Certified Information Systems Auditor practice questions

1. Question 1 of 25

   Which of the following should be of GREATEST concern to an IS auditor reviewing an organization's business continuity plan (BCP)?

   • AThe BCP has not been tested since it was first issued.
   • BThe BCP is not version-controlled.
   • CThe BCP's contact information needs to be updated.
   • DThe BCP has not been approved by senior management.

   Show answer

   Correct answer: A

   How others answered

   • A56%
   • D44%

   Only 56% agreed on this answer — treat it as contested rather than settled.

   Explanation

   I went to the CISA review manual to solve this, and the main concern should be the lack of testing. First: Senior management create a "business continuity policy" (Ref: Review Manual 27th edition 4.15.4). In general, senior management makes policies, and the plebs below make plans and procedures. Therefore a business continuity plan is not necessarily senior management approved. Furthermore there is a passage in the review manual (4.15.11) regarding auditing business continuity. The passage does not really mention senior management, but it does mention plan testing and obtaining historical results of tests during an audit.

   Adapted from community discussion by GenPatton · 2023-09-24 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

   1. G

      GenPatton

      2023-09-24

      Selected A11 upvotes

      I went to the CISA review manual to solve this, and the main concern should be the lack of testing. First: Senior management create a "business continuity policy" (Ref: Review Manual 27th edition 4.15.4). In general, senior management makes policies, and the plebs below make plans and procedures. Therefore a business continuity plan is not necessarily senior management approved. Furthermore there is a passage in the review manual (4.15.11) regarding auditing business continuity. The passage does not really mention senior management, but it does mention plan testing and obtaining historical results of tests during an audit.

   2. A

      AbdulQadirKhan

      2023-10-10

      9 upvotes

      Approval by Senior Management: The approval of the BCP by senior management is a fundamental step in ensuring that the BCP is considered a valid and authoritative document within the organization. Without senior management's buy-in and approval, it may not receive the necessary resources and attention it requires for effective implementation. While the other issues mentioned (A, B, and C) are important and should also be addressed, the lack of senior management approval can indicate a more significant problem with the BCP's overall effectiveness and organizational commitment to business continuity planning. This oversight may result in inadequate support, testing, or maintenance of the BCP, ultimately reducing its ability to ensure business continuity during disruptions.

   3. R

      ronniehaang

      2023-02-02

      Selected A4 upvotes

      The option that should be of greatest concern to an IS auditor reviewing an organization's business continuity plan (BCP) is A. The BCP has not been tested since it was first issued. The purpose of a BCP is to ensure that the organization can continue to operate in the event of a crisis or disruption. The effectiveness of the BCP cannot be determined unless it has been tested, and this testing is essential for identifying any weaknesses or gaps in the plan. The BCP must be able to respond quickly and effectively to minimize any damage and reduce the impact of the disruption on the business. If the BCP has not been tested since it was first issued, the IS auditor may not have confidence in the plan's ability to handle an actual crisis, and this could put the organization at risk.

   4. A

      AWS56

      2022-09-13

      Selected A4 upvotes

      As an auditor, I would check if the BCP plan has been tested. As a Enterprise/Solution Architect I would seek Sr management approval of the solution and the budget. So from a CISA perspective, my concern is whether the solution has been tested, and if not I give -1 mark. Answer: A

2. Question 2 of 25

   Which of the following is the BEST way to ensure that an application is performing according to its specifications?

   • APilot testing
   • BSystem testing
   • CIntegration testing
   • DUnit testing

   Show answer

   Correct answer: B

   How others answered

   • B52%
   • D26%
   • C22%

   Only 52% agreed on this answer — treat it as contested rather than settled.

   Explanation

   The correct answer is B. System testing. System testing is the best way to ensure that an application is performing according to its specifications because it: - Involves testing the entire application as a whole - Verifies that all components work together seamlessly - Checks that the application meets all specified requirements and functionality - Simulates real-world scenarios and user interactions Unit Testing: Checking individual components (e.g., a single brick, a window, or a door) to ensure they are defect-free and function correctly. Integration Testing: Testing how individual components work together (e.g., how the bricks are mortared together, how the windows and doors fit into the walls) to ensure a solid structure. System Testing:Inspecting the entire house (e.g., foundation, walls, roof, plumbing, electrical, HVAC) to ensure it's safe, functional, and meets building codes, simulating real-world scenarios (e.g., rain, wind, sunlight).

   Adapted from community discussion by jan1234 · 2024-09-24 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

   1. N

      NAJ_88

      2022-09-04

      8 upvotes

      the answer is D- Unit testing Unit testing uses a set of test cases that focus on the control structure of the procedural design. These tests ensure that the internal operation of the program performs according to specification.

   2. L

      Lilik

      2022-10-14

      7 upvotes

      Corrrect answear D: According to ISACA manual unit testing is: the testing of an individual program or module .unit testing uses a set of test cases that focus on the control structure of the procedural design.These tests ensure that the internal operation of the program performs according to specification.

   3. A

      Action

      2023-08-07

      Selected B4 upvotes

      Guys, pls use the voting comments pls instead of the simple comment. It helps a lot for. Thanks. Answer is C. System testing System testing involves testing the complete application as a whole to ensure that all the integrated components work together as intended and meet the specified requirements. This type of testing covers both functional and non-functional aspects of the application and aims to verify that the entire system functions correctly in different scenarios.

   4. J

      jan1234

      2024-09-24

      Selected B2 upvotes

      The correct answer is B. System testing. System testing is the best way to ensure that an application is performing according to its specifications because it: - Involves testing the entire application as a whole - Verifies that all components work together seamlessly - Checks that the application meets all specified requirements and functionality - Simulates real-world scenarios and user interactions Unit Testing: Checking individual components (e.g., a single brick, a window, or a door) to ensure they are defect-free and function correctly. Integration Testing: Testing how individual components work together (e.g., how the bricks are mortared together, how the windows and doors fit into the walls) to ensure a solid structure. System Testing:Inspecting the entire house (e.g., foundation, walls, roof, plumbing, electrical, HVAC) to ensure it's safe, functional, and meets building codes, simulating real-world scenarios (e.g., rain, wind, sunlight).

3. Question 3 of 25

   Which of the following is the GREATEST advantage of agile development over waterfall development?

   • AAgile development values working software over static documentation.
   • BAgile development values processes and tools over individuals and interactions.
   • CAgile development values contract negotiation over customer collaboration.
   • DAgile development values following a plan over responding to change.

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   The greatest advantage of agile development over waterfall development is often considered to be the emphasis on working software over static documentation. In agile development, the focus is on delivering a working product incrementally and iteratively, allowing for continuous feedback and adaptation. This approach contrasts with waterfall development, which typically involves a sequential process with extensive upfront documentation. The Agile Manifesto, a foundational document for agile development, explicitly states, "Working software over comprehensive documentation," emphasizing the importance of delivering a functional product rather than relying heavily on extensive documentation. Agile values individuals and interactions, customer collaboration, and responding to change over rigid processes, tools, contract negotiation, and following a plan.

