Isaca CISA Exam Questions Instant Access - No Installation Required

Question 1

An IS auditor found that a company executive is encouraging employee use of social networking sites for business purposes. Which of the following recommendations would BEST help to reduce the risk of data leakage?

ARequiring policy acknowledgment and nondisclosure agreements (NDAs) signed by employees

BEstablishing strong access controls on confidential data

CProviding education and guidelines to employees on use of social networking sites

DMonitoring employees' social networking usage

Answer : C

The best recommendation to reduce the risk of data leakage from employee use of social networking sites for business purposes is to provide education and guidelines to employees on use of social networking sites. Education and guidelines can help employees understand the benefits and risks of using social media for business purposes, such as enhancing brand awareness, engaging with customers, or sharing industry insights. They can also inform employees about the dos and don'ts of social media etiquette, such as respecting privacy, protecting intellectual property, avoiding conflicts of interest, or complying with legal obligations. Education and guidelines can also raise awareness of potential data leakage scenarios, such as phishing attacks, malicious links, fake profiles, or oversharing sensitive information, and provide tips on how to prevent or respond to them.

Question 2

An organization that has suffered a cyber-attack is performing a forensic analysis of the affected users' computers. Which of the following should be of GREATEST concern for the IS auditor reviewing this process?

AAn imaging process was used to obtain a copy of the data from each computer.

BThe legal department has not been engaged.

CThe chain of custody has not been documented.

DAudit was only involved during extraction of the Information

Answer : C

The chain of custody has not been documented is a finding that should be of greatest concern for an IS auditor reviewing a forensic analysis process of an organization that has suffered a cyber attack. The chain of custody is a record of who handled, accessed, or modified the evidence during a forensic investigation. Documenting the chain of custody is essential to preserve the integrity, authenticity, and admissibility of the evidence in a court of law. The other options are less concerning findings that may not affect the validity or reliability of the forensic analysis process.Reference:

CISAReview Manual (Digital Version), Chapter 7, Section 7.51

CISA Review Questions, Answers andExplanations Database, Question ID 220

Question 3

During an exit meeting, an IS auditor highlights that backup cycles

are being missed due to operator error and that these exceptions

are not being managed. Which of the following is the BEST way to

help management understand the associated risk?

AExplain the impact to disaster recovery.

BExplain the impact to resource requirements.

CExplain the impact to incident management.

DExplain the impact to backup scheduling.

Answer : A

The best way to help management understand the associated risk of missing backup cycles due to operator error and lack of exception management is to explain the impact to disaster recovery. Disaster recovery is the process of restoring normal operations and functions after a disruptive event, such as a natural disaster, a cyberattack, or a hardware failure. Backup cycles are essential for disaster recovery, because they ensure that the organization has copies of its critical data and systems that can be restored in case of data loss or corruption. If backup cycles are missed due to operator error, and these exceptions are not managed, the organization may not have the latest or complete backups available for disaster recovery, which can result in prolonged downtime, reduced productivity, lost revenue, reputational damage, and legal or regulatory penalties.The other options are not as effective as explaining the impact to disaster recovery, because they either do not address the risk of data loss or corruption, or they focus on operational or technical aspects rather than business outcomes.Reference:CISA Review Manual (Digital Version)1, Chapter 5, Section 5.2.1

Question 4

Which of the following is the BEST indication to an IS auditor that management's post-implementation review was effective?

ALessons learned were documented and applied.

BBusiness and IT stakeholders participated in the post-implementation review.

CPost-implementation review is a formal phase in the system development life cycle (SDLC).

DInternal audit follow-up was completed without any findings.

Answer : A

The best indication to an IS auditor that management's post-implementation review was effective is that lessons learned were documented and applied, as this shows that the management has identified and addressed the issues and gaps that arose during the implementation, and has improved the processes and practices for future projects. Business and IT stakeholders participating in the post-implementation review is a good practice, but it does not guarantee that the review was effective or that the outcomes were implemented. Post-implementation review being a formal phase in the system development life cycle (SDLC) is a requirement, but it does not ensure that the review was effective or that the outcomes were implemented.Internal audit follow-up being completed without any findings is a desirable result, but it does not indicate that the management's post-implementation review was effectiveorthat the outcomes were implemented.Reference:CISA Review Manual (Digital Version), Chapter 3: Information Systems Acquisition, Development andImplementation, Section 3.2: Project Management Practices1

Question 5

In a data center audit, an IS auditor finds that the humidity level is very low. The IS auditor would be MOST concerned because of an expected increase in:

Arisk of fire.

Bbackup tape failures.

Cstatic electricity problems.

Demployee discomfort.

Answer : C

Question 6

Which of the following is MOST helpful for understanding an organization's key driver to modernize application platforms?

AVendor software inventories

BNetwork architecture diagrams

CSystem-wide incident reports

DInventory of end-of-life software

Answer : D

Question 7

Data from a system of sensors located outside of a network is received by the open ports on a server. Which of the following is the BEST way to ensure the integrity of the data being collected from the sensor system?

ARoute the traffic from the sensor system through a proxy server.

BHash the data that is transmitted from the sensor system.

CImplement network address translation on the sensor system.

DTransmit the sensor data via a virtual private network (VPN) to the server.

Answer : B

Isaca Certified Information Systems Auditor CISA Exam Questions