements?
An organization has established hiring policies and procedures designed specifically to ensure network administrators are well qualified Which type of control is in place?
As part of business continuity planning, which of the following is MOST important to assess when conducting a business impact analysis (B1A)?
What would be an IS auditor's BEST course of action when an auditee is unable to close all audit recommendations by the time of the follow-up audit?
Which of the following areas is MOST likely to be overlooked when implementing a new data classification process?
Which of the following indicates that an internal audit organization is structured to support the independence and clarity of the reporting process?
Which of the following would provide the BEST evidence of an IT strategy corrections effectiveness?
A database administrator (DBA) should be prevented from having end user responsibilities:
Backup procedures for an organization's critical data are considered to be which type of control?
A senior auditor is reviewing work papers prepared by a junior auditor indicating that a finding was removed after the auditee said they corrected the problem. Which of the following is the senior auditor s MOST appropriate course of action?
Which of the following should be the FIRST step m managing the impact of a recently discovered zero-day attack?
Which of the following should be the GREATEST concern to an IS auditor reviewing an organization's method to transport sensitive data between offices?
An IS auditor learns that an in-house system development life cycle (SDLC) project has not met user specifications. The auditor should FIRST examine requirements from which of the following phases?
Afire alarm system has been installed in the computer room The MOST effective location for the fire alarm control panel would be inside the
An organization has engaged a third party to implement an application to perform business-critical calculations. Which of the following is the MOST important process to help ensure the application provides accurate calculations?
Which of the following is the MOST effective method of destroying sensitive data stored on electronic media?
Which of the following should be the PRIMARY role of an internal audit function in the management of identified business risks?
Which of the following is the BEST way to verify the effectiveness of a data restoration process?
An IS auditor is evaluating the progress of a web-based customer service application development project. Which of the following would be MOST helpful for this evaluation?
The charging method that effectively encourages the MOST efficient use of IS resources is:
The use of control totals satisfies which of the following control objectives?
An IS auditor has discovered that a software system still in regular use is years out of date and no longer supported. The auditee has stated that it will take six months until the software is running on the current version. Which of the following is the BEST way to reduce the immediate risk associated with using an unsupported version of the software?
Which of the following is MOST important to define within a disaster recovery plan (DRP)?
Which of the following is MOST important for an IS auditor to verify when reviewing the use of an outsourcer for disposal of storage media?
Which of the following is a PRIMARY responsibility of an IT steering committee?
An IS auditor is evaluating the access controls for a shared customer relationship management (CRM) system. Which of the following would be the GREATEST concern?
An incident response team has been notified of a virus outbreak in a network subnet. Which of the following should be the NEXT step?
An organization has replaced all of the storage devices at its primary data center with new higher-capacity units The replaced devices have been installed at the disaster recovery site to replace older units An IS auditor s PRIMARY concern would be whether
Which of the following should be the FIRST step when planning an IS audit of a third-party service provider that monitors network activities?
When evaluating information security governance within an organization, which of the following findings should be of MOST concern to an IS auditor?
Which of the following is the BEST way to sanitize a hard disk for reuse to ensure the organization's information cannot be accessed?
The use of access control lists (ACLs) is the MOST effective method to mitigate security risk for routers because they: (Identify Correct answer and related explanation/references from CISA Certification - Information Systems Auditor official Manual or book)
A vendor requires privileged access to a key business application. Which of the following is the BEST recommendation to reduce the risk of data leakage?
Which of the following is the BEST way to detect unauthorized copies of licensed software on systems?
An IS auditor has completed the fieldwork phase of a network security review and is preparing the initial following findings should be ranked as the HIGHEST risk?
Which of the following would be the MOST useful metric for management to consider when reviewing a project portfolio?
An IS auditor follows up on a recent security incident and finds the incident response was not adequate. Which of the following findings should be considered MOST critical?
Which of the following types of environmental equipment will MOST likely be deployed below the floor tiles of a data center?
