September Monthly Meet

During an incident management audit, an IS auditor finds that several similar incidents were logged during the audit period Which of the following is the auditor's MOST important course of action?

• Document the finding and present it to management

• Determine if a root cause analysis was conducted

• Confirm the resolution time of the incidents

• Validate whether all incidents have been actioned

Which of the following is the BEST performance indicator for the effectiveness of an incident management program?

• Incident alert meantime

• Number of incidents reported

• Average time between incidents

• Incident resolution meantime

An IS audit reveals that an organization is not proactively addressing known vulnerabilities. Which of the following should the IS auditor recommend the organization do FIRST?

• Ensure the intrusion prevention system (IPS) is effective

• Verify the disaster recovery plan (DRP) has been tested

• Assess the security risks to the business

• Confirm the incident response team understands the issue

During an internal audit of automated controls, an IS auditor identifies that the integrity of data transfer between systems has not been tested since successful implementation two years ago.

Which of the following should the auditor do NEXT?

• Review previous system interface testing records

• Document the finding in the audit report

• Review relevant system changes

• Review IT testing policies and procedures

Which of the following provides the MOST comprehensive understanding of an organizations information security posture?

• Risk management metrics

• External audit findings

• Results of vulnerability assessments

• The organizations security incident trends

When auditing the security architecture of an online application, an IS auditor should FIRST review the:

• location of the firewall within the network

• firewall standards

• firmware version of the firewall

• configuration of the firewall

What is the MAIN reason to use incremental backups?

• To increase backup resiliency and redundancy

• To reduce costs associates with backups

• To improve key availability metrics

• To minimize the backup time and resources

Which of the following should an IS auditor be MOST concerned with during a post-implementation review?

• The system does not have a maintenance plan

• The system contains several minor defects

• The system deployment was delayed by three weeks

• The system was over budget by 15%

Which of the following is the PRIMARY basis on which audit objectives are established?

• Audit risk

• Consideration of risks

• Assessment of prior audits

• Business strategy

Online banking transactions are being posted to the database when processing suddenly comes to a halt. The integrity of the transaction processing is BEST ensured by:

• Database integrity checks

• Validation checks

• Input controls

• Database commits and rollbacks