456 free ISACA CISA practice questions from the CertStash pack of 1,823, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 456 free here, all 1,823 in the pack, and each step includes the one before it.
Get all 1,823 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Which of the following should be of GREATEST concern to an IS auditor reviewing an organization's business continuity plan (BCP)?
Show answer and explanation
Correct answer: A. The BCP has not been tested since it was first issued.
An untested BCP is fundamentally unreliable and poses the greatest risk because it has never been validated to actually work during a real incident. Testing is critical to identifying gaps, clarifying procedures, and ensuring recovery objectives can be met. While version control, updated contact information, and management approval are all important, they are secondary to proving the plan actually functions when needed.
Why the other options are wrong
- B. Version control is a good practice but does not affect whether the BCP will actually work during a crisis.
- C. Outdated contact information should be corrected, but this is a maintenance issue, not a fundamental validity concern.
- D. Senior management approval is necessary for authority but does not validate that the plan will function effectively.
Question 2
Which of the following would be MOST useful when analyzing computer performance?
Show answer and explanation
Correct answer: C. Statistical metrics measuring capacity utilization
Statistical metrics measuring capacity utilization provide objective, quantifiable data about system performance across various conditions and time periods. These metrics enable trend analysis, bottleneck identification, and data-driven decision making. While operations reports and off-peak data provide some insight, they lack the comprehensive statistical foundation needed for thorough analysis. System tuning is an action, not an analysis tool.
Why the other options are wrong
- A. Tuning is a corrective action, not an analysis method for measuring performance.
- B. User satisfaction reports are subjective and do not provide the statistical foundation needed for rigorous performance analysis.
- D. Off-peak utilization alone does not capture the full picture of system performance under normal operating conditions.
Question 3
Which of the following is the GREATEST risk if two users have concurrent access to the same database record?
Show answer and explanation
Correct answer: D. Data integrity
When two users have concurrent access to the same database record without proper locking mechanisms, the greatest risk is data integrity, the loss or corruption of actual data values. This can result in lost updates, dirty reads, or inconsistent data states. Entity integrity, referential integrity, and availability integrity are all important, but data integrity is the broadest and most fundamental concern when concurrent modifications occur without proper synchronization controls.
Why the other options are wrong
- A. Entity integrity (unique identification) is less threatened by concurrent access than data value integrity.
- B. Availability integrity is not a standard integrity classification in database theory.
- C. Referential integrity (foreign key relationships) is less directly threatened than the core data values themselves.
Question 4
Which of the following is the MOST effective way for an organization to help ensure agreed-upon action plans from an IS audit will be implemented?
Show answer and explanation
Correct answer: A. Ensure ownership is assigned.
Assigning clear ownership is the most effective foundation for ensuring implementation because it establishes accountability and designates a responsible party with decision-making authority. Without clear ownership, action items can fall through the cracks regardless of other supporting activities. Testing, resource allocation, and communication are all valuable supporting measures, but they are ineffective without someone clearly responsible for seeing the actions through to completion.
Why the other options are wrong
- B. Testing corrective actions is important verification but occurs after implementation and does not drive the initial commitment.
- C. Adequate audit resources support the audit process itself but do not directly ensure management implements agreed-upon actions.
- D. Organization-wide communication raises awareness but does not create the accountability needed for implementation.
Question 5
Which of the following issues associated with a data center's closed circuit television (CCTV) surveillance cameras should be of MOST concern to an IS auditor?
Show answer and explanation
Correct answer: A. CCTV recordings are not regularly reviewed.
CCTV recordings that are not regularly reviewed provide false security, the system exists but serves no preventive or detective function. Regular review is essential for identifying suspicious activity, responding to incidents, and demonstrating that surveillance serves an actual security purpose. One-year retention is a reasonable policy, 24/7 recording is standard for critical areas, and break room exclusion is typically appropriate for privacy. However, unreviewed footage defeats the purpose of having the system.
Why the other options are wrong
- B. A one-year retention policy is reasonable and sufficient for most audit and security purposes.
- C. 24/7 recording is ideal but may be restricted to certain areas; not recording 24/7 in all areas does not eliminate the system's value.
- D. Break rooms typically should not have CCTV for privacy reasons, so this is not a security concern.
Question 6
An IS auditor has been asked to audit the proposed acquisition of new computer hardware. The auditor's PRIMARY concern is that:
Show answer and explanation
Correct answer: A. a clear business case has been established.
The primary concern for an IS auditor reviewing hardware acquisition is ensuring a clear business case exists. This establishes that the acquisition aligns with organizational strategy, has been justified by demonstrable need, and represents a prudent investment decision. Without a sound business case, security standards, audit trails, and user requirements become secondary concerns. The business case is the foundational justification that should precede all other implementation decisions.
Why the other options are wrong
- B. Security standards compliance is important but is typically addressed during the procurement specification phase, not the primary audit concern.
- C. Audit trails are implementation details that support accountability but do not determine whether the acquisition itself is justified.
- D. Meeting user requirements is important but assumes the acquisition decision itself is justified, which the business case must establish first.
Question 7
To confirm integrity for a hashed message, the receiver should use:
Show answer and explanation
Correct answer: D. the same hashing algorithm as the sender's to create a numerical representation of the file.
To confirm message integrity, the receiver must use the same hashing algorithm as the sender to produce a numerical representation (hash value) of the received message. This hash is then compared to the sender's transmitted hash; if they match, integrity is confirmed. Using the same algorithm is essential for reproducibility, and hashing produces a numerical digest, not a binary image. Any variation in algorithm or output format would prevent proper verification.
Why the other options are wrong
- A. While the same algorithm is correct, hashing produces a numerical representation (digest), not a binary image of the entire file.
- B. A different hashing algorithm would produce an incompatible result and prevent verification of the original sender's hash.
- C. Both the different algorithm and binary image characterizations are incorrect; the receiver must use the same algorithm and compare numerical hashes.
Question 8
An organization is implementing a new system that supports a month-end business process. Which of the following implementation strategies would be MOST efficient to decrease business downtime?
Show answer and explanation
Correct answer: D. Parallel
Parallel implementation is the most efficient strategy for minimizing business downtime in a month-end process. This approach runs the old and new systems concurrently during the critical month-end period, allowing the organization to validate the new system while maintaining full business continuity with the proven old system. If problems emerge, the organization can continue operations without interruption. Cutover involves immediate switching (high risk), phased implementation extends downtime across multiple phases, and pilot testing delays full deployment. For critical, time-sensitive processes, parallel provides the best protection.
Why the other options are wrong
- A. Cutover is the riskiest approach, involving immediate switching with no fallback, creating maximum exposure during month-end.
- B. Phased implementation extends the transition period and creates ongoing complexity during critical month-end operations.
- C. Pilot testing validates the system but delays full deployment and does not address the need to minimize downtime during go-live.
Question 9
Which of the following should be the FIRST step in managing the impact of a recently discovered zero-day attack?
Show answer and explanation
Correct answer: B. Identifying vulnerable assets
When a zero-day attack is discovered, the immediate first step must be to identify which assets in the organization are vulnerable to this new threat. This inventory of vulnerable systems is foundational, without knowing what is at risk, you cannot effectively prioritize response actions, estimate damage, or evaluate likelihood. Once vulnerable assets are identified, then you can assess impact, estimate damage, and implement remediation strategies.
Why the other options are wrong
- A. Estimating damage is premature before understanding which assets are actually vulnerable to the zero-day.
- C. Evaluating likelihood of attack is less urgent than first identifying what is exposed to the threat.
- D. Assessing impact of vulnerabilities should follow identification of which assets are vulnerable.
Question 10
Which of the following is the BEST way to ensure that an application is performing according to its specifications?
Show answer and explanation
Correct answer: B. System testing
System testing is the comprehensive phase where an integrated application is tested against the original specifications and requirements to verify it performs as intended. It validates the complete, end-to-end functionality of the application. Pilot testing validates in a live environment but not comprehensively against specs; integration testing focuses on component interactions; unit testing addresses individual code modules. Only system testing directly validates that the entire application meets its specified requirements.
Why the other options are wrong
- A. Pilot testing evaluates performance in a limited production environment but does not systematically verify all specifications.
- C. Integration testing verifies that components work together but does not comprehensively validate full application specifications.
- D. Unit testing validates individual code units but not the overall application behavior against complete specifications.
What people say about the full CISA pack 5.0 from 10
Passed the Certified Information Systems Auditor Exam today with the help of Cert Stash. I am so happy that finally, I will get my desired job in my field.
Absolutely worth it. Got the pass! Sat the exam last Tuesday. Cannot tell you how many times I saw the same questions from this dump. Unlike anything you get from official study material alone.
Passed on first try! Went through the dump twice. The questions are real exam questions, you can tell straight away. Very cheap for what you get.
Question 11
An IS auditor is performing a follow-up audit for findings identified in an organization's user provisioning process. Which of the following is the MOST appropriate population to sample from when testing for remediation?
Show answer and explanation
Correct answer: A. All users provisioned after management resolved the audit issue
The most appropriate population to sample from is users provisioned after management resolved the audit issue, as this allows the auditor to test whether the remediation controls are actually functioning effectively going forward. Testing users provisioned after the resolution ensures that the new or corrected process is being applied and working as intended. Testing users from other time periods would not directly assess whether the specific remediation implemented by management is effective, which is the purpose of a follow-up audit.
Why the other options are wrong
- B. Users who followed procedures may include both those before and after remediation, confounding the test of the specific fix.
- C. Testing only users after the final report may miss the actual implementation period when controls were first applied.
- D. Testing all users after the finding identification includes the period before remediation was implemented, mixing pre-fix and post-fix data.
Question 12
Many departments of an organization have not implemented audit recommendations by their agreed upon target dates. Who should address this situation?
Show answer and explanation
Correct answer: D. Senior management
Senior management must address the situation of audit recommendations not being implemented by target dates. While the head of audit may escalate the issue, only senior management has the authority and organizational position to enforce accountability across departments, allocate resources, and remove barriers to implementation. Senior management oversight ensures audit recommendations receive proper priority and timely execution.
Why the other options are wrong
- A. The head of audit can report the issue but lacks direct authority to compel departmental compliance.
- B. External auditors evaluate compliance but are not responsible for enforcing internal audit recommendations.
- C. Department managers are responsible for implementation but clearly are not complying; they need senior oversight.
Question 13
Which of the following is the MOST important consideration for an IS auditor when assessing the adequacy of an organization's information security policy?
Show answer and explanation
Correct answer: A. Business objectives
The most important consideration when assessing the adequacy of an organization's information security policy is alignment with business objectives. Security policies must support and enable the organization's business goals rather than impede them. An effective security policy balances risk protection with operational efficiency and business enablement, making business alignment the foundational assessment criterion.
Why the other options are wrong
- B. Alignment with the tactical IT plan is important but secondary to ensuring the policy serves the broader business objectives.
- C. Compliance with industry best practice is valuable but not the primary consideration; policies should first align with what the business needs.
- D. IT steering committee minutes may provide context but are not the most important consideration for adequacy assessment.
Question 14
During a review, an IS auditor discovers that corporate users are able to access cloud-based applications and data from any Internet-connected web browser. Which of the following is the auditor's BEST recommendation to help prevent unauthorized access?
Show answer and explanation
Correct answer: D. Implement multi-factor authentication.
Multi-factor authentication is the best recommendation to prevent unauthorized access to cloud-based applications accessible from any internet-connected browser. MFA adds a critical additional verification layer beyond passwords, significantly reducing the risk of unauthorized access even if credentials are compromised. While anti-malware, IDS, and policy updates are valuable, MFA is the most direct and effective control for preventing unauthorized access to web-based cloud services.
Why the other options are wrong
- A. Anti-malware protects devices but does not prevent unauthorized access with stolen credentials.
- B. IDS detects attacks but does not prevent unauthorized access at the authentication layer.
- C. Updated policies are necessary but do not provide technical controls to prevent unauthorized access.
Question 15
Which of the following is the BEST performance indicator for the effectiveness of an incident management program?
Show answer and explanation
Correct answer: D. Incident resolution meantime
Incident resolution meantime (MTTR) is the best performance indicator for incident management effectiveness because it directly measures how quickly the organization returns to normal operations and minimizes business impact. This metric reflects the entire incident lifecycle, detection, response, and recovery. While other metrics provide supporting data, MTTR is the most direct measure of program effectiveness and business value.
Why the other options are wrong
- A. Mean alert time measures detection speed but not the full resolution capability or effectiveness.
- B. Number of incidents reported reflects reporting culture, not management effectiveness; more reports could indicate worse security.
- C. Time between incidents measures overall security posture but is influenced by many factors beyond incident management program quality.
Question 16
Management has requested a post-implementation review of a newly implemented purchasing package to determine to what extent business requirements are being met. Which of the following is MOST likely to be assessed?
Show answer and explanation
Correct answer: D. Results of live processing
A post-implementation review assesses how well the newly implemented system is performing in the live environment and whether it meets business requirements. The results of live processing directly demonstrate whether the purchasing package is functioning correctly, meeting user needs, processing transactions accurately, and delivering the intended business benefits. This is the most relevant metric for determining whether business requirements are being met in actual operational conditions.
Why the other options are wrong
- A. Implementation methodology is concerned with how the system was built, not whether it meets business requirements in operation.
- B. Test results are from pre-implementation phases and do not reflect actual live performance or business requirement fulfillment.
- C. Reviewing policies is less directly relevant than observing whether the system actually supports purchasing operations as intended.
Question 17
An internal audit department reports directly to the chief financial officer (CFO) of an organization. This MOST likely leads to:
Show answer and explanation
Correct answer: B. concern over the independence of the auditor.
When internal audit reports directly to the CFO rather than the audit committee or board, there is a significant concern over auditor independence. The CFO is a senior financial executive whose operations are subject to audit, creating a potential conflict of interest. This reporting structure may compromise the auditor's objectivity when evaluating financial controls and could bias audit findings regarding the CFO's area of responsibility.
Why the other options are wrong
- A. Reporting to the CFO would not necessarily make audit findings more business-oriented; it would compromise independence.
- C. Recommendations from a compromised audit function would actually receive less credible attention from governance bodies.
- D. While bias is a concern, independence is the primary governance issue that reporting structure creates.
Question 18
An IS auditor has been asked to perform an assurance review of an organization's mobile computing security. To ensure the organization is able to centrally manage mobile devices to protect against data disclosure, it is MOST important for the auditor to determine whether:
Show answer and explanation
Correct answer: B. procedures for lost devices include remote wiping of data.
Procedures for remote wiping of lost or stolen devices are most important for preventing data disclosure from mobile devices. Remote wiping capability ensures that if a device is lost or compromised, sensitive organizational and customer data can be immediately destroyed, eliminating the risk of unauthorized access. This is the critical capability for centrally managing mobile devices to prevent data disclosure, the core objective stated in the question. While policies and other controls are necessary, the ability to remotely wipe data is the most direct technical control preventing data disclosure from lost devices.
Why the other options are wrong
- A. Remote device location is useful for recovery but does not prevent data disclosure if the device is accessed before recovery.
- C. Security awareness training is valuable but is not the most direct control for protecting against data disclosure from lost devices.
- D. A security policy is foundational but does not provide the specific capability to prevent data disclosure like remote wiping does.
Question 19
The PRIMARY focus of audit follow-up reports should be to:
Show answer and explanation
Correct answer: B. determine if audit recommendations have been implemented.
The primary focus of audit follow-up reports is to determine whether management has implemented the audit recommendations that were issued. This assessment of implementation status is fundamental to closing the audit loop and ensuring that identified risks are being addressed through corrective actions.
Why the other options are wrong
- A. Assessing new risks is important but is typically the focus of new audit planning cycles, not follow-up reports.
- C. Determining relevance is secondary; the primary focus is whether recommendations were actually implemented.
- D. Verifying completion dates is a tracking activity but not the primary focus, the focus is on implementation itself.
Question 20
Data from a system of sensors located outside of a network is received by the open ports on a server. Which of the following is the BEST way to ensure the integrity of the data being collected from the sensor system?
Show answer and explanation
Correct answer: D. Hash the data that is transmitted from the sensor system
Hashing the transmitted sensor data provides the best technical method to ensure data integrity by creating a cryptographic fingerprint that detects any modification or corruption during transmission. If the hash value changes or doesn't match upon receipt, the data has been altered and cannot be trusted. NAT and proxy routing address access control and anonymity, not data integrity. VPN protects data confidentiality and prevents interception, but without hashing, modified data can still pass through an encrypted tunnel undetected.
Why the other options are wrong
- A. Network address translation protects network location privacy but does not verify or ensure data integrity.
- B. Proxy routing provides access control and monitoring but cannot detect if data has been modified in transit.
- C. VPN encryption protects confidentiality during transmission but does not detect if data has been altered.
Question 21
Which of the following is MOST helpful to an IS auditor when assessing the effectiveness of controls?
Show answer and explanation
Correct answer: C. Results of control testing
Results of control testing provide objective, empirical evidence of whether controls are actually operating as designed. While interviews, CSAs, and control matrices all have value in the control assessment process, direct testing results are most helpful for determining actual effectiveness because they demonstrate real performance rather than reliance on management representation, self-assessment, or theoretical design documentation.
Why the other options are wrong
- A. Interviews with management provide subjective information about controls but lack objective evidence of actual control operation.
- B. CSA relies on self-reporting by staff and management, which is less objective than direct testing results.
- D. A control matrix documents the mapping of risks to controls but does not provide evidence of whether controls actually function as intended.
Question 22
When planning an audit, it is acceptable for an IS auditor to rely on a third-party provider’s external audit report on service level management when the:
Show answer and explanation
Correct answer: A. scope and methodology meet audit requirements
An IS auditor can acceptably rely on a third-party provider's external audit report when the scope and methodology of that report meet the auditor's specific requirements. This ensures the third-party audit addressed the relevant areas and used appropriate procedures aligned with the auditor's needs. Scope and methodology alignment is the critical criterion for determining whether reliance on external audit work is appropriate.
Why the other options are wrong
- B. While independent certification is valuable, it does not ensure the audit report's scope and methodology meet specific audit requirements.
- C. A report released within the last 12 months may be too old depending on the frequency of changes; timeliness is less important than scope and methodology alignment.
- D. A report confirming service levels were not violated does not ensure the report's scope and methodology are appropriate for the current audit's needs.
Question 23
Spreadsheets are used to calculate project cost estimates. Totals for each cost category are then keyed into the job-costing system. What is the BEST control to ensure that data is accurately entered into the system?
Show answer and explanation
Correct answer: B. Reconciliation of total amounts by project
Reconciliation of total amounts by project is the best control to ensure accuracy when transferring data from spreadsheets to the job-costing system. This detective control compares the totals calculated in the spreadsheet against what was actually entered into the system, catching discrepancies that may have occurred during manual data entry. This addresses the fundamental risk that individual line items may be incorrectly keyed, and provides independent verification of the complete data set.
Why the other options are wrong
- A. Displaying detail after entry is a review mechanism but doesn't systematically verify accuracy against the source spreadsheet.
- C. Reasonableness checks validate individual cost types but may miss systematic entry errors or transposition mistakes.
- D. Validity checks prevent character data entry but do nothing to ensure numerically correct amounts were entered for valid cost categories.
Question 24
Which of the following should an IS auditor review FIRST during the audit of an organization's business continuity plan (BCP)?
Show answer and explanation
Correct answer: B. List of critical business processes
The list of critical business processes should be reviewed first during a BCP audit because it provides the foundation for all subsequent planning activities. This list determines which systems require RTOs, what recovery procedures are needed, and prioritizes recovery efforts. Without validating that critical processes are correctly identified and prioritized, the auditor cannot assess whether the rest of the BCP plan is appropriately scoped and sequenced.
Why the other options are wrong
- A. RTOs are dependent on having first identified critical business processes; reviewing RTOs before validating the process list is illogical.
- C. Recovery manuals and documentation should be reviewed after confirming that the right processes are identified for recovery.
- D. Database replication frequency is a specific technical control that should be evaluated only after understanding which processes are critical.
Question 25
Which of the following is MOST important for an effective control self-assessment (CSA) program?
Show answer and explanation
Correct answer: D. Understanding the business process
Understanding the business process is most important because an effective CSA program must be grounded in knowledge of what processes exist, how they operate, and where controls should be embedded. Without this foundational understanding, assessments cannot be properly scoped, changes cannot be evaluated in context, and test procedures cannot be meaningfully designed.
Why the other options are wrong
- A. Determining scope depends on first understanding the business processes being assessed.
- B. Evaluating risk environment changes requires knowing the baseline business processes affected by those changes.
- C. Performing test procedures is premature and ineffective without understanding what processes and controls should be tested.
Question 26
Which of the following is MOST important to include in forensic data collection and preservation procedures?
Show answer and explanation
Correct answer: A. Maintaining chain of custody
Chain of custody is the most critical element in forensic data collection because it documents the chronological history of evidence handling, ensuring admissibility in legal proceedings and maintaining credibility of the investigation. While data integrity, physical security, and tool selection are all important, chain of custody is foundational, without it, even perfectly preserved data may be inadmissible or legally challenged.
Why the other options are wrong
- B. Data integrity is essential but is supported by chain of custody procedures; it's not the primary overarching requirement.
- C. Physical security is important for preventing tampering but doesn't address the procedural documentation needed for legal validity.
- D. Tool selection is a tactical decision that comes after establishing the framework of chain of custody protocols.
Question 27
Which of the following would be an appropriate role of internal audit in helping to establish an organization's privacy program?
Show answer and explanation
Correct answer: C. Analyzing risks posed by new regulations
Internal audit's appropriate role is to provide independent assurance and advisory services. Analyzing risks posed by new regulations is a consulting/assurance function that audit can perform to help establish a privacy program. Designing controls (A) is management's responsibility, defining organizational roles (B) is management's responsibility, and developing monitoring procedures (D) is operational management's responsibility. Internal audit evaluates these areas rather than creates them.
Why the other options are wrong
- A. Control design is a management responsibility, not an internal audit function.
- B. Defining organizational roles is a management responsibility during program establishment.
- D. Developing monitoring procedures is an operational responsibility, not internal audit's role.
Question 28
Which of the following should an IS auditor ensure is classified at the HIGHEST level of sensitivity?
Show answer and explanation
Correct answer: B. Penetration test results
Penetration test results should be classified at the highest sensitivity level because they document specific vulnerabilities, system weaknesses, and potential attack vectors in an organization's infrastructure. If this information were disclosed, attackers could directly exploit the identified weaknesses. The results represent a detailed attack map that poses exceptional risk if compromised.
Why the other options are wrong
- A. Emergency change records document change procedures but don't inherently contain the level of vulnerability detail that penetration results do.
- C. While security incidents are sensitive, they document what already occurred rather than proactive vulnerability information that could guide future attacks.
- D. Server room access history is operational information, less sensitive than detailed technical vulnerability assessments.
Question 29
An IS auditor performing a review of a newly purchased software program notes that an escrow agreement has been executed for acquiring the source code. What is MOST important for the IS auditor to verify?
Show answer and explanation
Correct answer: A. The source code is being held by an independent third party.
The MOST important element for the auditor to verify is that the source code is being held by an independent third party. The purpose of a software escrow agreement is to protect the acquiring organization by ensuring neutral custody of source code that can be released if the vendor fails or goes bankrupt. Verification that an independent third party (not the vendor or the acquiring company) holds the escrow is fundamental to the agreement's effectiveness.
Why the other options are wrong
- B. Product acceptance testing is important for implementation but is separate from escrow agreement verification.
- C. Vendor financial viability is relevant context but doesn't verify the actual escrow arrangement itself.
- D. Source code updates relate to ongoing maintenance; the immediate concern is confirming proper escrow custody.
Question 30
Which of the following BEST enables the effectiveness of an agile project for the rapid development of a new software application?
Show answer and explanation
Correct answer: B. The work is separated into sprints.
Sprints are the foundational organizing principle of agile methodology. Work is divided into short time-boxed iterations (sprints) that enable rapid development, frequent feedback, and continuous delivery. This sprint-based structure is what fundamentally enables agile projects to achieve rapid development cycles and respond to change effectively.
Why the other options are wrong
- A. Phases are characteristic of waterfall, not agile methodologies.
- C. Project milestones can exist in agile but are not what fundamentally enables rapid development.
- D. Project segments is vague terminology not specific to agile frameworks.
Question 31
During an IT governance audit, an IS auditor notes that IT policies and procedures are not regularly reviewed and updated. The GREATEST concern to the IS auditor is that policies and procedures might not:
Show answer and explanation
Correct answer: A. reflect current practices.
The greatest concern when policies and procedures are not regularly reviewed and updated is that they will not reflect current practices. Outdated policies create a disconnect between what the organization actually does and what it claims to do, undermining the entire governance framework. This is more fundamental than the other concerns, which are consequences of policies failing to reflect current reality.
Why the other options are wrong
- B. QA processes are separate from whether policies are current; outdated policies may still have undergone QA.
- C. Not including new systems is a specific manifestation of failing to reflect current practices, but not the greatest concern overall.
- D. While regulatory alignment is important, the primary audit concern is whether policies match actual operations.
Question 32
When an intrusion into an organization's network is detected, which of the following should be done FIRST?
Show answer and explanation
Correct answer: B. Identify nodes that have been compromised.
Identifying compromised nodes must be done first to understand the scope and nature of the intrusion, which informs all subsequent response actions. Without this assessment, blocking nodes could be premature or insufficient, law enforcement notification may lack critical details, and management briefing requires accurate situation data. This is the essential first investigative step.
Why the other options are wrong
- A. Law enforcement contact should follow after the scope is understood and internal response is planned.
- C. Blocking nodes prematurely, before identifying all compromised systems, may allow backdoors or miss affected assets.
- D. Notifying management should occur after initial assessment so accurate situation details can be reported.
Question 33
Which of the following provides the MOST assurance over the completeness and accuracy of loan application processing with respect to the implementation of a new system?
Show answer and explanation
Correct answer: A. Running historical transactions through the new system
Running historical transactions through the new system provides the most assurance over completeness and accuracy of loan application processing. This approach reprocesses known historical loans through the new system and compares outputs to original results, providing direct evidence that the new system produces accurate and complete results matching the legacy system. This is a proven method for validating that all business logic, rules, and calculations migrate correctly.
Why the other options are wrong
- B. Loading balance and transaction data is a data migration step, not a testing method to verify processing accuracy.
- C. Comparing code between systems is a technical review but does not verify functional correctness or data accuracy in actual processing.
- D. Reviewing QA procedures documents quality assurance plans but does not independently provide assurance over actual system completeness and accuracy.
Question 34
The BEST way to determine whether programmers have permission to alter data in the production environment is by reviewing:
Show answer and explanation
Correct answer: C. the access rights that have been granted.
The access rights that have been granted is the definitive record of what permissions users actually possess. This should be reviewed directly from the access control system's authorization records or access management documentation. This answers the factual question of whether programmers have permission to alter production data. System configuration and log settings support access control operations, and reviewing implementations documents what was done but not necessarily what rights exist currently.
