Question1: A PRIMARY benefit derived by an organization employing control self-assessment (CSA) techniques is that CSA
Question2: Which of the following is the client organization's responsibility in a Software as a Service (SaaS) environment?
Question3: Which of the following would provide the BEST evidence for use in a forensic investigation of an employee's hard drive?
Question4: Which of the following would be the BEST indicator of the effectiveness of an organization's portfolio management program?
Question5: Which of the following should be reviewed FIRST when assessing the effectiveness of an organization's network security procedures and controls?
Question6: An IS auditor finds that one employee has unauthorized access to confidential dat a. The IS auditor's BEST recommendation should be to:
Question7: Which of the following is the BEST way to mitigate the risk associated with a document storage application that has a syncing feature that could allow malware to spread to other machines in the network?
Question8: Which of the following provides the BEST method for maintaining the security of corporate applications pushed to employee-owned mobile devices?
Question9: Which of the following is a preventive control related to change management?
Question10: What should be the PRIMARY basis for scheduling a follow-up audit?
Question11: Which of the following is the MOST effective control against injection attacks on a web application?
Question12: Which of the following MOST effectively mitigates the risk of disclosure of sensitive data stored on company-owned smartphones?
Question13: An IS auditor is assessing the results of an organization's post-implementation review of a newly developed information system. Which of the following should be the auditor's MAIN focus?
Question14: Which of the following is MOST helpful for an IS auditor to review when determining the appropriateness of controls relevant to a specific audit area?
Question15: Which of the following is the MOST likely reason an organization would use Platform as a Service (PaaS)?
Question16: An organization processing high volumes of financial transactions has implemented log file analysis on a central log server to continuously monitor compliance with its fraud policy. Which of the following poses the GREATEST risk to this control?
Question17: An organization is within a jurisdiction where new regulations have recently been announced to restrict cross-border data transfer of personally identifiable information (PIl). Which of the following IT decisions will MOST likely need to be assessed in the context of this?
Question18: An IS auditor evaluating a three-tier client/server architecture observes an issue with graphical user interface (GUI) tasks. Which layer should the auditor recommend the client address?
Question19: Which of the following is the MOST important process to ensure planned IT system changes are completed in an efficient manner?
Question20: A banking organization has outsourced its customer data processing facilities to an external service provider. Which of the following roles is accountable for ensuring the security of customer data?
Question21: Which of the following approaches would BEST ensure that data protection controls are embedded into software being developed?
Question22: An organization has begun using social media to communicate with current and potential clients. Which of the following should be of PRIMARY concern to the auditor?
Question23: Which of the following poses the GREATEST security risk when implementing acquired application systems?
Question24: Which of the following is the PRIMARY benefit of performing a maturity model assessment'?
Question25: Which of the following is the MOST effective control for protecting the confidentiality and integrity of data stored unencrypted on virtual machines?
Question26: To BEST evaluate the effectiveness of a disaster recovery plan, the IS auditor should review the:
Question27: An organization offers an online information security awareness program to employees on an annual basis. Which of the following from an audit of the program should be the auditor's GREATEST concern?
Question28: A month after a company purchased and implemented system and performance monitoring software reports were too large and therefore were not reviewed or acted upon The MOST effective plan of action would be to
Question29: An IS auditor reviewing the database controls for a new e-commerce system discovers a security weakness in the database configuration. Which of the following should be the IS auditor's NEXT course of action?
Question30: Which of the following documents would be MOST useful in detecting a weakness in segregation of duties?
Question31: Which of the following is the PRIMARY reason an IS auditor should discuss observations with management before delivering a final report?
Question32: When an IS auditor evaluates key performance indicators (KPls) (or IT initiatives, it is MOST important that the KPIs indicate.
Question33: Which of the following should be included in emergency change control procedures?
Question34: An organization recently decided to send the backup of its customer relationship management (CRM) system to its cloud provider for recovery. Which of the following should be of GREATEST concern to an IS auditor reviewing this process?
Question35: An IS auditor s role in privacy and security is to:
Question36: As part of business continuity planning, which of the following is MOST important to assess when conducting a business impact analysis (BIA)?
Question37: A bank is relocating its servers to a vendor that provides data center hosting services to multiple clients. Which of the following controls would restrict other clients from physical access to the bank servers?
Question38: Which of the following is the MOST significant risk associated with peer-to-peer networking technology?
Question39: An IS auditor is reviewing database log settings and notices that only INSERT and DELETE operations are being monitored in the database. What is the MOST significant risk?
Question40: Which of the following should be an IS auditor's PRIMARY focus when developing a risk-banned IS audit program?
