CISA Practice Test

CISA Practice Test practice questions, page 42 of 73, with answer review and explanations.

Question 206

A checksum is classified as which type of control?

  1. Preventive control
  2. Detective control
  3. Administrative control
  4. Corrective control

Question 207

During a follow-up audit, an IS auditor finds that some critical recommendations have not been addressed as management has decided to accept the risk. Which of the following is the IS auditor's BEST course of action?

  1. Adjust the annual risk assessment accordingly.
  2. Require the auditee to address the recommendations in full.
  3. Evaluate senior management's acceptance of the risk.
  4. Update the audit program based on management's acceptance of risk.

Question 208

Management has asked internal audit to prioritize and perform a specialized cybersecurity audit, but the IS audit team has no experience in this area. Which of the following is the BEST course of action?

  1. Delay the audit until the IS auditors are sufficiently trained.
  2. Delay the audit until an experienced IS auditor has been hired.
  3. Perform the audit as requested using third-party support.
  4. Perform the audit with the most experienced IS auditors.

Question 209

When implementing a new IT maturity model, which of the following should occur FIRST?

  1. Determine the model elements to be evaluated.
  2. Benchmark with industry peers.
  3. Define the target IT maturity level.
  4. Develop performance metrics.

Question 210

When reviewing an organization's information security policies, an IS auditor should verify that the policies have been defined PRIMARILY on the basis of:

  1. an information security framework.
  2. past information security incidents.
  3. a risk management process.
  4. industry best practices.