Why the other options are wrong
- A. System configuration describes how access controls function but doesn't directly show what specific rights have been granted.
- B. How changes were implemented documents past actions but doesn't confirm current access rights.
- D. Log settings configure what is recorded but do not show the actual access permissions that have been granted.
Question 35
Which of the following is the BEST way to verify the effectiveness of a data restoration process?
Show answer and explanation
Correct answer: D. Performing periodic complete data restorations
Performing periodic complete data restorations is the best way to verify restoration process effectiveness because it tests the entire process end-to-end in a realistic scenario, identifying issues that might not be apparent from partial tests or reviews. This validates that backups are usable and recovery procedures work when needed. Reviewing physical access (A) addresses security but not restoration functionality; software validation (B) tests backup integrity but not the complete restoration process; policy reviews (C) ensure documentation but don't test actual effectiveness.
Why the other options are wrong
- A. Reviewing physical access to backup media addresses security controls but doesn't verify the actual restoration process works.
- B. Validating offline backups with software confirms backup integrity but doesn't test whether data can actually be restored successfully.
- C. Reviewing and updating policies ensures documentation is current but doesn't test whether the restoration process actually works in practice.
Question 36
Backups will MOST effectively minimize a disruptive incident's impact on a business if they are:
Show answer and explanation
Correct answer: A. taken according to recovery point objectives (RPOs).
Backups taken according to Recovery Point Objectives (RPOs) most effectively minimize incident impact because RPO defines the maximum tolerable data loss and ensures backup frequency matches business criticality. This approach ensures backups are taken at appropriate intervals to limit data loss to an acceptable level. RPO-aligned backups directly address business continuity requirements, whereas schedule-based approaches, storage media, and software choice are implementation details that don't guarantee alignment with business recovery needs.
Why the other options are wrong
- B. Scheduling by service delivery objectives is less precise than RPO-based alignment; RPO specifically addresses recovery point requirements.
- C. Automated fixed-schedule backups may not align with actual business recovery point needs and don't account for varying criticality.
- D. Write-once read-many media provides protection against modification but does not address how frequently backups should be taken.
Question 37
An organization allows employees to retain confidential data on personal mobile devices. Which of the following is the BEST recommendation to mitigate the risk of data leakage from lost or stolen devices?
Show answer and explanation
Correct answer: A. Configure to auto-wipe after multiple failed access attempts.
Auto-wipe after multiple failed access attempts is the best control for mitigating data leakage from lost or stolen devices. This technical control ensures that if a device falls into unauthorized hands and someone attempts to breach it, the confidential data will be automatically destroyed before access can be gained, providing the strongest protection against data exposure from a physical loss.
Why the other options are wrong
- B. Security awareness training helps with general security practices but does nothing to protect data already on a lost device.
- C. Device auto-lock alone creates only a minor delay for attackers and does not prevent data extraction if the device is compromised.
- D. Password protecting individual files is weaker than full device encryption and auto-wipe, and does not protect against data extraction via other methods.
Question 38
An organization is planning an acquisition and has engaged an IS auditor to evaluate the IT governance framework of the target company. Which of the following would be MOST helpful in determining the effectiveness of the framework?
Show answer and explanation
Correct answer: A. Recent third-party IS audit reports
Recent third-party IS audit reports would be MOST helpful in determining the effectiveness of the target company's IT governance framework because independent external auditors provide objective, professional assessments of control design and operating effectiveness. Third-party audit reports offer credible, unbiased evaluation that is most valuable for acquisition due diligence.
Why the other options are wrong
- B. Internal audit reports may be biased and less objective than third-party assessments, making them less reliable for acquisition evaluation.
- C. Benchmarking against competitors addresses competitive positioning, not the effectiveness of the governance framework itself.
- D. Self-assessment reports are inherently biased and lack the objectivity needed to reliably evaluate governance framework effectiveness for acquisition decisions.
Question 39
Which of the following provides the BEST assurance that a new process for purging transactions does not have a detrimental impact on the integrity of the database?
Show answer and explanation
Correct answer: B. Reviewing results of the process in a test environment
Testing the new purging process in a test environment before production deployment provides the best assurance by allowing observation of actual results and impact on database integrity. This is empirical validation. Option A (entity relationship diagrams) shows structure but not process outcomes. Option C (triggers) addresses one technical component but not overall impact. Option D (database structure) shows design but not whether the purge process affects integrity.
Why the other options are wrong
- A. ER diagrams show data relationships but don't demonstrate whether a purge process maintains integrity.
- C. Assessing trigger design is technical review but doesn't validate the actual impact on data integrity.
- D. Analyzing structure is passive design review and doesn't test whether the process actually preserves integrity.
Question 40
A company converted its payroll system from an external service to an internal package. Payroll processing in April was run in parallel. To validate the completeness of data after the conversion, which of the following comparisons from the old to the new system would be MOST effective?
Show answer and explanation
Correct answer: C. Master file employee data to payroll journals
Comparing master file employee data to payroll journals is the most effective validation of data completeness after conversion because it ties employee records in the system to actual payroll transactions, ensuring no employees were lost in conversion and all payroll obligations are captured. This cross-functional comparison directly validates that the conversion was complete.
Why the other options are wrong
- A. Cut-off dates and overwrites for a sample of employees addresses transaction accuracy and timing but does not validate overall completeness of the employee population.
- B. Turnaround time for payroll processing measures operational efficiency but does not validate data completeness or accuracy of the conversion.
- D. While employee counts and YTD totals are useful aggregate comparisons, they are less precise than linking master files to actual journals, which validates both completeness and accuracy of individual transactions.
Question 41
Who is PRIMARILY responsible for the design of IT controls to meet control objectives?
Show answer and explanation
Correct answer: C. Business management
Business management is primarily responsible for designing and implementing IT controls because they own the business processes and objectives that the controls must support. Business management defines control objectives and determines how to achieve them; IT implements the technical controls, and auditors evaluate effectiveness.
Why the other options are wrong
- A. IT managers implement technical controls but do not bear primary responsibility for their design to meet business control objectives.
- B. Internal auditors evaluate control effectiveness but do not design controls, doing so would impair their independence.
- D. Risk management assists in control design but business management retains primary responsibility for establishing controls over their operations.
Question 42
To address issues related to privileged users identified in an IS audit, management implemented a security information and event management (SIEM) system. Which type of control is in place?
Show answer and explanation
Correct answer: B. Detective
A SIEM system is a detective control because it monitors, logs, and alerts on activities after they occur. It detects unauthorized or suspicious actions by privileged users through event monitoring and analysis, but does not prevent the actions from happening in the first place.
Why the other options are wrong
- A. Directive controls guide behavior through policies and procedures, not through system monitoring.
- C. Preventive controls stop unwanted actions before they occur; SIEM operates after events.
- D. Corrective controls remediate issues after discovery; SIEM's primary function is detection and alerting.
Question 43
Which of the following is the GREATEST risk of using a reciprocal site for disaster recovery?
Show answer and explanation
Correct answer: A. Inability to utilize the site when required
The greatest risk with a reciprocal site arrangement is that the site may be unavailable when needed for actual recovery. Since both organizations share the same facility and resources, if a disaster affects one organization and they need to activate recovery, the other organization may simultaneously need the same resources, or the site may be unable to accommodate both organizations. This fundamental unavailability risk overshadows other concerns like testing limitations or equipment mismatches, which can be managed through planning.
Why the other options are wrong
- B. Testing limitations can be addressed through alternative testing methods and coordination with the reciprocal partner.
- C. Security policy mismatches, while a concern, can be reconciled through documentation and agreed-upon standards.
- D. Equipment compatibility can be verified and addressed during the planning phase of the reciprocal arrangement.
Question 44
Which of the following should an IS auditor expect to see in a network vulnerability assessment?
Show answer and explanation
Correct answer: B. Misconfiguration and missing updates
A network vulnerability assessment identifies system weaknesses through methodical testing and analysis. Misconfiguration and missing updates are the primary findings, these are testable, discoverable vulnerabilities in the current environment. Zero-day vulnerabilities cannot be found through standard assessments since they are unknown. Malicious software and spyware detection is part of malware scanning, not vulnerability assessment. Security design flaws require architectural review beyond typical vulnerability scanning.
Why the other options are wrong
- A. Security design flaws require architectural and design reviews, not standard network vulnerability assessments.
- C. Zero-day vulnerabilities are unknown and cannot be discovered through vulnerability assessments by definition.
- D. Detecting malicious software and spyware is the function of antivirus and malware scanning tools, not vulnerability assessments.
Question 45
Which of the following is the BEST approach to help ensure evidence from a computer forensics investigation is legally admissible?
Show answer and explanation
Correct answer: C. The media involved is preserved using imaging, and further analysis is performed on the image instead of the original.
Preserving media using imaging and performing analysis on the image rather than the original is the best practice for maintaining chain of custody and legal admissibility of forensic evidence. This approach prevents contamination, alteration, or damage to the original evidence, which is essential for courts to accept evidence. Imaging creates a forensically sound copy that can be analyzed without risking the integrity of the original evidence.
Why the other options are wrong
- A. Deleting evidence after analysis destroys potentially critical evidence and violates chain of custody procedures required for legal admissibility.
- B. Simply extracting and consolidating log data without proper imaging procedures does not ensure the evidence meets the strict standards required for legal admissibility.
- D. Isolating the computer and contacting the incident response team are appropriate initial steps but do not themselves ensure legal admissibility, proper evidence handling procedures are required.
Question 46
An IS auditor is reviewing a contract for the outsourcing of IT facilities. If missing, which of the following should present the GREATEST concern to the auditor?
Show answer and explanation
Correct answer: A. Access control requirements
Access control requirements are fundamental to IT security and must be explicitly defined in outsourcing contracts to ensure the organization maintains proper oversight of who can access systems and data. Without clear access control requirements, the organization cannot enforce security policies, manage risk exposure, or maintain compliance with regulatory requirements. While hardware configurations, help desk availability, and network diagrams are important, they are secondary to establishing the foundational security controls needed to protect organizational assets.
Why the other options are wrong
- B. Hardware configurations are important operational details but are less critical than security controls for outsourced facilities.
- C. Help desk availability affects operational efficiency but is not as critical as controlling access to facilities and systems.
- D. Network security diagrams support security but access controls are the primary mechanism for preventing unauthorized access.
Question 47
What is the BEST way to control updates to the vendor master file in an accounts payable system?
Show answer and explanation
Correct answer: D. Comparing updates against authorization
Comparing updates against authorization is the best control because it creates a systematic verification process where all changes are validated against approved authorization before posting. This prevents unauthorized modifications while maintaining an audit trail. This approach is superior because it works regardless of who makes the change and doesn't create single points of failure.
Why the other options are wrong
- A. Prenumbered forms are good documentation but don't prevent unauthorized changes from being processed.
- B. Limiting to one person creates a critical single point of failure and concentrates fraud risk.
- C. Periodic reviews detect problems after they occur; preventive controls are stronger than detective controls.
Question 48
An IS auditor notes that not all security tests were completed for an online sales system recently promoted to production. Which of the following is the auditor's BEST course of action?
Show answer and explanation
Correct answer: A. Determine exposure to the business.
When security tests are incomplete for a production system, the auditor's primary responsibility is to understand the business impact. Determining exposure to the business is the most critical first step because it informs all subsequent decisions about remediation priority, monitoring intensity, and risk acceptance. This assessment of actual risk exposure is foundational to any corrective action plan.
Why the other options are wrong
- B. Increasing monitoring is a reactive measure that doesn't address the root issue of incomplete testing or determine if risk is actually material.
- C. Hiring a third party may be necessary later, but the auditor must first assess whether the incomplete testing actually creates significant business risk.
- D. Adjusting future testing is important but premature without understanding the current exposure and what specific tests were missed.
Question 49
An IS auditor has discovered that a cloud-based application was not included in an application inventory that was used to confirm the scope of an audit. The business process owner explained that the application will be audited by a third party in the next year. The auditor's NEXT step should be to:
Show answer and explanation
Correct answer: A. evaluate the impact of the cloud application on the audit scope.
The auditor's next step should be to evaluate whether the cloud application has a material impact on audit scope and the organization's risk profile. This assessment determines whether the application must be included in the current audit or if excluding it is justified based on risk and materiality. This evaluation comes before deciding to revise scope, review third-party reports, or escalate issues.
Why the other options are wrong
- B. Revising scope is premature without first assessing the application's impact and materiality.
- C. Relying on future third-party audits does not address current audit responsibilities and gaps.
- D. Escalation without first evaluating the actual impact and risk misses the auditor's professional judgment step.
Question 50
Which of the following would lead an IS auditor to conclude that the evidence collected during a digital forensic investigation would not be admissible in court?
Show answer and explanation
Correct answer: A. The logs failed to identify the person handling the evidence.
Chain of custody is critical for evidence admissibility in court. If logs failed to identify who handled the evidence at each stage, the chain of custody is broken, which directly undermines the evidence's admissibility and reliability. This is a fundamental requirement in digital forensics. Option B concerns witness qualification but internal staff can still testify if qualified. Option C is incorrect because cloud backup is not a requirement for admissibility. Option D is incorrect because evidence collected by internal teams can be admissible if properly documented and handled.
Why the other options are wrong
- B. While witness qualification matters, internal forensics team members can testify if they are qualified and the chain of custody is maintained.
- C. Cloud-based backup prior to trial is not a legal requirement for evidence admissibility in digital forensic investigations.
- D. Evidence collected by internal forensics teams can be admissible if properly documented, preserved, and the chain of custody is maintained.
Question 51
An organization is experiencing a large number of phishing attacks targeting employees and executives following a press release announcing an acquisition. Which of the following would provide the BEST defense against these attacks?
Show answer and explanation
Correct answer: A. Conduct organization-wide awareness training.
Organization-wide awareness training is the best defense against phishing attacks because it addresses the human element, the primary vulnerability that phishing exploits. Trained employees can recognize phishing emails, avoid clicking malicious links, and report suspicious messages. While technical controls like intrusion detection, spam filters, and policy acknowledgments provide layers of defense, phishing succeeds primarily through user deception. Education that teaches employees to identify and respond appropriately to phishing attempts is the most effective preventive measure.
Why the other options are wrong
- B. Intrusion detection and prevention systems focus on network-level threats, not on preventing users from falling victim to social engineering.
- C. Spam filters may block some phishing emails but cannot detect all sophisticated phishing attacks, especially targeted ones.
- D. Signed acknowledgment of security policy does not prevent users from making mistakes or falling for sophisticated phishing schemes.
Question 52
Which of the following is the MOST appropriate indicator of change management effectiveness?
Show answer and explanation
Correct answer: C. Number of incidents resulting from changes
The number of incidents resulting from changes is the most appropriate indicator of change management effectiveness because it directly measures the outcome and impact of the change process. A well-managed change process should minimize incidents caused by changes. This metric directly reflects whether changes are being implemented safely and correctly.
Why the other options are wrong
- A. Time lag between configuration changes and record updates measures documentation timeliness, not change effectiveness.
- B. The number of system software changes reflects activity volume, not the quality or effectiveness of the change management process.
- D. Time lag between changes and documentation updates measures administrative speed, not whether changes themselves are effective or safe.
Question 53
While planning a review of IT governance, the IS auditor is MOST likely to:
Show answer and explanation
Correct answer: A. obtain information about the framework of control adopted by management.
When planning a review of IT governance, the IS auditor is most likely to obtain information about the framework of control adopted by management. This is foundational to understanding how management has structured oversight, accountability, and control mechanisms. The control framework defines the organization's approach to governance and is the starting point for assessing IT governance effectiveness.
Why the other options are wrong
- B. Examining audit committee minutes is a supporting activity but not the primary focus of governance review planning.
- C. Assessing consistency of business process owner responsibilities is a specific control evaluation, not the initial planning step.
- D. Reviewing compliance with board policies is an evaluation activity done after understanding the governance framework.
Question 54
An organization's information security department has recently created a centralized governance model to ensure that network-related findings are remediated within the service level agreement (SLA). What should the IS auditor use to assess the maturity and capability of this governance model?
Show answer and explanation
Correct answer: D. Key performance indicators (KPIs)
Key Performance Indicators (KPIs) are the appropriate metrics to assess the maturity and capability of a governance model, particularly one designed to ensure remediation within service level agreements. KPIs measure how well the governance model is performing against its stated objectives (timely remediation per SLA), making them ideal for evaluating maturity and operational effectiveness. KRIs measure risk exposure, KPIs measure performance outcomes, and KDEs describe data structure, only KPIs directly assess whether the governance model is achieving its intended results.
Why the other options are wrong
- A. Key risk indicators measure risk exposure, not the effectiveness of the governance model itself.
- B. Key process controls identify controls within processes but do not measure overall governance maturity.
- C. Key data elements describe what data is tracked, not how well governance is functioning.
Question 55
Which of the following BEST ensures the quality and integrity of test procedures used in audit analytics?
Show answer and explanation
Correct answer: B. Centralizing procedures and implementing change control
Centralizing procedures and implementing change control best ensures quality and integrity of test procedures because a centralized repository with formal change control creates a single source of truth, prevents conflicting versions, ensures consistency across audit teams, and provides an audit trail of all modifications. This standardized approach guarantees that all audit procedures are current, approved, and consistently applied.
Why the other options are wrong
- A. Communicating best practices alone does not ensure quality without formal governance mechanisms to enforce and track compliance with those practices.
- C. An audit data repository manages test data but does not directly ensure that the procedures themselves are of high quality or properly controlled.
- D. Decentralizing procedures directly undermines quality and integrity by creating multiple versions, inconsistency, and difficulty in tracking which procedures are authoritative.
Question 56
Which of the following controls is BEST implemented through system configuration?
Show answer and explanation
Correct answer: B. Network user accounts for temporary workers expire after 90 days.
Network user account expiration is a technical control that can be directly implemented and enforced through system configuration (setting expiration dates in Active Directory or similar identity management systems). This is an automatic, preventive control built into the system itself. The other options require manual processes: option A requires periodic review activities, option C involves manual job initiation, and option D requires manual tracing and verification procedures.
Why the other options are wrong
- A. User access reviews require manual assessment and approval processes, not system configuration.
- C. Batch job initiation is a manual operational process, not a system configuration control.
- D. Tracing financial data for completeness is a detective control requiring manual procedures, not system configuration.
Question 57
Which of the following approaches will ensure recovery time objectives (RTOs) are met for an organization's disaster recovery plan (DRP)?
Show answer and explanation
Correct answer: A. Performing a full interruption test
A full interruption test (also called a full-scale or cutover test) actually interrupts normal operations and recovers from backup to the alternate site under real conditions. This is the only test that realistically validates whether RTOs can actually be met because it measures true recovery time in a production-like scenario. Parallel tests run simultaneously without disruption and cannot accurately measure actual RTO performance, tabletop tests are theoretical discussions, and cyber-resilience tests focus on security rather than recovery timing.
Why the other options are wrong
- B. A parallel test runs the alternate system alongside production without actually failing over, so it does not truly validate RTO achievement under real recovery conditions.
- C. A tabletop test is a theoretical discussion and walkthrough that does not measure actual recovery time performance.
- D. A cyber-resilience test focuses on security incident response rather than measuring recovery time objectives.
Question 58
A project team has decided to switch to an agile approach to develop a replacement for an existing business application. Which of the following should an IS auditor do FIRST to ensure the effectiveness of the project audit?
Show answer and explanation
Correct answer: A. Understand the specific agile methodology that will be followed.
An IS auditor must first understand the specific agile methodology that will be followed because audit approaches, control expectations, and review points differ significantly across agile frameworks (Scrum, Kanban, XP, etc.). Without understanding the specific methodology's processes, ceremonies, roles, and deliverables, the auditor cannot design effective audit procedures or identify appropriate control points. This foundational understanding is prerequisite to all subsequent audit planning activities.
Why the other options are wrong
- B. Interviewing business process owners is important but should occur after understanding how the agile approach will structure requirements gathering and validation.
- C. Comparing agile to previous methodology is useful for transition planning but does not directly address the audit approach needed for the new methodology.
- D. Identifying existing controls assumes knowledge of the agile process, which must be understood first.
Question 59
Which of the following is the BEST indicator of the effectiveness of an organization's incident response program?
Show answer and explanation
Correct answer: D. Financial impact per security event
The financial impact per security event is the best indicator of incident response effectiveness because it directly measures the outcome of the response program. Lower financial impact indicates that incidents are being detected, contained, and remediated quickly and effectively, reducing overall organizational loss. This metric captures the real-world business value of the entire incident response program.
Why the other options are wrong
- A. Number of successful penetration tests measures vulnerability discovery, not the effectiveness of incident response once events occur.
- B. Percentage of protected business applications indicates security coverage but not how well incidents are actually handled once they occur.
- C. Number of security vulnerability patches reflects vulnerability management activity, not the effectiveness of detecting and responding to active incidents.
Question 60
Which of the following should be the FIRST step when planning an IS audit of a third-party service provider that monitors network activities?
Show answer and explanation
Correct answer: B. Review the roles and responsibilities of the third-party provider.
The first step when planning an IS audit of a third-party service provider should be reviewing the roles and responsibilities of that provider. Understanding the scope of the third party's responsibilities establishes the audit boundaries and identifies what aspects of network monitoring fall under their control versus the organization's control. This foundational step informs all subsequent audit planning decisions.
Why the other options are wrong
- A. Determining secure connections is a specific control to evaluate later, not the initial planning step.
- C. Evaluating the organization's monitoring process comes after understanding the third party's defined role.
- D. Reviewing logs and incident handling is part of detailed audit execution, not the initial planning phase.
Question 61
In a post-implementation review of a recently purchased system, it is MOST important for the IS auditor to determine whether the:
Show answer and explanation
Correct answer: B. user requirements were met.
The most important determination in a post-implementation review is whether user requirements were met. This is the fundamental measure of implementation success, the system must satisfy the business needs it was designed to address. Meeting user requirements is the primary criterion against which the entire implementation should be evaluated.
Why the other options are wrong
- A. Vendor viability is a pre-purchase decision, not a post-implementation review priority.
- C. Test scenario alignment is important but secondary to verifying actual requirements fulfillment.
- D. Stakeholder expectations should have been identified during planning, not reviewed post-implementation.
Question 62
Which of the following documents should specify roles and responsibilities within an IT audit organization?
Show answer and explanation
Correct answer: C. Audit charter
The audit charter is the foundational document that formally establishes the audit function and explicitly defines roles, responsibilities, authority, and reporting relationships within the IT audit organization. While an organizational chart may show structure visually, the charter is the authoritative document that formally assigns and defines these responsibilities. The annual audit plan focuses on specific audits to be performed, and an engagement letter is between the auditor and auditee for specific assignments.
Why the other options are wrong
- A. An organizational chart shows structure but does not formally document the detailed roles and responsibilities that define the audit function.
- B. The annual audit plan describes which audits will be conducted, not the roles and responsibilities within the audit organization.
- D. An engagement letter covers a specific audit engagement between auditor and client, not the internal structure of the audit organization.
Question 63
An internal audit department recently established a quality assurance (QA) program. Which of the following activities is MOST important to include as part of the QA program requirements?
Show answer and explanation
Correct answer: D. Ongoing monitoring of the audit activities
Ongoing monitoring of audit activities is the most important requirement for a QA program because it provides continuous assessment of whether audits are being conducted effectively and meeting quality standards. This continuous monitoring ensures compliance with audit standards, identifies deficiencies in real-time, and enables prompt corrective action. It is the core function that makes a QA program effective.
Why the other options are wrong
- A. Long-term resource planning is important for strategic audit operations but not a QA program requirement.
- B. While feedback from staff is valuable, it is not the primary focus of a QA program.
- C. User satisfaction reports are output measures, not measures of audit quality and compliance with standards.
Question 64
An IS auditor has been asked to advise on measures to improve IT governance within the organization. Which of the following is the BEST recommendation?
Show answer and explanation
Correct answer: D. Implement key performance indicators (KPIs).
Implementing key performance indicators (KPIs) is the best overall recommendation for improving IT governance because KPIs provide measurable targets that align IT activities with business objectives, enable monitoring of IT performance, support decision-making, and create accountability. KPIs establish a framework for continuous governance improvement across the organization. Third-party audits and benchmarking are valuable but are periodic or comparative rather than foundational; executive-drafted IT strategy without measurement mechanisms lacks accountability.
Why the other options are wrong
- A. Annual third-party audits provide periodic assurance but do not establish the continuous governance framework needed.
- B. Executive-drafted strategy is important but without KPIs lacks measurable implementation and accountability.
- C. Benchmarking provides external comparison but does not establish internal governance mechanisms or accountability.
Question 65
Which of the following is the BEST way to mitigate the risk associated with unintentional modifications of complex calculations in end-user computing (EUC)?
Show answer and explanation
Correct answer: A. Have an independent party review the source calculations.
Having an independent party review the source calculations is the best way to mitigate unintentional modification risk in complex EUC because it provides preventive control through peer review before errors propagate. Independent review detects logical errors, unintended changes, and calculation mistakes before the EUC is deployed, catching issues at the source. This approach is more effective than post-deployment verification methods and prevents the perpetuation of errors through business decisions.
Why the other options are wrong
- B. Verifying results through manual calculations is a detective control that occurs after calculations are complete, not preventive.
- C. Secure library execution prevents unauthorized access and changes but does not detect unintentional logical errors in calculations.
- D. Password controls address unauthorized access but do not prevent unintentional modifications made by authorized users.
Question 66
When responding to an ongoing denial of service (DoS) attack, an organization's FIRST course of action should be to:
Show answer and explanation
Correct answer: A. minimize impact.
When responding to an ongoing denial of service attack, the first course of action must be to minimize impact. This is the initial priority in incident response because the attack is actively occurring and causing harm. Minimizing impact involves containment and mitigation measures to reduce damage to business operations. Investigation and restoration of service follow after the immediate threat has been contained.
Why the other options are wrong
- B. Investigating damage is important but is a secondary step after immediate impact mitigation.
- C. Analyzing the attack path is part of investigation and forensics, which comes after minimizing ongoing damage.
- D. Restoring service is important but should not be attempted until the attack has been contained and its impact minimized.
Question 67
When designing a data analytics process, which of the following should be the stakeholder's role in automating data extraction and validation?
Show answer and explanation
Correct answer: B. Indicating which data elements are necessary to make informed decisions
Business stakeholders' primary role in automating data extraction and validation is to identify and specify which data elements are necessary and sufficient for making informed business decisions. Stakeholders own the business requirements and must communicate what data is needed for their decision-making context. Resource allocation is management's role, workflow design is the technical team's responsibility, and business case analysis is typically a finance or strategy function, though stakeholders may contribute information to it.
Why the other options are wrong
- A. Resource allocation and software procurement are management and procurement functions, not stakeholder roles.
- C. Workflow design for technical tools is the responsibility of data engineers and architects, not business stakeholders.
- D. Business case analysis is typically performed by finance or strategy, not primarily by data analytics stakeholders.
Question 68
Which of the following cloud capabilities BEST enables an organization to meet unexpectedly high service demand?