Question41: An IS auditor is assigned to review the IS departments quality procedures Upon contacting the IS manager, the auditor finds that there is an informal unwritten set of standards Which of the following should be the auditor's NEXT action?
Question42: Which of the following is the PRIMARY advantage of using virtualization technology for corporate applications?
Question43: Reviewing project plans and status reports throughout the development life cycle will:
Question44: An organization is acquiring a new customer relationship management (CRM) system In which of the following would the IS auditor find the MOST relevant information on projected cost savings?
Question45: Secure code reviews as part of a conbnuous deployment program are which type of control?
Question46: Which of the following is the MOST likely cause of a successful firewall penetration?
Question47: Which of the following is the BEST way to detect system security breaches?
Question48: Which of the following BEST helps to identify errors during data transfer?
Question49: Which of the following should be of concern to an IS auditor performing a software audit on virtual machines?
Question50: An IS auditor is planning on utilizing attribute sampling to determine the error rate for health care claims processed. Which of the following factors will cause the sample size to decrease?
Question51: An organization plans to receive an automated data feed into its enterprise data warehouse from a third-party service provider. Which of the following would be the BEST way to prevent accepting bad data?
Question52: Data analytics Tools are BEST suited for which of the following purposes?
Question53: Which of the following falls within the scope of an information security governance committee?
Question54: The decision to accept an IT control risk related to data quality should be the responsibility of the:
Question55: Due to budget restraints, an organization is postponing the replacement of an in-house developed mission critical application. Which of the following represents the GREATEST risk?
Question56: During a systems development project, participation in which of the following activities would compromise the IS auditor's independence?
Question57: Which of the following is the MAIN purpose of an information security management system?
Question58: Which of the following is MOST critical to include when developing a data loss prevention (DIP) policy?
Question59: Which of the following reports would provide the GREATEST assurance to an IS auditor about the controls of a third party that processes critical data for the organization?
Question60: An IS audit reveals an organization's IT department reports any deviations from its security standards to an internal IT risk committee involving IT senior management. Which of the following should be the IS auditor's GREATEST concern?
Question61: Which of the following is the MOST important difference between end-user computing (EUC) applications and traditional applications?
Question62: On a public-key cryptosystem when there is no previous knowledge between parties, which of the following will BEST help to prevent one person from using a fictitious key to impersonate someone else?
Question63: The PRIMARY reason an IS department should analyze past incidents and problems is to:
Question64: An IS auditor previously worked in an organization s IT department and was involved with the design of the business continuity plan (BCP). The IS auditor has now been asked to review this same BCP. The auditor should FIRST.
Question65: A financial institution has a system interface that is used by its branches to obtain applicable currency exchange rates when processing transactions Which of the following should be the PRIMARY control objective for maintaining the security of the system interface?
Question66: Which of the following is the BEST indication of the completeness of interface control documents used for the development of a new application?
Question67: An IS auditor is following up on prior period items and finds management did not address an audit finding. Which of the following should be the IS auditor's NEXT course of action?
Question68: Which of the following is the MOST important factor when an organization is developing information security policies and procedures?
Question69: A sales representative is reviewing the organization's feedback blog and gets redirected to a site that sells illegal prescription drugs. The blog site is MOST likely susceptible to which of the following types of attacks?
Question70: A help desk has been contacted regarding a lost business mobile device The FIRST course of action should be to
Question71: To create a digital signature in a message using asymmetric encryption, it is necessary to:
Question72: An organization is planning to re-purpose workstations mat were used to handle confidential information. Which of the following would be the IS auditor's BEST recommendation to dispose of this information?
Question73: An IS auditor is reviewing the implementation of an international quality management standard Which of the following provides the BEST evidence that quality management objectives have been achieved?
Question74: An organization performs both full and incremental database backups Which of the following will BEST enable full restoration in the event of the destruction of the data center?
Question75: Which of the following is MOST influential when defining disaster recovery strategies?
Question76: Which of the following is MOST important to ensure during computer forensics investigations?
Question77: Which of the following is a corrective control that reduces the impact of a threat event?
Question78: Which of the following should be a concern to an IS auditor reviewing a digital forensic process for a security incident?
Question79: An organization's business function wants to capture customer data and must comply with global data protection regulations. Which of the following should be considered FIRST?
Question80: An organization is using a single account shared by personnel for its social networking marketing page. Which of the following is the BEST method to maintain accountability over the account?
Question81: When reviewing backup policies, an IS auditor MUST verify that backup intervals of critical systems do not exceed which of the following?
