CISA Practice Exam

Which of the following processes will be MOST effective in reducing the risk that unauthorized software on a backup server is distributed to a production server?

• Manually copy files to accomplish replication

• Review changes in the software version control system.

• Ensure that developers do not have access to the backup server

• Review the access control log of the backup server

While performing an audit of an accounting application’s internal data integrity controls, an information systems (IS) auditor identifies a major control deficiency in the change management software supporting the accounting application. The MOST appropriate action for the IS auditor to take is to:

• continue to test the accounting application controls and inform the IT manager about the control deficiency and recommend possible solutions.

• complete the audit and not report the control deficiency because it is not part of the audit scope.

• continue to test the accounting application controls and include the deficiency in the final report.

• cease all audit activity until the control deficiency is resolved

When reviewing a hardware maintenance program, an information systems (IS) auditor should assess whether:

• the schedule of all unplanned maintenance is maintained

• it is in line with historical trends

• it has been approved by the IS steering committee

• the program is validated against vendor specifications

When reviewing the desktop software compliance of an organization, the information systems (IS) auditor should be MOST concerned if the installed software:

• is installed, but not documented in the IT department records

• is being used by users not properly trained in its use

• is not listed in the approved software standards document

• has a license that will expire in the next 15 days

When an employee is terminated from service, the MOST important action is to:

• hand over all of the employee’s files to another designated employee

• complete a backup of the employee’s work

• notify other employees of the termination

• disable the employee’s logical access

While evaluating software development practices in an organization, an information systems (IS) auditor notes that the quality assurance (QA) function reports to project management. The MOST important concern for an IS auditor is the:

• effectiveness of the QA function because it should interact between project management and user management.

• efficiency of the QA function because it should interact with the project implementation team.

• effectiveness of the project manager because the project manager should interact with the QA function

• efficiency of the project manager because the QA function needs to communicate with the project implementation team.

Change control for business application systems being developed using prototyping can be complicated by the:

• iterative nature of prototyping

• rapid pace of modifications in requirements and design

• emphasis on reports and screens

• lack of integrated tools

During an information systems (IS) audit of the disaster recovery plan of a global enterprise, the auditor observes that some remote offices have very limited local IT resources. Which of the following observations is the MOST critical for the IS auditor?

• A test has not been made to ensure that local resources can maintain security and service standards when recovering from a disaster or incident.

• The corporate business continuity plan (BCP) plan does not accurately document the systems that exist at remote offices.

• Corporate security measures have not been incorporated into the test plan

• A test has not been made to ensure that backups from the remote offices are usable

During an information systems (IS) risk assessment of a health care organization regarding protected health information (PHI), an IS auditor interviews IS management. Which of the following findings from the interviews would be of MOST concern to the IS auditor?

• The organization does not encrypt all of its outgoing email messages

• Staff have to type [PHI] in the subject field of email messages to be encrypted

• An individual’s computer screen saver function is disabled.

• Server configuration requires the user to change the password annually.

An information systems (IS) auditor reviewing wireless network security determines that the Dynamic Host Configuration Protocol is disabled at all wireless access points. This practice:

• reduces the risk of unauthorized access to the network

• is not suitable for small networks

• automatically provides an Internet Protocol (IP) address to anyone

• increases the risk associated with Wireless Encryption Protocol