Show answer and explanation
Correct answer: D. Scalability
Scalability is the cloud capability that best enables meeting unexpectedly high service demand by allowing resources to be rapidly increased to handle increased load. Flexibility (A) is broader but less specific to handling sudden demand spikes, high availability (C) ensures uptime but does not address capacity expansion, and alternate routing (B) is a network-level concept unrelated to meeting demand.
Why the other options are wrong
- A. Flexibility refers to adaptability of services generally, not specifically to handling sudden demand increases.
- B. Alternate routing is a network failover concept unrelated to handling increases in service demand.
- C. High availability ensures continuous operation but does not address the ability to increase capacity for unexpected demand.
Question 69
Which of the following is the BEST metric to measure the alignment of IT and business strategy?
Show answer and explanation
Correct answer: D. Level of stakeholder satisfaction with the scope of planned IT projects
Stakeholder satisfaction with the scope of planned IT projects is the best direct metric for measuring IT-business alignment because it reflects whether IT initiatives are addressing business needs and priorities as perceived by business leadership. When stakeholders are satisfied with planned IT project scope, it indicates that IT strategy is aligned with and responsive to business objectives. This metric directly captures the alignment outcome, whereas the other options measure related but less direct indicators.
Why the other options are wrong
- A. Frequency of capability maturity assessments measures assessment activity, not alignment itself.
- B. Percentage of risk assessments including IT-related risk measures risk management practice, not strategic alignment.
- C. Staff satisfaction with IT roles reflects employee experience but does not directly measure IT-business strategic alignment.
Question 70
An IS audit reveals that an organization is not proactively addressing known vulnerabilities. Which of the following should the IS auditor recommend the organization do FIRST?
Show answer and explanation
Correct answer: C. Assess the security risks to the business.
The organization should first assess security risks to the business because this establishes the prioritization framework for addressing vulnerabilities. Risk assessment determines which known vulnerabilities pose the greatest business impact, enabling the organization to allocate remediation resources effectively. Without understanding risk context, recommendations for IPS, DRP testing, or incident response would be premature and potentially misdirected.
Why the other options are wrong
- A. Implementing IPS is a technical control response but doesn't establish priorities; it may address lower-risk vulnerabilities inefficiently.
- B. Testing DRP is important but addresses only disaster recovery, not the proactive vulnerability management issue at hand.
- D. Incident response team awareness is necessary but comes after understanding what risks actually matter to the business.
Question 71
Which of the following is MOST important to ensure when reviewing a global organization's controls to protect data held on its IT infrastructure across all of its locations?
Show answer and explanation
Correct answer: C. Relevant data protection legislation and regulations for each location are adhered to.
Ensuring compliance with relevant data protection legislation and regulations for each location is the most critical concern because operating in violation of local data protection laws exposes the organization to legal liability, regulatory penalties, and reputational damage. Different jurisdictions have varying requirements (GDPR, CCPA, etc.), and compliance is non-negotiable.
Why the other options are wrong
- A. Communications infrastructure capacity is important for performance but not as critical as legal compliance.
- B. Natural disaster preparedness is important for business continuity but does not carry the same legal and compliance imperative as data protection regulation.
- D. Technical capabilities for management and recovery are important but secondary to ensuring legal compliance with data protection requirements.
Question 72
Which of the following provides the MOST comprehensive description of IT's role in an organization?
Show answer and explanation
Correct answer: D. IT charter
An IT charter provides the most comprehensive description of IT's role in an organization because it formally documents IT's mission, objectives, authority, responsibilities, scope, and strategic alignment with business goals. A charter establishes the foundational framework for IT's entire governance structure. Job descriptions only detail individual roles, a project portfolio shows current initiatives but not the overarching role, and an organizational chart merely depicts reporting structures without describing purpose and responsibilities.
Why the other options are wrong
- A. Job descriptions only describe individual positions, not the overall role of IT.
- B. An IT project portfolio shows current work but not IT's comprehensive organizational role.
- C. An organizational chart shows structure and reporting lines but not IT's mission, scope, and responsibilities.
Question 73
Which of the following measures BEST mitigates the risk of exfiltration during a cyberattack?
Show answer and explanation
Correct answer: D. Data loss prevention (DLP) system
A Data Loss Prevention (DLP) system is specifically designed to monitor, detect, and block unauthorized attempts to transfer sensitive data outside the organization. DLP systems work at multiple layers (endpoint, network, email) to prevent exfiltration during cyberattacks by identifying sensitive data patterns and enforcing policies to stop their movement. This directly addresses the exfiltration risk, whereas other options address different security concerns.
Why the other options are wrong
- A. A perimeter firewall controls traffic at network boundaries but does not specifically detect or prevent sensitive data exfiltration within authorized connections.
- B. Hashing is a one-way cryptographic function used for data integrity and password storage, not for preventing exfiltration of sensitive data.
- C. Network access controls manage who can connect to the network but do not specifically prevent authorized users from exfiltrating data once connected.
Question 74
An external IS auditor has been engaged to determine the organization's cybersecurity posture. Which of the following is MOST useful for this purpose?
Show answer and explanation
Correct answer: A. Capability maturity assessment
A capability maturity assessment is the most useful tool for determining an organization's overall cybersecurity posture because it evaluates the organization's current state across multiple dimensions of security capability and identifies maturity levels. This provides a comprehensive view of strengths and weaknesses. Compliance reports show adherence to specific standards, CSA relies on self-reporting which may be biased, and benchmark reports only provide relative comparisons without deep assessment of actual capabilities.
Why the other options are wrong
- B. Compliance reports only demonstrate adherence to specific requirements, not overall cybersecurity maturity or posture.
- C. Control self-assessments may introduce bias and lack the objectivity needed for determining true cybersecurity posture.
- D. Industry benchmarks provide comparative data but do not comprehensively assess an organization's actual cybersecurity capabilities.
Question 75
Which of the following is the MOST effective control to ensure electronic records beyond their retention periods are deleted from IT systems?
Show answer and explanation
Correct answer: B. Build in system logic to trigger data deletion at predefined times.
Building system logic to trigger automatic data deletion at predefined times is the most effective control because it removes human judgment and ensures consistent, reliable execution of retention policies without requiring manual intervention or oversight. Automated controls are more dependable than manual processes and reduce the risk of records being retained beyond their authorized periods. Executing deletions at a single predefined month is inefficient for varying retention periods. Manual review processes are slower and subject to human error. Sampling checks are detective controls that identify past non-compliance but do not prevent it.
Why the other options are wrong
- A. A single predefined month cannot accommodate different retention periods for different record types.
- C. Manual review-based deletion is slower, less reliable, and subject to human error compared to automation.
- D. Sampling checks only detect existing non-compliance; they do not prevent records from being retained past their retention periods.
Question 76
The PRIMARY advantage of object-oriented technology is enhanced:
Show answer and explanation
Correct answer: D. efficiency due to the re-use of elements of logic.
The PRIMARY advantage of object-oriented technology is code reusability and the ability to reuse logic elements across different objects and applications. This reduces development time, effort, and potential errors by leveraging existing, tested components rather than rewriting logic from scratch. Reusability is the foundational benefit that enables increased efficiency in software development.
Why the other options are wrong
- A. Grouping of objects into methods for data access is a structural feature, not the primary advantage.
- B. Sequential program execution management is not a particular strength of object-oriented technology.
- C. Object-oriented technology supports a wide variety of data types, not a restricted variety.
Question 77
Which of the following security assessment techniques attempts to exploit a system's open ports?
Show answer and explanation
Correct answer: B. Penetration testing
Penetration testing is an active, hands-on security assessment that attempts to exploit vulnerabilities and gain unauthorized access to systems, including through open ports. It simulates real-world attacks and is distinctly different from passive scanning. Vulnerability scanning identifies weaknesses but does not attempt exploitation. Network scanning discovers open ports and services but does not exploit them. Password cracking targets authentication credentials, not open ports specifically.
Why the other options are wrong
- A. Vulnerability scanning identifies weaknesses but does not actively attempt to exploit them or gain access.
- C. Network scanning discovers open ports and services but does not attempt to exploit them.
- D. Password cracking targets authentication credentials rather than exploiting open ports directly.
Question 78
Which of the following is the PRIMARY reason for using a digital signature?
Show answer and explanation
Correct answer: A. Authenticate the sender of a message
The primary purpose of a digital signature is to authenticate the sender and verify the integrity of the message through cryptographic means. While digital signatures do verify integrity and sender identity, the PRIMARY reason/purpose is authentication of the sender. Confidentiality (B) requires encryption, not digital signatures. Option C conflates authentication with recipient identity verification, which is not what digital signatures do. Option D about availability is incorrect.
Why the other options are wrong
- B. Confidentiality is provided by encryption, not digital signatures.
- C. Digital signatures authenticate the sender, not the recipient, and primarily serve authentication/integrity purposes.
- D. Availability is not addressed by digital signatures.
Question 79
The PRIMARY objective of value delivery in reference to IT governance is to:
Show answer and explanation
Correct answer: B. optimize investments.
The primary objective of value delivery in IT governance is to optimize investments, ensuring that IT resources and spending generate appropriate returns and support business objectives. While efficiency, compliance, and best practices are important outcomes and supporting goals within IT governance frameworks, the overarching value delivery focus is on ensuring investments achieve their intended business benefits and strategic returns.
Why the other options are wrong
- A. Increasing efficiency is a supporting goal, not the primary objective of value delivery.
- C. Ensuring compliance is part of risk management, a separate pillar from value delivery in governance frameworks.
- D. Promoting best practices is a supporting mechanism but not the primary objective of value delivery.
Question 80
An IS auditor reviewing the threat assessment for a data center would be MOST concerned if:
Show answer and explanation
Correct answer: C. all identified threats relate to external entities.
A threat assessment that includes only external threats is incomplete and dangerous because it ignores internal threats such as insider threats, human error, inadequate maintenance, and disgruntled employees. A comprehensive threat assessment must consider threats from all sources, external and internal. The omission of internal threats represents a significant gap in risk identification that could leave the organization vulnerable.
Why the other options are wrong
- A. Including neighboring organizations' operations provides useful context for understanding the threat landscape.
- B. Local management completing the exercise is appropriate and ensures practical, on-the-ground knowledge.
- D. Some unlikely threats should be included in threat assessments as they may have high impact if they occur; thoroughness is important.
Question 81
Which of the following data would be used when performing a business impact analysis (BIA)?
Show answer and explanation
Correct answer: B. Expected costs for recovering the business
A business impact analysis (BIA) uses expected costs for recovering the business as key input data. Recovery costs, including direct expenses for restoration, infrastructure, and resources needed to restore critical functions, are essential metrics in determining the financial impact of disruptions and informing recovery strategy prioritization.
Why the other options are wrong
- A. Projected impact of current business on future business is strategic planning data, not BIA-specific recovery cost data.
- C. Cost of regulatory compliance is a separate compliance consideration and not directly part of the recovery cost analysis in a BIA.
- D. Cost-benefit analysis of running the current business addresses ongoing operational costs, not the specific recovery costs examined in a BIA.
Question 82
An IS auditor is evaluating the progress of a web-based customer service application development project. Which of the following would be MOST helpful for this evaluation?
Show answer and explanation
Correct answer: B. Critical path analysis reports
Critical path analysis reports are MOST helpful for evaluating project progress because they show which tasks are on the critical path, identify schedule risks, and demonstrate whether the project is tracking toward on-time delivery. This provides objective measurement of development progress against milestones. Developer status reports are subjective, change logs show what changed not progress, and backlog consumption only shows velocity without schedule context.
Why the other options are wrong
- A. Developer status reports are subjective and may not accurately reflect overall project progress or schedule adherence.
- C. Change management logs document what changes occurred but do not directly indicate project progress or schedule performance.
- D. Backlog consumption reports show velocity but lack the schedule and timeline perspective needed to evaluate overall project progress.
Question 83
An organization has assigned two new IS auditors to audit a new system implementation. One of the auditors has an IT-related degree, and one has a business degree. Which of the following is MOST important to meet the IS audit standard for proficiency?
Show answer and explanation
Correct answer: C. Team member assignments must be based on individual competencies.
Team member assignments must be based on individual competencies to meet IS audit standards for proficiency. The ISACA standards require that audit teams collectively possess the necessary competencies, which means assigning tasks according to each team member's strengths and knowledge areas. Having one IT-educated and one business-educated auditor allows strategic assignment based on their respective competencies rather than relying on credentials, supervision, or outsourcing.
Why the other options are wrong
- A. Supervisor review alone does not ensure the team meets proficiency standards; the team itself must have appropriate competencies.
- B. While a recognized certification is valuable, the standard emphasizes team competencies over individual credentials alone.
- D. Co-sourcing is not necessary if the existing team members' competencies are appropriately utilized.
Question 84
Which of the following is the MOST important feature of access control software?
Show answer and explanation
Correct answer: B. Authentication
Authentication is the most important feature of access control software because it verifies that users are who they claim to be. Without proper authentication, identification becomes meaningless, and subsequent controls like violation reporting and nonrepudiation cannot function reliably. Authentication is the foundational security control upon which all other access control functions depend.
Why the other options are wrong
- A. Identification (knowing who the user is) requires authentication to be meaningful and secure.
- C. Violation reporting is important for monitoring but depends on proper authentication and identification first.
- D. Nonrepudiation is valuable for accountability but is secondary to ensuring only authorized users gain access.
Question 85
Critical processes are not defined in an organization's business continuity plan (BCP). Which of the following would have MOST likely identified the gap?
Show answer and explanation
Correct answer: C. Reviewing the business impact analysis (BIA)
Reviewing the business impact analysis (BIA) would most likely have identified the gap of undefined critical processes. The BIA is the process where organizations systematically identify and document all critical business processes, their dependencies, and recovery requirements. This is the primary mechanism for defining what constitutes critical processes. Updating the risk register focuses on threats, not process criticality; reviewing BC strategy is higher-level; and testing the incident response plan assumes processes are already defined.
Why the other options are wrong
- A. The risk register identifies threats and vulnerabilities, not critical business processes.
- B. Business continuity strategy review is too high-level and assumes processes have been identified through more detailed analysis.
- D. Testing the incident response plan occurs after critical processes should have been defined and would reveal the gap but not be the primary identification mechanism.
Question 86
What is the BEST way for an IS auditor to assess the adequacy of an expert consultant who was selected to be involved in an audit engagement?
Show answer and explanation
Correct answer: C. Review the independence and objectivity of the expert.
The independence and objectivity of an expert consultant are critical to ensuring the integrity and reliability of the audit engagement. A consultant who lacks independence or has conflicts of interest could compromise the audit's validity. ISACA standards emphasize that auditors must assess the independence and objectivity of experts to ensure their conclusions can be trusted. While experience, engagement letters, and firm reputation are relevant factors, independence and objectivity are the foundational requirements that enable all other qualifications to be meaningful.
Why the other options are wrong
- A. Understanding experience is important but is secondary to ensuring the expert has no conflicts of interest.
- B. An engagement letter documenting responsibilities is necessary but does not assess the expert's fundamental suitability.
- D. Firm reputation is a positive indicator but does not directly assess the individual expert's independence and objectivity.
Question 87
Which of the following is the MOST effective control to mitigate unintentional misuse of authorized access?
Show answer and explanation
Correct answer: B. Security awareness training
Security awareness training is the most effective control to prevent unintentional misuse because it addresses the root cause by educating users about proper use of their authorized access. While monitoring (A) detects misuse after it occurs, training prevents it proactively. Annual sign-offs (C) and disciplinary action (D) are reactive measures that do not prevent the initial unintentional misuse from happening.
Why the other options are wrong
- A. Monitoring detects misuse but does not prevent unintentional misuse from occurring in the first place.
- C. Annual sign-offs create awareness but are infrequent and do not provide ongoing education to prevent unintentional errors.
- D. Disciplinary action is reactive and inappropriate for unintentional misuse; it also does not prevent future incidents.
Question 88
Which of the following environments is BEST used for copying data and transformation into a compatible data warehouse format?
Show answer and explanation
Correct answer: D. Staging
The staging environment is best used for copying data and transforming it into a compatible data warehouse format. Staging is a dedicated intermediate environment designed specifically for data preparation, extraction, transformation, and loading (ETL) processes. It allows data to be extracted from source systems, transformed into the required format, and validated before being loaded into the production data warehouse. This separation prevents issues in development or testing environments and protects the production warehouse from untested transformations.
Why the other options are wrong
- A. Development is for building code and applications, not for data transformation operations.
- B. Testing is for validating completed solutions, not the primary environment for ongoing ETL processes.
- C. Replication refers to copying data between systems but is not a standard environment type for transformation work.
Question 89
Which of the following should be the PRIMARY basis for procedures to dispose of data securely?
Show answer and explanation
Correct answer: C. Classification of data
The classification of data is the primary basis for determining secure disposal procedures because different sensitivity levels require different levels of protection and disposal rigor. Highly classified or sensitive data requires more stringent disposal methods than non-sensitive data. While data retention policy determines how long to keep data, the classification determines how to destroy it. Media type is secondary to classification, and environmental regulations are constraints but not the primary basis for determining disposal procedures.
Why the other options are wrong
- A. Media type affects how disposal is performed technically, but classification level is the primary factor determining whether rigorous disposal is needed.
- B. Environmental regulations are compliance constraints on disposal methods, not the primary basis for determining what disposal procedures should be applied.
- D. Data retention policy determines retention periods, but classification of the data itself is the primary factor determining the rigor of disposal procedures needed.
Question 90
Which of the following is the GREATEST risk related to the use of virtualized environments?
Show answer and explanation
Correct answer: D. The host may be a potential single point of failure within the system.
The host system is the greatest risk in virtualized environments because it represents a single point of failure for all guest virtual machines. If the host fails, all dependent guests become unavailable simultaneously, creating a critical availability risk. Session hijacking (A) is a general threat not specific to virtualization. Insufficient processing capacity (B) is a performance concern, not a critical security risk. Limited OS changes (C) is a minor operational limitation, not a major risk compared to host dependency.
Why the other options are wrong
- A. Session hijacking is a general threat not uniquely associated with virtualization.
- B. Processing capacity is a performance issue, not a critical security or availability risk.
- C. OS change limitations are operational constraints, not a critical risk to the system.
Question 91
The GREATEST benefit of using a prototyping approach in software development is that it helps to:
Show answer and explanation
Correct answer: B. conceptualize and clarify requirements.
The greatest benefit of prototyping is that it helps conceptualize and clarify requirements by allowing stakeholders to see a tangible, interactive representation of the proposed system early in development. This facilitates feedback, reveals ambiguities in requirements, and ensures alignment between what users expect and what developers build, preventing costly rework later. While prototyping may improve QA efficiency and reduce some testing time, these are secondary benefits. It does not minimize scope changes; in fact, it often reveals scope clarifications. The primary value is achieving shared understanding of requirements upfront.
Why the other options are wrong
- A. Improving QA efficiency is a potential benefit but is secondary to the core advantage of requirements clarity.
- C. Prototyping does not decrease user testing time; if anything, it increases early user engagement to refine requirements.
- D. Prototyping does not minimize scope changes; it often reveals needed scope adjustments by clarifying actual requirements.
Question 92
The PRIMARY benefit of information asset classification is that it:
Show answer and explanation
Correct answer: A. enables risk management decisions.
The primary benefit of information asset classification is that it enables risk management decisions by categorizing assets based on sensitivity, criticality, and impact. This classification directly informs which assets require which levels of protection and control, allowing organizations to allocate security resources appropriately.
Why the other options are wrong
- B. While classification may support alignment of objectives, this is a secondary benefit rather than the primary one.
- C. Classification itself does not prevent loss of assets; it enables decision-making that leads to preventive measures.
- D. Budgeting accuracy is a potential secondary outcome, not the primary benefit of classification.
Question 93
Which of the following is the BEST indication of effective IT investment management?
Show answer and explanation
Correct answer: A. IT investments are mapped to specific business objectives.
The best indication of effective IT investment management is that investments are mapped to specific business objectives. This ensures alignment between IT spending and organizational strategy, enabling proper prioritization, ROI measurement, and accountability. While SDLC adherence, KPI definition, and budget benchmarking are important practices, they do not necessarily indicate that investments serve business goals. A low budget relative to benchmarks could actually indicate underinvestment, and KPIs without business objective linkage lack strategic context.
Why the other options are wrong
- B. Low budget relative to industry benchmarks does not indicate effectiveness; it may indicate underinvestment or poor strategic positioning.
- C. SDLC compliance is a development best practice but does not guarantee investments align with business objectives.
- D. KPI definition is valuable but without linkage to business objectives, it lacks strategic context and effectiveness.
Question 94
An organization's enterprise architecture (EA) department decides to change a legacy system's components while maintaining its original functionality. Which of the following is MOST important for an IS auditor to understand when reviewing this decision?
Show answer and explanation
Correct answer: A. The current business capabilities delivered by the legacy system
An IS auditor's primary concern when reviewing component changes to a legacy system is understanding the current business capabilities the system delivers. Since the requirement is to maintain original functionality, the auditor must first understand what functionality is being delivered to ensure the redesign preserves it. The other options address technical implementation details that are secondary to confirming business capability preservation.
Why the other options are wrong
- B. Database relationships are implementation details; understanding capabilities comes first.
- C. Network topology is a technical design choice not essential to validating functionality preservation.
- D. Data flows are important but secondary to understanding the business capabilities being maintained.
Question 95
Following a security breach in which a hacker exploited a well-known vulnerability in the domain controller, an IS auditor has been asked to conduct a control assessment. The auditor's BEST course of action would be to determine if:
Show answer and explanation
Correct answer: A. the patches were updated.
The auditor's best course of action is to determine if patches were updated. Following a breach exploiting a known vulnerability, the most critical control assessment is whether the organization had a patch management process in place and whether applicable patches had been applied. This addresses the root cause of the compromise. While monitoring logs and network traffic are important detective controls, and high availability is a system characteristic, none of these would have prevented exploitation of a well-known vulnerability. Patch management is the primary preventive control that should have mitigated this risk.
Why the other options are wrong
- B. Log monitoring is a detective control that identifies breaches after they occur, not a preventive control.
- C. High availability classification is unrelated to vulnerability remediation.
- D. Network traffic monitoring is a detective control that would not prevent exploitation of known vulnerabilities.
Question 96
During a disaster recovery audit, an IS auditor finds that a business impact analysis (BIA) has not been performed. The auditor should FIRST:
Show answer and explanation
Correct answer: D. evaluate the impact on current disaster recovery capability.
When an IS auditor discovers that a business impact analysis has not been performed, the first step is to evaluate the impact on current disaster recovery capability. This assessment determines how much risk the organization faces without a BIA, what the implications are, and how this gap affects the overall DR posture. This evaluation informs the severity of findings and next steps, rather than immediately conducting a BIA (which is management's responsibility) or jumping to compliance testing.
Why the other options are wrong
- A. Additional compliance testing is premature without understanding the impact of the BIA gap.
- B. An intermediate report may follow the evaluation but the evaluation comes first.
- C. The auditor should not perform the BIA; management must do this as the missing control.
Question 97
Which of the following is the BEST method to maintain an audit trail of changes made to the source code of a program?
Show answer and explanation
Correct answer: B. Utilize automated version control.
Automated version control is the best method because it systematically captures and maintains a complete, tamper-resistant record of every change made to source code, including who made the change, when, and what was changed. Version control systems are designed specifically for this purpose and provide full traceability. File naming conventions (A) are manual and prone to error; embedding details in code (C) is redundant and difficult to audit; and change registers (D) are manual, error-prone, and lack automation.
Why the other options are wrong
- A. File naming conventions alone do not create an audit trail; they can be inconsistently applied and provide no version history.
- C. Embedding change details within source code is redundant, difficult to enforce consistently, and complicates code review.
- D. Manual change registers are prone to omissions, errors, and are not as reliable as automated tracking systems.
Question 98
The PRIMARY focus of a post-implementation review is to verify that:
Show answer and explanation
Correct answer: B. user requirements have been met.
The primary focus of a post-implementation review is to verify that user requirements have been met. This assessment confirms the system delivers the intended business value and functionality that stakeholders expected. While enterprise architecture compliance, testing execution, and access controls are important aspects to review, the fundamental purpose is to validate that the implemented system satisfies the original user requirements and business objectives.
Why the other options are wrong
- A. Enterprise architecture compliance is important but is not the primary focus of post-implementation review.
- C. Acceptance testing verification is part of the implementation process, not the primary focus of post-implementation review.
- D. Access control design validation is a specific security concern but not the primary overall focus of the review.
Question 99
An IS auditor has discovered that unauthorized customer management software was installed on a workstation. The auditor determines the software has been uploading customer data to an external party. Which of the following is the IS auditor's BEST course of action?
Show answer and explanation
Correct answer: C. Notify the incident response team.
The IS auditor's best course of action is to notify the incident response team immediately. This discovery represents an active security incident involving unauthorized software, data theft, and potential customer data compromise. The incident response team has the authority, expertise, and responsibility to investigate, contain, and remediate the threat. While the auditor may later participate in broader investigations, immediately escalating to the proper incident response channels ensures timely containment and proper handling of the security breach.
Why the other options are wrong
- A. While extent assessment is eventually important, it should be done by the incident response team, not the auditor independently.
- B. Determining the full scope of data theft is part of incident investigation but should be delegated to the response team immediately.
- D. Waiting for the next audit meeting would delay critical incident response actions and could allow further damage or data exfiltration.
Question 100
Which of the following is a threat to IS auditor independence?
Show answer and explanation
Correct answer: C. Internal auditors design remediation plans to address control gaps identified by internal audit
Internal auditors designing remediation plans creates a threat to independence because auditors would then be responsible for implementing solutions they recommended, blurring the line between audit oversight and management responsibility. Recommending controls (A) is advisory in nature, attending steering committee meetings (B) provides necessary visibility, and sharing plans with management (D) ensures transparency, none of these compromise independence like directly designing remediation plans does.
Why the other options are wrong
- A. Recommending controls is an advisory function that does not compromise audit independence.
- B. Attendance at steering committee meetings is necessary for effective audit visibility and does not threaten independence.
- D. Sharing audit plans with management prior to commencement promotes transparency and is a standard practice.
Question 101
What is the MOST difficult aspect of access control in a multiplatform, multiple-site client/server environment?
Show answer and explanation
Correct answer: C. Maintaining consistency throughout all platforms
Maintaining consistency throughout all platforms is the MOST difficult aspect of access control in a multiplatform, multiple-site client/server environment. In heterogeneous environments with different operating systems, applications, and locations, ensuring uniform access policies, user provisioning, authentication mechanisms, and authorization rules across all systems presents significant technical and administrative challenges. Local restrictions on individual platforms (A and D) are comparably easier within their scope, and creating platform-specific user IDs (B) is a routine operational task.
Why the other options are wrong
- A. Restricting a local user on a local platform is a contained, manageable task within a single system.
- B. Creating user IDs valid on specific hosts is a straightforward administrative task.
- D. Restricting a local user to host server resources is isolated to that single connection point.
Question 102
Which of the following audit procedures would be MOST conclusive in evaluating the effectiveness of on e-commerce application system's edit routine?