Question82: A USB device containing sensitive production data was lost by an employee and its contents were subsequently found published online Which of the following controls is the BEST recommendation to prevent a similar recurrence?
Question83: An organization that has suffered a cyber attack is performing a forensic analysis of the affected users' computers Which of the following should be of GREATEST concern for the IS editor reviewing this process?
Question84: What is the BEST way (or an IS auditor to assess the adequacy of an expert consultant who was selected to be involved in an audit engagement?
Question85: Which of the following control techniques BEST ensures the integrity of system interface transmissions?
Question86: Which of the following should be defined in an audit chatter?
Question87: Which of the following is the GREATEST benefit of implementing an incident management process?
Question88: Which of the following is MOST important for an IS auditor to assess during a post-implementation review of a newly modified IT application developed in-house?
Question89: Which of the following is MOST important for an effective control self-assessment (CSA) program?
Question90: Which of the following is the BEST way to mitigate the impact of ransomware attacks?
Question91: An organization decides to establish a formal incident response capability with clear roles and responsibilities facilitating centralized reporting of security incidents. Which type of control is being implemented?
Question92: Data analytics tools and techniques are MOST helpful to an IS auditor during which of the following audit activities?
Question93: Which of the following strategies BEST optimizes data storage without compromising data retention practices?
Question94: Which of the following is the BEST compensating control when segregation of duties is lacking in a small IS department?
Question95: During an IT operations audit multiple unencrypted backup tapes containing sensitive credit card information cannot be found Which of the following presents the GREATEST risk to the organization?
Question96: An existing system is being replaced with a new application package User acceptance testing (UAT) should ensure that
Question97: The results of an IS audit indicating the need to strengthen controls has been communicated to the appropriate stakeholders. Which of the following is the BEST way for management to enforce implementation of the recommendations?
Question98: An organization maintains an inventory of the IT applications used by its staff Which of the following would pose the GREATEST concern with regard to the quality of the inventory data?
Question99: Capacity management enables organizations to:
Question100: Which of the following should be of GREATEST concern to an IS auditor reviewing project documentation for a client relationship management (CRM) system migration project?
Question101: A legacy application is running on an operating system that is no longer supported by vendor, if the organization continues to use the current application, which of the application should be the IS auditor's GREATEST concern?
Question102: An IS auditor has been asked to perform a post-Implementation assessment of a new corporate human resources (HR) system. Which of the following control areas would be MOST important to review for the protection of employee information?
Question103: In an environment that automatically reports all program changes. which of the following is the MOST efficient way to detect unauthorized changes to production programs?
Question104: Which of the following should be the PRIMARY consideration for IT management when selecting a new information security tool that monitors suspicious file access patterns?
Question105: Which of the following provides the MOST comprehensive understanding of an organizations information security posture?
Question106: The purpose of data migration testing is to validate data:
Question107: An IS auditor concludes that an organization has a quality security policy. Which of the following is MOST important to determine next? The policy must be:
Question108: Which of the following should be of GREATEST concern for an IS auditor reviewing an organization's bring your own device (BYOD) policy?
Question109: Which of the following represents a potential single point of failure in the virtualized environment that could result in a compromise with greater scope and impact?
Question110: Which of the following is MOST important for an IS auditor to verify during a disaster recovery audit?
Question111: Which of the following is MOST appropriate for measuring a batch processing application's system performance over time?
Question112: Which of the following is an IS auditor's BEST recommendation to mitigate the risk of eavesdropping associated with an application programming interface (API) integration implementation?
Question113: Which of the following is MOST important for an IS auditor to test when reviewing market data received from external providers?
Question114: An IS auditor attempts to sample for variables in a population of items with wide differences in values but determines that an unreasonably large number of sample items must be selected to produce the desired confidence level. In this situation, which of the following is the BEST audit decision?
Question115: An IS auditor finds that application servers had inconsistent security settings leading to potential vulnerabilities Which of the following is the BEST recommendation by the IS auditor?
Question116: Which of the following human resources management practices BEST leads to the detection of fraudulent activity?
Question117: During an audit of identity and access management, an IS auditory finds that the engagement audit plan does not include the testing of controls that regulate access by third parties. Which of the following would be the auditor's BEST course of action?
Question118: Which of the following security assessment techniques attempts to exploit a system's open ports?
Question119: Which of the following metrics would be MOST useful to an IS auditor when assessing the resilience of an application programming interface (API)?
Question120: A financial institution suspects that a manager has been crediting customer accounts without authorization. Which of the following is the MOST effective method to validate this concern?