   Adapted from community discussion by FAGFUR · 2023-11-13 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

   1. F

      FAGFUR

      2023-11-13

      Selected A5 upvotes

      The greatest advantage of agile development over waterfall development is often considered to be the emphasis on working software over static documentation. In agile development, the focus is on delivering a working product incrementally and iteratively, allowing for continuous feedback and adaptation. This approach contrasts with waterfall development, which typically involves a sequential process with extensive upfront documentation. The Agile Manifesto, a foundational document for agile development, explicitly states, "Working software over comprehensive documentation," emphasizing the importance of delivering a functional product rather than relying heavily on extensive documentation. Agile values individuals and interactions, customer collaboration, and responding to change over rigid processes, tools, contract negotiation, and following a plan.

   2. S

      SuperMax

      2023-09-30

      Selected A4 upvotes

      The GREATEST advantage of agile development over waterfall development is: A. Agile development values working software over static documentation. Agile prioritizes delivering functional software quickly and iteratively, focusing on the end product's functionality and adaptability rather than extensive upfront documentation.

   3. S

      swmasinde

      2023-02-27

      Selected A3 upvotes

      A. Agile development values working software over static documentation

   4. T

      Tsubasa1234

      2023-02-08

      3 upvotes

      Answer is A. According to agile manifesto "Working software over comprehensive documentation"

4. Question 4 of 25

   Which of the following should be the role of internal audit in an organization’s move to the cloud?

   • AIdentifying and mitigating risk to an acceptable level
   • BIdentifying impacts to organizational budgets and resources
   • CImplementing security controls for data prior to migration
   • DServing as a trusted partner and advisor

   Show answer

   Correct answer: A

   How others answered

   • A38%
   • B31%
   • D31%

   Only 38% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Because They can evaluate potential risks such as data breaches, data loss, service disruptions, and compliance issues. By identifying these risks, internal audit can work with the relevant stakeholders to develop and implement risk mitigation strategies to ensure that the risks are reduced to an acceptable level.

   Adapted from community discussion by 007Georgeo · 2023-05-15 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

   1. 0

      007Georgeo

      2023-05-15

      3 upvotes

      Because They can evaluate potential risks such as data breaches, data loss, service disruptions, and compliance issues. By identifying these risks, internal audit can work with the relevant stakeholders to develop and implement risk mitigation strategies to ensure that the risks are reduced to an acceptable level.

   2. S

      Swallows

      2024-06-23

      Selected A1 upvote

      Identifying and mitigating risk: Moving to the cloud introduces various risks related to security, compliance, data integrity, and operational continuity. Internal audit plays a crucial role in identifying these risks specific to cloud migration, assessing their potential impact on the organization, and recommending controls and mitigations to reduce these risks to an acceptable level.

   3. S

      Sibsankar

      2024-05-03

      1 upvote

      Internal audit plays a crucial role in assessing the risks associated with cloud migration, such as security, compliance, vendor lock-in, and data privacy. They can also help identify controls to mitigate these risks and ensure the organization migrates to the cloud in a secure and controlled manner. So, the right answer is A

   4. O

      OD1N

      2023-12-02

      1 upvote

      C Implementing security controls for data prior to migration

5. Question 5 of 25

   During a review of an organization's network threat response process, the IS auditor noticed that the majority of alerts were closed without resolution. Management responded that those alerts were unworkable due to lack of actionable intelligence, and therefore the support team is allowed to close them. What is the BEST way for the auditor to address this situation?

   • AFurther review closed unactioned alerts to identify mishandling of threats.
   • BReopen unactioned alerts and report to the audit committee.
   • CRecommend that management enhance the policy and improve threat awareness training.
   • DOmit the finding from the report as this practice is in compliance with the current policy.

   Show answer

   Correct answer: A

   How others answered

   • A57%
   • C43%

   Only 57% agreed on this answer — treat it as contested rather than settled.

   Explanation

   The IS auditor should review the closed unactioned alerts to determine if there was any mishandling of threats. This will help the auditor assess if the current policy and practice are effective and if there is a need for improvements in the threat response process. so answer is a

   Adapted from community discussion by SBD600 · 2023-04-26 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

   1. S

      SBD600

      2023-04-26

      6 upvotes

      The IS auditor should review the closed unactioned alerts to determine if there was any mishandling of threats. This will help the auditor assess if the current policy and practice are effective and if there is a need for improvements in the threat response process. so answer is a

   2. B

      Bankyz

      2023-07-16

      4 upvotes

      By recommending that management enhances the policy and improves threat awareness training, the auditor addresses the underlying issues. Enhancing the policy can provide clearer guidelines and expectations for handling alerts, including criteria for closure. Improving threat awareness training can better equip the support team with the knowledge and skills to evaluate alerts effectively and take appropriate action.

   3. S

      saado9

      2023-03-31

      5 upvotes

      C. Recommend that management enhance the policy and improve threat awareness training.

   4. 1

      1Naa

      2024-12-17

      Selected A1 upvote

      The auditor must verify whether the alerts truly lacked actionable intelligence or if they were improperly closed without thorough investigation. By analyzing the closed alerts, the auditor can: i.Identify potential false negatives or missed threats. ii.Assess whether the process for handling alerts is adequate and effective. iii.Determine if systemic issues exist, such as poor threat intelligence integration or inadequate training.

6. Question 6 of 25

   A national bank recently migrated a large number of business-critical applications to the cloud. Which of the following is MOST important to ensuring the resiliency of the applications?

   • AConducting periodic system stress testing
   • BNegotiating a service level agreement (SLA) with the provider
   • CUsing a monitoring tool to assess uptime
   • DCreating restore points for critical applications

   Show answer

   Correct answer: B

   How others answered

   • B80%
   • A20%

   Explanation

   In the context of ensuring the resiliency of business-critical applications migrated to the cloud, option B, "Negotiating a service level agreement (SLA) with the provider," is typically the MOST important. While all the options listed are important for application resiliency, negotiating a comprehensive SLA with the cloud provider helps establish clear expectations regarding uptime, performance, and other critical aspects of service. A well-defined SLA can provide legal guarantees and penalties for the provider if service levels are not met, which is essential for ensuring the reliability and resiliency of your applications. It serves as a contractual commitment to maintaining the required levels of availability and performance for your applications in the cloud.

   Adapted from community discussion by SuperMax · 2023-09-30 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

   1. S

      SuperMax

      2023-09-30

      Selected B2 upvotes

      In the context of ensuring the resiliency of business-critical applications migrated to the cloud, option B, "Negotiating a service level agreement (SLA) with the provider," is typically the MOST important. While all the options listed are important for application resiliency, negotiating a comprehensive SLA with the cloud provider helps establish clear expectations regarding uptime, performance, and other critical aspects of service. A well-defined SLA can provide legal guarantees and penalties for the provider if service levels are not met, which is essential for ensuring the reliability and resiliency of your applications. It serves as a contractual commitment to maintaining the required levels of availability and performance for your applications in the cloud.

   2. F

      FAGFUR

      2023-11-13

      Selected B2 upvotes

      Negotiating a service level agreement is the most crucial step for ensuring the resiliency of business-critical applications migrated to the cloud. The SLA provides a contractual basis for maintaining high levels of performance, availability, and support.

   3. Y

      Yejide03

      2024-03-24

      1 upvote

      A. Conducting periodic system stress testing. Explanation: Periodic system stress testing is crucial for assessing the performance, reliability, and resilience of business-critical applications in a cloud environment. Stress testing involves subjecting the applications to simulated high-demand scenarios or adverse conditions to identify potential weaknesses, bottlenecks, or failure points. By conducting stress tests regularly, the organization can proactively identify and address any issues that may impact the availability and performance of the applications, thereby enhancing their resiliency.