Show answer and explanation
Correct answer: C. Use of test transactions
Using test transactions is the most conclusive audit procedure because it demonstrates actual system behavior through real execution. Test transactions can verify that edit routines correctly validate, reject invalid data, and accept valid data. This provides empirical evidence of effectiveness. Program documentation review and source code review are static analyses that don't prove runtime behavior, and user interviews are subjective without concrete validation.
Why the other options are wrong
- A. Documentation review does not confirm the edit routine actually functions as intended during execution.
- B. Source code review cannot conclusively demonstrate whether the logic executes correctly or produces expected results.
- D. User interviews provide anecdotal evidence but lack the rigor to conclusively evaluate technical effectiveness.
Question 103
Which of the following is the BEST way for an organization to mitigate the risk associated with third-party application performance?
Show answer and explanation
Correct answer: D. Utilize performance monitoring tools to verify service level agreements (SLAs).
Utilizing performance monitoring tools to verify SLAs is the best way to mitigate third-party application performance risk because it provides continuous, objective measurement against agreed-upon standards. This approach enables proactive identification of performance degradation, validates that the third party is meeting contractual obligations, and provides data for corrective actions or escalation. Real-time monitoring allows the organization to detect and address issues before they impact business operations.
Why the other options are wrong
- A. Internal audit analytics may identify issues but are typically reactive and do not provide continuous real-time performance visibility.
- B. Resource allocation is necessary but is a one-time planning activity; it does not provide ongoing verification that requirements are actually being met.
- C. Capacity planning is important for forward-looking planning but does not verify actual current performance against SLAs.
Question 104
A warehouse employee of a retail company has been able to conceal the theft of inventory items by entering adjustments of either damaged or lost stock items to the inventory system. Which control would have BEST prevented this type of fraud in a retail environment?
Show answer and explanation
Correct answer: B. Separate authorization for input of transactions
Separate authorization for input of transactions would have prevented this fraud because no single employee could both initiate and authorize inventory adjustments. By requiring two different individuals to approve damage or loss adjustments, the control creates a detective barrier that prevents one person from fraudulently concealing theft. This segregation of duties is a fundamental preventive control against unauthorized or fraudulent transactions.
Why the other options are wrong
- A. Statistical sampling is a detective control that identifies irregularities after the fact, not a preventive control.
- C. An edit check for validity only confirms that transaction codes exist; it does not prevent unauthorized adjustments.
- D. Unscheduled audits are detective controls performed after transactions have been recorded, not preventive measures.
Question 105
Which of the following is the MOST appropriate role for an IS auditor assigned as a team member for a software development project?
Show answer and explanation
Correct answer: D. Monitoring assessed risk for the project
An IS auditor's appropriate role is to independently monitor and assess risk throughout the project lifecycle. This maintains auditor independence and objectivity. Implementing controls, developing test scripts, and performing mid-term evaluations would compromise the auditor's independent oversight position and create conflicts of interest with project delivery responsibilities.
Why the other options are wrong
- A. Implementing controls makes the auditor a project participant rather than an independent monitor.
- B. Developing UAT scripts is a project team responsibility that prevents the auditor from independently evaluating testing adequacy.
- C. Performing evaluations of project management processes conflicts with the auditor's need to maintain independence from project decisions.
Question 106
What would be an IS auditor's BEST course of action when an auditee is unable to close all audit recommendations by the time of the follow-up audit?
Show answer and explanation
Correct answer: C. Evaluate the residual risk due to open issues.
When recommendations remain open at follow-up, the IS auditor's best course of action is to evaluate the residual risk posed by unresolved issues. This assessment determines whether the organization can operate acceptably with those risks remaining, whether compensating controls exist, and whether further action is needed. This is more comprehensive and professional than simply retaining them, only recommending compensating controls, or terminating the audit prematurely.
Why the other options are wrong
- A. Merely retaining open issues in results does not address the critical question of whether residual risk is acceptable.
- B. Recommending compensating controls may be part of the solution but does not evaluate the overall risk picture first.
- D. Terminating the follow-up is inappropriate; the auditor must assess the significance of unresolved issues before concluding the engagement.
Question 107
A data breach has occurred due to malware. Which of the following should be the FIRST course of action?
Show answer and explanation
Correct answer: B. Quarantine the impacted systems.
Quarantining impacted systems is the first critical action in a malware breach response. This prevents further spread of the malware to other systems and contains the damage. While shutting down might seem similar, quarantining (isolating from the network while maintaining them for forensic investigation) is the preferred first step that balances containment with preserving evidence. Notifying customers and insurance companies are important but should follow after initial containment, as premature notification without understanding the scope could cause unnecessary panic.
Why the other options are wrong
- A. Shutting down systems immediately may destroy evidence needed for forensic investigation and root cause analysis.
- C. Customer notification is important but should occur after containment and scope assessment to avoid panic and provide accurate information.
- D. Notifying insurance is a subsequent administrative step that should follow initial incident containment and assessment.
Question 108
Which of the following is MOST important to ensure when planning a black box penetration test?
Show answer and explanation
Correct answer: A. The management of the client organization is aware of the testing.
Management awareness and authorization is the most critical element before conducting any penetration test, including black box testing. Without explicit approval from senior management, a penetration test, even with good intentions, could be considered unauthorized access and create legal liability. This is a mandatory prerequisite that supersedes all other planning elements.
Why the other options are wrong
- B. Documentation and communication of results occur after testing and are important for follow-up, not for ensuring the test can proceed safely.
- C. Network architecture diagrams are not available in a true black box test by definition, and their absence is expected in this type of assessment.
- D. While scope determination is important for planning, it cannot proceed without management authorization, making authorization the prerequisite.
Question 109
Which of the following observations would an IS auditor consider the GREATEST risk when conducting an audit of a virtual server farm for potential software vulnerabilities?
Show answer and explanation
Correct answer: B. Antivirus software has been implemented on the guest operating system only.
Antivirus software implemented only on guest operating systems leaves the hypervisor unprotected, creating the greatest vulnerability risk. The hypervisor is the critical foundation that all guest systems depend upon; if compromised, all guest systems are at risk regardless of their individual protections. Monthly guest OS updates (A) is adequate patching, quarterly hypervisor updates (D) is reasonable, and having multiple guest operating systems (C) is normal and manageable. The critical gap is hypervisor-level protection.
Why the other options are wrong
- A. Monthly updates for guest operating systems is an appropriate patching frequency.
- C. Multiple guest operating systems on one hypervisor is a normal virtualization configuration.
- D. Quarterly hypervisor updates is a reasonable maintenance schedule.
Question 110
Which of the following would provide the MOST important input during the planning phase for an audit on the implementation of a bring your own device (BYOD) program?
Show answer and explanation
Correct answer: A. Results of a risk assessment
A risk assessment provides the most critical foundation for audit planning by identifying which areas pose the greatest threats and vulnerabilities specific to the organization's BYOD implementation. This informs audit scope, resource allocation, and testing priorities. While policies, prior audit findings, and device inventory are all relevant inputs, the risk assessment uniquely guides where audit efforts should be concentrated based on organizational risk exposure.
Why the other options are wrong
- B. Policies are necessary to audit against, but they don't guide where to focus audit procedures or identify what risks exist.
- C. Prior audit findings provide historical context but don't assess current risks in the BYOD program.
- D. Device inventory is a data source for testing but doesn't identify which areas pose the greatest audit risk.
Question 111
In an environment that automatically reports all program changes, which of the following is the MOST efficient way to detect unauthorized changes to production programs?
Show answer and explanation
Correct answer: C. Reviewing the last compile date of production programs
In an environment with automatic reporting of program changes, reviewing the last compile date of production programs is the most efficient method to detect unauthorized changes. Compile dates provide a quick indicator of when code was last modified; unexplained recent compile dates would immediately flag unauthorized changes. Testing with data requires time-intensive analysis. User approval verification relies on documentation that may be falsified. Manual code comparison is labor-intensive and impractical in large environments.
Why the other options are wrong
- A. Testing against production programs is time-consuming and may not detect all unauthorized changes.
- B. Verifying user approval only confirms documented approvals and doesn't detect unauthorized modifications.
- D. Manual code comparison is inefficient and impractical as the primary detection method in large environments.
Question 112
Which of the following would BEST manage the risk of changes in requirements after the analysis phase of a business application development project?
Show answer and explanation
Correct answer: C. Ongoing participation by relevant stakeholders
Ongoing participation by relevant stakeholders best manages the risk of changing requirements because continuous stakeholder engagement throughout the analysis and subsequent phases ensures that requirement changes are identified early, evaluated, and managed systematically. This proactive involvement prevents scope creep from becoming uncontrolled and maintains alignment between evolving business needs and development progress.
Why the other options are wrong
- A. IT team sign-off only validates technical feasibility at a single point in time and does not address ongoing requirement changes throughout the project.
- B. Quality assurance reviews occur after development and cannot prevent requirement changes from occurring during or after the analysis phase.
- D. Meeting project deadlines does not address the underlying risk that requirements will change; it merely addresses scheduling.
Question 113
When auditing the closing stages of a system development project, which of the following should be the MOST important consideration?
Show answer and explanation
Correct answer: C. User acceptance test (UAT) results
User acceptance test (UAT) results should be the most important consideration when auditing the closing stages of a system development project because UAT results demonstrate whether the system actually meets business requirements and is fit for purpose before go-live. This validation is critical before handoff to production. Rollback procedures are contingency measures; control requirements should have been addressed throughout development; and functional requirements documentation is a planning artifact from earlier phases.
Why the other options are wrong
- A. Rollback procedures are important contingency planning but less critical than confirming the system actually works as intended.
- B. Control requirements should be validated throughout the development lifecycle, not just at closing; they are necessary but not most important at closing stage.
- D. Functional requirements documentation is important in earlier phases but is less critical at closing than confirming those requirements were actually met.
Question 114
Which of the following is the MOST effective control to mitigate against the risk of inappropriate activity by employees?
Show answer and explanation
Correct answer: C. User activity monitoring
User activity monitoring provides real-time or near-real-time visibility into employee actions, enabling detection of inappropriate activity, enforcing accountability, and serving as both a preventive and detective control. This directly addresses the risk of inappropriate employee behavior most comprehensively.
Why the other options are wrong
- A. Two-factor authentication prevents unauthorized access by outsiders but does not monitor the actions of authenticated employees.
- B. Network segmentation limits lateral movement but does not detect or prevent inappropriate actions by authorized users.
- D. Access recertification reviews who has access but does not monitor what those users actually do with their access.
Question 115
When reviewing past results of a recurring annual audit, an IS auditor notes that findings may not have been reported and independence may not have been maintained. Which of the following IS the auditor's BEST course of action?
Show answer and explanation
Correct answer: D. Inform audit management
When an auditor discovers that past audit findings may not have been reported and independence may not have been maintained, the best course of action is to inform audit management first. Audit management has authority over audit procedures, independence standards, and the integrity of the audit function and must address these governance issues before involving senior management. This follows the proper escalation chain within the audit function.
Why the other options are wrong
- A. Reevaluating controls doesn't address the fundamental audit independence and reporting integrity issues.
- B. Re-performing audits is a response, but not the initial course of action before reporting the concern.
- C. Senior management should be informed by audit management after audit management addresses the issue.
Question 116
Which of the following is the MOST important issue for an IS auditor to consider with regard to Voice-over IP (VoIP) communications?
Show answer and explanation
Correct answer: C. Continuity of service
For an IS auditor evaluating VoIP communications, continuity of service is the most critical concern because VoIP systems replace traditional telephony infrastructure. Service disruption directly impacts business operations and communication capabilities. While nonrepudiation, identity management, and network homogeneity are all relevant security considerations, continuity of service is paramount since a VoIP system that is unavailable cannot function regardless of its security features.
Why the other options are wrong
- A. Nonrepudiation, while important for some communications, is not the primary audit concern for VoIP systems.
- B. Identity management is a component of VoIP security but is secondary to ensuring the system remains operational.
- D. Network homogeneity is a technical consideration but does not address the critical business need for reliable voice communications.
Question 117
Which of the following features of a library control software package would protect against unauthorized updating of source code?
Show answer and explanation
Correct answer: A. Access controls for source libraries
Access controls for source libraries directly protect against unauthorized updating by restricting who can modify source code. This is the primary preventive control that stops unauthorized changes before they occur. While date/time stamping, approvals, and comparisons are useful detective or administrative controls, access controls are the fundamental mechanism that prevents unauthorized access in the first place.
Why the other options are wrong
- B. Date and time stamping records when changes occurred but does not prevent unauthorized updates from happening.
- C. Approval processes are detective/administrative controls that catch unauthorized changes after the fact rather than preventing them.
- D. Release comparison identifies differences between versions but does not prevent unauthorized updates from being made.
Question 118
During the design phase of a software development project, the PRIMARY responsibility of an IS auditor is to evaluate the:
Show answer and explanation
Correct answer: B. controls incorporated into the system specifications.
During the design phase, the PRIMARY responsibility of an IS auditor is to evaluate the controls incorporated into the system specifications. At the design stage, the auditor must ensure that security and control requirements are properly specified and built into the system architecture, as this is when control frameworks are most cost-effective to implement. Evaluating methodology (A) is secondary, future compatibility (C) is a technical consideration beyond primary audit scope, and proposed functionality (D) is a business requirement that is evaluated separately from control assessment.
Why the other options are wrong
- A. Development methodology is important but is not the primary focus of control evaluation.
- C. Future compatibility is a technical design consideration, not the primary audit focus.
- D. Functionality assessment is the responsibility of business analysts and requirements teams, not the auditor's primary focus.
Question 119
An IS auditor finds the log management system is overwhelmed with false positive alerts. The auditor's BEST recommendation would be to:
Show answer and explanation
Correct answer: D. fine tune the intrusion detection system (IDS).
The best recommendation to address an overwhelmed log management system with false positive alerts is to fine-tune the intrusion detection system (IDS). Tuning the IDS rules, thresholds, and detection parameters will reduce false positives at their source, allowing the system to generate more accurate and actionable alerts. This improves the signal-to-noise ratio and enables security personnel to focus on genuine threats without wasting resources investigating false alarms.
Why the other options are wrong
- A. Recruiting more personnel does not solve the root cause of false positives; it merely adds resources to handle noise.
- B. Establishing criteria for reviewing alerts is a reactive response and still requires processing false positives.
- C. Reducing firewall rules would not address false positives generated by the IDS and could reduce security coverage.
Question 120
Which of the following is the MOST effective way to maintain network integrity when using mobile devices?
Show answer and explanation
Correct answer: B. Implement network access control.
Network access control (NAC) is the most effective approach for maintaining network integrity with mobile devices because it evaluates device compliance and security posture before granting network access. NAC can enforce policies requiring authentication, encryption, patch levels, and other security requirements on mobile devices before they connect, preventing non-compliant devices from compromising network integrity.
Why the other options are wrong
- A. Outbound firewall rules manage traffic leaving the network but don't prevent unauthorized or non-compliant mobile devices from accessing it.
- C. Network reviews are periodic assessments that don't proactively maintain integrity in real-time as devices connect.
- D. Access control lists manage permissions for known resources but don't evaluate mobile device security posture or compliance before network access.
Question 121
Which of the following is the BEST source of information for an IS auditor to use as a baseline to assess the adequacy of an organization's privacy policy?
Show answer and explanation
Correct answer: D. Local privacy standards and regulations
Local privacy standards and regulations provide the mandatory baseline that an organization must meet. While best practices, historical breaches, and benchmarks are all useful inputs, they are secondary to understanding the specific legal and regulatory requirements that apply to the organization's jurisdiction and industry. An IS auditor must first ensure compliance with applicable law before assessing against voluntary standards.
Why the other options are wrong
- A. Best practices provide guidance but are not binding requirements and may exceed or fall short of what is legally required.
- B. Historical breaches inform risk management but do not establish the baseline standard the policy should meet.
- C. Benchmarks from similar organizations are helpful for comparative analysis but do not define the organization's specific obligations.
Question 122
Which of the following provides an IS auditor assurance that the interface between a point-of-sale (POS) system and the general ledger is transferring sales data completely and accurately?
Show answer and explanation
Correct answer: B. Monthly bank statements are reconciled without exception.
Monthly bank statement reconciliation without exception provides assurance that sales data transferred from POS to general ledger is complete and accurate because discrepancies would be detected. If the interface transferred data incompletely or inaccurately, bank reconciliation would fail or show exceptions. This is a substantive control that validates end-to-end data integrity. Electronic receipt copies (A) don't verify transfer accuracy. Encryption (C) ensures confidentiality, not completeness or accuracy. Real-time processing (D) doesn't inherently ensure accuracy compared to batch processing.
Why the other options are wrong
- A. Maintaining electronic receipts documents transactions but does not verify that data transferred accurately to the ledger.
- C. Encryption protects data in transit but does not provide assurance that transferred data is complete and accurate.
- D. Real-time versus batch processing does not inherently provide assurance of data completeness or accuracy in transfers.
Question 123
Due to a recent business divestiture, an organization has limited IT resources to deliver critical projects. Reviewing the IT staffing plan against which of the following would BEST guide IT management when estimating resource requirements for future projects?
Show answer and explanation
Correct answer: D. Records of actual time spent on projects
Records of actual time spent on projects BEST guide IT management when estimating resource requirements for future projects. Historical actuals from the organization's own experience provide the most relevant baseline for projecting staffing needs, as they reflect the organization's specific context, technologies, processes, and productivity patterns. While peer benchmarks (A) offer external comparison, internal records are more accurate for planning. HR sourcing strategy (B) addresses hiring mechanisms rather than capacity estimation, and budgeted forecasts (C) are outputs of estimation rather than inputs to it.
Why the other options are wrong
- A. Peer benchmarks provide external reference points but may not reflect the organization's specific circumstances and efficiency.
- B. HR sourcing strategy addresses how to acquire resources, not how many are needed.
- C. Budgeted forecasts are typically the result of resource estimation, not the basis for it.
Question 124
An IS auditor is asked to review a large organization's change management process. Which of the following practices presents the GREATEST risk?
Show answer and explanation
Correct answer: D. Emergency code changes are promoted without user acceptance testing (UAT).
Emergency code changes promoted without user acceptance testing (UAT) presents the greatest risk because UAT is a critical control that verifies changes function as intended and do not introduce unintended consequences. Bypassing UAT means changes go directly to production without validation by business users, dramatically increasing the risk of system failures, data corruption, or business process disruptions. While emergency changes may sometimes be necessary, proceeding without any testing significantly amplifies operational risk.
Why the other options are wrong
- A. A senior developer making transaction data changes is a segregation of duties concern but may be acceptable in smaller organizations with compensating controls.
- B. Incomplete documentation is a control gap but does not immediately expose the system to functional failures the way untested code does.
- C. A system administrator performing code migration during planned downtime is a standard practice and does not inherently present greater risk than untested emergency changes.
Question 125
Code changes are compiled and placed in a change folder by the developer. An implementation team migrates changes to production from the change folder. Which of the following BEST indicates separation of duties is in place during the migration process?
Show answer and explanation
Correct answer: B. The implementation team does not have access to change the source code.
Separation of duties requires that different individuals perform different functions to prevent fraud and error. The implementation team not having access to change source code is the clearest indicator that separation of duties is in place during migration. This ensures the development function (code writing) is separated from the implementation function (deployment), preventing any single person from both creating and deploying code without oversight.
Why the other options are wrong
- A. Code review is a quality control measure but does not specifically demonstrate separation of duties between developer and implementer.
- C. Lack of coding experience is an inadequate control and does not represent formal separation of duties; it relies on competency rather than role definition.
- D. Developer approval of their own changes violates separation of duties rather than demonstrating it.
Question 126
Which of the following will BEST help detect software licensing issues in a networked environment where all software is purchased and loaded by IT?
Show answer and explanation
Correct answer: B. Comparing the number of individual software instances installed to the license inventory
Comparing the number of individual software instances installed to the license inventory provides the most direct way to detect licensing issues. This quantitative approach identifies discrepancies between what is deployed and what is licensed. Option A checks purchased software but may miss unlicensed versions; Option C relies on manual identification of unlicensed software versions; Option D addresses metering mechanisms rather than overall compliance detection.
Why the other options are wrong
- A. This approach only verifies purchased software is installed but cannot detect unlicensed or unauthorized software.
- C. Manual review of known unlicensed versions is labor-intensive and may miss variants or newly identified unlicensed software.
- D. Metering software compliance is specific to per-seat licensing and does not address broader licensing compliance detection.
Question 127
A PRIMARY benefit derived by an organization employing control self-assessment (CSA) techniques is that CSA:
Show answer and explanation
Correct answer: A. can identify high-risk areas for detailed review.
The primary benefit of CSA is that it enables the organization to systematically identify and prioritize high-risk areas requiring detailed audit review. CSA engages management and process owners in evaluating controls, resulting in better risk identification and allowing auditors to focus resources on the most critical areas. This improves audit efficiency and effectiveness.
Why the other options are wrong
- B. IS auditors must maintain independence; CSA is performed by management, not auditors independently.
- C. CSA supplements but cannot replace traditional audits, which provide independent assurance.
- D. CSA reinforces that management owns control responsibility; it does not allow management to relinquish this responsibility.
Question 128
An IS auditor is reviewing an organization's primary router access control list. Which of the following should result in a finding?
Show answer and explanation
Correct answer: A. There are conflicting permit and deny rules for the IT group.
Conflicting permit and deny rules in an ACL create ambiguity in access control enforcement and represent a configuration error. Depending on how the router processes rules (typically first-match or most-specific-match), this can lead to unpredictable access decisions, either blocking legitimate traffic or allowing unauthorized access. This is a clear security misconfiguration that warrants a finding.
Why the other options are wrong
- B. Having one rule per group is actually a reasonable design practice that simplifies management and troubleshooting.
- C. Individual permissions overriding group permissions is a normal and often desirable security practice for fine-grained access control.
- D. Allowing the network security group to change NAT is not inherently problematic if NAT management is part of their defined responsibilities.
Question 129
The use of control totals reduces the risk of:
Show answer and explanation
Correct answer: D. incomplete processing.
Control totals are cumulative sums or counts used to verify that all records have been processed completely and correctly. They directly reduce the risk of incomplete processing by ensuring no data is omitted during batch processing or file transfers. This detective control identifies when a batch count doesn't match the expected total, signaling missing transactions.
Why the other options are wrong
- A. Control totals do not prevent posting errors to wrong records; they verify completeness, not accuracy of individual record routing.
- B. Control totals are unrelated to backup procedures or backup adequacy.
- C. Control totals do not address authorization controls; they focus on data completeness, not access or approval.
Question 130
The PRIMARY purpose of running a new system in parallel is to:
Show answer and explanation
Correct answer: A. validate the operation of the new system against its predecessor.
The primary purpose of parallel running is to validate that the new system operates correctly by comparing its results against the proven predecessor system. This validation provides confidence in the new system's reliability before full cutover. While parallel running may reveal efficiency differences or interface errors, these are secondary benefits; the main purpose is validation of operational correctness against a known working baseline.
Why the other options are wrong
- B. Determining efficiency is a comparison benefit, not the primary purpose of parallel running.
- C. Error resolution occurs as a result of parallel validation, but is not the primary purpose.
- D. Unit and system testing should occur before parallel running, not as its basis.
Question 131
During an audit of a disaster recovery plan (DRP) for a critical business area, an IS auditor finds that not all critical systems are covered. What should the auditor do NEXT?
Show answer and explanation
Correct answer: D. Verify whether the systems are part of the business impact analysis (BIA)
When an auditor finds that not all critical systems are covered in a disaster recovery plan, the NEXT step should be to verify whether the systems are part of the business impact analysis (BIA). The BIA determines which systems are truly critical and should be included in the DRP. If systems are not in the BIA, they may not require DRP coverage; if they are in the BIA but not in the DRP, this is a significant gap. This verification step logically precedes impact evaluation (A), establishes context before escalation (B), and is more current than prior year results (C).
Why the other options are wrong
- A. Evaluating impact is premature before determining whether these systems should be covered per the BIA.
- B. Escalation is appropriate after establishing the severity and context of the finding.
- C. Prior year results provide historical context but do not determine current DRP adequacy.
Question 132
An organization has outsourced its data processing function to a service provider. Which of the following would BEST determine whether the service provider continues to meet the organization's objectives?
Show answer and explanation
Correct answer: D. Review of performance against service level agreements (SLAs)
Service Level Agreements (SLAs) define the specific performance metrics and objectives the service provider is contractually obligated to meet. Reviewing performance against SLAs provides objective, measurable evidence of whether the provider continues to deliver against organizational requirements. Independent audits, insurance adequacy, and personnel training are all important but are supporting factors rather than the primary measurement of whether objectives are being met.
Why the other options are wrong
- A. While periodic audits provide assurance, they are retrospective and less direct than current SLA performance measurement.
- B. Insurance adequacy addresses financial risk mitigation but does not measure whether the provider meets operational objectives.
- C. Personnel training assessment is a control factor but does not directly measure whether service objectives are being achieved.
Question 133
An accounting department uses a spreadsheet to calculate sensitive financial transactions. Which of the following is the MOST important control for maintaining the security of data in the spreadsheet?
Show answer and explanation
Correct answer: B. Access to the spreadsheet is given only to those who require access.
Access control is the foundational security mechanism for protecting sensitive data in spreadsheets. Limiting access only to those with legitimate need directly prevents unauthorized viewing, modification, or theft of sensitive financial data. While backups, reconciliation, and locking are valuable controls, they are secondary to preventing unauthorized access in the first place. An unauthorized user with access can bypass locks or escape detection through reconciliation.
Why the other options are wrong
- A. Backups protect against data loss but don't prevent unauthorized access or use of sensitive data.
- C. Reconciliation detects errors or fraud but doesn't prevent unauthorized access to the data.
- D. Locking prevents inadvertent changes but can be bypassed by someone with legitimate access intent and doesn't prevent viewing or authorized misuse.
Question 134
Which of the following is the BEST way to mitigate the risk associated with malicious changes to binary code during the software development life cycle (SDLC)?
Show answer and explanation
Correct answer: C. Cryptographic hash
Cryptographic hash functions are the best mitigation for detecting malicious changes to binary code. By computing a hash of the binary code at a trusted point and comparing it later, any unauthorized modification will produce a different hash, immediately revealing tampering. This provides integrity verification without encryption overhead.
Why the other options are wrong
- A. Parity check is a simple error-detection mechanism insufficient for detecting intentional malicious modifications to binary code.
- B. Digital envelope combines encryption and key exchange but does not specifically detect alterations to existing binary code; it protects new transmissions.
- D. Segregation of duties prevents unauthorized changes during development but does not detect changes that have already occurred or detect modifications by authorized personnel acting maliciously.
Question 135
Which of the following is the BEST indication of the completeness of interface control documents used for the development of a new application?
Show answer and explanation
Correct answer: D. All inputs and outputs for potential actions are included.