Question121: An IS auditor is asked to provide feedback on the systems options analysis for a new project The BEST course of action for the IS auditor would be to:
Question122: Which of the following is necessary for effective risk management in IT governance?
Question123: Which of the following is MOST important for an IS auditor to consider when reviewing documentation for an organization's forensics policy?
Question124: Which of the following is MOST critical for the effective implementation of IT governance?
Question125: Which of the following security testing techniques is MOST effective in discovering unknown malicious attacks?
Question126: Which of the following is the PRIMARY purpose of using data analytics when auditing an enterprise resource planning (ERP) system for a large organization?
Question127: Which of the following is MOST important to ensure that electronic evidence collected during a forensic investigation will be admissible in future legal proceeding?
Question128: The PRIMARY advantage of object-oriented technology is enhanced:
Question129: Which of the following applications has the MOST inherent risk and should be prioritized during audit planning?
Question130: Which of the following is the GREATEST concern associated with control self-assessments (CSAs)?
Question131: An IS auditor plans to review all access attempts to a video-monitored and proximity card-controlled communications room. Which of the following would be MOST useful to the auditor?
Question132: Which of the following is the MOST effective way to identify anomalous transactions when performing a payroll fraud audit?
Question133: When auditing the closing stages of a system development project, which of the following should be the MOST important consideration?
Question134: Which of the following is a characteristic of a single mirrored data center used for disaster recovery?
Question135: Which of the following provides an IS auditor with the BEST evidence that a system has been assessed for known exploits?
Question136: An IS auditor finds that an organization's data toss prevention (DLP) system is configured to use vendor default settings to identify violations. The auditor's MAIN concern should be that:
Question137: Which of the following is MOST important for an IS auditor to verify when evaluating an organization's firewall?
Question138: Which of the following would be an IS auditor's GREATEST concern when reviewing the early stages of a software development project?
Question139: In a database management system (DBMS) normalization is used to:
Question140: Batch processes running in multiple countries are merged to one batch job to be executed in a single data center. Which of the following is the GREATEST concern with this approach?
Question141: To help determine whether a controls-reliant approach to auditing financial systems r a company should be used which sequence of IS audit work is MOST appropriate'
Question142: Which of the following is a determine security control that reduces the likelihood of an insider threat event?
Question143: Which of the following provides the MOST assurance that new information systems are ready for migration to the production environment?
Question144: An IS auditor is reviewing a network diagram. Which of the following would be the BEST location for placement of a firewall?
Question145: An online retailer is receiving customer complaints about receiving different items from what they ordered on the organization's website. The root cause has been traced to poor data quality. Despite efforts to clean erroneous data from the system, multiple data quality issues continue to occur. Which of the following recommendations would be the BEST way to reduce the likelihood of future occurrences?
Question146: Which of the following should an IS auditor be MOST concerned with when reviewing the IT asset disposal process?
Question147: Which of the following metrics would BEST measure the agility of an organization's IT function?
Question148: During business process reengineering (BPR) of a bank's teller activities, an IS auditor should evaluate:
Question149: Which of the following is MOST important to verify when implementing an organization's information security program?
Question150: After the release of an application system, an IS auditor wants to verify that the system is providing value to the organization. The auditor's BEST course of action would be to:
Question151: Which of the following is MOST likely to be included in computer operating procedures in a large data center?
Question152: Following an IS audit, which of the following types of risk would be MOST critical to communicate to key stakeholders?
Question153: Following the discovery of inaccuracies in a data warehouse, an organization has implemented data profiling, cleansing, and handling filters to enhance the quality of data obtained from c
Question154: Malicious program code was found in an application and corrected prior to release into production. After the release, the same issue was reported. Which of the following is the IS auditor's BEST recommendation?
Question155: Which of the following BEST describes the relationship between vulnerability scanning and penetration testing?
Question156: Which of the following validation techniques would BEST prevent duplicate electronic vouchers?
Question157: A third-party service provider is hosting a private cloud for an organization. Which of the following findings during an audit of the provider poses the GREATEST risk to the organization?
Question158: An organization is shifting to a remote workforce. In preparation, the IT department is performing stress and capacity testing of remote access infrastructure and systems. What type of control is being implemented?
Question159: An organization is in the process of deciding whether to allow a bring your own device (BYOD) program. If approved, which of the following should be the FIRST control required before implementation?
Question160: An IS auditor is reviewing an industrial control system (ICS) that uses older unsupported technology in the scope of an upcoming audit. What should the auditor consider the MOST significant concern?
Question161: Which of the following development practices would BEST mitigate the risk associated with theft erf user credentials transmitted between mobile devices and the corporate network?
