CISA Practice Test practice questions, page 56 of 73, with answer review and explanations.
Question 276
A new regulation in one country of a global organization has recently prohibited cross-border transfer of personal data. An IS auditor has been asked to determine the organization's level of exposure in the affected country. Which of the following would be MOST helpful in making this assessment?
Identifying data security threats in the affected jurisdiction
Reviewing data classification procedures associated with the affected jurisdiction
Identifying business processes associated with personal data exchange with the affected jurisdiction
Developing an inventory of all business entities that exchange personal data with the affected jurisdiction
Question 277
When responding to an ongoing denial of service (DoS) attack, an organization's FIRST course of action should be to:
minimize impact.
investigate damage.
analyze the attack path.
restore service.
Question 278
Which of the following BEST describes an audit risk?
The financial report may contain undetected material errors.
Employees have been misappropriating funds.
The company is being sued for false accusations.
Key employees have not taken vacation for 2 years.
Question 279
In an IT organization where many responsibilities are shared, which of the following is the BEST control for detecting unauthorized data changes?
Users are required to periodically rotate responsibilities.
Segregation of duties conflicts are periodically reviewed.
Data changes are logged in an outside application.
Data changes are independently reviewed by another group.
Question 280
End users have been demanding the ability to use their own devices for work, but want to keep personal information out of corporate control. Which of the following would be MOST effective at reducing the risk of security incidents while satisfying end user requirements?