What should an IS auditor do FIRST when management responses
to an in-person internal control questionnaire indicate a key internal
control is no longer effective?
Which of the following is the BEST control lo mitigate attacks that redirect Internet traffic to an unauthorized website?
Which of the following is a challenge in developing a service level agreement (SLA) for network services?
Which of the following is the BEST way to enforce the principle of least privilege on a server containing data with different security classifications?
Which of the following is MOST important for an IS auditor to confirm when reviewing an organization's plans to implement robotic process automation (RPA> to automate routine business tasks?
in a controlled application development environment, the MOST important segregation of duties should be between the person who implements changes into the production environment and the:
A post-implementation review was conducted by issuing a survey to users. Which of the following should be of GREATEST concern to an IS auditor?
Which of the following should be of GREATEST concern to an IS auditor reviewing a network printer disposal process?
Which of the following would be MOST effective to protect information assets in a data center from theft by a vendor?
Which of the following is MOST critical for the effective implementation of IT governance?
Which of the following is MOST important for an IS auditor to determine during the detailed design phase of a system development project?
An IS auditor has found that a vendor has gone out of business and the escrow has an older version of the source code. What is the auditor's BEST recommendation for the organization?
An IS auditor is reviewing logical access controls for an organization's financial business application Which of the following findings should be of GREATEST concern to the auditor?
An audit has identified that business units have purchased cloud-based applications without IPs support. What is the GREATEST risk associated with this situation?
An IS auditor plans to review all access attempts to a video-monitored and proximity card-controlled communications room. Which of the following would be MOST useful to the auditor?
What Is the BEST method to determine if IT resource spending is aligned with planned project spending?
Which of the following should be the FIRST step in the incident response process for a suspected breach?
An organization is disposing of a system containing sensitive data and has deleted all files from the hard disk. An IS auditor should be concerned because:
An IS auditor notes that the previous year's disaster recovery test was not completed within the scheduled time frame due to insufficient hardware allocated by a third-party vendor. Which of the following provides the BEST evidence that adequate resources are now allocated to successfully recover the systems?
Which of the following should an IS auditor ensure is classified at the HIGHEST level of sensitivity?
Which of the following is the BEST metric to measure the alignment of IT and business strategy?
What would be an IS auditor's BEST recommendation upon finding that a third-party IT service provider hosts the organization's human resources (HR) system in a foreign country?
An IS auditor is reviewing processes for importing market price data from external data providers. Which of the following findings should the auditor consider MOST critical?
During an exit meeting, an IS auditor highlights that backup cycles
are being missed due to operator error and that these exceptions
are not being managed. Which of the following is the BEST way to
help management understand the associated risk?
An IS auditor assessing the controls within a newly implemented call center would First
Which of the following BEST facilitates the legal process in the event of an incident?
An audit identified that a computer system is not assigning sequential purchase order numbers to order requests. The IS auditor is conducting an audit follow-up to determine if management has reserved this finding. Which of two following is the MOST reliable follow-up procedure?
What is the GREATEST concern for an IS auditor reviewing contracts for licensed software that executes a critical business process?
Which of the following would BEST ensure that a backup copy is available for restoration of mission critical data after a disaster''
An organization has outsourced the development of a core application. However, the organization plans to bring the support and future maintenance of the application back in-house. Which of the following findings should be the IS auditor's GREATEST concern?
Which of the following should an IS auditor expect to see in a network vulnerability assessment?
Which of the following is MOST important to ensure that electronic evidence collected during a forensic investigation will be admissible in future legal proceedings?
Which of the following BEST enables the effectiveness of an agile project for the rapid development of a new software application?
Which task should an IS auditor complete FIRST during the preliminary planning phase of a database security review?
Management receives information indicating a high level of risk associated with potential flooding near the organization's data center within the next few years. As a result, a decision has been made to move data center operations to another facility on higher ground. Which approach has been adopted?