Question162: During the planning stage of a compliance audit an IS auditor discovers that a bank's Inventory of compliance requirements does not include recent regulatory changes related to managing data risk. What should the auditor do FIRST?
Question163: Which of the following implementation strategies for new applications presents the GREATEST risk during data conversion and migration from an old system to a new system?
Question164: Which of the following should an IS auditor do FIRST when assessing the level of compliance for an organization in the banking industry?
Question165: In an environment where most IT services have been outsourced, continuity planning is BEST controlled by:
Question166: An accounts receivable data entry routine prevents the entry of the same customer with different account numbers. Which of the following is the BEST way to test if this programmed control is effective?
Question167: Which of the following BEST demonstrates the degree of alignment between IT and business strategy?
Question168: Which of the following should be done FIRST when developing a business continuity plan (BCP)?
Question169: An organization has established hiring policies and procedures designed specifically to ensure network administrators are well qualified. Which type of control is in place?
Question170: An IS auditor performing a review of a newly purchased software program notes that an escrow agreement has been executed for acquiring the source code. What is MOST important for the IS auditor to verify?
Question171: Which of the following is the BEST way to determine il IT is delivering value to the business?
Question172: A bank has implemented a new accounting system. Which of the following is the BEST lime for an IS auditor to perform a post-implementation review?
Question173: A CIO has asked an IS auditor to implement several security controls for an organization s IT processes and systems. The auditor should:
Question174: A manufacturing company is implementing application software for its sales and distribution system. Which of the following is the MOST important reason for the company to choose a centralized online database?
Question175: Which of the following development practices would BEST mitigate the risk associated with theft of user credentials transmitted between mobile devices and the corporate network?
Question176: Which of the following is the GREATEST security risk associated with data migration from a legacy human resources (HR) system to a cloud-based system''
Question177: An organization with high availability resource requirements is selecting a provider for cloud computing. Which of the following would cause the GREATEST concern to an IS auditor? The provider:
Question178: An IS auditor assessing the controls within a newly implemented call center would FIRST
Question179: A company uses a standard form to document and approve all changes in production programs. To ensure that the forms are properly authorized, which of the following is the MOST effective sampling method?
Question180: Which of the following is MOST important to review when evaluating the performance of a critical web application?
Question181: An IS auditor reviewing the use of encryption finds that the symmetric key is sent by an email message between the parties. Which of the following audit responses is correct in this situation?
Question182: During an ongoing audit management requests a briefing on the findings to date Which of the following is the IS auditor's BEST course of action? *
Question183: Which of the following is an example of a corrective control?
Question184: Which of the following is the MAIN purpose of data classification?
Question185: The PRIMARY objective of IT service level management is to.
Question186: An auditor is creating an audit program in which the objective is to establish the adequacy of personal data privacy controls in a payroll process. Which of the following would be MOST important to include?
Question187: A large insurance company is about to replace a major financial application. Which of the following is the IS auditor's PRIMARY focus when conducting the pre-implementation review?
Question188: Which of the following is the BEST way to achieve high availability and fault tolerance for an e-business system?
Question189: A user of a telephone banking system has forgotten his personal identification number (PIN), after the user has been authenticated, the BEST method of issuing a new pin is to have:
Question190: Which of the following is the PRIMARY benefit of continuous auditing?
Question191: As part of a recent business-critical initiative, an organization is re- purposing its customer dat a. However, its customers are unaware that their data is being used for another purpose. What is the BEST recommendation to address the associated data privacy risk to the organization?
Question192: An IS auditor wants to understand the collective effect of the preventive, detective, and corrective controls for a specific business process. Which of the following should the auditor focus on FIRST?
Question193: Which of the following is MOST likely to enable a hacker to successfully penetrate a system?
Question194: When removing a financial application system from production, which of the following is MOST important?2E1457D5D1DDCBD40AB3BF70D5D
Question195: An IS auditor is a member of an application development team that is selecting software. Which of the following would impair the auditor's independence?
Question196: An IS auditor conducting a follow-up audit learns that previously funded recommendations have not been implemented due to recent budget restrictions. Which of the following should the
Question197: Which of the following are examples of detective controls?
Question198: A new regulation in one country of a global organization has recently prohibited cross-border transfer of personal data. An IS auditor has been asked to determine the organization's level of exposure in the affected country. Which of the following would be MOST helpful in making this assessment?
Question199: Which of the following is a preventive control that can be used to mitigate insider threats?
Question200: An IS auditor discovers a box of hard drives in a secured location that are overdue for physical destruction. The vendor responsible for this task was never made aware of these hard drives. Which of the following is the BEST course of action to address this issue?