Interface control documents are complete when they include all possible inputs and outputs for all potential actions the interface may perform. This comprehensive coverage ensures that developers have documented every data flow scenario, reducing the risk of unhandled cases or missed requirements. Options A, B, and C describe outcomes or review processes but do not directly measure completeness, a document could fail transfers, be reviewed, and still be incomplete if potential actions are missing.
Why the other options are wrong
- A. Failed transfers indicate that the interface may have issues, but do not demonstrate that documentation is complete; completeness precedes implementation.
- B. End-user review confirms acceptance but does not verify that all potential inputs and outputs have been documented.
- C. Recording successful and failed transfers indicates good monitoring but does not demonstrate that the documentation itself is complete.
Question 136
Which of the following is the BEST approach for determining the overall IT risk appetite of an organization when business units use different methods for managing IT risks?
Show answer and explanation
Correct answer: C. Establish a global IT risk scoring criteria.
Establishing a global IT risk scoring criteria ensures consistent evaluation and comparison across all business units, creating a unified organizational risk appetite standard. This approach allows meaningful aggregation of risk information and ensures all units are evaluated against the same standards, rather than averaging incompatible measurements or selecting a single unit's approach.
Why the other options are wrong
- A. Averaging risk levels masks important variations and treats incompatible measurements as equivalent.
- B. Using the highest-rated risk level provides no overall appetite statement and is overly conservative.
- D. Prioritizing risk scenarios addresses specific risks but does not establish organization-wide appetite criteria.
Question 137
When reviewing a data classification scheme, it is MOST important for an IS auditor to determine if:
Show answer and explanation
Correct answer: C. the security criteria are clearly documented for each classification.
It is most important to determine if security criteria are clearly documented for each classification level. This is fundamental to a data classification scheme because it ensures that the classification system actually drives security decisions and resource allocation. Without clear security criteria tied to each classification, the classification scheme becomes meaningless, staff won't know what protection level each classification requires, and different parts of the organization may apply inconsistent protections. Clear documented criteria enable consistent implementation and auditing of the classification scheme.
Why the other options are wrong
- A. While approval authority is important, it's a procedural aspect; the substance of what security protections apply is more critical.
- B. Manager identification relates to governance structure but doesn't ensure the classifications have meaningful security implications.
- D. Different classifications for each asset is impractical and unnecessary; multiple assets can share the same classification level if they have similar protection requirements.
Question 138
Which of the following would be of MOST concern when determining if information assets are adequately safeguarded during transport and disposal?
Show answer and explanation
Correct answer: C. Lack of appropriate data classification
Data classification is foundational to determining what safeguards are appropriate during transport and disposal. Without proper classification, an organization cannot determine the sensitivity level of information assets and therefore cannot ensure proportionate protective measures during these high-risk phases. Data classification drives all subsequent protection decisions. While labeling (option B) is important for implementation, classification must precede it. Awareness training and password protection are secondary controls compared to the foundational classification.
Why the other options are wrong
- A. Awareness training supports proper handling but lacks of training does not prevent classification schemes from existing and being applied.
- B. Labeling is important for implementing protection but follows from classification; without classification, labeling lacks purpose and criteria.
- D. Password protection is not the primary concern for physical transport and disposal of information assets; classification drives the appropriate protection method needed.
Question 139
Which of the following is MOST appropriate to prevent unauthorized retrieval of confidential information stored in a business application system?
Show answer and explanation
Correct answer: B. Enforce an internal data access policy.
Enforcing an internal data access policy is the most appropriate control to prevent unauthorized retrieval of confidential information because it establishes clear rules defining who can access what data under which circumstances. A well-defined access policy provides the foundation for all access control decisions and should be consistently enforced across the application. While other options provide supporting technical controls, the policy framework is the primary preventive control.
Why the other options are wrong
- A. Segregation of duties prevents individuals from holding conflicting responsibilities but does not directly control data retrieval access.
- C. Digital signatures provide non-repudiation and integrity verification but do not prevent unauthorized initial retrieval of data.
- D. Single sign-on simplifies authentication but does not restrict what data an authenticated user can access.
Question 140
An organization has shifted from a bottom-up approach to a top-down approach in the development of IT policies. This should result in:
Show answer and explanation
Correct answer: A. greater consistency across the organization
A top-down approach to IT policy development, initiated by senior leadership and cascaded throughout the organization, naturally results in greater consistency across the organization because policies are standardized from the highest level and applied uniformly. While best practices may be incorporated (B), comprehensive risk assessment (C), and synthesis of operational policies (D) are not necessarily outcomes of the top-down approach itself, the primary benefit is the uniformity it enforces.
Why the other options are wrong
- B. Greater adherence to best practices depends on the quality of the top-down policies, not simply on using a top-down approach.
- C. A more comprehensive risk assessment plan is not a direct result of shifting to a top-down policy development approach.
- D. Synthesis of existing operational policies is more characteristic of bottom-up approaches, not top-down approaches.
Question 141
Which of the following is the BEST way to mitigate the risk associated with technology obsolescence?
Show answer and explanation
Correct answer: A. Create tactical and strategic IS plans.
Creating tactical and strategic IS plans is the best mitigation for technology obsolescence because these plans provide a systematic framework for evaluating technology needs, planning upgrades, and aligning technology investments with business strategy over both short and long terms. This proactive planning approach addresses obsolescence comprehensively.
Why the other options are wrong
- B. Budget provisions for upgrades are reactive and do not address the underlying need to evaluate and plan technology evolution.
- C. Investing in current technology is costly and does not guarantee protection against future obsolescence.
- D. A technology watch team can monitor trends but does not directly mitigate risk without formal planning and budgeting mechanisms.
Question 142
An IS auditor observes that a business-critical application does not currently have any level of fault tolerance. Which of the following is the GREATEST concern with this situation?
Show answer and explanation
Correct answer: D. Single point of failure
A single point of failure is the greatest concern because it means the entire system will be unavailable if that one component fails, with no redundancy or alternative path. This is a critical risk for business-critical applications. While service degradation, MTBF, and damage tolerance are all related concepts, the fundamental architectural weakness is the existence of a single point of failure that can cause complete system unavailability.
Why the other options are wrong
- A. Degradation of services is a symptom rather than the core concern; without fault tolerance, the system fails completely rather than degrading.
- B. MTBF is a measurement metric that may actually be acceptable; the concern is what happens when failure occurs, not the frequency.
- C. Limited tolerance for damage is imprecise terminology; the real issue is zero tolerance for any single component failure.
Question 143
Which of the following is the GREATEST concern associated with control self-assessments (CSAs)?
Show answer and explanation
Correct answer: C. Controls may not be assessed objectively.
The greatest concern with control self-assessments is the lack of objectivity, employees assessing their own controls may be biased, overly optimistic, or have conflicts of interest in reporting results. This undermines the credibility and reliability of the assessment. While awareness issues and communication gaps are also concerns, the fundamental problem with CSAs is that self-interested parties may not provide objective evaluations of control effectiveness.
Why the other options are wrong
- A. Insufficient awareness of controls can be mitigated through training and preparation before the CSA.
- B. Limited assurance is a characteristic of CSAs but is often accepted as a trade-off for their cost-effectiveness.
- D. Communication challenges are operational issues that can be addressed through better CSA program design and management.
Question 144
Due to system limitations, segregation of duties (SoD) cannot be enforced in an accounts payable system. Which of the following is the IS auditor's BEST recommendation for a compensating control?
Show answer and explanation
Correct answer: A. Require written authorization for all payment transactions.
When system limitations prevent enforcing segregation of duties, written authorization serves as a compensating control by creating an independent approval step that must be documented before transactions are processed. This control substitutes for the system's inability to separate incompatible functions by requiring human review and approval. Transaction history review (B) is detective only and post-transaction. Reconciliation (C) detects errors after the fact. Restricting to senior staff (D) provides weaker compensation than explicit written authorization requirements.
Why the other options are wrong
- B. Reviewing transaction history is a detective control that occurs after transactions are processed, not a preventive compensating control.
- C. Reconciliation is also a detective control that identifies discrepancies after the fact, not a preventive compensating control.
- D. Restricting authorization to senior staff does not create the same level of control as requiring documented written authorization for each transaction.
Question 145
When evaluating the management practices at a third-party organization providing outsourced services, the IS auditor considers relying on an independent auditor's report. The IS auditor would FIRST:
Show answer and explanation
Correct answer: A. review the objectives of the audit.
Before relying on an independent auditor's report, an IS auditor must first review the objectives of the audit to determine whether the scope and focus align with the specific areas of concern for the organization. The audit objectives define what was examined and tested. Only after confirming that the audit covered relevant areas can the auditor assess the report's applicability and reliability. Examining workpapers, discussing with the auditor, and reviewing implementation of recommendations are all appropriate follow-up steps, but they come after confirming the audit's objectives are suitable.
Why the other options are wrong
- B. Examining workpapers comes after determining whether the audit's objectives are relevant to the organization's needs.
- C. Discussing the report with the independent auditor is premature before understanding the audit's scope and objectives.
- D. Determining implementation of recommendations is a later step in the process of evaluating the report's value.
Question 146
In a RACI model, which of the following roles must be assigned to only one individual?
Show answer and explanation
Correct answer: B. Accountable
In the RACI model, Accountable must be assigned to only one individual because accountability requires a single point of ownership and ultimate decision-making authority. This prevents confusion about who has final authority and responsibility. The other roles, Responsible, Consulted, and Informed, can be distributed among multiple people to ensure proper collaboration and communication.
Why the other options are wrong
- A. Responsible can be assigned to multiple individuals who perform the work.
- C. Informed can be assigned to multiple stakeholders who need to be kept updated.
- D. Consulted can be assigned to multiple people whose input is sought before decisions are made.
Question 147
Which of the following BEST minimizes performance degradation of servers used to authenticate users of an e-commerce website?
Show answer and explanation
Correct answer: B. Configure each authentication server as belonging to a cluster of authentication servers.
Configuring authentication servers as a cluster distributes the authentication load across multiple servers, preventing any single server from becoming a bottleneck and minimizing performance degradation through load balancing and redundancy. Duplexing disks (A) addresses storage redundancy but not load distribution. A primary-secondary configuration (C) provides failover but not load balancing during normal operations. RAID configuration (D) improves disk reliability but doesn't address server-level performance distribution.
Why the other options are wrong
- A. Disk duplexing addresses storage redundancy but does not distribute authentication load across servers.
- C. Primary-secondary provides failover capability but does not load balance during normal operation.
- D. RAID controller configuration improves disk reliability but does not reduce server performance degradation.
Question 148
Which of the following observations noted during a review of the organization's social media practices should be of MOST concern to the IS auditor?
Show answer and explanation
Correct answer: C. The organization does not have a documented social media policy.
The absence of a documented social media policy is the greatest concern because it establishes no baseline for acceptable use, security standards, or compliance requirements. Without a documented policy, there is no framework for evaluating other observations or controlling risks. While lack of training, approval processes, and role distribution are concerns, they cannot be properly addressed without an underlying documented policy.
Why the other options are wrong
- A. Incomplete security awareness training is concerning but can be addressed once a policy framework exists.
- B. Lack of post approval is a procedural control that should be documented in a formal policy.
- D. Multiple authorized publishers is a risk management issue that should be addressed within a documented policy framework.
Question 149
The waterfall life cycle model of software development is BEST suited for which of the following situations?
Show answer and explanation
Correct answer: D. The project requirements are well understood.
The waterfall model is best suited for projects where requirements are well understood and stable from the outset. Waterfall's sequential phases (requirements, design, implementation, testing) work well when you can clearly define and document all requirements upfront with minimal expected changes. This allows for predictable planning and execution without the iterative feedback loops that agile methods provide.
Why the other options are wrong
- A. New technology introduces uncertainty and unknowns that require iterative exploration and adjustment, which waterfall does not accommodate well.
- B. Object-oriented design is independent of life cycle methodology; both waterfall and agile can use OO approaches.
- C. Time pressures favor agile methods, which can deliver working increments quickly and adapt to urgent changes rather than waterfall's lengthy sequential phases.
Question 150
An IS auditor is planning an audit of an organization's accounts payable processes. Which of the following controls is MOST important to assess in the audit?
Show answer and explanation
Correct answer: A. Segregation of duties between issuing purchase orders and making payments
Segregation of duties between issuing purchase orders and making payments is the most critical control in accounts payable. This fundamental control prevents a single individual from initiating, authorizing, and executing payments, which is the primary fraud risk in this process. Without this segregation, there is minimal protection against unauthorized or fraudulent payments. While management review and authorization controls are important, they are secondary to preventing the concentration of payment authority in one person.
Why the other options are wrong
- B. Management review of purchase orders is a detective control but does not prevent the primary risk of a single person controlling the entire payment process.
- C. Authorization tiers are important but less critical than ensuring different people handle ordering and payment execution.
- D. Segregation between receiving invoices and setting authorization limits does not address the most direct fraud risk in accounts payable.
Question 151
Which of the following is MOST likely to ensure that an organization's systems development meets its business objectives?
Show answer and explanation
Correct answer: A. Business owner involvement
Business owner involvement is the most critical factor ensuring that systems development aligns with business objectives. Business owners define what needs to be built and validate that the system meets actual business needs throughout development, preventing misalignment and ensuring the final solution delivers intended business value.
Why the other options are wrong
- B. A project plan and requirements are necessary but do not guarantee business alignment if business owners are not actively involved in defining and validating those requirements.
- C. Focusing on strategic projects does not ensure that individual development efforts meet their specific business objectives; selection criteria differ from execution oversight.
- D. Segregation of development and testing supports quality assurance but does not directly ensure systems meet business objectives.
Question 152
A CFO has requested an audit of IT capacity management due to a series of finance system slowdowns during month-end reporting. What would be MOST important to consider before including this audit in the program?
Show answer and explanation
Correct answer: A. Whether the system's performance poses a significant risk to the organization
Before including an audit in the program, an IS auditor must prioritize based on risk. The most important consideration is whether the identified issue, system slowdowns during critical financial reporting, poses a significant risk to the organization. Risk-based audit planning ensures resources are allocated to areas where failures have the greatest business impact. If capacity management issues don't significantly threaten organizational objectives, they may not warrant immediate audit attention regardless of stakeholder interest or internal skill availability.
Why the other options are wrong
- B. Stakeholder commitment is important for audit execution, but risk assessment comes first in prioritization.
- C. The consequence of delays (increased manual processing) relates to the impact assessment of risk, not the primary consideration.
- D. Internal auditor skills can be developed or external expertise obtained if the audit is high-risk; lack of skills alone shouldn't prevent a critical audit.
Question 153
An IS auditor is observing transaction processing and notes that a high-priority update job ran out of sequence. What is the MOST significant risk from this observation?
Show answer and explanation
Correct answer: D. The job completes with invalid data.
When a high-priority update job runs out of sequence, the most significant risk is that it completes with invalid data. Batch jobs depend on specific sequencing because subsequent jobs often rely on data from prior jobs being complete and accurate. Running out of sequence means prerequisite data may not exist or be incomplete, causing the out-of-sequence job to process against incorrect or incomplete data. Lack of change control is a control issue but not the primary risk. Previous job failures are a secondary concern. Incomplete execution is possible but less significant than data integrity.
Why the other options are wrong
- A. Lack of change control is a control deficiency but not the primary risk from out-of-sequence execution.
- B. Previous job failures are a secondary concern; the immediate risk is to data validity.
- C. Incomplete execution is possible but less significant than the risk of processing invalid data.
Question 154
Which task should an IS auditor complete FIRST during the preliminary planning phase of a database security review?
Show answer and explanation
Correct answer: A. Determine which databases will be in scope.
Determining which databases will be in scope is the logical first step in preliminary planning for a database security review. This establishes the boundaries of the audit and ensures resources are allocated appropriately, and all other planning activities depend on knowing what systems are being audited. This foundational decision precedes all subsequent analysis and evaluation efforts.
Why the other options are wrong
- B. Identifying critical controls requires first knowing which databases are in scope.
- C. Evaluating database types is secondary to first determining the scope of review.
- D. A business impact analysis is important but premature until scope is established.
Question 155
An IS auditor concludes that logging and monitoring mechanisms within an organization are ineffective because central servers are not included within the central log repository. Which of the following audit procedures would have MOST likely identified this exception?
Show answer and explanation
Correct answer: C. Comparing a list of all servers from the directory server against a list of all servers present in the central log repository
Comparing a complete list of all servers from an authoritative source (directory server) against the central log repository directly identifies which servers are missing from logging. This comprehensive reconciliation approach will definitively expose any gaps in coverage, including central servers not being included. Options A, B, and D focus on samples or specific data rather than performing a complete reconciliation of what should be logged versus what is being logged.
Why the other options are wrong
- A. Year-over-year comparison may not identify servers missing from the current year if they were also missing previously.
- B. Inspecting alert samples only validates that existing alerts function properly, not whether all required servers are included.
- D. Reviewing alert settings tests configuration quality but doesn't identify whether servers are actually present in the repository.
Question 156
Which of the following should be the FIRST step when developing a data loss prevention (DLP) solution for a large organization?
Show answer and explanation
Correct answer: C. Conduct a data inventory and classification exercise.
Before creating DLP policies, identifying approved workflows, or conducting threat analysis, an organization must first understand what data it has, where it resides, and how sensitive it is. Data inventory and classification is the foundational step that informs all subsequent DLP decisions, making it logically the FIRST step in developing a comprehensive DLP solution.
Why the other options are wrong
- A. Creating policies requires knowing what data exists and its sensitivity level first.
- B. Threat analysis should follow data classification to target the most critical assets.
- D. Approved workflows should be identified after understanding the data landscape, not before.
Question 157
Which of the following is MOST important for an IS auditor to examine when reviewing an organization's privacy policy?
Show answer and explanation
Correct answer: B. The organization's legitimate purpose for collecting personal data
The organization's legitimate purpose for collecting personal data is the most important element for an IS auditor to examine because it forms the legal and ethical foundation for all data collection activities. Privacy regulations like GDPR and CCPA require documented lawful bases for processing. Without a clear legitimate purpose, all subsequent data handling activities, including encryption, retention, and sharing, lack proper justification.
Why the other options are wrong
- A. Explicit regulator permission is not always required; lawful bases under privacy frameworks may include consent or contractual necessity without prior regulator approval.
- C. While encryption is important for data protection, it does not justify data collection itself and is a technical control rather than a foundational privacy principle.
- D. Prohibition on third-party sharing is too restrictive and impractical; the key is whether sharing is disclosed and compliant with stated purposes, not whether it's prohibited entirely.
Question 158
An IS auditor is reviewing a sample of production incidents and notes that a root cause analysis is not being performed. Which of the following is the GREATEST risk associated with this finding?
Show answer and explanation
Correct answer: A. The same incident may occur in the future.
Without root cause analysis, the underlying reasons for incidents remain unknown, making it impossible to implement corrective measures. This directly results in the same incidents recurring in the future. While timely resolution, prioritization, and SLA compliance are important, they are consequences of not understanding root causes. The greatest risk is the cyclical nature of preventable incidents.
Why the other options are wrong
- B. Timely resolution depends on incident severity and resource availability, not primarily on root cause analysis.
- C. Inappropriate prioritization is a process issue, not the greatest risk from lack of root cause analysis.
- D. SLA compliance is a scheduling and resource management issue, not directly caused by missing root cause analysis.
Question 159
Which of the following system implementation approaches allows for the LONGEST overlap period between the old and new systems?
Show answer and explanation
Correct answer: D. Parallel
The parallel approach runs old and new systems simultaneously, providing the longest overlap period. This allows users to work with both systems concurrently, providing fallback capability and maximum validation time. Phased implementation is gradual but doesn't maintain full parallel operation. Modular and pilot approaches are narrower in scope and don't create extended overlap of complete systems.
Why the other options are wrong
- A. Phased implementation is gradual but each phase displaces the previous system; there is no extended overlap.
- B. Modular implementation involves deploying modules incrementally, not maintaining parallel full systems.
- C. Pilot implementation tests on a limited user group before full deployment, not a long overlap period.
Question 160
Which of the following strategies BEST optimizes data storage without compromising data retention practices?
Show answer and explanation
Correct answer: C. Moving emails to a virtual email vault after 30 days
Moving emails to a virtual email vault after 30 days optimizes storage by removing emails from primary systems while preserving them in a dedicated archive, maintaining retention compliance without compromising accessibility. This balances storage efficiency with retention requirements and maintains organizational control over data.
Why the other options are wrong
- A. Storing data on personal flash drives creates security and compliance risks and loses organizational control.
- B. Automatic deletion after one year may violate retention requirements depending on organizational policy.
- D. Limiting attachment sizes does not optimize storage or address retention of existing data.
Question 161
Which of the following analytical methods would be MOST useful when trying to identify groups with similar behavior or characteristics in a large population?
Show answer and explanation
Correct answer: D. Classification
Classification is the analytical method that identifies and organizes data into categories or groups based on similar characteristics or behaviors. This directly addresses the need to identify groups with similar behavior or characteristics within a large population. Deviation detection finds anomalies, not groups. Cluster sampling and random sampling are sampling techniques used to select subsets of a population, not methods for identifying behavioral groups within an existing dataset.
Why the other options are wrong
- A. Deviation detection identifies outliers and anomalies, not groups with similar characteristics.
- B. Cluster sampling is a sampling technique for selecting a subset, not an analytical method for identifying behavior groups.
- C. Random sampling is a sampling technique for data collection, not an analysis method for identifying groups.
Question 162
Which of the following is the GREATEST concern associated with a high number of IT policy exceptions approved by management?
Show answer and explanation
Correct answer: C. The exceptions may elevate the level of operational risk.
A high number of approved policy exceptions elevates operational risk because each exception represents a deviation from established security or operational controls. Exceptions create gaps in risk mitigation, increase the organization's vulnerability to threats and errors, and compound when multiple exceptions interact. While noncompliance is possible, the immediate and broader concern is the cumulative elevation of operational risk exposure.
Why the other options are wrong
- A. While exceptions may continue indefinitely, the concern about continuation is secondary to the underlying risk they create.
- B. Exceptions may sometimes improve efficiency by removing overly restrictive controls, so this is not consistently a concern.
- D. While exceptions could lead to noncompliance depending on the regulation, the greater concern is operational risk; noncompliance is a potential consequence rather than the direct concern.
Question 163
Which of the following is MOST important for an IS auditor to do during an exit meeting with an auditee?
Show answer and explanation
Correct answer: B. Ensure that the facts presented in the report are correct.
Ensuring that the facts presented in the audit report are correct is the most important function of an exit meeting. This final verification step with the auditee allows for clarification, correction of any factual errors, and confirmation of accuracy before the report is finalized, protecting the integrity of the audit and preventing disputes over the findings.
Why the other options are wrong
- A. Specifying implementation dates is the auditee's responsibility in response to recommendations, not the auditor's role.
- C. Communicating recommendations to senior management occurs after the exit meeting and is part of report distribution.
- D. While input on corrective actions is valuable, ensuring factual accuracy of the report itself is the primary auditor responsibility in the exit meeting.
Question 164
The operations team of an organization has reported an IS security attack. Which of the following should be the FIRST step for the security incident response team?
Show answer and explanation
Correct answer: C. Perform a damage assessment.
The first step should be to perform a damage assessment to understand the scope, nature, and impact of the security attack. This assessment is necessary to guide all subsequent actions, determine the severity level, allocate appropriate resources, and inform decisions about containment and recovery before reporting results or determining corrective actions.
Why the other options are wrong
- A. Reporting results to management should occur after initial assessment and damage determination to provide management with accurate, actionable information.
- B. Documenting lessons learned occurs at the conclusion of incident response, not as the first step; first, the incident must be assessed and addressed.
- D. Prioritizing resources for corrective action should follow the damage assessment, which informs what resources are needed and in what priority.
Question 165
In which of the following system development life cycle (SDLC) phases would an IS auditor expect to find that controls have been incorporated into system specifications?
Show answer and explanation
Correct answer: A. Design
The Design phase is where system specifications are created, and this is the appropriate point in the SDLC to incorporate controls into those specifications. During design, security and control requirements are translated into technical specifications before implementation begins. Building controls into the design phase prevents costly rework and ensures controls are integral to the system architecture rather than added as afterthoughts.
Why the other options are wrong
- B. Feasibility phase assesses project viability but predates detailed system specifications.
- C. Implementation executes the design but controls should already be specified before this phase.
- D. Development creates code based on specifications; controls should be specified before development begins.
Question 166
A business unit cannot achieve desired segregation of duties between operations and programming due to size constraints. Which of the following is MOST important for the IS auditor to identify?
Show answer and explanation
Correct answer: B. Compensating controls
When an organization cannot achieve ideal segregation of duties due to practical constraints like size, the auditor's primary responsibility is to identify and evaluate compensating controls, alternative controls that mitigate the risk created by the separation of duties weakness. Compensating controls might include enhanced monitoring, supervisory reviews, or automated logs. Identifying compensating controls is the most important finding because it determines whether the control risk is adequately managed despite the constraint.
Why the other options are wrong
- A. Unauthorized user controls are already implied by the segregation of duties problem and don't address the constraint.
- C. Operational effectiveness controls don't specifically address the segregation of duties gap.
- D. While identifying other weaknesses is important, compensating controls are the most critical factor for assessing residual risk from the segregation gap.
Question 167
A new regulation requires organizations to report significant security incidents to the regulator within 24 hours of identification. Which of the following is the IS auditor's BEST recommendation to facilitate compliance with the regulation?
Show answer and explanation
Correct answer: A. Include the requirement in the incident management response plan.
Including the 24-hour reporting requirement in the incident management response plan is the best recommendation because it ensures the organization has a documented, coordinated process for identifying, classifying, and reporting incidents within the regulatory timeframe. This creates accountability and establishes procedures that all stakeholders understand. Enhancing IDS alerts (B) only addresses detection, not response; external experts (C) add capability but don't establish internal processes; and KPIs (D) measure performance but don't create the procedural framework needed for compliance.
Why the other options are wrong
- B. Enhancing IDS alerts may help identify incidents faster but doesn't ensure a coordinated response or reporting process is in place.
- C. External experts can assist with incident handling but don't establish the internal processes and accountability needed for regulatory compliance.
- D. KPIs measure performance but don't create the documented procedures and processes required to achieve the 24-hour reporting requirement.
Question 168
Management receives information indicating a high level of risk associated with potential flooding near the organization's data center with in the next few years. As a result, a decision has been made to move data center operations to another facility on higher ground. Which approach has been adopted?
Show answer and explanation
Correct answer: D. Risk avoidance
Moving data center operations to another facility on higher ground is risk avoidance because the organization is eliminating the risk entirely by no longer operating in the location subject to flooding. Risk avoidance means taking action to eliminate the risk condition altogether, rather than accepting it, reducing it, or transferring it to another party.
Why the other options are wrong
- A. Risk reduction would involve mitigating the flooding risk at the current location, such as installing flood barriers.
- B. Risk acceptance would mean acknowledging the flooding risk and choosing to remain at the current location.
- C. Risk transfer would involve purchasing insurance or outsourcing operations to another company that assumes the flooding risk.
Question 169
Which of the following MOST effectively minimizes downtime during system conversions?