Which of the following is the MOST efficient way to identify segregation of duties violations in a new system?
During audit framework. an IS auditor teams that employees are allowed to connect their personal devices to company-owned computers. How can the auditor BEST validate that appropriate security controls are in place to prevent data loss?
A system administrator recently informed the IS auditor about the occurrence of several unsuccessful intrusion attempts from outside the organization. Which of the following is MOST effective in detecting such an intrusion?
Which of the following should be of GREATEST concern to an IS auditor reviewing an organization's business continuity plan (BCP)?
Which of the following would BEST detect that a distributed denial of service (DDoS) attack is occurring?
During an IT general controls audit of a high-risk area where both internal and external audit teams are reviewing the same approach to optimize resources?
Which of the following provides the BEST providence that outsourced provider services are being properly managed?
Which of the following application input controls would MOST likely detect data input errors in the customer account number field during the processing of an accounts receivable transaction?
A credit card company has decided to outsource the printing of customer statements It Is MOST important for the company to verify whether:
Which of the following would BEST enable an organization to address the security risks associated with a recently implemented bring your own device (BYOD) strategy?
Which of the following is MOST important for an IS auditor to look
for in a project feasibility study?
Which of the following is the BEST evidence that an organization's IT strategy is aligned lo its business objectives?
An organization allows its employees lo use personal mobile devices for work. Which of the following would BEST maintain information security without compromising employee privacy?
Which of the following audit procedures would be MOST conclusive in evaluating the effectiveness of an e-commerce application system's edit routine?
During a security audit, an IS auditor is tasked with reviewing log entries obtained from an enterprise intrusion prevention system (IPS). Which type of risk would be associated with the potential for the auditor to miss a sequence of logged events that could indicate an error in the IPS configuration?
An IS auditor finds that the process for removing access for terminated employees is not documented What is the MOST significant risk from this observation?
Which of the following is the BEST way to mitigate the risk associated with unintentional modifications of complex calculations in end-user computing (EUC)?
An organization has made a strategic decision to split into separate operating entities to improve profitability. However, the IT infrastructure remains shared between the entities. Which of the following would BEST help to ensure that IS audit still covers key risk areas within the IT environment as part of its annual plan?
When verifying the accuracy and completeness of migrated data for a new application system replacing a legacy system. It is MOST effective for an IS auditor to review;
Which of the following is the PRIMARY reason for an IS auditor to perform a risk assessment?
Which of the following is the MOST important responsibility of data owners when implementing a data classification process?
If a source code is not recompiled when program changes are implemented, which of the following is a compensating control to ensure synchronization of source and object?
Which of the following is the MAIN responsibility of the IT steering committee?
When reviewing past results of a recurring annual audit, an IS auditor notes that findings may not have been reported and independence may not have been maintained. Which of the following is the auditor's BEST course of action?
Aligning IT strategy with business strategy PRIMARILY helps an organization to:
An IS auditor is reviewing the service agreement with a technology company that provides IT help desk services to the organization. Which of the following monthly performance
metrics is the BEST indicator of service quality?
A global organization's policy states that all workstations must be scanned for malware each day. Which of the following would provide an IS auditor with the BEST evidence of continuous compliance with this policy?
What should an IS auditor recommend to management as the MOST important action before selecting a Software as a Service (SaaS) vendor?
An IS auditor learns that an organization's business continuity plan (BCP) has not been updated in the last 18 months and that the organization recently closed a production plant. Which of the following is the auditor's BEST course of action?
An organization that operates an e-commerce website wants to provide continuous service to its customers and is planning to invest in a hot site due to service criticality. Which of the following is the MOST important consideration when making this decision?
Which of the following BEST describes the role of a document owner when implementing a data classification policy in an organization?
Which of the following should be given GREATEST consideration when implementing the use of an open-source product?
Which of the following BEST enables an organization to improve the effectiveness of its incident response team?