Question201: During an incident management audit, an IS auditor finds that several similar incidents were logged during the audit period Which of the following is the auditor's MOST important course of action?
Question202: Which of the following are BEST suited for continuous auditing?
Question203: In a typical system development life cycle (SDLC), which group is PRIMARILY responsible for confirming compliance with requirements?
Question204: An IS auditor finds that periodic reviews of read-only users for a reporting system are not being performed. Which of the following should be the IS auditor's NEXT course of action?
Question205: Which of the following is the PRIMARY reason an IS auditor should use an IT-related framework as a basis for scoping and structuring an audit?
Question206: During a review of operations, it is noted that during a batch update, an error was detected and the database initiated a roll-back. An IT operator stopped the roll-back and re-initiated the update. What should the operator have done PRIOR to re-initiating the update?
Question207: During which phase of the incident management life cycle should metrics such as "mean time to incident discovery" and "cost of recovery" be reported?
Question208: An IS auditor is observing transaction processing and notes that a high-priority update job ran out of sequence What is the MOST significant risk from this observation?
Question209: Which of the following would BEST indicate the effectiveness of a security awareness training program?
Question210: A healthcare facility offers patients health tracking devices that can be monitored remotely by healthcare professionals. Which of the following is the BEST way to protect patient personal information from unauthorized exfiltration?
Question211: During a review of a production schedule, an IS auditor observes that a staff member is not complying with mandatory operational procedures. The auditor's NEXT step should be to:
Question212: Which of the following is the PRIMARY reason for an organization's procurement processes to include an independent party who is not directly involved with business operations and related decision-making'?
Question213: Which of the following practices BEST ensures that archived electronic information of permanent importance is accessible over time?
Question214: Which of the following is the MAIN benefit of using data analytics when testing the effectiveness of controls?
Question215: Prior to the of acquired software into production, it is MOST important that the IS auditor review the:
Question216: Which of the following should be of GREATEST concern to an IS auditor testing interface controls for an associated bank wire transfer process?
Question217: What would be an IS auditor's BEST recommendation upon finding that a third-party IT service provider hosts the organization's human resources (HR) system in a foreign country?
Question218: When reviewing an organization's information security policies, an IS auditor should verify that the policies have been defined PRIMARILY on the basis of
Question219: A small financial institution is preparing to implement a check image processing system to support planned mobile banking product offerings Which of the following is MOST critical to the successful implementation of the system?
Question220: When aligning IT projects with organizational objectives, it is MOST important to ensure that the:
Question221: internal IS auditor recommends that incoming accounts payable payment files be encrypted. Which type of control is the auditor recommending?
Question222: Which of the following provides the MOST assurance over the completeness and accuracy of loan application processing with respect to the implementation of a new system?
Question223: Which of the following is the BEST development methodology to help manage project requirements in a rapidly changing environment?
Question224: The PRIMARY benefit of information asset classification is that it:
Question225: When reviewing an organization s IT governance processes, which of the following provides the BEST indication that information security expectations are being met at all levels?
Question226: Which of the following BEST enables an organization to quantify acceptable data loss in the event of a disaster?
Question227: An organization plans to launch a social media presence as part of a new customer service campaign. Which of the following is the MOST significant risk from the perspective of potential litigation?
Question228: Which of the following should be the PRIMARY basis for prioritizing follow-up audits?
Question229: An IS auditor has been asked to assess the security of a recently migrated database system that contains personal and financial data for a bank's customers. Which of the following controls is MOST important for the auditor to confirm is in place?
Question230: Which of the following would be MOST important to update once a decision has been made to outsource a critical application to a cloud service provider?
Question231: When implementing a new IT maturity model which of the following should occur FIRST?
Question232: An organization has recently implemented a Voice-over IP (VoIP) communication system. Which of the following should be the IS auditor's PRIMARY concern?
Question233: An IS auditor is reviewing a banking mobile application that allows end users to perform financial transactions. Which of the following poses a security risk to the organization?
Question234: Which of the following would be the MOST significant factor when choosing among several backup system alternatives with different restoration speeds?
Question235: Which of the following is the MOST effective way to maintain network integrity when using mobile devices?
Question236: Which of the following establishes the role of the internal audit function?
Question237: An IS auditor is evaluating a virtual server environment and teams that the production server, development server and management console are housed in the same physical host. What
Question238: Using swipe cards to limit employee access to restricted areas requires implementing which additional control?
Question239: Which of the following fire suppression systems needs to be combined with an automatic switch to shut down the electricity supply in the event of activation?