   4. S

      Sibsankar

      2024-05-03

      2 upvotes

      conducting periodic system stress testing. Stress testing specifically evaluates the robustness, scalability, and performance of applications under stress conditions, making it the most important measure for ensuring application resiliency in the context of cloud migration. It should be A

7. Question 7 of 25

   Which of the following should be an IS auditor's PRIMARY consideration when evaluating the development and design of a privacy program?

   • APolicies and procedures consistent with privacy guidelines
   • BIndustry practice and regulatory compliance guidance
   • CInformation security and incident management practices
   • DPrivacy training and awareness program for employees

   Show answer

   Correct answer: B

   How others answered

   • B75%
   • A25%

   Explanation

   The IS auditor's PRIMARY consideration when evaluating the development and design of a privacy program should be: B. Industry practice and regulatory compliance guidance While all the options listed are important aspects of a privacy program, ensuring that the program aligns with industry best practices and complies with relevant regulations is typically the top priority. This provides a strong foundation for addressing privacy concerns effectively.

   Adapted from community discussion by SuperMax · 2024-03-30 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

   1. S

      SuperMax

      2024-03-30

      Selected B2 upvotes

      The IS auditor's PRIMARY consideration when evaluating the development and design of a privacy program should be: B. Industry practice and regulatory compliance guidance While all the options listed are important aspects of a privacy program, ensuring that the program aligns with industry best practices and complies with relevant regulations is typically the top priority. This provides a strong foundation for addressing privacy concerns effectively.

   2. S

      saado9

      2023-09-21

      3 upvotes

      A. Policies and procedures consistent with privacy guidelines

   3. F

      FAGFUR

      2024-05-13

      Selected B1 upvote

      When evaluating the development and design of a privacy program, an IS auditor's PRIMARY consideration should be industry practice and regulatory compliance guidance. This involves aligning the organization's privacy program with relevant laws, regulations, and industry best practices.

   4. 3

      3008

      2024-02-16

      1 upvote

      Policies and procedures consistent with privacy guidelines should be an IS auditor's primary consideration when evaluating the development and design of a privacy program. These policies and procedures ensure that personal information is collected, used, and disclosed in accordance with legal and ethical requirements.

8. Question 8 of 25

   Which of the following is the PRIMARY objective of cyber resiliency?

   • ATo efficiently and effectively recover from an incident with limited operational impact
   • BTo prevent potential attacks or disruptions in operations
   • CTo limit the severity of security breaches and maintain continuous operations
   • DTo resume normal operations after service disruptions

   Show answer

   Correct answer: C

   How others answered

   • C71%
   • A29%

   Only 71% agreed on this answer — treat it as contested rather than settled.

   Explanation

   The PRIMARY objective of cyber resiliency is to limit the severity of security breaches and maintain continuous operations. Cyber resiliency involves not only recovering from incidents but also proactively planning and implementing measures to prevent, detect, respond to, and recover from cyber threats. It focuses on the organization's ability to adapt to and recover from adverse cyber events while maintaining essential functions and minimizing the impact on operations.

   Adapted from community discussion by FAGFUR · 2023-11-14 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

   1. F

      FAGFUR

      2023-11-14

      Selected C3 upvotes

      The PRIMARY objective of cyber resiliency is to limit the severity of security breaches and maintain continuous operations. Cyber resiliency involves not only recovering from incidents but also proactively planning and implementing measures to prevent, detect, respond to, and recover from cyber threats. It focuses on the organization's ability to adapt to and recover from adverse cyber events while maintaining essential functions and minimizing the impact on operations.

   2. K

      KAP2HURUF

      2024-01-02

      Selected C1 upvote

      B. To prevent potential attacks or disruptions in operations: This is another crucial aspect, but it's just one part of the broader goal of managing the impact of breaches. Cyber resiliency encompasses not just prevention, but also the ability to withstand and adapt to attacks that do happen.

   3. S

      saado9

      2023-05-06

      2 upvotes

      C. To limit the severity of security breaches and maintain continuous operations

   4. J

      Joloms

      2023-04-17

      1 upvote

      efinition(s): The ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources.

9. Question 9 of 25

   Due to system limitations, segregation of duties (SoD) cannot be enforced in an accounts payable system. Which of the following is the IS auditor's BEST recommendation for a compensating control?

   • ARequire written authorization for all payment transactions.
   • BReview payment transaction history.
   • CReconcile payment transactions with invoices.
   • DRestrict payment authorization to senior staff members.

   Show answer

   Correct answer: A

   How others answered

   • A60%
   • C30%

   Only 60% agreed on this answer — treat it as contested rather than settled.

   Explanation

   The correct answer is C because there is no dual control due to system limitation, the only compensating control here is to reconcile each transaction with the invoice inorder to ensure the accuracy of the transaction processed.

   Adapted from community discussion by Pauloludele · 2022-09-10 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

   1. P

      Pauloludele

      2022-09-10

      10 upvotes

      The correct answer is C because there is no dual control due to system limitation, the only compensating control here is to reconcile each transaction with the invoice inorder to ensure the accuracy of the transaction processed.

   2. N

      NoKev

      2024-08-12

      Selected A3 upvotes

      I go with A. It says there is a system limitation, meaning they will have to use what they already have. Can't assign more work or responsibility since they got no people. Hence, best option is to create a authorization system in between.

   3. T

      TranquiRelax

      2025-01-02

      Selected A1 upvote

      Reconciliation is typically a post-transaction control and might not catch fraud or errors in the payment process before the transaction is authorized. Hence the answer is A.

   4. A

      abeedfarooqui86

      2023-07-20

      2 upvotes

      They mentioned that SoD cannot be carried out, hece D cannot be the answer.

10. Question 10 of 25

    Which of the following is MOST important to define within a disaster recovery plan (DRP)?

    • ARoles and responsibilities for recovery team members
    • BTest results for backup data restoration
    • CA comprehensive list of disaster recovery scenarios and priorities
    • DBusiness continuity plan (BCP)

    Show answer

    Correct answer: C

    How others answered

    • C67%
    • A33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Option C. According to the Certified Information Systems Auditor (CISA) exam, the MOST important thing to define within a disaster recovery plan (DRP) is option C: A comprehensive list of disaster recovery scenarios and priorities. A comprehensive list of disaster recovery scenarios and priorities is critical in a disaster recovery plan (DRP) as it helps ensure that the organization is prepared to respond to a range of potential disasters effectively. The list should identify all the possible disaster scenarios that could affect the organization and their relative priorities. The list should also identify the critical systems, applications, and data that must be recovered first in the event of a disaster.

    Adapted from community discussion by SRJ13 · 2023-03-27 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

    1. S

       SRJ13

       2023-03-27

       9 upvotes

       Option C. According to the Certified Information Systems Auditor (CISA) exam, the MOST important thing to define within a disaster recovery plan (DRP) is option C: A comprehensive list of disaster recovery scenarios and priorities. A comprehensive list of disaster recovery scenarios and priorities is critical in a disaster recovery plan (DRP) as it helps ensure that the organization is prepared to respond to a range of potential disasters effectively. The list should identify all the possible disaster scenarios that could affect the organization and their relative priorities. The list should also identify the critical systems, applications, and data that must be recovered first in the event of a disaster.