A bank wants to outsource a system to a cloud provider residing in another country. Which of the following would be the MOST appropriate IS audit recommendation?
When reviewing a business case for a proposed implementation of a third-party system, which of the following should be an IS auditor's GREATEST concern?
Which of the following would minimize the risk of losing transactions as a result of a disaster?
Which of the following is the BEST way for management to ensure the effectiveness of the cybersecurity incident response process?
Which of the following is an example of a preventive control for physical access?
Which of the following observations should be of GREATEST concern to an IS auditor performing an audit of change and release management controls for a new complex system developed by a small in-house IT team?
Which of the following is the MOST important consideration for patching mission critical business application servers against known vulnerabilities?
Which of the following is the BEST compensating control against segregation of duties conflicts in new code development?
Which of the following is the MOST reliable way for an IS auditor to evaluate the operational effectiveness of an organization's data loss prevention (DLP) controls?
An organization has an acceptable use policy in place, but users do not formally acknowledge the policy. Which of the following is the MOST significant risk from this finding?
An organization considering the outsourcing of a business application should FIRST:
Which of the following is MOST useful when planning to audit an organization's compliance with cybersecurity regulations in foreign countries?
An IS auditor is verifying the adequacy of an organization's internal controls and is concerned about potential circumvention of regulations. Which of the following is the BEST sampling method to use?
Which of the following should be identified FIRST during the risk assessment process?
Which type of attack poses the GREATEST risk to an organization's most sensitive data?
An IS audit reveals that an organization operating in business continuity mode during a pandemic situation has not performed a simulation test of the
business continuity plan (BCP). Which of the following is the auditor's BEST course of action?
During the review of a system disruption incident, an IS auditor notes that IT support staff were put in a position to make decisions beyond their level of authority.
Which of the following is the BEST recommendation to help prevent this situation in the future?
Which of the following is BEST used for detailed testing of a business application's data and configuration files?
An IS auditor reviewing a job scheduling tool notices performance and reliability problems. Which of the following is MOST likely affecting the tool?
An organization's IT department and internal IS audit function all report to the chief information officer (CIO). Which of the following is the GREATEST concern associated with this reporting structure?
Which of the following approaches would utilize data analytics to facilitate the testing of a new account creation process?
An IS auditor reviewing the database controls for a new e-commerce system discovers a security weakness in the database configuration. Which of the following should be the IS auditor's NEXT course of action?
An organization is disposing of removable onsite media which contains sensitive information. Which of the following is the MOST effective method to prevent disclosure of sensitive data?
An IS auditor has identified deficiencies within the organization's software development life cycle policies. Which of the following should be done NEXT?
Which of the following physical controls provides the GREATEST assurance that only authorized individuals can access a data center?
In the case of a disaster where the data center is no longer available, which of the following tasks should be done FIRST?
During audit planning, the IS audit manager is considering whether to budget for audits of entities regarded by the business as having low risk. Which of the following is the BEST course of action in this situation?
The BEST way to evaluate the effectiveness of a newly developed application is to:
Which of the following findings from a database security audit presents the GREATEST risk of critical security exposures?
An IS audit manager was temporarily tasked with supervising a project manager assigned to the organization's payroll application upgrade. Upon returning to the audit department, the audit manager has been asked to perform an audit to validate the implementation of the payroll application. The audit manager is the only one in the audit department with IT project management
experience. What is the BEST course of action?
A business has requested an audit to determine whether information stored in an application is adequately protected. Which of the following is the MOST important action before the audit work begins?
Which of the following is the MOST important control for virtualized environments?
An IS auditor is reviewing a contract for the outsourcing of IT facilities. If missing, which of the following should present the GREATEST concern to the auditor?
A national tax administration agency with a distributed network experiences service disruptions due to a large influx of traffic to a regional office near the end of each year. Which of the following would BEST enable the agency to improve the performance of its servers during the busy period?
Which of the following would the IS auditor MOST likely review to determine whether modifications to the operating system parameters were authorized?
