CISA Practice Test practice questions, page 55 of 73, with answer review and explanations.
Question 271
During an audit of a disaster recovery plan (DRP) for a critical business area, an IS auditor finds that not all critical systems are covered. What should the auditor do NEXT?
Evaluate the impact of not covering the systems
Escalate the finding to senior management
Evaluate the prior year's audit results regarding critical system coverage
Verify whether the systems are part of the business impact analysis (BIA)
Question 272
Due to a recent business divestiture, an organization has limited IT resources to deliver critical projects. Reviewing the IT staffing plan against which of the following would BEST guide IT management when estimating resource requirements for future projects?
Peer organization staffing benchmarks
Human resources (HR) sourcing strategy
Budgeted forecast for the next financial year
Records of actual time spent on projects
Question 273
A bank's web-hosting provider has just completed an internal IT security audit and provides only a summary of the findings to the bank's auditor. Which of the following should be the bank's GREATEST concern?
The audit scope may not have addressed critical areas.
The audit procedures are not provided to the bank.
The bank's auditors are not independent of the service provider.
The audit may be duplicative of the bank's internal audit procedures
Question 274
An incorrect version of source code was amended by a development team. This MOST likely indicates a weakness in:
change management.
project management.
incident management.
quality assurance (QA).
Question 275
An organization allows employees to retain confidential data on personal mobile devices. Which of the following is the BEST recommendation to mitigate the risk of data leakage from lost or stolen devices?
Configure to auto-wipe after multiple failed access attempts.
Require employees to attend security awareness training.