    2. F

       FAGFUR

       2023-11-14

       Selected C3 upvotes

       While all the options are important components of a disaster recovery plan (DRP), defining a comprehensive list of disaster recovery scenarios and priorities is MOST important. This involves identifying potential disasters, disruptions, or incidents that could affect the organization and prioritizing them based on their impact and criticality. Understanding the potential scenarios allows the organization to develop targeted and effective strategies for recovery. It helps in prioritizing resources, defining response procedures, and ensuring that critical systems and processes are restored in a manner that aligns with the organization's priorities and business needs. Roles and responsibilities, test results, and integration with the business continuity plan (BCP) are also crucial elements, but the foundation of a DRP lies in a thorough understanding of potential disaster scenarios and the priorities associated with them.

    3. S

       SuperMax

       2023-09-30

       2 upvotes

       While all of these elements are important in a disaster recovery plan (DRP), defining a comprehensive list of disaster recovery scenarios and priorities is typically considered the MOST important. This involves identifying potential disasters, their potential impact on the organization, and establishing priorities for recovery efforts. Without a clear understanding of potential scenarios and their priorities, it becomes challenging to allocate resources, set recovery objectives, and create an effective plan. Once you have this foundation in place, you can then address roles and responsibilities, test results, and alignment with the business continuity plan (BCP).

    4. S

       Swallows

       2024-07-15

       Selected C3 upvotes

       Identifying disaster recovery scenarios and prioritizing them is essential for an effective recovery, so you know which systems and data should be prioritized for recovery.

11. Question 11 of 25

    Which of the following findings should be of MOST concern to an IS auditor assessing agile software development practices?

    • AThere is a low acceptance rate by the business of delivered software.
    • BTesting is performed by both software developers and testers.
    • CRelease plans have been revised several times before actual release.
    • DThe IT team feels unable to strictly follow standard agile practices.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Answer is A Of the options listed, the finding that should be of MOST concern to an IS auditor assessing agile software development practices is A. There is a low acceptance rate by the business of delivered software. One of the key principles of agile software development is to prioritize customer satisfaction through early and continuous delivery of working software. If the business is not accepting the delivered software, it indicates a potential misalignment between the development team and the business. This could be due to a variety of reasons, such as a lack of communication or collaboration, unclear requirements, or insufficient testing.

    Adapted from community discussion by jsalamba · 2023-08-27 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

    1. J

       jsalamba

       2023-08-27

       Selected A9 upvotes

       Answer is A Of the options listed, the finding that should be of MOST concern to an IS auditor assessing agile software development practices is A. There is a low acceptance rate by the business of delivered software. One of the key principles of agile software development is to prioritize customer satisfaction through early and continuous delivery of working software. If the business is not accepting the delivered software, it indicates a potential misalignment between the development team and the business. This could be due to a variety of reasons, such as a lack of communication or collaboration, unclear requirements, or insufficient testing.

    2. F

       FAGFUR

       2024-05-14

       Selected A2 upvotes

       An IS auditor assessing agile software development practices would be most concerned if there is a low acceptance rate by the business of delivered software. In agile development, one of the key principles is to have frequent and early interactions with stakeholders, including the business, to ensure that the delivered software meets their expectations. A low acceptance rate could indicate a misalignment between the delivered software and business needs, which may lead to inefficiencies, increased rework, and a lack of value delivery. Continuous collaboration and feedback from stakeholders, particularly the business, are essential in agile development, and a low acceptance rate suggests a potential breakdown in this critical aspect of the agile process.

    3. S

       SuperMax

       2024-03-30

       Selected A3 upvotes

       A. There is a low acceptance rate by the business of delivered software. This finding indicates a significant disconnect between the software being developed and the needs or expectations of the business. It suggests that the agile development process may not be effectively delivering value to the organization, which is a crucial concern for an IS auditor assessing the effectiveness of agile practices.

    4. S

       Sibsankar

       2024-11-04

       1 upvote

       Considering these points, finding (D) is the most concerning for an IS auditor. It suggests the team might not be reaping the benefits of Agile and could be struggling with the methodology.

12. Question 12 of 25

    Spreadsheets are used to calculate project cost estimates. Totals for each cost category are then keyed into the job-costing system. What is the BEST control to ensure that data is accurately entered into the system?

    • ADisplay back of project detail after entry
    • BReconciliation of total amounts by project
    • CReasonableness checks for each cost type
    • DValidity checks, preventing entry of character data

    Show answer

    Correct answer: B

    How others answered

    • B50%
    • D25%
    • C25%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    B. Reconciliation of total amounts by project The best control to ensure that data is accurately entered into the job-costing system after being calculated in spreadsheets is to perform a reconciliation of total amounts by project (Option B). Reconciliation involves comparing the totals from the spreadsheet calculations with the totals entered into the job-costing system. This helps identify any discrepancies or errors between the two sets of data, ensuring that the data has been accurately transferred and entered. Reconciliation provides an effective way to catch data entry mistakes and maintain the integrity of the financial information in the system.

    Adapted from community discussion by lsiau76 · 2023-08-19 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

    1. L

       lsiau76

       2023-08-19

       Selected B2 upvotes

       B. Reconciliation of total amounts by project The best control to ensure that data is accurately entered into the job-costing system after being calculated in spreadsheets is to perform a reconciliation of total amounts by project (Option B). Reconciliation involves comparing the totals from the spreadsheet calculations with the totals entered into the job-costing system. This helps identify any discrepancies or errors between the two sets of data, ensuring that the data has been accurately transferred and entered. Reconciliation provides an effective way to catch data entry mistakes and maintain the integrity of the financial information in the system.

    2. D

       Davibless

       2024-07-18

       Selected B1 upvote

       Reconciliation is a comprehensive control that verifies the overall accuracy of the data entry. It ensures that the sum of the individual entries matches the total expected amount, thereby providing a strong assurance of accuracy. While the other options provide some level of control, they do not offer the same level of comprehensive assurance: A. Display back of project detail after entry: This control allows users to review entered data but relies on manual verification and may not catch all errors. C. Reasonableness checks for each cost type: These checks can identify unusual or unexpected values but may not catch all types of data entry errors and do not verify the accuracy of the total amounts. D. Validity checks, preventing entry of character data: These checks ensure that only numerical data is entered, but they do not verify the correctness or accuracy of the data itself.

    3. 3

       3008

       2023-06-05

       4 upvotes

       Reconciliation of total amounts by project: This control involves verifying the total cost estimate calculated in the spreadsheet against the total entered into the job-costing system. By reconciling the two amounts, any discrepancies can be identified and corrected. This control provides the best assurance of data accuracy.

    4. A

       a84n

       2024-04-25

       Selected B2 upvotes

       Answer: B while reasonableness checks can catch certain types of errors, they may not detect all inaccuracies. Additionally, they rely on predefined criteria for what constitutes a "reasonable" value, which may not always capture all legitimate transactions. In contrast, reconciling total amounts by project (Option B) provides a more comprehensive validation of data accuracy. It ensures that the overall totals entered into the job-costing system match the totals calculated in the spreadsheets, which serves as a robust check on the accuracy of the data as a whole.

13. Question 13 of 25

    An IS auditor is reviewing a bank’s service level agreement (SLA) with a third-party provider that hosts the bank's secondary data center. Which of the following findings should be of GREATEST concern to the auditor?