Show answer and explanation
Correct answer: B. Parallel run
A parallel run minimizes downtime by running both the old and new systems simultaneously, allowing for validation and rollback if needed before the old system is decommissioned. This approach ensures business continuity with minimal disruption. A phased approach takes longer, a direct cutover has maximum downtime risk, and a pilot study is preliminary testing rather than a conversion method.
Why the other options are wrong
- A. Phased approach extends the conversion period, increasing total downtime across multiple phases.
- C. Direct cutover has the greatest downtime risk as it switches systems immediately without validation.
- D. Pilot study is a testing methodology, not a conversion approach that addresses downtime.
Question 170
An IS auditor finds that capacity management for a key system is being performed by IT with no input from the business. The auditor's PRIMARY concern would be:
Show answer and explanation
Correct answer: B. unanticipated increase in business's capacity needs.
When capacity management is performed by IT without business input, the primary risk is that IT may not understand or anticipate the business's actual capacity needs, leading to systems that cannot support future business growth or strategic initiatives. Without business perspective, IT cannot align infrastructure planning with business objectives and forecasted growth, resulting in inadequate capacity when needed most.
Why the other options are wrong
- A. Maximizing equipment use is an operational efficiency concern, secondary to ensuring business needs are met.
- C. While excess storage is a cost concern, the primary risk is underestimating needs rather than overestimating.
- D. Project funding impact is a consequence of poor capacity planning, not the primary concern itself.
Question 171
Which of the following is the BEST way to ensure that business continuity plans (BCPs) will work effectively in the event of a major disaster?
Show answer and explanation
Correct answer: D. Involve staff at all levels in periodic paper walk-through exercises.
Involving staff at all levels in periodic paper walk-through exercises is the best way to ensure BCPs work effectively during a major disaster. Walk-through exercises test the plan's practicality, identify gaps and unclear instructions, build organizational familiarity with recovery procedures, and engage the people who will actually execute the plan. These exercises reveal whether detailed plans are truly workable and whether staff understand their roles. While regular BIA updates, detailed plans, and clear accountability are all necessary components, the actual testing and validation through staff participation is what ensures effectiveness when needed.
Why the other options are wrong
- A. Updating BIAs maintains current priorities but does not test whether plans actually work.
- B. Detailed plans are necessary but do not validate whether they function in practice.
- C. Senior manager accountability is important but does not test plan execution at the operational level where most work occurs.
Question 172
When evaluating the ability of a disaster recovery plan (DRP) to enable the recovery of IT processing capabilities, it is MOST important for the IS auditor to verify the plan is:
Show answer and explanation
Correct answer: D. periodically tested.
Periodic testing of a disaster recovery plan is the most important factor in verifying it can actually enable recovery of IT capabilities. Testing reveals whether the documented procedures work in practice, whether recovery time objectives can be met, and whether the plan remains current. While offsite storage and communication are necessary, and reviews are important, only testing provides concrete evidence that the plan will function when needed.
Why the other options are wrong
- A. Offsite storage protects the plan but does not verify it will work.
- B. Communication to department heads is necessary but does not validate the plan's effectiveness.
- C. Regular review keeps the plan current but does not verify actual recovery capability.
Question 173
As part of an audit response, an auditee has concerns with the recommendations and is hesitant to implement them. Which of the following would be the BEST course of action for the IS auditor?
Show answer and explanation
Correct answer: C. Conduct further discussions with the auditee to develop a mitigation plan.
Conducting further discussions with the auditee to develop a mutually acceptable mitigation plan is the best course of action. This collaborative approach respects the auditee's concerns, seeks understanding of implementation obstacles, and develops practical solutions. It maintains professional relationships and increases the likelihood of meaningful remediation. The auditor can explain the risk rationale, discuss alternative approaches, and negotiate realistic timelines. This is standard audit practice for handling disagreements. Hiring consultants (A) is unnecessary escalation, issuing reports without auditee input (B) bypasses due process, and accepting the response without further analysis (D) abandons the auditor's responsibility to address identified risks.
Why the other options are wrong
- A. Hiring a third-party consultant is an unnecessary escalation before exhausting direct dialogue with the auditee.
- B. Issuing a report without the auditee's perspective violates audit due process and professional standards requiring discussion of findings.
- D. Accepting the auditee's response and performing additional testing does not address the auditee's concerns or develop a mitigation path forward.
Question 174
During a security audit, an IS auditor is tasked with reviewing log entries obtained from an enterprise intrusion prevention system (IPS). Which type of risk would be associated with the potential for the auditor to miss a sequence of logged events that could indicate an error in the IPS configuration?
Show answer and explanation
Correct answer: A. Detection risk
Detection risk is the risk that an auditor will fail to detect a material error or misstatement that exists. In this case, the auditor reviewing IPS log entries could miss a sequence of events indicating misconfiguration, which is a failure of detection procedures. This specifically describes the auditor's inability to identify an issue that is present, the definition of detection risk.
Why the other options are wrong
- B. Control risk relates to the likelihood that a control itself will fail to prevent or detect errors, not the auditor's ability to detect issues.
- C. Sampling risk applies when auditing a sample rather than a complete population; reviewing log entries is typically a detailed examination, not a sampling issue.
- D. Inherent risk relates to the susceptibility of an assertion to error before considering controls, not to the auditor's detection capabilities.
Question 175
An IS audit manager is preparing the staffing plan for an audit engagement of a cloud service provider. What should be the manager's PRIMARY concern when made aware that a new auditor in the department previously worked for this provider?
Show answer and explanation
Correct answer: D. Independence
When an auditor previously worked for the organization being audited, the PRIMARY concern is independence. Prior employment at the cloud service provider creates an appearance of conflict of interest and potential bias, which directly threatens the auditor's ability to conduct an objective, impartial audit. While competency and integrity are important, independence is the foundational requirement that ensures audit credibility.
Why the other options are wrong
- A. Professional conduct is a broader concern but is not the primary issue when prior employment exists; independence is more specific and critical.
- B. Competency of the auditor is not the main concern here; the issue is their objectivity, not their qualifications.
- C. Integrity refers to the auditor's character and honesty, but the specific risk here is the lack of independence due to prior relationship with the auditee.
Question 176
An IS auditor follows up on a recent security incident and finds the incident response was not adequate. Which of the following findings should be considered MOST critical?
Show answer and explanation
Correct answer: D. The security weakness facilitating the attack was not identified.
The failure to identify the security weakness that enabled the attack is the most critical finding because it means the same vulnerability remains exploitable and the organization has not remediated the root cause. Without fixing the underlying weakness, the incident will recur. Failure to trace the attacker is a forensic limitation, IDS bypass is a detection failure, and missing documentation is a procedural gap, all less critical than leaving the vulnerability unfixed.
Why the other options are wrong
- A. Inability to trace the attacker back to an originating person is a forensic limitation but does not prevent fixing the vulnerability.
- B. IDS failure to block the attack indicates a detection/prevention gap but the vulnerability can still be remediated.
- C. Missing incident documentation is a procedural and audit trail deficiency but does not prevent future mitigation of the root cause.
Question 177
A new system is being developed by a vendor for a consumer service organization. The vendor will provide its proprietary software once system development is completed. Which of the following is the MOST important requirement to include in the vendor contract to ensure continuity?
Show answer and explanation
Correct answer: A. Source code for the software must be placed in escrow.
Source code escrow is the most critical contractual requirement for ensuring business continuity when a vendor provides proprietary software. If the vendor fails, becomes insolvent, or discontinues support, escrow allows the organization to access and maintain the source code independently. This protects the organization from vendor lock-in and ensures long-term system viability.
Why the other options are wrong
- B. While 24/7 support is valuable, it doesn't guarantee continuity if the vendor goes out of business or discontinues the product.
- C. The vendor's DRP addresses their operations but doesn't directly protect the organization's ability to maintain the software independently.
- D. Staff training is important for operational management but doesn't address the fundamental risk of losing access to the proprietary software itself.
Question 178
A small financial institution is preparing to implement a check image processing system to support planned mobile banking product offerings. Which of the following is MOST critical to the successful implementation of the system?
Show answer and explanation
Correct answer: C. Integration testing
Integration testing is most critical for a check image processing system because it must accurately interface with existing banking systems, mobile platforms, and regulatory requirements. Failures in integration can compromise transaction integrity and regulatory compliance. While feasibility, control design, and training are all important, integration testing directly validates that the system will function correctly within the technical ecosystem.
Why the other options are wrong
- A. Feasibility studies occur before implementation decisions are finalized.
- B. Control design must be completed before testing can occur; it's prerequisite rather than most critical.
- D. End user training is essential but occurs after system validation is confirmed through integration testing.
Question 179
An organization's security policy mandates that all new employees must receive appropriate security awareness training. Which of the following metrics would BEST assure compliance with this policy?
Show answer and explanation
Correct answer: B. Percentage of new hires that have completed the training
To assure compliance with a mandatory training policy, the metric must directly measure whether the required action (training completion) has been performed. The percentage of new hires who completed the training is the most direct and objective measure of policy compliance, as it shows the proportion of employees who met the requirement.
Why the other options are wrong
- A. Policy violations are an outcome measure of control effectiveness, not a direct measure of training completion compliance.
- C. Incident reporting by new hires measures awareness outcome but does not directly demonstrate training completion.
- D. Incident reporting percentage is a leading indicator of awareness but not a direct measure of training compliance.
Question 180
Which of the following is the BEST control to mitigate attacks that redirect Internet traffic to an unauthorized website?
Show answer and explanation
Correct answer: D. Perform domain name system (DNS) server security hardening.
DNS server security hardening is the BEST control to prevent attacks that redirect Internet traffic to unauthorized websites. Such attacks (DNS hijacking, DNS spoofing) work by compromising or poisoning DNS resolution. Hardening DNS servers through measures like DNSSEC, access controls, and configuration security directly prevents attackers from redirecting traffic at the DNS layer where the attack originates.
Why the other options are wrong
- A. Network firewalls operate at the network/transport layer and cannot prevent DNS-level redirection attacks.
- B. Security awareness training helps users recognize phishing but does not prevent DNS hijacking at the infrastructure level.
- C. Strong password policies are irrelevant to DNS-based traffic redirection attacks.
Question 181
Which of the following is the GREATEST risk associated with storing customer data on a web server?
Show answer and explanation
Correct answer: D. Data confidentiality
Storing customer data on web servers presents the greatest risk to data confidentiality because web servers are internet-facing and frequently targeted by attackers seeking unauthorized access to sensitive information. While data integrity and availability are concerns, the primary risk of web exposure is unauthorized disclosure of confidential customer data through network attacks or compromise.
Why the other options are wrong
- A. Data integrity risks exist but are secondary to confidentiality exposure on web-facing systems.
- B. Data availability is a concern but not the primary risk associated with web server storage.
- C. Data redundancy is an operational concern, not a primary security risk for web-stored customer data.
Question 182
The IS auditor has recommended that management test a new system before using it in production mode. The BEST approach for management in developing a test plan is to use processing parameters that are:
Show answer and explanation
Correct answer: D. simulated by production entities and customers.
Test parameters simulated by production entities and customers represent real-world usage scenarios and business requirements, providing the most realistic validation of system behavior. This approach ensures the system will perform appropriately when actual users and customer data enter production. Random selection or vendor-provided parameters lack this business context and real-world applicability.
Why the other options are wrong
- A. Randomly selected parameters lack connection to actual business requirements and use cases.
- B. Vendor-provided parameters may not reflect the organization's actual business needs or environment.
- C. Randomly selected parameters by users lack structured methodology and real-world business validation.
Question 183
Which of the following is the PRIMARY advantage of parallel processing for a new system implementation?
Show answer and explanation
Correct answer: D. Assurance that the new system meets performance requirements
Parallel processing (running old and new systems simultaneously) provides the PRIMARY advantage of assurance that the new system meets performance requirements because actual production workloads can be compared between systems in real-time, demonstrating that the new system can handle the required throughput and response times. This is the most critical validation parallel processing provides.
Why the other options are wrong
- A. Functional requirements are tested before implementation through other testing methodologies, not primarily through parallel processing.
- B. Parallel processing is actually more costly than other approaches since both systems run simultaneously, consuming double resources.
- C. Parallel processing does not provide additional training time; training must occur before or alongside implementation regardless of the approach used.
Question 184
An organization is running servers with critical business applications that are in an area subject to frequent but brief power outages. Knowledge of which of the following would allow the organization's management to monitor the ongoing adequacy of the uninterruptible power supply (UPS)?
Show answer and explanation
Correct answer: A. Duration and interval of the power outages
To monitor ongoing UPS adequacy, management must understand the duration and interval of power outages in the organization's environment. By comparing actual outage characteristics against the UPS battery runtime specifications and recovery time requirements, management can determine if the current UPS capacity remains sufficient. This direct measurement allows ongoing assessment of whether the UPS matches environmental conditions.
Why the other options are wrong
- B. Business impact of downtime is important for risk prioritization but doesn't directly indicate UPS adequacy for current conditions.
- C. The number of servers is a fixed design parameter, not a dynamic monitoring metric for ongoing UPS adequacy.
- D. Mean time to recover is a recovery metric unrelated to monitoring whether the UPS can sustain operations through power outages.
Question 185
Which of the following is the MOST important aspect of an information security policy approved by the board of directors?
Show answer and explanation
Correct answer: C. The policy must be communicated to all stakeholders.
The MOST important aspect of an information security policy approved by the board is that it must be communicated to all stakeholders. A policy is only effective if people know about it and understand their responsibilities. Without communication, stakeholders cannot comply with the policy, and the board's approval becomes meaningless. While the policy should provide guidance on classification (A) and be modified periodically (B), and may address privacy (D), none of these matter if the policy is not communicated. Communication is the essential prerequisite for effectiveness and accountability.
Why the other options are wrong
- A. Information classification guidance is an important component but does not address the fundamental requirement that the policy be communicated.
- B. Periodic modification for relevance is important for long-term effectiveness but does not ensure the current policy is known and understood.
- D. Privacy protection is important content but is not more critical than ensuring all stakeholders actually know the policy exists and their responsibilities under it.
Question 186
An IS auditor identifies that a legacy application to be decommissioned in three months cannot meet the security requirements established by the current policy. What is the BEST way for the auditor to address this issue?
Show answer and explanation
Correct answer: B. Verify management has approved a policy exception to accept the risk.
When a legacy application cannot meet current security policies, the IS auditor's responsibility is to ensure management is aware of and has formally accepted the risk through an approved exception. Simply informing the director without documented approval is insufficient; recommending patches may be impractical for a decommissioned system; and taking no action ignores the auditor's duty to report noncompliance regardless of the application's planned retirement.
Why the other options are wrong
- A. Merely informing management without obtaining documented risk acceptance does not complete the audit responsibility.
- C. Patching a legacy application scheduled for decommissioning in three months is not practical or cost-effective.
- D. The auditor cannot ignore policy noncompliance; a formal exception approval is still required for the interim period.
Question 187
When conducting a requirements analysis for a project, the BEST approach would be to:
Show answer and explanation
Correct answer: D. consult key stakeholders.
Consulting key stakeholders is the foundational best practice in requirements analysis. Stakeholders, including business owners, end users, and technical teams, provide essential input on what the system must accomplish and how it will be used. This direct engagement ensures requirements capture actual business needs rather than assumptions. While CSA, testing, and prototyping may supplement the process, stakeholder consultation is the primary, best approach to effective requirements gathering.
Why the other options are wrong
- A. Control self-assessment is a specific audit technique, not a general requirements analysis approach.
- B. Testing operational deliverables occurs after requirements are defined, not during analysis.
- C. Prototyping is a useful technique but typically comes after gathering requirements from stakeholders.
Question 188
Which of the following statements appearing in an organization's acceptable use policy BEST demonstrates alignment with data classification standards related to the protection of information assets?
Show answer and explanation
Correct answer: D. All information assets will be assigned a clearly defined level to facilitate proper employee handling.
Assigning clearly defined classification levels to information assets is the best demonstration of alignment with data classification standards. This enables consistent application of handling requirements appropriate to each sensitivity level. Need-to-know access, encryption requirements, and approval processes are all important security practices but don't directly demonstrate data classification alignment, they depend on proper classification being in place first.
Why the other options are wrong
- A. Need-to-know access is an access control principle but doesn't demonstrate alignment with data classification standards themselves.
- B. Encryption is a protection mechanism but applying it uniformly to all assets ignores the risk-based differentiation that classification provides.
- C. Executive approval for transmissions is a control but does not address the foundational requirement to classify data by sensitivity level.
Question 189
An organization is considering allowing users to connect personal devices to the corporate network. Which of the following should be done FIRST?
Show answer and explanation
Correct answer: C. Implement an acceptable use policy.
An acceptable use policy must be established first because it defines the rules, expectations, and security requirements that govern personal device access to the corporate network. This policy provides the foundational framework for all subsequent implementation steps. Without this policy in place, organizations cannot properly enforce security requirements or set user expectations.
Why the other options are wrong
- A. MDM configuration cannot be completed until security requirements and acceptable use parameters are defined by policy.
- B. Creating inventory records occurs after policy is established and devices are approved for connection.
- D. Security awareness training should occur after policy is implemented, as users need to know what policy requires.
Question 190
Which of the following is the BEST audit procedure to determine whether a firewall is configured in compliance with the organization's security policy?
Show answer and explanation
Correct answer: C. Reviewing the parameter settings
Reviewing the actual parameter settings of a firewall is the most direct and objective method to verify compliance with security policy. Parameter settings show exactly what the firewall is configured to do, including rules, access controls, and security protocols. This provides concrete evidence of whether the configuration matches the organization's documented security requirements.
Why the other options are wrong
- A. System logs show what has occurred but not what the firewall is configured to do, making them an indirect measure of compliance.
- B. Reviewing procedures documents intended actions but not the actual configuration currently in place.
- D. Interviewing the administrator provides subjective input and may not reveal actual misconfigurations or drift from policy.
Question 191
Which type of testing BEST determines whether a new system meets business requirements and is ready to be placed into production?
Show answer and explanation
Correct answer: B. User acceptance testing (UAT)
User Acceptance Testing (UAT) is specifically designed to validate that a new system meets business requirements and is ready for production deployment. UAT involves actual end-users or business stakeholders testing the system against business requirements, making it the definitive test for production readiness. Load, volume, and performance testing focus on technical metrics like capacity and speed rather than business requirement validation.
Why the other options are wrong
- A. Load testing measures system behavior under expected load but does not validate business requirements.
- C. Volume testing checks system handling of large data volumes but is not the primary indicator of business readiness.
- D. Performance testing evaluates speed and efficiency metrics, not business requirement alignment.
Question 192
Which of the following should be an IS auditor's PRIMARY focus when developing a risk-based IS audit program?
Show answer and explanation
Correct answer: A. Business processes
A risk-based IS audit program should primarily focus on business processes because these are where organizational risks materialize and where controls operate. Business processes are the mechanisms through which the organization creates value and manages risks, making them the logical starting point for understanding what needs to be audited. While IT strategic plans, business plans, and portfolio management are relevant inputs, the audit program must ultimately assess how well processes are controlled and risk-managed.
Why the other options are wrong
- B. Business plans provide strategic direction but are too broad and abstract to form the primary focus of operational audit work.
- C. Portfolio management relates to project and resource prioritization but is not the core focus of IS audit risk assessment.
- D. IT strategic plans guide IT direction but audit must examine actual business process execution and control effectiveness, not just IT's plans.
Question 193
Which of the following concerns is BEST addressed by securing production source libraries?
Show answer and explanation
Correct answer: C. Unauthorized changes can be moved into production.
Securing production source libraries directly addresses the concern that unauthorized changes can be moved into production. By implementing access controls, change management approval processes, and audit trails on production source libraries, organizations prevent unauthorized or unapproved modifications from being deployed to production systems. This control is fundamental to maintaining production integrity and security.
Why the other options are wrong
- A. While version control is important, securing production libraries primarily prevents unauthorized changes rather than routing changes to the correct version.
- B. Approval processes are related but are a separate control mechanism; securing libraries themselves prevents unauthorized access independent of approval workflows.
- D. Source and object library synchronization is a technical concern that relates to compilation and deployment, not directly to the security of the libraries themselves.
Question 194
An IS auditor performing an audit of backup procedures observes that backup tapes are picked up weekly and stored offsite at a third-party hosting facility. Which of the following recommendations would be the BEST way to protect the integrity of the data on the backup tapes?
Show answer and explanation
Correct answer: A. Ensure that data is encrypted before leaving the facility.
Encryption of data before leaving the facility is the best control to protect backup tape integrity and confidentiality. Encryption ensures that even if tapes are lost, stolen, or intercepted during transport, the data remains protected and unreadable without the encryption key. This is a preventive control that addresses the fundamental risk of data exposure throughout the transport and storage process. Encryption protects against all threats to data confidentiality and integrity during transport, making it more comprehensive than physical security or procedural controls alone.
Why the other options are wrong
- B. Logging transfers provides an audit trail but does not protect data if tapes are compromised in transit.
- C. Tamper-evident containers provide evidence of tampering but do not prevent unauthorized access to readable data.
- D. Signature procedures provide documentation but do not prevent data exposure if containers are compromised.
Question 195
Which of the following should be the FIRST step in the incident response process for a suspected breach?
Show answer and explanation
Correct answer: D. Research the validity of the alerted breach.
The first step in incident response for a suspected breach must be to validate whether a breach actually occurred by researching the validity of the alert. This prevents false alarms from triggering expensive and disruptive response procedures. Only after confirming that a breach is real should the organization proceed to management notification, customer notification, or third-party engagement. Reacting before validation could cause unnecessary panic and business disruption.
Why the other options are wrong
- A. Engaging third parties before validating the breach is premature and potentially costly for a false alarm.
- B. Notifying management should occur after confirming the breach is real, not as the first step based on an unverified alert.
- C. Informing customers must wait until the breach is validated and understood; notifying customers about a false alarm causes unnecessary concern.
Question 196
Which of the following is MOST important for an IS auditor to verify when reviewing the use of an outsourcer for disposal of storage media?
Show answer and explanation
Correct answer: B. The vendor's process appropriately sanitizes the media before disposal.
Verifying that the vendor's process appropriately sanitizes storage media before disposal is the most important control to ensure that sensitive data cannot be recovered from disposed media. This addresses the root cause of the risk, actual data exposure. Proper sanitization (overwriting, degaussing, or physical destruction) ensures that discarded media cannot be reconstructed and exploited, regardless of other contractual or security protections.
Why the other options are wrong
- A. A certificate of destruction documents the disposal event but does not guarantee that sanitization was performed correctly; the process itself is what matters.
- C. Past incident history is useful for vendor evaluation but does not verify the technical controls in place for the current disposal process.
- D. Secure transportation protects media during transit but does not ensure that the media itself cannot be accessed if it is not properly sanitized first.
Question 197
Which of the following BEST facilitates detection of zero-day exploits?
Show answer and explanation
Correct answer: B. User behavior analytics
User behavior analytics (UBA) detects zero-day exploits by identifying abnormal system and user behavior patterns that indicate compromise, rather than relying on known threat signatures. Since zero-day exploits are previously unknown, signature-based detection methods fail. UBA can detect suspicious activities like unusual data access patterns, privilege escalation, or lateral movement that indicate a breach, making it most effective against unknown threats.
Why the other options are wrong
- A. Anti-malware software relies on known signatures and heuristics; zero-days by definition lack known signatures, limiting effectiveness.
- C. IDS detects intrusions through signature matching and anomaly detection but is less effective than behavioral analytics for unknown zero-day patterns.
- D. IPS is preventive and signature-based; it cannot prevent zero-day attacks when no signature exists for the unknown vulnerability.
Question 198
Which of the following should be of GREATEST concern for an IS auditor reviewing an organization's disaster recovery plan (DRP)?
Show answer and explanation
Correct answer: A. The DRP has not been updated since an IT infrastructure upgrade.
The DRP not being updated since an IT infrastructure upgrade is of greatest concern because it creates a critical gap between the documented recovery procedures and the actual current IT environment. An outdated DRP will likely fail during a disaster when recovery depends on accurate, current procedures, potentially rendering the entire plan ineffective. This directly impacts organizational resilience.
Why the other options are wrong
- B. While end users should be trained on their DRP roles, the primary concern for an auditor is the plan's technical accuracy and completeness, not distribution to all staff.
- C. Though formal approval is important for governance, an unapproved but accurate plan is more valuable than an outdated approved one.
- D. Covering critical servers is a reasonable prioritization given resource constraints; the plan should focus on critical systems first.
Question 199
An organization has made a strategic decision to split into separate operating entities to improve profitability. However, the IT infrastructure remains shared between the entities. Which of the following would BEST help to ensure that IS audit still covers key risk areas within the IT environment as part of its annual plan?
Show answer and explanation
Correct answer: A. Developing a risk-based plan considering each entity's business processes
When an organization splits into separate operating entities but maintains shared IT infrastructure, a risk-based audit plan must consider each entity's distinct business processes, risk profiles, and control objectives. This approach ensures comprehensive coverage of all risk areas across both entities within the shared environment. The risk-based methodology allows the audit plan to adapt to the new organizational structure while maintaining focus on areas of highest concern to each business unit.
Why the other options are wrong
- B. Auditing only new policies and procedures would miss existing risks in the unchanged shared infrastructure.
- C. Focusing only on post-split IT changes ignores pre-existing risks in the shared environment that may now affect multiple entities differently.
- D. Increasing frequency alone does not ensure better coverage of key risk areas; the plan itself must be designed with each entity's needs in mind.
Question 200
Which of the following BEST facilitates the legal process in the event of an incident?
Show answer and explanation
Correct answer: B. Preserving the chain of custody
Preserving the chain of custody is the critical foundation for legal proceedings. It establishes the integrity and admissibility of evidence in court by documenting who handled evidence, when, and under what conditions. Without proper chain of custody, evidence may be deemed inadmissible, undermining the entire legal case regardless of other factors.
Why the other options are wrong
- A. E-discovery is a process right but does not itself facilitate the legal process as directly as chain of custody.
- C. Root cause analysis explains what happened but does not ensure evidence admissibility or legal validity.
- D. Legal counsel's advice is important but is reactive; chain of custody is the proactive control that enables legal success.
Question 201
Which of the following is the MOST appropriate and effective fire suppression method for an unstaffed computer room?
Show answer and explanation
Correct answer: C. Carbon dioxide (CO )
Carbon dioxide (CO ) is the most appropriate fire suppression method for unstaffed ₂ computer rooms because it extinguishes fire without leaving residue, doesn't damage sensitive equipment, and poses no corrosion risk. CO is safe for unoccupied spaces and ₂ doesn't require cleanup like water-based systems. It's specifically designed for facilities with valuable equipment and no personnel present.
Why the other options are wrong
- A. Water sprinklers cause significant damage to electronics and equipment, making them unsuitable for computer rooms.
- B. Fire extinguishers require human operation and cannot work in unstaffed environments where fires go undetected initially.
- D. Dry pipe systems are better suited for areas with water damage concerns but are not specifically optimized for equipment protection like CO systems. ₂
Question 202
Which of the following types of testing would BEST mitigate the risk of a newly implemented system adversely impacting existing systems?