Which of the following provides the GREATEST assurance that a middleware application compiling data from multiple sales transaction databases for forecasting is operating effectively?
In an organization's feasibility study to acquire hardware to support a new web server, omission of which of the following would be of MOST concern?
Which of the following would be of GREATEST concern to an IS auditor reviewing an IT strategy document?
A bank performed minor changes to the interest calculation computer program. Which of the following techniques would provide the STRONGEST evidence to determine whether the interest calculations are correct?
Which of the following is MOST important for the successful establishment of a security vulnerability management program?
Which of the following statements appearing in an organization's acceptable use policy BEST demonstrates alignment with data classification standards related to the protection of information assets?
Which of the following would provide the MOST important input during the planning phase for an audit on the implementation of a bring your own device (BYOD) program?
Which of the following would be of MOST concern for an IS auditor evaluating the design of an organization's incident management processes?
Which of the following is the BEST way to identify whether the IT help desk is meeting service level agreements (SLAS)?
An organization recently implemented a cloud document storage solution and removed the ability for end users to save data to their local workstation hard drives. Which of the following findings should be the IS auditor's GREATEST concern?
Which of the following Is the BEST way to ensure payment transaction data is restricted to the appropriate users?
Which of the following BEST Indicates that an incident management process is effective?
An organization has developed mature risk management practices that are followed across all departments What is the MOST effective way for the audit team to leverage this risk management maturity?
During an IT governance audit, an IS auditor notes that IT policies and procedures are not regularly reviewed and updated. The GREATEST concern to the IS auditor is that policies and procedures might not:
The performance, risks, and capabilities of an IT infrastructure are BEST measured using a:
During the implementation of a new system, an IS auditor must assess whether certain automated calculations comply with the regulatory requirements Which of the following is the BEST way to obtain this assurance?
Which of the following is the BEST source of information for an IS auditor to use as a baseline to assess the adequacy of an organization's privacy policy?
Which of the following environments is BEST used for copying data and transformation into a compatible data warehouse format?
An IS auditor is evaluating the risk associated with moving from one database management system (DBMS) to another. Which of the following would be MOST helpful to ensure the integrity of the system throughout the change?
Which of the following weaknesses would have the GREATEST impact on the effective operation of a perimeter firewall?
A project team has decided to switch to an agile approach to develop a replacement for an existing business application. Which of the following should an IS auditor do FIRST to ensure the effectiveness of the protect audit?
Which of the following BEST enables the timely identification of risk exposure?
When planning an audit to assess application controls of a cloud-based system, it is MOST important tor the IS auditor to understand the.
After the merger of two organizations, which of the following is the MOST important task for an IS auditor to perform?
Which of the following BEST demonstrates that IT strategy Is aligned with organizational goals and objectives?
Which of the following is the MOST important activity in the data classification process?
Which of the following provides the MOST assurance over the completeness and accuracy ol loan application processing with respect to the implementation of a new system?
During an exit interview, senior management disagrees with some of me facts presented m the draft audit report and wants them removed from the report. Which of the following would be the auditor's BEST course of action?
An IS auditor is reviewing an organization's primary router access control list. Which of the following should result in a finding?
In an environment that automatically reports all program changes, which of the following is the MOST efficient way to detect unauthorized changes to production programs?
In which phase of penetration testing would host detection and domain name system (DNS) interrogation be performed?
An IS auditor learns the organization has experienced several server failures in its distributed environment. Which of the following is the BEST recommendation to limit the potential impact of server failures in the future?
An organization that has suffered a cyber-attack is performing a forensic analysis of the affected users' computers. Which of the following should be of GREATEST concern for the IS auditor reviewing this process?
The PRIMARY reason for an IS auditor to use data analytics techniques is to reduce which type of audit risk?
Having knowledge in which of the following areas is MOST relevant for an IS auditor reviewing public key infrastructure (PKI)?