    • AThe SLA has not been reviewed in more than a year.
    • BThe recovery time objective (RTO) has a longer duration than documented in the disaster recovery plan (DRP).
    • CThe recovery point objective (RPO) has a shorter duration than documented in the disaster recovery plan (DRP).
    • DBackup data is hosted online only.

    Show answer

    Correct answer: B

    How others answered

    • B85%
    • C15%

    Explanation

    The finding of GREATEST concern to the IS auditor in this scenario would be: B. The recovery time objective (RTO) has a longer duration than documented in the disaster recovery plan (DRP). This is a significant concern because the RTO specifies the maximum allowable downtime for the bank’s systems. If the RTO in the SLA is longer than what is documented in the disaster recovery plan, it means that in the event of a disaster, the third-party provider may not be able to meet the bank’s required downtime limits. This could potentially result in extended downtime, financial losses, and disruptions to the bank’s operations. It’s crucial for the RTO in the SLA to align with the bank’s business continuity requirements as outlined in its disaster recovery plan.

    Adapted from community discussion by SuperMax · 2023-09-30 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

    1. S

       SuperMax

       2023-09-30

       Selected B2 upvotes

       The finding of GREATEST concern to the IS auditor in this scenario would be: B. The recovery time objective (RTO) has a longer duration than documented in the disaster recovery plan (DRP). This is a significant concern because the RTO specifies the maximum allowable downtime for the bank’s systems. If the RTO in the SLA is longer than what is documented in the disaster recovery plan, it means that in the event of a disaster, the third-party provider may not be able to meet the bank’s required downtime limits. This could potentially result in extended downtime, financial losses, and disruptions to the bank’s operations. It’s crucial for the RTO in the SLA to align with the bank’s business continuity requirements as outlined in its disaster recovery plan.

    2. F

       FAGFUR

       2023-11-14

       Selected B2 upvotes

       The finding that the Recovery Time Objective (RTO) in the SLA has a longer duration than documented in the Disaster Recovery Plan (DRP) is of the GREATEST concern to the auditor. The RTO is a critical parameter that defines the maximum tolerable downtime for a system after a disruption. If the RTO in the SLA is longer than what is specified in the DRP, it may indicate a misalignment between the agreed-upon service levels and the organization's expectations for recovery time. This could lead to potential disruptions in business continuity and impact the bank's ability to recover its services within the desired timeframe in case of a disaster.

    3. P

       Pakawat

       2023-05-22

       Selected B4 upvotes

       B: RTO has a longer duration than documented in DRP. This is insufficient as in agreement doc.

    4. 3

       3008

       2023-08-19

       1 upvote

       where the recovery time objective (RTO) has a longer duration than documented in the disaster recovery plan, is also a concern, but it is not as critical as option C. The RTO is the amount of time it takes for an organization to resume normal operations after a disaster or disruption. If the RTO in the SLA is longer than what is documented in the disaster recovery plan, it means that the bank may take longer to resume normal operations, which could result in financial losses or reputational damage.

14. Question 14 of 25

    Which of the following audit procedures would provide the BEST assurance that an application program is functioning as designed?

    • AInterviewing business management
    • BUsing a continuous auditing module
    • CConfirming accounts
    • DReviewing program documentation

    Show answer

    Correct answer: D

    How others answered

    • D55%
    • B36%

    Only 55% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The best assurance that an application program is functioning as designed is often obtained through reviewing program documentation (Option D). Program documentation typically includes specifications, design documents, and other materials that outline how the application is supposed to work. By comparing the actual program behavior with the documented design and specifications, an auditor can assess whether the program is functioning as intended.

    Adapted from community discussion by FAGFUR · 2023-11-14 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

    1. J

       JONESKA

       2023-07-23

       4 upvotes

       Should be B. Continuous auditing involves the automated and ongoing monitoring of processes, transactions, and controls in real-time or near-real-time. It uses technology-based tools and techniques to continuously gather and analyze data, identify exceptions, and report on the results. This allows auditors to proactively detect anomalies, errors, or potential issues with the application program, providing timely assurance on its functionality.

    2. F

       FAGFUR

       2023-11-14

       Selected D3 upvotes

       The best assurance that an application program is functioning as designed is often obtained through reviewing program documentation (Option D). Program documentation typically includes specifications, design documents, and other materials that outline how the application is supposed to work. By comparing the actual program behavior with the documented design and specifications, an auditor can assess whether the program is functioning as intended.

    3. S

       SuperMax

       2023-10-01

       Selected D3 upvotes

       D. Reviewing program documentation. Reviewing program documentation involves examining the written documentation, specifications, flowcharts, and other materials related to the application program. This can help auditors understand the intended design and functionality of the program and compare it to the actual implementation. It allows for a thorough assessment of whether the program aligns with its intended purpose and design specifications.

    4. S

       SuperMax

       2023-10-01

       3 upvotes

       While interviewing business management (Option A) may provide some insight, it is primarily a qualitative approach and may not provide as concrete evidence as reviewing program documentation. Using a continuous auditing module (Option B) may be a useful tool but may not directly assess the program's design. Confirming accounts (Option C) is typically related to financial audits and may not directly address the functionality of an application program. Therefore, Option D is the most appropriate choice for assessing the program's functionality as designed.

15. Question 15 of 25

    Which task should an IS auditor complete FIRST during the preliminary planning phase of a database security review?

    • ADetermine which databases will be in scope.
    • BIdentify the most critical database controls.
    • CEvaluate the types of databases being used.
    • DPerform a business impact analysis (BIA).

    Show answer

    Correct answer: A

    How others answered

    • A67%
    • C33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    During the preliminary planning phase of a database security review, an IS auditor should first determine which databases will be in scope. This allows the auditor to focus their efforts on the specific databases that are relevant to the organization's security posture and objectives.

    Adapted from community discussion by SBD600 · 2023-11-04 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

    1. S

       SBD600

       2023-11-04

       8 upvotes

       During the preliminary planning phase of a database security review, an IS auditor should first determine which databases will be in scope. This allows the auditor to focus their efforts on the specific databases that are relevant to the organization's security posture and objectives.

    2. C

       crowsaint

       2024-03-18

       Selected A5 upvotes

       Setting scope is very important. After deciding on the scope, you need to find the important databases within the scope. Databases outside the scope are not important.

    3. M

       MJORGER

       2024-09-10

       3 upvotes

       C. Evaluate the types of databases being used. CISA Study Guide 27th: Tycpical Audit Process Steps bys Phase Planning Phase (Determine audit subject --> Define audit objective --> Set audit scope...)

    4. C

       ChaBum

       2024-08-25

       1 upvote

       before looking at which databases will be in scope, first understand the types of databases being used.

16. Question 16 of 25

    A bank uses a system that requires monetary amounts found on check images to be input twice by two separate individuals. The system then identifies any mismatches between the first and second input. Which type of control has the bank implemented?

    • ADetective
    • BCorrective
    • CCompensating
    • DDeterrent

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    The bank has implemented a Detective control. A Detective control is designed to discover or detect errors or discrepancies after they have occurred. In this case, the system identifies mismatches between the first and second input of monetary amounts on check images, serving as a detective control to catch discrepancies. Corrective controls are implemented to correct or remedy an issue after it has been identified, while Compensating controls offset the lack of effectiveness in other controls. Deterrent controls are implemented to discourage individuals from violating policies or procedures, often through the threat of penalties.