Show answer and explanation
Correct answer: C. Sociability testing
Sociability testing (also called integration testing or compatibility testing) specifically evaluates how a newly implemented system interacts with and impacts existing systems in the environment. This type of testing directly addresses the risk of adverse impacts on legacy or dependent systems by verifying data flow, communication protocols, and functional compatibility between the new and existing systems before full deployment.
Why the other options are wrong
- A. UAT validates that the system meets business requirements but does not specifically focus on compatibility with existing systems.
- B. Functionality testing verifies that individual features work as designed but does not address interactions with other systems.
- D. Unit testing examines individual code components in isolation and does not evaluate system-to-system integration impacts.
Question 203
An IS auditors reviewing the perimeter security design of a network. Which of the following provides the GREATEST assurance that both incoming and outgoing internet traffic is controlled?
Show answer and explanation
Correct answer: D. Statetul firewall
A stateful firewall provides the greatest assurance for controlling both incoming and outgoing internet traffic because it maintains awareness of connection states, inspects traffic bidirectionally, and makes allow/deny decisions based on established communication patterns. It actively enforces security policies at the network perimeter for all traffic flows, whereas other options provide monitoring or load balancing but lack the comprehensive bidirectional control capability.
Why the other options are wrong
- A. Load balancers distribute traffic across servers but do not control or filter traffic based on security policies.
- B. SIEM systems monitor and analyze security events but do not actively block or control traffic flow.
- C. IDS systems detect intrusions but do not actively block traffic; they only alert on suspicious activity.
Question 204
Following an IS audit, which of the following types of risk would be MOST critical to communicate to key stakeholders?
Show answer and explanation
Correct answer: D. Residual
Residual risk is the risk remaining after controls have been implemented and is the most critical to communicate to stakeholders because it represents the actual, actionable risk the organization faces. Inherent risk is pre-control risk, audit risk relates to the audit process itself, and control risk is intermediate. Stakeholders need to understand what risks remain despite existing controls to make informed decisions about the organization's risk posture.
Why the other options are wrong
- A. Control risk addresses the effectiveness of controls but doesn't represent the final risk picture stakeholders need.
- B. Inherent risk is relevant for auditors but doesn't reflect the organization's actual exposure after controls are applied.
- C. Audit risk relates to the auditor's procedures and conclusion quality, not the organization's operational risk exposure.
Question 205
Which of the following is the BEST method to prevent wire transfer fraud by bank employees?
Show answer and explanation
Correct answer: B. System-enforced dual control
System-enforced dual control is the best method to prevent wire transfer fraud by bank employees because it requires two separate individuals to authorize and execute each wire transfer, making it virtually impossible for a single employee to commit fraud undetected. This control is enforced by the system itself, preventing workarounds. While two-factor authentication provides access security, independent reconciliation detects fraud after it occurs, and re-keying catches entry errors, only dual control prevents an authorized employee from fraudulently authorizing and executing unauthorized transfers.
Why the other options are wrong
- A. Two-factor authentication controls access but does not prevent an authorized employee from initiating fraudulent transfers with legitimate credentials.
- C. Independent reconciliation is a detective control that identifies fraud after it has occurred, not a preventive control.
- D. Re-keying of amounts is a data quality control that catches entry errors but not intentional fraud by authorized personnel.
Question 206
An organization sends daily backup media by courier to an offsite location. Which of the following provides the BEST evidence that the media is transported reliably?
Show answer and explanation
Correct answer: B. Signed acknowledgments by offsite manager
Signed acknowledgments by the offsite manager provide the best evidence that backup media was transported reliably and received in proper condition. These acknowledgments create a documented chain of custody demonstrating that media was delivered to the intended location, received by authorized personnel, and presumably in acceptable condition. This provides concrete, verifiable evidence of reliable transport. While procedures and courier certification establish expectations and capability, actual signed acknowledgments prove delivery occurred as intended.
Why the other options are wrong
- A. Procedures document intentions but don't prove they were actually followed.
- C. Courier certification shows they are capable but doesn't prove successful delivery of specific shipments.
- D. A delivery schedule shows when shipments occur but not whether they arrived in usable condition.
Question 207
Which of the following is MOST important to consider when scheduling follow-up audits?
Show answer and explanation
Correct answer: A. The impact if corrective actions are not taken
The impact if corrective actions are not taken is the most important consideration for scheduling follow-up audits. High-impact findings require prompt follow-up because delayed remediation exposes the organization to greater risk. Risk-based scheduling ensures resources are focused where they matter most. The auditor's agreement on time commitment is a logistical constraint but not the primary determinant. Verification efforts with new auditors are procedural considerations. While control and detection risks are relevant, they are secondary to understanding the business impact of unresolved issues.
Why the other options are wrong
- B. Auditor time availability is a logistical matter, not the primary driver of follow-up scheduling decisions.
- C. Verification procedures are implementation details, not the main factor in scheduling decisions.
- D. Control and detection risks are relevant but secondary to assessing the impact of unresolved findings.
Question 208
Which of the following would be the MOST useful metric for management to consider when reviewing a project portfolio?
Show answer and explanation
Correct answer: B. Net present value (NPV) of the portfolio
Net Present Value (NPV) is the most useful metric for management reviewing a project portfolio because it quantifies the financial value creation of the entire portfolio by discounting future cash flows to present value. This allows management to make informed decisions about which projects to fund and prioritize based on overall financial impact. NPV accounts for the time value of money and provides a comprehensive view of portfolio profitability.
Why the other options are wrong
- A. Cost as a percentage of total IT cost is a relative measure but does not indicate actual value creation or return on investment.
- C. Total cost of each project alone provides no insight into value generated or ROI, making it insufficient for portfolio-level decision making.
- D. Expected return divided by total project cost is a ratio metric that lacks the sophistication of NPV analysis and does not account for time value of money.
Question 209
During the evaluation of controls over a major application development project, the MOST effective use of an IS auditor's time would be to review and evaluate:
Show answer and explanation
Correct answer: D. project plans.
Reviewing project plans is the most effective use of an auditor's time during application development controls evaluation because it establishes the governance framework, identifies control requirements, and determines scope and risk at the foundational level. This high-level review guides all subsequent audit activities and prevents wasted effort on low-risk areas. Detailed evaluation of test cases and acceptance testing are important but are tactical activities best focused after understanding overall project governance. Cost-benefit analysis is not directly an IS auditor's primary concern.
Why the other options are wrong
- A. Cost-benefit analysis is a business decision tool, not a primary focus of IS audit control evaluation.
- B. Acceptance testing review is a detailed operational activity that comes after understanding the broader project control framework.
- C. Detailed review of individual test cases is a tactical activity less efficient than first understanding overall project governance and controls.
Question 210
An IS auditor observes that a bank's web page address is prefixed "https://". The auditor would be correct to conclude that:
Show answer and explanation
Correct answer: B. transactions are encrypted.
The 'https://' prefix indicates the use of HTTPS (HTTP Secure), which encrypts the data transmitted between the client and the web server using TLS/SSL encryption. This ensures that transactions and communications are protected from eavesdropping and tampering. This is the correct and most direct conclusion from observing the https:// prefix.
Why the other options are wrong
- A. HTTPS does not establish a VPN; it is transport-layer encryption for web communications.
- C. The URL scheme has no bearing on whether an IP address is restricted or public.
- D. HTTPS does not indicate connection to an intranet; it can be used on public internet connections as well.
Question 211
When an IS audit reveals that a firewall was unable to recognize a number of attack attempts, the auditor's BEST recommendation is to place an intrusion detection system (IDS) between the firewall and:
Show answer and explanation
Correct answer: D. the organization's network.
An IDS should be placed between the firewall and the organization's internal network to detect attack attempts that successfully bypass the firewall. This placement allows the IDS to monitor traffic that has already passed firewall filters and can identify sophisticated or obfuscated attacks that the firewall missed. Placing it at other locations would either duplicate firewall functionality or fail to protect the internal network from attacks that bypass the firewall.
Why the other options are wrong
- A. Placing the IDS only between the firewall and web server limits detection to one asset rather than protecting the entire internal network.
- B. The DMZ is typically already protected as an intermediate zone; the IDS is more critical for protecting the core internal network.
- C. Placing the IDS between the firewall and the Internet would only add redundant detection and not address attacks that bypass the firewall.
Question 212
Which of the following is the GREATEST risk associated with the lack of an effective data privacy program?
Show answer and explanation
Correct answer: A. Failure to comply with data-related regulations
The greatest risk of lacking an effective data privacy program is regulatory non-compliance, which can result in significant legal penalties, mandatory fines, consent orders, and reputational damage. Regulations like GDPR, CCPA, HIPAA, and others impose strict requirements on data handling; without a privacy program to ensure compliance, organizations face substantial legal and financial exposure. This is a foundational risk greater than operational failures.
Why the other options are wrong
- B. Preventing fraud is a security and controls objective but is not the primary function of a data privacy program.
- C. Access management is one component of privacy protection but not the main comprehensive risk associated with lacking an entire privacy program.
- D. Customer confidence, while important, is a secondary business impact; regulatory compliance is the primary concern.
Question 213
Which of the following is the MOST effective approach in assessing the quality of modifications made to financial software?
Show answer and explanation
Correct answer: D. Independent quality assurance (QA) activities will be undertaken at various phases of the project.
Independent quality assurance activities conducted at various phases of the project provides the most comprehensive and effective quality assessment. This approach enables continuous verification throughout development, allowing defects to be caught and corrected early rather than only at the end. Multiple QA checkpoints across design, development, and testing phases ensure quality is built in rather than inspected in at the end.
Why the other options are wrong
- A. A pre-implementation review by an independent auditor provides assessment at only one point and comes too late to prevent defects early in development.
- B. Acceptance testing occurs only at the end and may find critical issues too late to address cost-effectively during the project.
- C. Assessing the quality plan during design is useful but does not actually evaluate the quality of the implementation itself.
Question 214
Which of the following BEST protects an organization's proprietary code during a joint-development activity involving a third party?
Show answer and explanation
Correct answer: C. Nondisclosure agreement (NDA)
A nondisclosure agreement (NDA) is the best mechanism to protect proprietary code during joint-development with a third party. An NDA establishes legal obligations preventing the third party from disclosing, using, or sharing the organization's proprietary information beyond the scope of the joint project. While a statement of work defines deliverables and a service level agreement defines performance standards, neither provides the confidentiality protections that an NDA offers. A privacy agreement addresses personal data protection, not code protection.
Why the other options are wrong
- A. Privacy agreements address personal data protection, not proprietary code protection.
- B. A statement of work defines scope and deliverables but does not establish confidentiality protections for proprietary information.
- D. Service level agreements define performance and support standards but do not provide confidentiality protections for proprietary code.
Question 215
An employee has accidentally posted confidential data to the company's social media page. Which of the following is the BEST control to prevent this from recurring?
Show answer and explanation
Correct answer: B. Implement a moderator approval process.
Implementing a moderator approval process is the best preventive control because it prevents confidential data from being posted in the first place by requiring review before publication. This stops the problem at the source. Two-factor authentication (A) doesn't prevent accidental posting; restricting to the director (C) is impractical and doesn't prevent accidental errors by authorized users; periodic audits (D) are detective controls that find incidents after they occur, not preventive.
Why the other options are wrong
- A. Two-factor authentication controls access but does not prevent authorized users from accidentally posting confidential information.
- C. Restricting to one person is impractical and does not prevent human error from that individual.
- D. Audits are detective controls that find problems after posting; they don't prevent incidents from occurring.
Question 216
Which of the following should be the FIRST step when conducting an IT risk assessment?
Show answer and explanation
Correct answer: C. Identify assets to be protected
Identifying assets to be protected is the logical first step in any risk assessment. You cannot assess what you're protecting against or what vulnerabilities matter until you know what assets exist and what is valuable. Threats (D) are evaluated relative to assets, controls (B) are assessed in context of asset risks, and vulnerabilities (A) only matter when they affect specific assets.
Why the other options are wrong
- A. Assessing vulnerabilities is premature before identifying what assets those vulnerabilities could affect.
- B. Evaluating controls comes after understanding what risks and assets exist to be controlled.
- D. Identifying threats should follow asset identification, as threat relevance depends on what assets need protection.
Question 217
An auditee disagrees with a recommendation for corrective action that appears in the draft engagement report. Which of the following is the IS auditor's BEST course of action when preparing the final report?
Show answer and explanation
Correct answer: A. Come to an agreement prior to issuing the final report.
The IS auditor should come to an agreement with the auditee prior to issuing the final report. The audit process requires professional discourse to resolve disagreements, and reaching consensus or clearly understanding the auditee's position strengthens the credibility of the final report. This approach maintains professional relationships and ensures the recommendation is properly evaluated before finalization.
Why the other options are wrong
- B. Including comments only in working papers doesn't address the disagreement in the formal report and leaves the issue unresolved.
- C. Excluding disputed recommendations avoids accountability and may leave material risks unaddressed in the final report.
- D. Deferring to senior management without auditee discussion bypasses the proper engagement process and may misrepresent the facts.
Question 218
Which of the following establishes the role of the internal audit function?
Show answer and explanation
Correct answer: C. Audit charter
The audit charter is the foundational document that formally establishes the internal audit function's role, authority, responsibilities, scope, independence, and reporting relationships. It is approved by senior management and the board, and provides the authoritative basis for all audit activities. An audit project plan addresses a specific engagement, audit objectives define goals for a particular audit, and audit governance structures the broader function, but the charter is the document that specifically establishes the role itself.
Why the other options are wrong
- A. An audit project plan is specific to individual engagements and does not establish the overall role of internal audit.
- B. Audit objectives define goals for specific audits but do not establish the role and authority of the internal audit function.
- D. Audit governance structures the oversight and organization of internal audit but is not the primary document that establishes its role.
Question 219
Which of the following is the BEST way to address segregation of duties issues in an organization with budget constraints?
Show answer and explanation
Correct answer: B. Implement compensating controls.
Compensating controls are the best approach for addressing segregation of duties issues when budget constraints exist. They provide detective or preventive mechanisms that mitigate the risk when ideal segregation cannot be achieved due to cost limitations. Examples include supervisory review, automated monitoring, or approval workflows that reduce the risk of fraud or errors without requiring additional staff or major restructuring.
Why the other options are wrong
- A. An independent audit would only identify the problem, not address it, and does not resolve the segregation of duties gap.
- C. Hiring temporary staff is a workaround that increases costs, contradicting the budget constraint premise, and may introduce security and control risks.
- D. Job rotation alone does not address segregation of duties issues and may not be feasible with budget constraints; it is also a detective rather than compensating control.
Question 220
An IS auditor is informed that several spreadsheets are being used to generate key financial information. What should the auditor verify NEXT?
Show answer and explanation
Correct answer: C. Whether there is a complete inventory of end-user computing (EUC) spreadsheets
When an IS auditor learns that spreadsheets are used for key financial information, the next verification should be whether a complete inventory of end-user computing (EUC) spreadsheets exists. Establishing an inventory is the foundational step to understanding scope, identifying risks, and implementing appropriate controls. Documentation and training (A) cannot be assessed without knowing all spreadsheets exist, IT general controls requirements (B) should be evaluated after inventory is established, and CFO review (D) is one control element but not the most critical starting point.
Why the other options are wrong
- A. Documentation and training should be verified, but only after establishing what spreadsheets exist through an inventory.
- B. Assessing compliance with IT general controls requires first knowing all the spreadsheets in scope.
- D. CFO review is one control measure but establishing a complete inventory is the foundational priority.
Question 221
Which of the following network topologies will provide the GREATEST fault tolerance?
Show answer and explanation
Correct answer: D. Mesh configuration
Mesh topology provides the greatest fault tolerance because every node is connected to every other node, creating multiple redundant paths for data transmission. If any single connection fails, data can still reach its destination through alternate routes. Star (A) has a single point of failure at the hub, bus (B) has a single backbone, and ring (C) requires data to travel sequentially with vulnerabilities at each node.
Why the other options are wrong
- A. Star topology has a central point of failure; if the hub fails, the entire network becomes unusable.
- B. Bus topology uses a single backbone cable; any break in the bus disables the entire network.
- C. Ring topology creates a single path in a circle; failure of any node disrupts communication for nodes beyond it.
Question 222
Which of the following approaches would BEST ensure that data protection controls are embedded into software being developed?
Show answer and explanation
Correct answer: D. Tracking data protection requirements throughout the SDLC
Tracking data protection requirements throughout the entire Software Development Life Cycle (SDLC) ensures that these controls are consistently incorporated at every stage, from design through development, testing, and deployment. This end-to-end approach is superior to point-in-time interventions because it embeds data protection as a fundamental aspect of development rather than an afterthought or isolated check.
Why the other options are wrong
- A. Using a template only for UAT addresses protection late in the cycle and misses earlier design and development opportunities.
- B. A QA process during development alone does not ensure requirements are captured, tracked, and met throughout the entire lifecycle.
- C. Deriving requirements from stakeholders is necessary but insufficient without tracking implementation and compliance across all SDLC phases.
Question 223
Providing security certification for a new system should include which of the following prior to the system's implementation?
Show answer and explanation
Correct answer: C. An evaluation of the configuration management practices
An evaluation of configuration management practices must be completed prior to implementation because secure system configuration and the ability to track and manage configuration changes are fundamental to maintaining security posture throughout the system lifecycle. This ensures the tested and certified secure configuration can be properly maintained. End-user authorization and testing in production occur during or after implementation, and financial audit sign-off is not a security certification prerequisite.
Why the other options are wrong
- A. End-user authorization is a post-certification step that occurs as part of the implementation process, not before certification.
- B. Testing should occur in test/pre-production environments, not production, before the system is implemented.
- D. External financial controls audit is unrelated to security certification for system implementation.
Question 224
Which of the following occurs during the issues management process for a system development project?
Show answer and explanation
Correct answer: D. Impact assessment
Impact assessment occurs during the issues management process in system development projects. When issues are identified, they must be assessed to determine their impact on scope, schedule, budget, quality, and risks before decisions can be made about resolution and prioritization. This analysis is a core part of managing issues throughout the project lifecycle. Configuration management manages system components, help desk management addresses operational support, and contingency planning addresses potential future risks, none are primary to issues management.
Why the other options are wrong
- A. Configuration management controls components and versions but is separate from issues management.
- B. Help desk management handles operational incidents, not project-level issues management.
- C. Contingency planning prepares for potential future problems, distinct from assessing current issues.
Question 225
Which type of control is being implemented when a biometric access device is installed at the entrance to a facility?
Show answer and explanation
Correct answer: A. Preventive
A biometric access device at a facility entrance is a preventive control because it stops unauthorized access before it occurs by requiring authentication at the point of entry. Preventive controls act to eliminate the possibility of an unwanted event happening, which is exactly what biometric authentication does by preventing unauthorized persons from entering the facility.
Why the other options are wrong
- B. Deterrent controls discourage misconduct through awareness and threat of consequences, whereas biometric devices actively prevent access rather than merely discouraging it.
- C. Corrective controls remediate damage or restore systems after an unwanted event has occurred, not prevent it beforehand.
- D. Detective controls identify and report unwanted events after they have occurred, whereas biometric devices prevent unauthorized entry from happening in the first place.
Question 226
Which of the following information security requirements BEST enables the tracking of organizational data in a bring your own device (BYOD) environment?
Show answer and explanation
Correct answer: D. Employees must enroll their personal devices in the organization's mobile device management program.
Mobile Device Management (MDM) enrollment is the requirement that best enables actual tracking of organizational data on personal devices. MDM solutions provide the technical capability to monitor, locate, and manage devices remotely. Loss reporting, auto-lock features, and policy acknowledgment are important security practices but do not provide the technological means to actively track data location and movement on BYOD devices.
Why the other options are wrong
- A. Loss reporting is reactive notification after the fact, not a mechanism that enables ongoing tracking of organizational data.
- B. Auto-lock and password requirements protect device access but do not track where organizational data resides or how it moves.
- C. Policy acknowledgment documents understanding but provides no technical capability to actually track data on personal devices.
Question 227
Following an internal audit of a database, management has committed to enhance password management controls. Which of the following provides the BEST evidence that management has remediated the audit finding?
Show answer and explanation
Correct answer: D. Observation of updated password settings with database administrators (DBAs)
Observation of updated password settings with database administrators (DBAs) provides the best direct evidence of remediation. This is contemporaneous, objective evidence that the control has actually been implemented and is functioning. DBAs can demonstrate the actual technical configurations in place. Screenshots and change tickets could be fabricated or may not reflect current state, interviews are hearsay, and neither provides definitive proof that the control is currently operational and effective.
Why the other options are wrong
- A. Screenshots can be outdated, manipulated, or misrepresent the actual current state of systems.
- B. Interviews are indirect evidence and management may claim completion without actual implementation.
- C. Change tickets document that changes were requested but not that they are currently in effect or functioning properly.
Question 228
Which of the following should be the PRIMARY role of an internal audit function in the management of identified business risks?
Show answer and explanation
Correct answer: A. Validating enterprise risk management (ERM)
The primary role of internal audit is to provide independent assurance by validating the enterprise risk management (ERM) framework, assessing whether risks are properly identified, managed, and mitigated. Internal audit should not establish or operate the ERM framework or determine risk appetite, as these are management and governance responsibilities; audit's independence depends on oversight rather than operational involvement.
Why the other options are wrong
- B. Establishing a risk management framework is a management responsibility, not the auditor's role.
- C. Operating the risk management framework compromises audit independence; internal audit must validate, not operate.
- D. Establishing risk appetite is a governance and management decision, not an internal audit function.
Question 229
What is the BEST method to determine if IT resource spending is aligned with planned project spending?
Show answer and explanation
Correct answer: C. Earned value analysis (EVA)
Earned Value Analysis (EVA) measures actual project spending against planned spending and schedule progress, providing a comprehensive view of cost performance and whether resources are being spent as planned. EVA directly compares actual expenditures to budgeted amounts across the project timeline. ROI analysis measures returns after completion, Gantt charts show schedule visually, and critical path analysis focuses on schedule dependencies rather than cost alignment.
Why the other options are wrong
- A. ROI analysts evaluate financial returns but not alignment of spending with project plans during execution.
- B. Critical path analysis addresses scheduling and dependencies, not cost and spending alignment.
- D. Gantt charts display timeline and milestones visually but do not measure spending against planned budgets.
Question 230
Reviewing project plans and status reports throughout the development life cycle will:
Show answer and explanation
Correct answer: D. facilitate the optimal use of resources over the life of the project.
Reviewing project plans and status reports throughout the development lifecycle enables continuous monitoring of resource allocation, schedule adherence, budget utilization, and scope management. This ongoing oversight allows for timely adjustments to optimize resource use across the project's lifespan. Regular reviews facilitate course corrections, prevent waste, and ensure efficient allocation of personnel, budget, and materials throughout all project phases.
Why the other options are wrong
- A. Risk assessment is a separate process that cannot be eliminated by reviewing project documentation.
- B. Project progress documentation should be continuous throughout the lifecycle, not postponed until the final phase.
- C. Reviewing plans and reports improves the likelihood of meeting deliverables but cannot guarantee it, as unforeseen circumstances may occur.
Question 231
An IS auditor is conducting a post-implementation review of an enterprise resource planning (ERP) system. End users indicated concerns with the accuracy of critical automatic calculations made by the system. The auditor's FIRST course of action should be to:
Show answer and explanation
Correct answer: B. verify results to determine validity of user concerns.
The auditor's first action should be to verify the validity of user concerns by independently testing the system's critical calculations. This is the most direct and efficient course of action. Before investigating why calculations may be inaccurate (UAT, requirements, changes), the auditor must confirm whether the concerns are actually valid. If calculations are accurate, further investigation is unnecessary. If calculations are indeed inaccurate, independent verification establishes the facts needed to guide subsequent investigation into root causes.
Why the other options are wrong
- A. Verifying UAT completeness is important but should follow confirmation that calculations are actually inaccurate.
- C. Reviewing original requirements might explain design but does not address whether current calculations are accurate.
- D. Reviewing recent changes is investigative but should follow confirmation that a calculation problem actually exists.
Question 232
An IS audit manager is reviewing workpapers for a recently completed audit of the corporate disaster recovery test. Which of the following should the IS audit manager specifically review to substantiate the conclusions?
Show answer and explanation
Correct answer: C. Detailed evidence of the successes and weaknesses of all contingency testing
To substantiate conclusions about a disaster recovery test audit, the auditor manager must review detailed evidence showing what actually succeeded and failed during contingency testing. This provides objective documentation of test results rather than subjective opinions or procedural documentation. Option C contains the concrete evidence needed to support audit findings and recommendations.
Why the other options are wrong
- A. Interview overviews are preliminary observations, not substantive evidence of test outcomes.
- B. Summary memos reflect auditor opinions but do not constitute the underlying evidence needed to support those opinions.
- D. Prior audit reports on other disaster recovery audits are historical comparisons, not evidence of the current audit's findings.
Question 233
An employee approaches an IS auditor and expresses concern about a critical security issue in a newly installed application. Which of the following would be the MOST appropriate action for the auditor to take?
Show answer and explanation
Correct answer: A. Discuss the concern with audit management
When an employee reports a critical security issue, the auditor's first responsibility is to escalate the concern through proper channels to audit management. This ensures the issue is documented, prioritized appropriately, and handled according to organizational procedures and governance. This is more appropriate than immediately conducting a review, reverting systems, or gathering anecdotal employee opinions before proper assessment.
Why the other options are wrong
- B. Recommending system reversion is beyond the auditor's scope without proper investigation and management approval.
- C. Conducting an immediate review without management notification bypasses proper escalation procedures.
- D. Discussing with additional users risks spreading concern without proper investigation and may not follow incident protocols.
Question 234
Which of the following is a concern when an organization's disaster recovery strategy utilizes a hot site?
Show answer and explanation
Correct answer: D. Conflicts due to reciprocal agreements with other organizations
Hot sites often rely on reciprocal agreements with other organizations sharing the facility, creating conflicts when multiple organizations simultaneously need to activate their disaster recovery. This contention for shared resources is the primary practical concern with hot sites. Environmental controls, distance, and networking infrastructure are typically adequate in professionally managed hot sites.
Why the other options are wrong
- A. Professional hot site facilities maintain proper environmental controls as a standard service.
- B. Distance from the primary data center is deliberately planned and is not inherently a hot site concern.
- C. Hot sites include comprehensive networking infrastructure as part of their standard offering.
Question 235
Which of the following activities would allow an IS auditor to maintain independence while facilitating a control self-assessment (CSA)?
Show answer and explanation
Correct answer: C. Developing the CSA questionnaire
An IS auditor maintains independence by facilitating and guiding the CSA process without directly performing the assessment or remediation. Developing the CSA questionnaire is a facilitating activity that supports the organization's self-assessment while the auditor remains in an oversight role. This allows the auditor to later evaluate the CSA results objectively.
Why the other options are wrong
- A. Implementing remediation would violate independence by performing management functions.
- B. Developing the remediation plan constitutes management work and compromises auditor independence.