Question240: An organization's enterprise architecture (EA) department decides to change a legacy system's components while maintaining its original functionality Which of the following is MOST important for an IS auditor to understand when reviewing this decision?
Question241: While conducting a review of project plans related to a new software development, an IS auditor finds the project initiation document (PID) is incomplete. What is the BEST way for the auditor to proceed?
Question242: Which of the following is the BEST source of information for an IS auditor to use as a baseline to assess the adequacy of an organization's privacy policy?
Question243: During a review of an application system, an IS auditor identifies automated controls designed to prevent the entry of duplicate transactions. What is the BEST way to verify that the controls work as designed?
Question244: When auditing the alignment of IT to the business strategy, it is MOST important (or the IS auditor to:
Question245: An IS auditor has discovered that unauthorized customer management software was installed on a workstation. The auditor determines the software has been uploading customer data to an external party Which of the following is the IS auditor's BEST course of action?
Question246: When evaluating information security governance within an organization which of the following findings should be of MOST concern to an IS auditor?
Question247: Which of the following is the MOST effective sampling method for an IS auditor to use for identifying fraud and circumvention of regulations?
Question248: Which of the following is the BEST indicator of the effectiveness of signature-based intrusion detection systems (IDSs)?
Question249: Which of the following is MOST important to ensure when reviewing a global organization's controls to protect data held on its IT infrastructure across all of its locations?
Question250: Which of the following is an example of a control that is both detective and preventive at the same lime?
Question251: Which of the following is MOST important when implementing a data classification program?
Question252: In the case of a disaster where the data center is no longer available which of the following tasks should be done FIRST?
Question253: Which of the following would be the GREATEST risk associated with a new chat feature on a retailer's website?
Question254: An organization plans to implement a virtualization strategy enabling multiple operating systems on a single host. Which of the following should be the GREATEST concern with this strategy?
Question255: Which of the following is the FIRST step in initiating a data classification program?
Question256: Which of the following would be an IS auditor's GREATEST concern when reviewing an organization's security controls for policy compliance?
Question257: Which of the following would be of GREATEST concern to an IS auditor evaluating governance over open source development components?
Question258: Which of the following is the GREATEST risk associated with vulnerability scanning tools used to identify security weaknesses?
Question259: Which of the following findings should be of GREATEST concern to an IS auditor conducting a forensic analysis following incidents of suspicious activities on a server?
Question260: An organization has installed blade server technology in its data center. To determine whether higher cooling demands are maintained, which of the following should the IS auditor review?
Question261: An IS audit manager is preparing the starling plan for an audit engagement of a cloud service provider What should be the manager's PRIMARY concern when made aware that a new auditor in the department previous worked for this provider?
Question262: An organization's strategy to source certain IT functions from a Software as a Service (SaaS) provider should be approved by the:
Question263: Which of the following is the GREATEST advantage of application penetration testing over vulnerability scanning?
Question264: Which of the following is a detective control that can be used to uncover unauthorized access to information systems?
Question265: The GREATEST risk of database denormalization is:
Question266: Which of the following conditions would be of MOST concern to an IS auditor assessing the risk of a successful brute force attack against encrypted data at rest?
Question267: Which of the following is the BEST way to mitigate risk to an organization's network associated with devices permitted under a bring your own device (BYOD) policy?
Question268: Which of the following must be in place before an IS auditor initiates audit follow-up activities?
Question269: Which of the following should an IS auditor review FIRST when evaluating a business process for auditing?
Question270: The PRIMARY role of a control self-assessment (CSA) facilitator Is to:
Question271: What is the BEST population to select from when testing that programs are migrated to production with proper approval?
Question272: An IS auditor learns a server administration team regularly applies workarounds to address repeated failures of critical data processing services. Which of the following would BEST enable the organization to resolve this issue?
Question273: Which of the following metrics is MOST useful to an IS auditor when evaluating whether IT investments are meeting business objectives?
Question274: Which of the following is the BEST control to prevent the transfer of files to external parties through instant messaging (IM) applications?
Question275: An IS auditor is using data analytics in an audit and has obtained the data to be used for testing. Which of the following is the MOST important task before testing begins?
Question276: Which of the following would BEST detect unauthorized modification of data by a database administrator (DBA)?
Question277: Which of the following is MOST important for an IS auditor to consider during a review of the IT governance of an organization?
Question278: The IS quality assurance (OA) group is responsible for
Question279: In a high-volume, real-time system, the MOST effective technique by which to continuously monitor and analyze transaction processing is:
Question280: Which of the following is the MOST effective control to mitigate unintentional misuse of authorized access?