    Adapted from community discussion by FAGFUR · 2024-05-14 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

    1. F

       FAGFUR

       2024-05-14

       Selected A2 upvotes

       The bank has implemented a Detective control. A Detective control is designed to discover or detect errors or discrepancies after they have occurred. In this case, the system identifies mismatches between the first and second input of monetary amounts on check images, serving as a detective control to catch discrepancies. Corrective controls are implemented to correct or remedy an issue after it has been identified, while Compensating controls offset the lack of effectiveness in other controls. Deterrent controls are implemented to discourage individuals from violating policies or procedures, often through the threat of penalties.

    2. K

       KAP2HURUF

       2024-07-01

       Selected A1 upvote

       Detective Control: This is a type of control designed to identify and report errors or irregularities after they have occurred. Key verification falls into this category because it detects data entry errors after the initial entry by comparing it against a second entry. Compensating Control: A compensating control is an alternative control put in place to mitigate the risk when the primary control is deemed inadequate or is not feasible. It's essentially a backup measure, used when the preferred method of controlling a risk is too costly or complex. Compensating controls are generally used to achieve the same control objective as the primary control.

    3. K

       KAP2HURUF

       2024-07-01

       Selected A1 upvote

       Key verification is a form of detective control. It is designed to detect errors or discrepancies in data entry after the initial entry has occurred. By having data entered twice, usually by two different individuals, and then comparing the two sets of data, discrepancies can be identified and corrected. This process happens after the initial data entry error occurs, hence it is a detective control, not a preventive one.

    4. M

       marc4354345

       2024-09-04

       Selected A1 upvote

       In IaaS, the operating system is part of the infrastructure and hence under the control of the cloud provider.

17. Question 17 of 25

    Which of the following is MOST important to include in a data retention policy to reduce legal liabilities associated with information life cycle management?

    • AEnsuring that unnecessary data is not stored.
    • BReducing the cost of data storage through media sanitization.
    • CEnsuring that personal information is destroyed.
    • DRequiring that data be securely wiped so it cannot be restored for legal discovery.

    Show answer

    Correct answer: A

    How others answered

    • A89%

    Explanation

    A data retention policy is the first step in helping protect an organization’s data and avoid financial, civil, and criminal penalties that increasingly accompany poor data management practices. By ensuring that unnecessary data is not stored,

    Adapted from community discussion by 3008 · 2023-08-19 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

    1. 3

       3008

       2023-08-19

       Selected A2 upvotes

       A data retention policy is the first step in helping protect an organization’s data and avoid financial, civil, and criminal penalties that increasingly accompany poor data management practices. By ensuring that unnecessary data is not stored,

    2. K

       KAP2HURUF

       2024-01-01

       Selected A1 upvote

       In summary, while not storing unnecessary data (Option A) is a foundational principle of data management that can reduce overall legal liabilities, securely wiping data (Option D) is more directly focused on the specific legal risks associated with data discovery in legal proceedings. The choice between these options depends on the primary concern and specific context of the organization's data retention policy.

    3. S

       Swallows

       2024-07-15

       Selected A1 upvote

       Not storing unnecessary data is crucial for legal risk mitigation and compliance. By minimizing the data you store, you reduce the risk of data leakage and legal liability.

    4. S

       saado9

       2023-03-21

       2 upvotes

       why not C. Ensuring that personal information is destroyed. ?

18. Question 18 of 25

    When auditing the feasibility study of a system development project, the IS auditor should:

    • Areview the request for proposal (RFP) to ensure that it covers the scope of work.
    • Bensure that vendor contracts are reviewed by legal counsel.
    • Creview cost-benefit documentation for reasonableness.
    • Dreview qualifications of key members of the project team.

    Show answer

    Correct answer: C

    How others answered

    • C80%
    • D20%

    Explanation

    option C is the correct answer. The feasibility study of a system development project is an important phase that helps to determine whether the project is viable and worth pursuing. One key aspect of the feasibility study is the cost-benefit analysis, which assesses the potential benefits of the project against the costs and risks associated with it.

    Adapted from community discussion by Aly · 2023-05-10 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

    1. A

       Aly

       2023-05-10

       Selected C2 upvotes

       option C is the correct answer. The feasibility study of a system development project is an important phase that helps to determine whether the project is viable and worth pursuing. One key aspect of the feasibility study is the cost-benefit analysis, which assesses the potential benefits of the project against the costs and risks associated with it.

    2. F

       FAGFUR

       2023-11-14

       Selected C1 upvote

       The feasibility study typically includes an analysis of the costs and benefits associated with the proposed system development. The IS auditor should review the cost-benefit documentation to ensure that it is reasonable, accurate, and provides a sound basis for decision-making. This involves assessing the validity of cost estimates, evaluating projected benefits, and ensuring that the financial analysis aligns with industry standards and organizational goals.

    3. S

       SuperMax

       2023-10-01

       1 upvote

       C. Review cost-benefit documentation for reasonableness: This is a critical part of auditing a feasibility study. The IS auditor should assess whether the projected costs and benefits outlined in the study are reasonable and have been adequately justified. This is essential for determining the project's economic feasibility. D. Review qualifications of key members of the project team: Assessing the qualifications of key team members is important to ensure that they have the necessary expertise and experience to successfully execute the project. This is especially relevant in evaluating the project's technical feasibility.

    4. S

       SuperMax

       2023-10-01

       1 upvote

       A. Review the request for proposal (RFP) to ensure that it covers the scope of work: This is important because it ensures that the RFP accurately reflects the project's scope and requirements. Ensuring that the RFP is comprehensive and aligned with the feasibility study is a key part of the audit. B. Ensure that vendor contracts are reviewed by legal counsel: This is also crucial to ensure that the contracts are legally sound and protect the interests of the organization. While it may not be part of the feasibility study itself, reviewing contracts is an important part of project management and risk assessment.

19. Question 19 of 25

    Which of the following fire suppression systems needs to be combined with an automatic switch to shut down the electricity supply in the event of activation?

    • AFM-200
    • BDry pipe
    • CCarbon dioxide
    • DHalon

    Show answer

    Correct answer: B

    How others answered

    • B56%
    • C44%

    Only 56% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Carbon dioxide (CO2) fire suppression systems are designed to extinguish fires by reducing the level of oxygen that supports combustion. However, CO2 systems pose a significant risk to human life because they can lead to suffocation if individuals are present in the area when the system discharges. Due to this risk, CO2 systems are often used in unoccupied spaces or are designed to allow for evacuation before discharge. In addition to the risk to humans, the use of CO2 as a fire suppression agent does not remove the electrical energy that may have caused the fire, potentially allowing the fire to reignite once the CO2 has dissipated. Therefore, it's important that these systems be combined with an automatic switch to shut down the electricity supply in the event of activation. This helps ensure that the electrical source of the fire is also cut off, preventing re-ignition.

    Adapted from community discussion by mdh717 · 2024-04-08 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

    1. M

       mdh717

       2024-04-08

       2 upvotes

       Carbon dioxide (CO2) fire suppression systems are designed to extinguish fires by reducing the level of oxygen that supports combustion. However, CO2 systems pose a significant risk to human life because they can lead to suffocation if individuals are present in the area when the system discharges. Due to this risk, CO2 systems are often used in unoccupied spaces or are designed to allow for evacuation before discharge. In addition to the risk to humans, the use of CO2 as a fire suppression agent does not remove the electrical energy that may have caused the fire, potentially allowing the fire to reignite once the CO2 has dissipated. Therefore, it's important that these systems be combined with an automatic switch to shut down the electricity supply in the event of activation. This helps ensure that the electrical source of the fire is also cut off, preventing re-ignition.

