Isaca Certified Information Systems Auditor CISA Exam Questions

Answer : A

Answer : C

The correct answer is C. The consolidated responsibilities do not allow for appropriate separation of duties.

The primary risk is that too many critical responsibilities are concentrated in one individual. This creates a segregation/separation of duties issue, because one person may be able to initiate, approve, implement, and monitor critical IT activities without independent review. In IT, this could allow unauthorized changes, inappropriate access, fraud, errors, or malicious actions to occur without timely detection.

ISACA defines segregation/separation of duties as a basic internal control that prevents or detects errors and irregularities by assigning incompatible responsibilities to different individuals. ISACA also notes that SoD helps ensure no single person is in a position to introduce fraudulent or malicious code without detection.

Option A is not the best answer because resource optimization may be affected, but the major control risk is excessive authority and incompatible duties. Option B is incorrect because the issue is not limited authority; the concern is too much combined authority. Option D is a valid secondary concern because succession planning may be weakened when knowledge is concentrated in one person, but CISA questions usually prioritize the control risk of inadequate separation of duties over staffing continuity concerns.

This maps mainly to Governance and Management of IT because the issue relates to organizational structure, IT governance, resource management, roles, responsibilities, and control ownership. ISACA's CISA Exam Content Outline includes organizational structure, IT governance, IT resource management, and determining whether ownership of IT risk, controls, and standards has been defined.

===================

Answer : D

The correct answer is D. Completeness testing has not been performed on the log data.

For an event log aggregation system, the auditor must first be concerned with whether the log data is complete. If completeness testing has not been performed, the organization may not know whether all required logs are being collected, whether sources are missing, whether log feeds are interrupted, or whether critical events are excluded. Incomplete log data weakens monitoring, investigation, incident response, and risk management.

Option A is a concern because non-normalized logs can make correlation and analysis more difficult. However, incomplete logs are a more fundamental problem because missing data cannot be analyzed at all. Option B may be acceptable if batch uploads meet monitoring and investigation requirements. Option C is not the best answer because DES is an outdated encryption standard, but the question is mainly about whether the aggregated log data is complete and reliable for risk management.

This maps to Information Systems Operations and Business Resilience because ISACA's CISA Exam Content Outline includes operational log management, incident/problem management, and IT operations under Domain 4.

===================

Answer : B

Machine shredding is the process of using a shredding machine to physically destroy the media and make the data unrecoverable.This is more effective than software formatting, which only erases the data logically and may leave traces that can be recovered by special tools1. Encrypting and destroying keys may prevent unauthorized access to the data, but it does not erase the data from the media.Wiping and rewriting three times is unnecessary and may reduce the lifespan of the media, especially for solid state drives2.Machine shredding is also recommended by various security standards and guidelines for media disposal345.

Answer : C

Secure coding practices are the best way to prevent cross-site scripting (XSS) attacks, because they can ensure that the web application validates and sanitizes user input and output data to prevent malicious scripts from being executed on the web browser. XSS attacks are a type of web application vulnerability that exploit the lack of input validation or output encoding in webpages that accept user input or display dynamic content.Application firewall policy settings, a three-tier web architecture, and use of common industry frameworks are not effective controlsto prevent XSS attacks, because they do not address the root cause of the vulnerability in the web application code.Reference:CISA Review Manual (Digital Version), Chapter 5, Section 5.4.2

Answer : A

The most effective way to maintain network integrity when using mobile devices is to implement network access control. Network access control is a security control that regulates and restricts access to network resources based on predefined policies and criteria, such as device type, identity, location, or security posture. Network access control can help maintain network integrity when using mobile devices by preventing unauthorized or compromised devices from accessing or affecting network systems or data. The other options are not as effective as network access control in maintaining network integrity when using mobile devices, as they do not address all aspects of network access or security. Implementing outbound firewall rules is a security control that filters and blocks network traffic based on source, destination, protocol, or port, but it does not regulate or restrict network access based on device characteristics or conditions. Performing network reviews is a monitoring activity that evaluates and reports on the performance, availability, or security of network resources, but it does not regulate or restrict network access based on device characteristics or conditions. Reviewing access control lists is a verification activity that validates and confirms the access rights and privileges of network users or devices, but it does not regulate or restrict network access based on device characteristics or conditions.Reference:CISA Review Manual (Digital Version), Chapter 5, Section 5.2.2

Answer : D

The absence of a right-to-audit clause in the outsourcing contract for a cloud service provider would be of greatest concern to an IS auditor1.This clause gives the client the right to audit the service provider's activities that are relevant to the services being provided1.It is crucial for ensuringthat the service provider is complying with the terms of the contract and meeting the client's standards for performance, security, and other aspects1.Without this clause, the client may not be able to effectively monitor and manage risks associated with the outsourcing arrangement1.

Audit rights in outsourcing: certifications and third party reports