Isaca CISA Certification CISA Questions & Answers

• Question 1:

  A checksum is classified as which type of control?

  A. Detective control

  B. Preventive control

  C. Corrective control

  D. Administrative control

  Correct Answer: A

• Question 2:

  An organization has an acceptable use policy in place, but users do not formally acknowledge the policy. Which of the following is the MOST significant risk from this finding?

  A. Lack of data for measuring compliance

  B. Violation of industry standards

  C. Noncompliance with documentation requirements

  D. Lack of user accountability

  Correct Answer: D

  Without formal acknowledgement of the acceptable use policy, users may not be aware of the policies and procedures that are in place and may not understand the consequences of their actions. This could lead to violations of the policy and the associated risks, such as data breaches, security violations, and financial losses.

• Question 3:

  An IS auditor observes that a business-critical application does not currently have any level of fault tolerance. Which of the following is the GREATEST concern with this situation?

  A. Degradation of services

  B. Limited tolerance for damage

  C. Decreased mean time between failures (MTBF)

  D. Single point of failure

  Correct Answer: D

• Question 4:

  Which of the following should be the FIRST consideration when deciding whether data should be moved to a cloud provider for storage?

  A. Data storage costs

  B. Data classification

  C. Vendor cloud certification

  D. Service level agreements (SLAs)

  Correct Answer: B

• Question 5:

  An IS auditor evaluating the change management process must select a sample from the change log. What is the BEST way tor the auditor to confirm the change log is complete?

  A. Interview change management personnel about completeness.

  B. Take an item from the log and trace it back to the system.

  C. Obtain management attestation of completeness.

  D. Take the last change from the system and trace it back to the log.

  Correct Answer: D

  Taking the last change from the system and tracing it back to the log is the best way for the auditor to confirm the change log is complete, because:

  It verifies that the most recent change made to the system is recorded and documented in the change log, which implies that the change log is up to date and accurate12. It tests the effectiveness of the change management process and

  controls that ensure that all changes made to the system are authorized, approved, tested, implemented, and monitored123. It provides evidence of the traceability and accountability of the change management process and personnel, which can help the auditor identify any gaps, errors, or risks in the process123.

• Question 6:

  Which of the following is the MOST effective control to mitigate against the risk of inappropriate activity by employees?

  A. User activity monitoring

  B. Two-factor authentication

  C. Network segmentation

  D. Access recertification

  Correct Answer: A

  The most effective control to mitigate against the risk of inappropriate activity by employees is A. User activity monitoring. User activity monitoring (UAM) is a control that can be used to identify and monitor any suspicious or inappropriate user

  activity, such as unauthorized access or data manipulation. UAM can also be used to detect insider threats and detect any malicious activity that could lead to security breaches.

  Reference: ISACA CISA Study Manual, section 3.3.3.3.

• Question 7:

  An IS auditor should look for which of the following to ensure the risk associated with scope creep has been mitigated during software development?

  A. Source code version control

  B. Project change management controls

  C. Existence of an architecture review board

  D. Configuration management

  Correct Answer: B

  Based on the information provided, the IS auditor should look for B: Project change management controls to ensure the risk associated with scope creep has been mitigated during software development. Project change management controls ensure that any changes made to the project are properly documented, communicated, and approved by the appropriate personnel. This helps to ensure that changes to the project are tracked and managed and that the project remains within its originally defined scope. Additionally, project change management controls help to ensure that any changes made are in line with the organization's goals and objectives.

• Question 8:

  An IS auditor is reviewing an organization's business continuity plan (BCP) following a change in organizational structure with significant impact to business processes. Which of the following findings should be the auditor's GREATEST concern?

  A. Key business process end users did not participate in the business impact " analysis (BIA)

  B. Copies of the BCP have not been distributed to new business unit end users sjnce the reorganization

  C. A test plan for the BCP has not been completed during the last two years

  Correct Answer: C

• Question 9:

  Which of the following is the BEST way to address potential data privacy concerns associated with inadvertent disclosure of machine identifier information contained within security logs?

  A. Unit the use of logs to only those purposes for which they were collected

  B. Restrict the transfer of log files from host machine to online storage

  C. Only collect logs from servers classified as business critical

  D. Limit log collection to only periods of increased security activity

  Correct Answer: A

• Question 10:

  The BEST way to prevent fraudulent payments is to implement segregation of duties between the vendor setup and:

  A. payment processing.

  B. payroll processing.

  C. procurement.

  D. product registration.

  Correct Answer: A

  Explanation: The best way to prevent fraudulent payments is to implement segregation of duties between the vendor setup and payment processing. Segregation of duties is an important control measure used to mitigate the risks associated with fraud and errors. By separating the processes of vendor setup and payment processing, it ensures that no single individual has control over both activities, and thereby reduces the risk of fraudulent payments. Additionally, other measures such as dual authorization and automated controls can be used to further reduce the risk.