    2. S

       Swallows

       2024-04-07

       Selected B1 upvote

       When the sprinkler head is activated by heat from a fire, the air in the pipe is discharged from the head, causing the pressure in the pipe to drop and water to be discharged from the sprinkler head.

    3. K

       kGiGa

       2023-08-20

       2 upvotes

       Why shoud the electricity shut down to use the Carbon dioxide?

    4. K

       kGiGa

       2023-08-20

       1 upvote

       "Carbon dioxide systems - Due to the threat to human life, it is illegal for these systems to be set to automatic release if any human may be in the area."

20. Question 20 of 25

    Which of the following would provide the BEST evidence of the effectiveness of mandated annual security awareness training?

    • ATrending of social engineering test results
    • BSurveys completed by randomly selected employees
    • CNumber of security incidents
    • DResults of a third-party penetration test

    Show answer

    Correct answer: A

    How others answered

    • A61%
    • B33%

    Only 61% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Trending social engineering test results over time provides a direct measure of how well employees are applying the security awareness training to identify and resist social engineering attacks. Monitoring the success or failure rates of simulated social engineering tests helps gauge the impact of the training on employees' ability to recognize and respond to security threats. This evidence is more specific and directly related to the training's effectiveness compared to other options such as general surveys, the number of security incidents, or third-party penetration test results.

    Adapted from community discussion by FAGFUR · 2023-11-14 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

    1. F

       FAGFUR

       2023-11-14

       Selected A6 upvotes

       Trending social engineering test results over time provides a direct measure of how well employees are applying the security awareness training to identify and resist social engineering attacks. Monitoring the success or failure rates of simulated social engineering tests helps gauge the impact of the training on employees' ability to recognize and respond to security threats. This evidence is more specific and directly related to the training's effectiveness compared to other options such as general surveys, the number of security incidents, or third-party penetration test results.

    2. K

       KAP2HURUF

       2024-07-27

       Selected A3 upvotes

       Trending of social engineering test results would provide the best evidence of the effectiveness of mandated annual security awareness training. Social engineering tests, such as phishing simulations, directly measure how well employees can recognize and respond to the types of security threats that the training is designed to address. By analyzing the trend over time, an organization can assess whether employees are improving in their ability to identify and avoid social engineering attacks, which would indicate the training's effectiveness.

    3. S

       Sibsankar

       2024-05-11

       2 upvotes

       Trending of social engineering test results provides direct feedback on how well all employees are able to recognize and respond to simulated phishing emails, malicious links, or other social engineering tactics. Other hand, randomly selected employees survey does not provide the actual result. So the answer will be A surely

    4. 3

       3008

       2023-12-09

       1 upvote

       Results of a social engineering test: A social engineering test can demonstrate the effectiveness of the training to a certain extent, but it cannot be the best evidence of the training's effectiveness. Social engineering tests are designed to evaluate the effectiveness of security controls and detect vulnerabilities, but they do not provide a comprehensive evaluation of the employees' knowledge and understanding of the security policies.

21. Question 21 of 25

    Which of the following methods BEST enforces data leakage prevention in a multi-tenant cloud environment?

    • AMonitoring tools are configured to alert in case of downtime.
    • BA comprehensive security review is performed every quarter.
    • CData for different tenants is segregated by database schema
    • DTenants are required to implement data classification policies.

    Show answer

    Correct answer: C

    How others answered

    • C90%

    Explanation

    Option C. In a multi-tenant cloud environment, where multiple tenants share the same infrastructure, it is essential to ensure that data is kept separate and secure to prevent data leakage. Segregating data by database schema is a common method for enforcing data leakage prevention in a multi-tenant cloud environment. This method involves creating separate database schemas for each tenant, ensuring that data is stored and managed separately, and access is restricted to authorized users. While monitoring tools, comprehensive security reviews, and data classification policies are all important methods for enforcing data leakage prevention, they are not as effective as segregating data by database schema in a multi-tenant cloud environment. Segregating data by database schema helps ensure that data is kept separate and secure, minimizing the risk of data leakage and protecting the confidentiality and integrity of the data.

    Adapted from community discussion by SRJ13 · 2023-09-27 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

    1. S

       SRJ13

       2023-09-27

       8 upvotes

       Option C. In a multi-tenant cloud environment, where multiple tenants share the same infrastructure, it is essential to ensure that data is kept separate and secure to prevent data leakage. Segregating data by database schema is a common method for enforcing data leakage prevention in a multi-tenant cloud environment. This method involves creating separate database schemas for each tenant, ensuring that data is stored and managed separately, and access is restricted to authorized users. While monitoring tools, comprehensive security reviews, and data classification policies are all important methods for enforcing data leakage prevention, they are not as effective as segregating data by database schema in a multi-tenant cloud environment. Segregating data by database schema helps ensure that data is kept separate and secure, minimizing the risk of data leakage and protecting the confidentiality and integrity of the data.

    2. S

       SuperMax

       2024-04-02

       Selected C3 upvotes

       In a multi-tenant cloud environment, where multiple organizations or tenants share the same infrastructure, enforcing data leakage prevention is critical to maintaining data security and privacy. Among the options provided, the method that BEST enforces data leakage prevention is: C. Data for different tenants is segregated by database schema. This approach ensures that data from different tenants is physically separated at the database schema level, reducing the risk of unauthorized access and data leakage between tenants. It provides a strong isolation mechanism to prevent data from leaking from one tenant to another. However, it's important to note that additional security measures, such as encryption, access controls, and regular security reviews, should complement this segregation to create a comprehensive security strategy.

    3. F

       FAGFUR

       2024-05-14

       Selected C4 upvotes

       In a multi-tenant cloud environment, where multiple users or tenants share the same infrastructure, it's essential to enforce data leakage prevention. Segregating data by database schema is a method that helps achieve this goal. Each tenant has its own database schema, which ensures isolation and separation of their data. This segregation helps prevent data leakage between tenants and enhances data privacy and security.

    4. K

       KAP2HURUF

       2024-06-29

       Selected C2 upvotes

       While data classification policies (option D) are important for managing and securing data, the question specifically asks about enforcing data leakage prevention in a multi-tenant cloud environment. Option C, segregating data by database schema for different tenants, is a more direct and effective method in this context. It ensures that data from different tenants is physically separated, reducing the risk of unintended data leakage between tenants in a shared environment.

22. Question 22 of 25

    An organization's security policy mandates that all new employees must receive appropriate security awareness training. Which of the following metrics would BEST assure compliance with this policy?

    • ANumber of new hires who have violated enterprise security policies
    • BPercentage of new hires that have completed the training
    • CNumber of reported incidents by new hires
    • DPercentage of new hires who report incidents

    Show answer

    Correct answer: B

    How others answered

    • B67%
    • D25%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Not that it's straight forward. But getting the question. Assure compliance to this policy is the key, thus answer is B. But C or D could be the answer if probably asking to measure the effectiveness. My guess.