While conducting a follow-up on an asset management audit, the IS auditor finds paid invoices for IT devices not recorded in the organization's inventory. Which of the following is the auditor's BEST course of action?
An IS auditor notes that IT and the business have different opinions on the availability of their application servers. Which of the following should the IS auditor review FIRST in order to understand the problem?
Which of the following would lead an IS auditor to conclude that the evidence collected during a digital forensic investigation would not be admissible in court?
Which of the following is the BEST indicator of the effectiveness of signature-based intrusion detection systems (lDS)?
Which of the following activities provides an IS auditor with the MOST insight regarding potential single person dependencies that might exist within the organization?
An IS auditor is reviewing an industrial control system (ICS) that uses older unsupported technology in the scope of an upcoming audit. What should the auditor consider the MOST significant concern?
Which of the following BEST protects an organization's proprietary code during a joint-development activity involving a third party?
In an online application which of the following would provide the MOST information about the transaction audit trail?
Which of the following is the PRIMARY reason to follow a configuration management process to maintain application?
An IS auditor performs a follow-up audit and learns the approach taken by the auditee to fix the findings differs from the agreed-upon approach confirmed during the last audit. Which of the following should be the auditor's NEXT course of action?
Which of the following conditions would be of MOST concern to an IS auditor assessing the risk of a successful brute force attack against encrypted data at test?
During a follow-up audit, it was found that a complex security vulnerability of low risk was not resolved within the agreed-upon timeframe. IT has stated that the system with the identified vulnerability is being replaced and is expected to be fully functional in two months Which of the following is the BEST course of action?
During the planning stage of a compliance audit, an IS auditor discovers that a bank's inventory of compliance requirements does not include recent regulatory changes related to managing data risk. What should the auditor do FIRST?
In data warehouse (DW) management, what is the BEST way to prevent data quality issues caused by changes from a source system?
Which of the following is MOST helpful for measuring benefits realization for a new system?
While auditing a small organization's data classification processes and procedures, an IS auditor noticed that data is often classified at the incorrect level. What is the MOST effective way for the organization to improve this situation?
Which of the following metrics would BEST measure the agility of an organization's IT function?
An organization plans to receive an automated data feed into its enterprise data warehouse from a third-party service provider. Which of the following would be the BEST way to prevent accepting bad data?
The GREATEST benefit of using a polo typing approach in software development is that it helps to:
A third-party consultant is managing the replacement of an accounting system. Which of the following should be the IS auditor's GREATEST concern?
Which of the following findings should be of GREATEST concern to an IS auditor performing a review of IT operations?
Which of the following is the MOST important determining factor when establishing appropriate timeframes for follow-up activities related to audit findings?
Which of the following is MOST important to consider when scheduling follow-up audits?
Which of the following is the GREATEST risk associated with storing customer data on a web server?
Which of the following should be an IS auditor's GREATEST concern when an international organization intends to roll out a global data privacy policy?
Which of the following controls BEST ensures appropriate segregation of dudes within an accounts payable department?
Which of the following is MOST important for an IS auditor to do during an exit meeting with an auditee?
An IS auditor is reviewing the release management process for an in-house software development solution. In which environment Is the software version MOST likely to be the same as production?
When building or upgrading enterprise cryptographic infrastructure, which of the following is the MOST critical requirement for growing business environments?
Which of the following observations regarding change management should be considered the MOST serious risk by an IS auditor?
Which of the following controls is the BEST recommendation to prevent the skimming of debit or credit card data in point of sale (POS) systems?
When an intrusion into an organization's network is detected, which of the following should be done FIRST?
What should be an IS auditor's PRIMARY focus when reviewing a patch management procedure in an environment where availability is a top priority?
Management is concerned about sensitive information being intentionally or unintentionally emailed as attachments outside the organization by employees. What is the MOST important task before implementing any associated email controls?
A network analyst is monitoring the network after hours and detects activity that appears to be a brute-force attempt to compromise a critical server. After reviewing the alerts to ensure their accuracy, what should be done NEXT?