Question281: What information within change records would provide an IS auditor with the MOST assurance that configuration management is operating effectively?
Question282: Of the following, who should approve a release to a critical application that would make the application inaccessible for 24 hours?
Question283: An IS auditor is reviewing a data conversion project Which of the following is the auditor's BEST recommendation prior to golive?
Question284: Which of the following is the GREATEST risk associated with data conversion and migration during implementation of a new application?
Question285: Which of the following is the BEST incident of an effective problem management process?
Question286: Which of the following would be of MOST concern during an audit of an end-user computing (EUC) system containing sensitive information?
Question287: When an organization introduces virtualization into its architecture, which of the following should be an IS auditor's PRIMARY area of focus to verify adequate protection?
Question288: What is the BEST way to control updates to the vendor master file in an accounts payable system?
Question289: Within the context of an IT-related governance framework, which type of organization would be considered MOST mature?
Question290: Which of the following is the GREATEST risk associated with conducting penetration testing on a business-critical application production environment?
Question291: When is the BEST time to commence continuity planning for a new application system?
Question292: The use of cookies constitutes the MOST significant security threat when they are used for:
Question293: Which of the following should be an IS auditor's GREATEST concern when a security audit reveals the organization's vulnerability assessment approach is limited to running a vulnerability scanner on its network?
Question294: An IS auditor learns the organization has experienced several server failures in its distributed environment. Which of the following is the BEST recommendation to limit the potential Impact of server failures in the future?
Question295: A project team evaluated vendor responses to a request for proposal (RFP). An IS auditor reviewing the evaluation process would expect the team to have considered each vendor's:
Question296: An organization has agreed to perform remediation related to high-risk audit findings. The remediation process involves a complex reorganization of user roles as well as the Implementation of several compensating controls that may not be completed within the next audit cycle Which of the following is the BEST way for an IS auditor to follow up on their activities?
Question297: Which of the following processes BEST addresses the risk associated with the deployment of a new production system?
Question298: An organization recently implemented a cloud document storage solution and removed the ability for end users to save data to their local workstation hard drives Which of the following findings should be the IS auditor's GREATEST concern?
Question299: An IS auditor has obtained a large complex data set for analysis. Which of the following activities will MOST improve the output from the use of data analytics tools?
Question300: Which of the following is the PRIMARY reason for an IS auditor to select a statistical sampling method?
Question301: In a typical network architecture used for e-commerce a load balancer is normally found between the
Question302: Which of the following findings should be of MOST concern to an IS auditor reviewing an organization's business continuity plan (BCP)?
Question303: When a firewall is subjected to a probing attack, the MOST appropriate first response is for the firewall to:
Question304: When determining which IS audits to conduct during the upcoming year, internal audit has received a request from management for multiple audits of the contract division due to fraud findings during the prior year Which of the following is the BEST basis for selecting the audits to be performed?
Question305: An IS auditor reviewed the business case for a proposed investment to virtualize an organization's server infrastructure. Which of the following is MOST likely to be included among the benefits in the project proposal?
Question306: Which of the following is the BEST way to loster continuous improvement of IS audit processes and practices?
Question307: A senior auditor is reviewing work papers prepared by a junior auditor indicating that a finding was removed after the auditee said they corrected the problem. Which of the following is the senior auditor's MOST appropriate course of action?
Question308: An organization seeks to control costs related to storage media throughout the information life cycle while still meeting business and regulatory requirements. Which of the following is the BEST way to achieve this objective?
Question309: Which of the following types of testing would BEST mitigate the risk of a newly implemented system adversely impacting existing systems?
Question310: An IS auditor finds that the process for removing access for terminated employee is not documented. What is the MOST significant risk from this observation?
Question311: An IS auditor notes that application super-user activity was not recorded in system logs. What is the auditor's BEST course of action?
Question312: Which of the following should be the PRIMARY objective of a migration audit?
Question313: What is the BEST control to address SQL injection vulnerabilities?
Question314: A database audit reveals an issue with the way data ownership for client data is defined. Which of the following roles should be accountable for this finding?
Question315: The use of control totals reduces the risk of
Question316: An IS auditor is reviewing the installation of a new server. The IS auditor's PRIMARY objective is to ensure that
Question317: What would be of GREATEST concern to an IS auditor observing shared key cards being utilized to access an organization's data center?
Question318: The BEST way to determine whether programmers have permission to alter data in the production environment is by reviewing:
Question319: An IS auditor is evaluating a virtual server environment and learns that the production server, development server, and management console are housed in the same physical host. What should be the auditor's PRIMARY concern?
Question320: Which of the following is a corrective control?