CISA Practice Test

CISA Practice Test practice questions, page 46 of 73, with answer review and explanations.

Question 226

An employee approaches an IS auditor and expresses concern about a critical security issue in a newly installed application. Which of the following would be the MOST appropriate action for the auditor to take?

  1. Discuss the concern with audit management
  2. Recommend reverting to the previous application.
  3. Immediately conduct a review of the application.
  4. Discuss the concern with additional end users.

Question 227

An organization has outsourced its data processing function to a service provider. Which of the following would BEST determine whether the service provider continues to meet the organization's objectives?

  1. Periodic audits of controls by an independent auditor
  2. Adequacy of the service provider's insurance
  3. Assessment of the personnel training processes of the provider
  4. Review of performance against service level agreements (SLAs)

Question 228

The PRIMARY objective of value delivery in reference to IT governance is to:

  1. increase efficiency.
  2. optimize investments.
  3. ensure compliance.
  4. promote best practices.

Question 229

What is the MAIN purpose of an organization's internal IS audit function?

  1. Provide assurance to management about the effectiveness of the organization's risk management and internal controls.
  2. Identify and initiate necessary changes in the control environment to help ensure sustainable improvement.
  3. Review the organization's policies and procedures against industry best practice and standards.
  4. Independently attest the organization's compliance with applicable legal and regulatory requirements.

Question 230

Following a recent internal data breach, an IS auditor was asked to evaluate information security practices within the organization. Which of the following findings would be MOST important to report to senior management?

  1. Employees are not required to sign a non-compete agreement.
  2. Security education and awareness workshops have not been completed.
  3. Users lack technical knowledge related to security and data protection.
  4. Desktop passwords do not require special characters.