CISA Practice Test

CISA Practice Test practice questions, page 20 of 73, with answer review and explanations.

Question 96

Which of the following is the BEST control to mitigate attacks that redirect Internet traffic to an unauthorized website?

  1. Utilize a network-based firewall.
  2. Conduct regular user security awareness training.
  3. Enforce a strong password policy meeting complexity requirements.
  4. Perform domain name system (DNS) server security hardening.

Question 97

During a follow-up audit, an IS auditor learns that some key management personnel have been replaced since the original audit, and current management has decided not to implement some previously accepted recommendations. What is the auditor's BEST course of action?

  1. Retest the control.
  2. Notify the audit manager.
  3. Close the audit finding.
  4. Notify the chair of the audit committee

Question 98

An organization wants to classify database tables according to its data classification scheme. From an IS auditor's perspective, the tables should be classified based on the:

  1. specific functional contents of each single table.
  2. frequency of updates to the table.
  3. number of end users with access to the table.
  4. descriptions of column names in the table.

Question 99

Management is concerned about sensitive information being intentionally or unintentionally emailed as attachments outside the organization by employees. What is the MOST important task before implementing any associated email controls?

  1. Provide notification to employees about possible email monitoring.
  2. Develop an information classification scheme.
  3. Develop an acceptable use policy for end-user computing (EUC).
  4. Require all employees to sign nondisclosure agreements (NDAs).

Question 100

While auditing a small organization's data classification processes and procedures, an IS auditor noticed that data is often classified at the incorrect level. What is the MOST effective way for the organization to improve this situation?

  1. Conduct awareness presentations and seminars for information classification policies.
  2. Use automatic document classification based on content.
  3. Have IT security staff conduct targeted training for data owners.
  4. Publish the data classification policy on the corporate web portal.