    Adapted from community discussion by d43268b · 2024-11-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

    1. P

       Pauloludele

       2022-09-10

       5 upvotes

       The correct answer here is C, number of reported incidents by the new hire

    2. D

       d43268b

       2024-11-18

       2 upvotes

       Not that it's straight forward. But getting the question. Assure compliance to this policy is the key, thus answer is B. But C or D could be the answer if probably asking to measure the effectiveness. My guess.

    3. A

       Action

       2024-10-22

       Selected B1 upvote

       Guys, no need to over think or over analyze this, the correct answer is B, straight forward and clear choice.

    4. V

       veli_117

       2024-10-08

       1 upvote

       Should be D, since this is the only option, that ensures the quality or effectiveness of the training on the individual level. The total number is not valid. It needs to be ensured, that new hires understand the policy. In any case, the discussion can only be between C and D, not B.

23. Question 23 of 25

    Which of the following business continuity activities prioritizes the recovery of critical functions?

    • ABusiness impact analysis (BIA)
    • BRisk assessment
    • CBusiness continuity plan (BCP) testing
    • DDisaster recovery plan (DRP) testing

    Show answer

    Correct answer: A

    How others answered

    • A78%
    • D22%

    Explanation

    The BIA is explicitly designed to identify and prioritize critical business functions and their required recovery times. This is a strategic assessment that informs both the Business Continuity Plan (BCP) and the Disaster Recovery Plan (DRP). DRP testing is a tactical exercise that ensures the recovery procedures for IT systems work as intended. It verifies that the systems prioritized by the BIA can be recovered within the required timeframes. Again, another question I cannot agree with results

    Adapted from community discussion by analuisamoreira · 2024-06-24 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

    1. A

       analuisamoreira

       2024-06-24

       Selected A2 upvotes

       The BIA is explicitly designed to identify and prioritize critical business functions and their required recovery times. This is a strategic assessment that informs both the Business Continuity Plan (BCP) and the Disaster Recovery Plan (DRP). DRP testing is a tactical exercise that ensures the recovery procedures for IT systems work as intended. It verifies that the systems prioritized by the BIA can be recovered within the required timeframes. Again, another question I cannot agree with results

    2. M

       MichaelHoang

       2023-01-13

       Selected A3 upvotes

       A should be the answer here. BIA is used to identify the critical processes and this is the first step of creating BCP

    3. S

       Swallows

       2024-04-07

       Selected A1 upvote

       Critical functions are those that should be prioritized according to the results of the business impact analysis.

    4. D

       Davibless

       2024-07-18

       1 upvote

       Completely agree with you sentiments. Disaster recovery plan (DRP) testing tests the procedures for recovering IT systems and infrastructure but does not prioritize overall business functions without considering their criticality as identified in a BIA.

24. Question 24 of 25

    What should an IS auditor evaluate FIRST when reviewing an organization’s response to new privacy legislation?

    • AImplementation plan for restricting the collection of personal information
    • BAnalysis of systems that contain privacy components
    • CPrivacy legislation in other countries that may contain similar requirements
    • DOperational plan for achieving compliance with the legislation

    Show answer

    Correct answer: D

    How others answered

    • D63%
    • B25%

    Only 63% agreed on this answer — treat it as contested rather than settled.

    Explanation

    When reviewing an organization's response to new privacy legislation, the IS auditor should first evaluate the operational plan for achieving compliance with the legislation. The operational plan outlines the specific actions and measures that the organization intends to take to meet the requirements of the new privacy legislation. Understanding the operational plan is crucial because it provides insights into how the organization is addressing compliance, allocating resources, and implementing necessary changes to adhere to the legal requirements. It includes details about processes, controls, and timelines for achieving compliance.

    Adapted from community discussion by FAGFUR · 2023-11-14 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

    1. S

       saado9

       2023-03-29

       7 upvotes

       D. Operational plan for achieving compliance with the legislation

    2. F

       FAGFUR

       2023-11-14

       Selected D2 upvotes

       When reviewing an organization's response to new privacy legislation, the IS auditor should first evaluate the operational plan for achieving compliance with the legislation. The operational plan outlines the specific actions and measures that the organization intends to take to meet the requirements of the new privacy legislation. Understanding the operational plan is crucial because it provides insights into how the organization is addressing compliance, allocating resources, and implementing necessary changes to adhere to the legal requirements. It includes details about processes, controls, and timelines for achieving compliance.

    3. S

       SuperMax

       2023-10-02

       Selected D2 upvotes

       D. Operational plan for achieving compliance with the legislation. The operational plan outlines how the organization intends to meet the requirements of the new privacy legislation. It includes specific actions, timelines, responsible parties, and resource allocations for achieving compliance. Before diving into the technical or system-related aspects (options A and B) or exploring international legislation (option C), it's crucial to understand how the organization intends to implement and manage its compliance efforts, as this sets the foundation for the entire privacy program.

    4. K

       KAP2HURUF

       2023-12-26

       Selected D1 upvote

       The operational plan (option D) typically encompasses various aspects, including the implementation plan for specific measures like restricting the collection of personal information. By starting with the operational plan, an IS auditor gains a comprehensive overview of the organization's approach, timelines, and key strategies for compliance. It sets the stage for a more detailed examination of specific elements, such as the implementation plan mentioned in option A.

25. Question 25 of 25

    Which of the following would an IS auditor consider the GREATEST risk associated with a mobile workforce environment?

    • ALoss or damage to the organization's assets
    • BLack of compliance with organizational policies
    • CDecrease in employee productivity and accountability
    • DInability to access data remotely

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    An Information Systems (IS) auditor would consider the greatest risk associated with a mobile workforce environment to be security. A mobile workforce environment increases the risk of unauthorized access to sensitive information, loss of data due to device theft or loss, and exposure to malware and other cyber threats. To address these risks, an IS auditor would recommend implementing strong security controls such as encryption, remote wipe, and two-factor authentication to ensure the protection of sensitive information. They may also suggest conducting regular security audits and training employees on best practices for mobile device security.

    Adapted from community discussion by zebree · 2023-08-04 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • isaca.org documentation

    View community discussion3

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISA or CertExamHQ.

    1. U

       user173681972

       2023-06-15

       7 upvotes

       A as per https://www.isaca.org/resources/isaca-journal/issues/2017/volume-4/mobile-workforce-security-considerations-and-privacy#:~:text=The%20biggest%20risk%20in%20this,possession%20of%20the%20remote%20employees.

    2. Z

       zebree

       2023-08-04

       Selected A2 upvotes

       An Information Systems (IS) auditor would consider the greatest risk associated with a mobile workforce environment to be security. A mobile workforce environment increases the risk of unauthorized access to sensitive information, loss of data due to device theft or loss, and exposure to malware and other cyber threats. To address these risks, an IS auditor would recommend implementing strong security controls such as encryption, remote wipe, and two-factor authentication to ensure the protection of sensitive information. They may also suggest conducting regular security audits and training employees on best practices for mobile device security.

    3. S

       Swallows

       2024-12-08

       Selected A1 upvote

       In a mobile workforce environment, employees often use various mobile devices and access corporate resources remotely. This increases the risk of loss or damage to the organization's assets, including sensitive data, intellectual property, and physical devices. Mobile devices are more prone to loss or theft due to their portability, and if they contain sensitive corporate information, such incidents can have significant consequences for the organization, including financial losses, reputational damage, and regulatory penalties.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 1 of 25