In a data center audit, an IS auditor finds that the humidity level is very low. The IS auditor would be MOST concerned because of an expected increase in:
Which of the following is the MOST important privacy consideration for an organization that uses a cloud service provider to process customer data?
An IS auditor is conducting an IT governance audit and notices many initiatives are managed informally by isolated project managers. Which of the following recommendations would have the GREATEST impact on improving the maturity of the IT team?
Which of the following is the PRIMARY purpose of a rollback plan for a system change?
An IS auditor discovers that a developer has used the same key to grant access to multiple applications making calls to an application programming interface (API). Which of the following is the BEST recommendation to address this situation?
Which of the following BEST enables an IS auditor to confirm the batch processing to post transactions from an input source is successful?
Which of the following BEST indicates that an incident management process is effective?
An organization has decided to purchase a web-based email service from a third-party vendor and eliminate its own email server infrastructure. What type of cloud computing environment would BEST meet the organization's objective?
An organization produces control reports with a desktop application that accesses data in the central production database. Which of the following would give an IS auditor concern about the reliability of these reports?
Which of the following is the GREATEST risk associated with hypervisors in virtual environments?
A mission-critical application utilizes a one-node database server. On multiple occasions, the database service has been stopped to perform routine patching, causing application outages. Which of the following should be the IS auditor’s GREATEST concern?
Which of the following BEST describes the role of the IS auditor in a control self-assessment (CSA)?
Which of the following is the MOST appropriate responsibility of an IS auditor involved in a data center renovation project?
During the course of fieldwork, an internal IS auditor observes a critical vulnerability within a newly deployed application. What is the auditor's BEST course of action?
The purpose of a checksum on an amount field in an electronic data interchange (EDI) communication of financial transactions is to ensure:
How is nonrepudiation supported within a public key infrastructure (PKI) environment?
An IS auditor is reviewing a machine learning model that predicts the likelihood that a user will watch a certain movie. Which of the following would be of GREATEST concern to the auditor?
A configuration management audit identified that predefined automated procedures are used when deploying and configuring application infrastructure in a cloud-based
environment. Which of the following is MOST important for the IS auditor to review?
Which of the following is a PRIMARY benefit of using risk assessments to determine areas to be included in an audit plan?
An organization plans to centrally decommission end-of-life databases and migrate the data to the latest model of hardware. Which of the following BEST ensures data integrity is preserved during the migration?
Which of the following should be of MOST concern to an IS auditor reviewing an organization's operational log management?
In an area susceptible to unexpected increases in electrical power, which of the following would MOST effectively protect the system?
A review of IT interface controls finds an organization does not have a process to identify and correct records that do not get transferred to the receiving system. Which of the following is the IS
auditor's BEST recommendation?
Which of the following should be the PRIMARY objective of conducting an audit follow-up of management action plans?
Which of the following is the MAIN risk associated with adding a new system functionality during the development phase without following a project change management process?
An organization is implementing a new data loss prevention (DLP) tool. Which of the following will BEST enable the organization to reduce false positive alerts?
An IS auditor is reviewing a data conversion project. Which of the following is the auditor's BEST recommendation prior to go-live?
An IS auditor finds that a number of key patches have not been applied in a timely manner due to re-source constraints. Which of the following is the GREATEST risk to the organization in this
situation?
Which of the following would an IS auditor find to be the GREATEST risk associated with the server room in a remote office location?
At the end of each business day, a business-critical application generates a report of financial transac-tions greater than a certain value, and an employee
then checks these transactions for errors. What type of control is in place?
An IT governance body wants to determine whether IT service delivery is based on consistently effective processes. Which of the following is the BEST approach?
Which of the following should be of GREATEST concern to an IS auditor assessing the effectiveness of an organization's information security governance?
Which of the following is the PRIMARY reason to involve IS auditors in the software acquisition process?