CISA Practice Test

CISA Practice Test practice questions, page 36 of 73, with answer review and explanations.

Question 176

In the case of a disaster where the data center is no longer available, which of the following tasks should be done FIRST?

  1. Arrange for a secondary site.
  2. Analyze risk.
  3. Perform data recovery.
  4. Activate the call tree

Question 177

An organization shares some of its customers' personally identifiable information (PII) with third-party suppliers for business purposes. What is MOST important for the IS auditor to evaluate to ensure that risk associated with leakage of privacy-related data during transmission is effectively managed?

  1. Encrypting and masking of customer data
  2. The third party's privacy and data security policies
  3. Nondisclosure and indemnity agreements
  4. Service and operational level agreements

Question 178

Following an internal audit of a database, management has committed to enhance password management controls. Which of the following provides the BEST evidence that management has remediated the audit finding?

  1. Screenshots from end users showing updated password settings
  2. Interviews with management about remediation completion
  3. Change tickets of recent password configuration updates
  4. Observation of updated password settings with database administrators (DBAs)

Question 179

Reviewing project plans and status reports throughout the development life cycle will:

  1. eliminate the need to perform a risk assessment.
  2. postpone documenting the project's progress until the final phase.
  3. guarantee that the project will meet its intended deliverables.
  4. facilitate the optimal use of resources over the life of the project.

Question 180

An organization is experiencing a large number of phishing attacks targeting employees and executives following a press release announcing an acquisition. Which of the following would provide the BEST defense against these attacks?

  1. Conduct organization-wide awareness training.
  2. Deploy intrusion detection and prevention systems.
  3. Install spam filters on the acquired systems.
  4. Require signed acknowledgment of the organization's security policy.