Isaca CISA Certification CISA Questions & Answers

• Question 41:

  Which of the following should be considered when examining fire suppression systems as part of a data center environmental controls review?

  A. Installation manuals

  B. Onsite replacement availability

  C. Insurance coverage

  D. Maintenance procedures

  Correct Answer: D

• Question 42:

  When planning an audit, it is acceptable for an IS auditor to rely on a third-party providers external audit report on service level management when the

  A. scope and methodology meet audit requirements

  B. service provider is independently certified and accredited

  C. report confirms that service levels were not violated

  D. report was released within the last 12 months

  Correct Answer: A

• Question 43:

  Which of the following should be done FIRST to minimize the risk of unstructured data?

  A. Identify repositories of unstructured data.

  B. Purchase tools to analyze unstructured data.

  C. Implement strong encryption for unstructured data.

  D. Implement user access controls to unstructured data.

  Correct Answer: A

  Explanation: Based on the information provided, the first step to minimize the risk of unstructured data should be to A: Identify repositories of unstructured data. Unstructured data can present a significant security risk if not managed properly, so it is important to identify where it is stored and who has access to it. Once the repositories of unstructured data have been identified, additional steps can be taken to protect it, such as implementing strong encryption and user access controls, and purchasing tools to analyze it.

• Question 44:

  Which of the following should be an IS auditor's GREATEST concern when a data owner assigns an incorrect classification level to data?

  A. Controls to adequately safeguard the data may not be applied.

  B. Data may not be encrypted by the system administrator.

  C. Competitors may be able to view the data.

  D. Control costs may exceed the intrinsic value of the IT asset.

  Correct Answer: A

  Explanation: According to the ISACA CISA Study Manual (2020), "incorrectly classifying information or not implementing adequate controls to protect the information is a major risk" (p. 328). Therefore, the IS auditor's greatest concern should be that controls to adequately safeguard the data may not be applied.

• Question 45:

  Which of the following should be of MOST concern to an IS auditor reviewing the information systems acquisition, development, and implementation process?

  A. Data owners are not trained on the use of data conversion tools.

  B. A post-implementation lessons-learned exercise was not conducted.

  C. There is no system documentation available for review.

  D. System deployment is routinely performed by contractors.

  Correct Answer: B

  It is important for an IS auditor to review the information systems acquisition, development, and implementation process to ensure that it has been performed properly and that any errors or issues have been identified and addressed. A lessons-learned exercise is an important part of this process, as it allows for the identification and rectification of any issues that may have been missed during the initial stages of the process. Without this exercise, any potential issues may go unnoticed and lead to further problems down the line.

• Question 46:

  Capacity management tools are PRIMARILY used to ensure that:

  A. available resources are used efficiently and effectively

  B. computer systems are used to their maximum capacity most of the time

  C. concurrent use by a large number of users is enabled

  D. proposed hardware acquisitions meet capacity requirements

  Correct Answer: A

• Question 47:

  When assessing a proposed project for the two-way replication of a customer database with a remote call center, the IS auditor should ensure that:

  A. database conflicts are managed during replication.

  B. end users are trained in the replication process.

  C. the source database is backed up on both sites.

  D. user rights are identical on both databases.

  Correct Answer: A

  Explanation: When assessing a proposed project for the two-way replication of a customer database with a remote call center, the IS auditor should ensure that database conflicts are managed during replication. This should include verifying that the replication process is designed to reconcile any discrepancies between the databases, such as conflicting data or duplicate records. Additionally, the IS auditor should review the security and access controls in place to ensure that the replications are performed securely and only authorized users have access to the replicated data.

• Question 48:

  Which of the following provides the BEST audit evidence that a firewall is configured in compliance with the organization's security policy?

  A. Analyzing how the configuration changes are performed

  B. Analyzing log files

  C. Reviewing the rule base

  D. Performing penetration testing

  Correct Answer: C

• Question 49:

  An IS auditor finds a segregation of duties issue in an enterprise resource planning (ERP) system. Which of the following is the BEST way to prevent the misconfiguration from recurring?

  A. Monitoring access rights on a regular basis

  B. Referencing a standard user-access matrix

  C. Granting user access using a role-based model

  D. Correcting the segregation of duties conflicts

  Correct Answer: C

  An effective way to prevent segregation of duties issues in an enterprise resource planning (ERP) system is to grant user access using a role-based model. This means that access to systems and applications is based on the role or job

  function of the user. This helps to enforce appropriate segregation of duties, so that critical tasks are not performed by the same individual, reducing the risk of fraud or other security breaches. A role-based model allows for the efficient and

  effective management of user access rights, helping to ensure that the system is properly configured and secured.

  Reference:

  ISACA. (2021). 2021 CISA Review Manual, 27th Edition. ISACA. (Chapter 7, Security Administration)

• Question 50:

  An IS auditor learns a server administration team regularly applies workarounds to address repeated failures of critical data processing services Which of the following would BEST enable the organization to resolve this issue?

  A. Problem management

  B. Incident management

  C. Service level management

  D. Change management

  Correct Answer: B