- D. Partially completing the CSA means the auditor is performing assessment work rather than facilitating it.
Question 236
Which of the following would BEST help to support an auditor's conclusion about the effectiveness of an implemented data classification program?
Show answer and explanation
Correct answer: A. Access rights provisioned according to scheme
Access rights provisioned according to the classification scheme provides the best evidence of classification program effectiveness because it demonstrates that the classification scheme is actually being implemented and used to control data access, the primary objective of data classification. This shows real-world application and business value. A detailed scheme (B) exists but may not be applied; tool purchase (C) provides capability but doesn't prove implementation; and business use cases (D) explain intent but don't demonstrate actual execution and control.
Why the other options are wrong
- B. A detailed classification scheme shows good planning but doesn't prove the scheme is actually being implemented and followed.
- C. Purchasing information management tools provides technical capability but doesn't verify that classification is being applied or enforced.
- D. Business use cases explain why classification matters but don't demonstrate that the program is actually functioning effectively in practice.
Question 237
Which of the following BEST demonstrates that IT strategy is aligned with organizational goals and objectives?
Show answer and explanation
Correct answer: D. Business stakeholders are involved in approving the IT strategy.
When business stakeholders are involved in approving the IT strategy, it demonstrates that IT priorities and direction are explicitly aligned with and supported by those responsible for business objectives. This approval step ensures IT strategy reflects business needs and goals. Communication alone (option A) doesn't ensure alignment; CIO involvement in business strategy (option B) is one-directional; CIO approval of business strategy (option C) inverts the proper relationship.
Why the other options are wrong
- A. Communication of IT strategies to stakeholders shows dissemination but not that strategy was shaped to meet their actual objectives.
- B. Communicating organizational strategy to the CIO is necessary but insufficient to demonstrate IT strategy alignment with those goals.
- C. The CIO should advise on business strategy, not approve it; this inverts proper governance hierarchy.
Question 238
Which of the following is the BEST source of information for an IS auditor to use when determining whether an organization's information security policy is adequate?
Show answer and explanation
Correct answer: A. Risk assessment results
Risk assessment results provide the foundation for determining whether a security policy is adequate, as the policy must address the organization's identified risks and threat landscape. A risk assessment identifies what threats and vulnerabilities exist, allowing the auditor to evaluate whether the policy adequately covers those specific risks. Penetration test results reveal vulnerabilities but don't necessarily indicate policy adequacy. Industry benchmarks show general best practices but may not align with the organization's specific risk profile. Security program plans describe implementation but not policy sufficiency relative to actual risk.
Why the other options are wrong
- B. Penetration test results identify vulnerabilities but don't directly measure policy adequacy.
- C. Industry benchmarks provide general guidance but don't account for the organization's specific risk context.
- D. Program plans describe implementation but don't determine whether policies adequately address identified risks.
Question 239
Which of the following would be a result of utilizing a top-down maturity model process?
Show answer and explanation
Correct answer: C. Identification of processes with the most improvement opportunities
A top-down maturity model process evaluates organizational processes against a maturity framework, systematically identifying which processes have the lowest maturity levels and thus the most improvement opportunities. This prioritization approach helps focus remediation efforts where they're most needed. Comparing effectiveness of other processes (A) is cross-comparative analysis, not maturity modeling. Identifying older processes (B) doesn't follow maturity logic. Benchmarking with peers (D) is external comparison, not an inherent result of internal top-down maturity assessment.
Why the other options are wrong
- A. Comparing effectiveness between different processes is not the result of a maturity model assessment.
- B. Age of processes is not what a top-down maturity model identifies or focuses on.
- D. Benchmarking with external peers is external comparison, not a result of internal top-down maturity modeling.
Question 240
During a follow-up audit, an IS auditor finds that some critical recommendations have not been addressed as management has decided to accept the risk. Which of the following is the IS auditor's BEST course of action?
Show answer and explanation
Correct answer: C. Evaluate senior management's acceptance of the risk.
When management decides to accept risk rather than remediate critical recommendations, the IS auditor must evaluate whether senior management has properly authorized and understood this acceptance. The auditor needs to verify that appropriate risk ownership, authorization level, and risk assessment occurred. This ensures the risk acceptance is valid and properly documented.
Why the other options are wrong
- A. Adjusting the risk assessment acknowledges the decision but does not verify its appropriateness or authorization.
- B. Requiring full remediation ignores management's legitimate authority to accept calculated risks.
- D. Updating the audit program accommodates the decision but does not evaluate whether the decision-making process was adequate.
Question 241
An organization with many desktop PCs is considering moving to a thin client architecture. Which of the following is the MAJOR advantage?
Show answer and explanation
Correct answer: B. System administration can be better managed.
The major advantage of thin client architecture is that system administration can be significantly better managed because all applications, patches, updates, and configurations are centrally controlled on servers rather than distributed across hundreds of individual PCs. This centralization reduces administrative overhead, improves consistency, enables faster patching and updates, and simplifies management of software licenses and configurations.
Why the other options are wrong
- A. While security can be managed at the server level, this is not the MAJOR advantage; administrative management is the primary benefit.
- C. Thin client security is not inherently enhanced compared to desktop PCs; security depends on implementation.
- D. Desktop applications in a thin client environment will still require upgrades and maintenance just as traditional systems do.
Question 242
During an exit interview, senior management disagrees with some of the facts presented in the draft audit report and wants them removed from the report. Which of the following would be the auditor's BEST course of action?
Show answer and explanation
Correct answer: B. Gather evidence to analyze senior management's objections.
When management disputes findings, the auditor's professional responsibility is to objectively evaluate their concerns by gathering and analyzing evidence to support or refute the disagreement. This maintains audit independence and credibility while demonstrating due diligence. Simply removing facts (A) would compromise the audit's integrity, escalating immediately (C) skips the auditor's obligation to investigate, and finalizing without consideration (D) ignores legitimate management input that may contain valid evidence.
Why the other options are wrong
- A. Removing facts based on management objections compromises audit objectivity and independence.
- C. Escalation should occur after the auditor investigates the objections, not before.
- D. Ignoring management's concerns without evaluation fails to demonstrate due professional care.
Question 243
Which of the following is an IS auditor's GREATEST concern when an organization does not regularly update software on individual workstations in the internal environment?
Show answer and explanation
Correct answer: D. The organization may be more susceptible to cyber-attacks.
The greatest concern for an IS auditor when workstations are not regularly updated is the increased susceptibility to cyber-attacks. Unpatched software contains known vulnerabilities that attackers actively exploit. This represents a direct and significant security risk to the organization's systems, data, and operations, making it the primary concern from a security and risk perspective.
Why the other options are wrong
- A. Licensing compliance is a contractual/legal issue but not the auditor's greatest security concern.
- B. System functionality relates to business needs but is not the primary risk from missing updates.
- C. Version control issues may exist but are secondary to the security vulnerabilities present in unpatched systems.
Question 244
Which of the following is MOST important for an IS auditor to confirm when conducting a review of an active-active application cluster configuration?
Show answer and explanation
Correct answer: B. The cluster configuration includes adequate network bandwidth.
Adequate network bandwidth is most important to confirm in an active-active cluster because both nodes process traffic simultaneously, requiring sufficient bandwidth to handle the combined load and inter-node communication. Insufficient bandwidth will cause bottlenecks, defeating the purpose of the active-active configuration and potentially causing performance failures. While user satisfaction, configuration switching, and version history are relevant, they do not address the fundamental technical requirement for the active-active design to function properly under load.
Why the other options are wrong
- A. User satisfaction surveys measure operational outcomes but do not confirm technical prerequisites for the cluster design.
- C. Switching between active-active and active-passive indicates the cluster configuration may not be stable or properly designed.
- D. Version history management is a maintenance practice but does not verify the cluster has adequate resources to operate as designed.
Question 245
When planning an audit to assess application controls of a cloud-based system, it is MOST important for the IS auditor to understand the:
Show answer and explanation
Correct answer: B. architecture and cloud environment of the system.
Understanding the architecture and cloud environment of the system is most important because cloud systems operate differently from on-premises systems, with different controls, responsibility models, and data locations. This foundational knowledge is essential for an IS auditor to effectively design an audit scope and identify where application controls exist within the shared responsibility model between the organization and cloud provider.
Why the other options are wrong
- A. Availability reports are a result of system performance but do not directly inform how to assess application controls in a cloud environment.
- C. While business policies are important, they are secondary to understanding the technical architecture in which those policies must be implemented.
- D. The business process is important context, but the technical architecture of the cloud system itself is more critical for planning application control audits.
Question 246
Which of the following management decisions presents the GREATEST risk associated with data leakage?
Show answer and explanation
Correct answer: B. There is no requirement for desktops to be encrypted.
No requirement for desktop encryption presents the GREATEST data leakage risk because unencrypted devices contain sensitive data that is immediately accessible if the device is lost, stolen, or accessed by unauthorized parties. This is a direct technical vulnerability enabling data theft. Remote work requires additional controls but can be secured with VPN; lack of training is addressed through awareness; and outdated policies, while problematic, do not directly enable data exposure like unencrypted storage does.
Why the other options are wrong
- A. Remote work increases risk but can be mitigated through VPN, access controls, and monitoring, it is not inherently the greatest risk.
- C. Lack of security awareness training reduces the human element of security but does not directly enable data leakage like unencrypted storage.
- D. Outdated policies represent a governance gap but do not directly facilitate data leakage without corresponding technical or procedural failures.
Question 247
Using swipe cards to limit employee access to restricted areas requires implementing which additional control?
Show answer and explanation
Correct answer: C. Periodic review of access profiles by management
Periodic review of access profiles by management is the critical additional control needed to ensure swipe cards remain effective. Over time, employees change roles, leave the organization, or their access needs change. Regular management review ensures access rights remain appropriate and revokes access that should no longer exist, preventing unauthorized access and data breaches.
Why the other options are wrong
- A. Physical sign-in is redundant when swipe cards already record access electronically.
- B. Escorting new hires is an onboarding procedure unrelated to ongoing access control maintenance.
- D. Access criteria should be based on job function and business need, not IS experience level.
Question 248
Which of the following is the BEST way for an IS auditor to determine whether an organization’s disaster recovery plan (DRP) is current?
Show answer and explanation
Correct answer: D. Verify the DRP is periodically tested.
Periodic testing of the DRP is the best way to determine whether it is current and functional. Testing reveals gaps, outdated procedures, changed system configurations, inaccurate contact information, and whether the plan can actually achieve its stated recovery objectives. Testing is the only method that comprehensively validates both the currentness and the effectiveness of a disaster recovery plan.
Why the other options are wrong
- A. Reviewing documentation alone does not verify that the plan is current or that it actually works in practice.
- B. Verifying contact details addresses only one component of the DRP and does not ensure overall plan currentness or functionality.
- C. Staff training on business continuity does not directly validate whether the DRP itself is current or functional.
Question 249
Which of the following is the MAIN purpose of an information security management system?
Show answer and explanation
Correct answer: B. To reduce the frequency and impact of information security incidents
The primary purpose of an information security management system is to reduce both the frequency (prevention) and impact (mitigation) of security incidents through systematic controls and management practices. Root cause elimination (C) is a benefit but not the main purpose. Keeping policies updated (D) is a maintenance activity. Enhanced reporting (A) is a consequence but not the primary purpose.
Why the other options are wrong
- A. Enhanced reporting is a benefit of the system but not its main purpose.
- C. Root cause elimination is an outcome of incident management, not the primary purpose of the system.
- D. Policy maintenance is part of system management but not the primary purpose.
Question 250
An IS auditor is reviewing security controls related to collaboration tools for a business unit responsible for intellectual property and patents. Which of the following observations should be of MOST concern to the auditor?
Show answer and explanation
Correct answer: D. Employees can share files with users outside the company through collaboration tools.
Allowing employees to share files with external users through collaboration tools poses the MOST critical risk for a department handling intellectual property and patents. This directly threatens the confidentiality of sensitive IP, potentially exposing trade secrets, patent information, and proprietary data to unauthorized external parties. This is a direct loss of control over sensitive assets.
Why the other options are wrong
- A. While training is important for security awareness, lack of training is less of an immediate risk than the ability to share IP externally.
- B. Logging and monitoring for content filtering is a detective control; the absence is less critical than the preventive failure in option D.
- C. Browser-based access does not inherently reduce security and is increasingly common; this is not the primary concern for IP protection.
Question 251
Which of the following would BEST protect the confidentiality of sensitive data in transit between multiple offices?
Show answer and explanation
Correct answer: B. Public key infrastructure (PKI)
Public Key Infrastructure (PKI) provides end-to-end encryption of data in transit through asymmetric cryptography, ensuring confidentiality between multiple offices. PKI establishes trusted key management, authentication, and encrypted communication channels that protect sensitive data while it moves across networks, making it the most comprehensive solution for multi-office data confidentiality.
Why the other options are wrong
- A. Digital signatures provide authentication and non-repudiation but do not encrypt data, leaving content readable in transit.
- C. Hash algorithms create fixed-length digests for integrity verification but do not provide confidentiality, hashes are one-way functions and cannot encrypt data.
- D. Kerberos is primarily an authentication protocol for local networks and does not inherently provide encryption for data in transit between offices.
Question 252
An IS auditor is reviewing a recent security incident and is seeking information about the approval of a recent modification to a database system's security settings. Where would the auditor MOST likely find this information?
Show answer and explanation
Correct answer: B. Change log
A change log is the formal record that documents all modifications to systems, including who approved them, when they occurred, and what was changed. This is the primary source for tracking system modifications and their approvals. SIEM reports track security events and incidents but not necessarily change approvals. System event correlation reports focus on event patterns rather than change authorization. Database logs record database activity but not change approval workflows.
Why the other options are wrong
- A. SIEM reports track security events and incidents, not change approvals.
- C. Event correlation reports analyze patterns in events, not change authorization records.
- D. Database logs record database activity and transactions, not change approvals.
Question 253
Which of the following findings should be of GREATEST concern for an IS auditor when auditing the effectiveness of a phishing simulation test administered for staff members?
Show answer and explanation
Correct answer: C. Staff members who failed the test did not receive follow-up education.
The greatest concern for an IS auditor is whether failed phishing tests result in follow-up education, as this directly impacts the remediation and behavioral change necessary to reduce future phishing incidents. Without follow-up education, staff members who fell victim to the phishing simulation have not learned from their mistake, defeating the purpose of the test. Follow-up education converts test failures into learning opportunities and measurable security improvements.
Why the other options are wrong
- A. While pre-test training is good practice, its absence does not negate the value of testing to identify vulnerabilities in current awareness levels.
- B. Advance notification would bias test results and provide unrealistic conditions; unannounced tests measure actual vulnerability and are industry standard.
- D. Not communicating results to staff is suboptimal, but the absence of communication is less critical than the absence of corrective education following failures.
Question 254
Which of the following techniques provides the BEST assurance of server availability over time?
Show answer and explanation
Correct answer: A. Analyzing logs in the server administration console
Analyzing logs in the server administration console provides comprehensive, continuous, and objective data about server availability and downtime over time. Logs capture all availability events, can be aggregated for trends, and are verifiable, providing the best assurance of actual server availability patterns compared to subjective user reports or limited manual checks.
Why the other options are wrong
- B. User-reported downtime is subjective, often incomplete, and may miss unnoticed availability issues.
- C. Planned outages are known events and don't reflect unexpected downtime or availability trends.
- D. Manual daily pinging is sparse, inconsistent, and cannot capture downtime events between checks.
Question 255
Which of the following is a deterrent security control that reduces the likelihood of an insider threat event?
Show answer and explanation
Correct answer: B. Distributing disciplinary policies
Distributing disciplinary policies is a deterrent control that reduces the likelihood of insider threats by making clear the consequences of misconduct. Deterrent controls work by discouraging bad behavior through knowledge of penalties. Removing malicious code (A) is a corrective control addressing existing threats. Contingency plans (C) and data recovery (D) are recovery controls addressing consequences, not preventing the threat from occurring.
Why the other options are wrong
- A. Removing malicious code is a corrective control, not a deterrent.
- C. Contingency plans are contingency controls, not deterrent controls.
- D. Data recovery procedures are recovery controls, not preventive or deterrent controls.
Question 256
When reviewing an organization's IT governance processes, which of the following provides the BEST indication that information security expectations are being met at all levels?
Show answer and explanation
Correct answer: A. Achievement of established security metrics
Achievement of established security metrics provides the best indication that security expectations are being met at all levels. Metrics demonstrate measurable, objective outcomes across the organization, incident rates, patch compliance, training completion, access control effectiveness, etc. Metrics indicate actual performance rather than intentions or approvals. Management approval, standards adoption, and awareness programs are all necessary components but do not demonstrate that security expectations are actually being achieved in practice.
Why the other options are wrong
- B. Senior management approval is important for governance but does not prove security expectations are being met operationally.
- C. Using an internationally recognized standard provides a framework but does not demonstrate actual achievement or compliance.
- D. A security awareness program is a necessary control but does not by itself indicate that security expectations are being met organization-wide.
Question 257
Which of the following is MOST important to consider when assessing the scope of privacy concerns for an IT project?
Show answer and explanation
Correct answer: B. Applicable laws and regulations
Applicable laws and regulations establish the mandatory requirements and boundaries for privacy protection in any given jurisdiction. These legal and regulatory obligations must be the foundation for assessing privacy scope, as non-compliance creates legal risk regardless of other business factors.
Why the other options are wrong
- A. Business requirements and data flows are important for understanding data movement but do not establish what privacy protections are required.
- C. Data ownership is relevant to accountability but does not determine the scope of privacy concerns that must be addressed.
- D. End user access rights are a control mechanism but do not define the privacy scope that must be considered.
Question 258
Which of the following is the BEST use of a maturity model in a small organization?
Show answer and explanation
Correct answer: B. To identify required actions to close the gap between current and desired maturity levels
The best use of a maturity model in a small organization is to identify required actions to close the gap between current and desired maturity levels. This practical, action-oriented approach allows small organizations with limited resources to prioritize improvements strategically and focus efforts on the most impactful enhancements. Gap analysis transforms the maturity assessment into a concrete roadmap for improvement.
Why the other options are wrong
- A. While assessment is important, identifying actions for improvement is more valuable for a small organization.
- C. Benchmarking against the highest performers is less practical for resource-constrained small organizations.
- D. Achieving the highest maturity level may not be realistic or appropriate for small organizations with different risk profiles.
Question 259
Which of the following is the BEST indicator of the effectiveness of an organization's portfolio management program?
Show answer and explanation
Correct answer: A. Percentage of investments achieving their forecasted value
The percentage of investments achieving their forecasted value is the best indicator of portfolio management effectiveness because it directly measures whether the portfolio program is delivering intended business outcomes. This metric demonstrates whether investments are being selected, prioritized, and managed effectively to create actual value. While maturity levels, personnel experience, and stakeholder perception are relevant factors, the ultimate measure of any portfolio management program's effectiveness is the tangible realization of projected benefits.
Why the other options are wrong
- B. Maturity levels indicate process capability but not actual results achieved.
- C. Personnel experience is a capability input, not an output measure of effectiveness.
- D. Stakeholder perception is subjective and may not align with objective value delivery metrics.
Question 260
Which of the following is MOST important for an IS auditor to look for in a project feasibility study?
Show answer and explanation
Correct answer: C. An assessment of whether the expected benefits can be achieved
The MOST important assessment for an IS auditor to evaluate in a feasibility study is whether the expected benefits can actually be achieved given the project's constraints, timeline, resources, and technology. This assessment determines project viability and realistic success probability. While benefits exceeding investment and meeting requirements are also important, assessing achievability is foundational because an unachievable project will fail regardless of its apparent cost-benefit ratio or requirements specification.
Why the other options are wrong
- A. Benefits exceeding investment is important for financial justification but does not ensure the benefits are actually achievable.
- B. Control effectiveness assessment is important but is a subset of overall project viability rather than the MOST important element.
- D. Meeting requirements is important, but the focus should be on whether anticipated benefits can realistically be delivered, which is broader than requirements fulfillment.
Question 261
A client/server configuration will:
Show answer and explanation
Correct answer: B. enhance system performance through the separation of front-end and back-end processes.
A client/server configuration enhances system performance by separating front-end processes (client-side presentation logic) from back-end processes (server-side business logic and data management). This separation allows each tier to be optimized independently and distributes processing load efficiently across the network.
Why the other options are wrong
- A. Incorrect terminology; servers are on the back-end, not front-end, and clients are on client machines, not hosts in this sense.
- C. Client/server architecture does not inherently track all clients through IS facilities of a service organization; that is a separate function.
- D. Client/server architecture actually distributes systems across multiple hardware systems, not limiting them to a single system.
Question 262
An incorrect version of source code was amended by a development team. This MOST likely indicates a weakness in:
Show answer and explanation
Correct answer: A. change management.
An incorrect version of source code being amended by a development team indicates a failure in change management processes. Proper change management controls would include version control, configuration management, and approval procedures to ensure that only correct, authorized versions of code are used and modified. This weakness allows unapproved or incorrect changes to propagate through the development environment without proper controls.
Why the other options are wrong
- B. Project management focuses on timelines and resources, not on controlling which code versions are modified.
- C. Incident management deals with responding to problems after they occur, not preventing incorrect versions from being used.
- D. While QA should catch errors, the root cause here is the lack of change management controls that allowed an incorrect version to be worked with in the first place.
Question 263
When classifying information, it is MOST important to align the classification to:
Show answer and explanation
Correct answer: A. business risk.
Information classification schemes must be fundamentally aligned with business risk to ensure that classification levels reflect the actual impact and threat landscape relevant to the organization. Business risk drives which data requires protection and at what level, making it the foundational criterion for effective classification. While data retention requirements, industry standards, and security policy are all important considerations, they are secondary to understanding and addressing the underlying business risks that necessitate classification in the first place.
Why the other options are wrong
- B. Data retention requirements are a consequence of classification, not the driver for it.
- C. Industry standards provide guidance but may not fully align with an organization's specific business risks.
- D. Security policy should be informed by risk-based classification, not the other way around.
Question 264
Which of the following types of environmental equipment will MOST likely be deployed below the floor tiles of a data center?
Show answer and explanation
Correct answer: C. Water sensors
Water sensors are most likely to be deployed below data center floor tiles to detect water leaks and flooding hazards. Raised floors in data centers are common, and water detection in this space is critical for preventing equipment damage. Water sensors provide early warning of leaks from HVAC systems, pipes, or external sources before water reaches expensive equipment.
Why the other options are wrong
- A. Temperature sensors are typically mounted on walls or within equipment racks, not below floor tiles, as they monitor ambient air temperature.
- B. Humidity sensors are usually positioned in the main data center environment rather than below floors, as they monitor the air in the occupied space.
- D. Air pressure sensors are not standard data center environmental monitoring equipment; pressure control is not a typical concern below data center floors.
Question 265
An IT balanced scorecard is PRIMARILY used for:
Show answer and explanation
Correct answer: B. measuring IT strategic performance.
An IT balanced scorecard is primarily used for measuring IT strategic performance by translating IT strategy into measurable performance indicators across multiple dimensions (financial, customer, internal process, learning/growth). It provides a comprehensive framework to assess how well IT initiatives align with and support organizational strategy. While it may support resource allocation and risk monitoring, these are secondary applications; strategic performance measurement is its primary purpose.
Why the other options are wrong
- A. Risk monitoring is a control activity, not the primary purpose of a balanced scorecard.
- C. Project portfolio evaluation is a portfolio management activity, distinct from strategic performance measurement.
- D. Budget allocation is a financial planning function, not the primary use of a balanced scorecard.
Question 266
An IS auditor finds a high-risk vulnerability in a public-facing web server used to process online customer payments. The IS auditor should FIRST:
Show answer and explanation
Correct answer: C. identify compensating controls.
When a high-risk vulnerability is discovered in a public-facing, payment-processing server, the auditor should first identify compensating controls to determine what protective measures are currently in place. This rapid assessment helps establish whether there is immediate risk exposure requiring urgent remediation or whether existing controls mitigate the vulnerability. This allows the organization to prioritize the response appropriately before escalating through formal reporting channels.
Why the other options are wrong
- A. Notifying the audit committee is an important escalation step but should follow initial risk assessment.
- B. Reviewing incident reports is a detective activity that does not address the current vulnerability.
- D. Documenting in a formal audit report is appropriate but should follow assessment of compensating controls and current risk level.
Question 267
Which of the following business continuity activities prioritizes the recovery of critical functions?
Show answer and explanation
Correct answer: A. Business impact analysis (BIA)
A Business Impact Analysis (BIA) is the foundational BC activity that identifies and prioritizes critical business functions based on their importance to organizational operations. It determines which functions must be recovered first and establishes recovery time objectives and recovery point objectives, directly prioritizing recovery of critical functions.
Why the other options are wrong
- B. Risk assessment identifies threats and vulnerabilities but does not directly prioritize recovery of critical functions.
- C. BCP testing validates previously developed plans but does not prioritize critical functions, that prioritization comes from the BIA.
- D. DRP testing validates disaster recovery procedures but is implementation-focused, not prioritization-focused.
Question 268
The MOST important function of a business continuity plan (BCP) is to:
Show answer and explanation
Correct answer: A. ensure that the critical business functions can be recovered.
The primary purpose of a BCP is to enable recovery of critical business functions during a disaster. This is the fundamental objective, maintaining business continuity when normal operations are disrupted. While the BCP includes procedures and schedules, these are means to achieving the core goal of ensuring critical functions can be recovered.
Why the other options are wrong
- B. Procedures for testing the BCP are important but are supporting activities, not the main function.
- C. A schedule of disaster events is a component of the plan, not its primary function.
- D. Restoring all business functions is a secondary goal; critical functions take priority due to resource constraints.
Question 269
Which of the following is the BEST reason to implement a data retention policy?
Show answer and explanation
Correct answer: C. To limit the liability associated with storing and protecting information
The primary business reason to implement a data retention policy is to limit legal and regulatory liability. By establishing clear retention periods, organizations ensure they do not retain data longer than necessary, which reduces exposure to regulatory fines, legal discovery obligations, and breach risks. This directly addresses the organization's risk management and compliance posture. While the other options describe secondary benefits or unrelated objectives, limiting liability is the core governance and risk-based rationale for formal retention policies.
Why the other options are wrong
- A. Recovery point objective (RPO) is a disaster recovery concept, not the primary purpose of data retention policy, though retention policies may inform RPO decisions.
- B. Data retention policies can assign responsibility, but the primary purpose is not about assigning ownership outside IT.
- D. Documenting business objectives for data processing is useful but is not the primary driver for establishing retention policies; the focus is on retention limits, not processing purposes.
Question 270
Which of the following would BEST prevent the potential leakage of sensitive corporate data from personal mobile devices accessing corporate applications?
Show answer and explanation
Correct answer: B. Creating a separate secure partition on the devices
Creating a separate secure partition on personal mobile devices is the BEST preventive control because it logically isolates corporate applications and data from the personal environment. This technical control ensures that sensitive corporate data is confined to an encrypted, controlled space that cannot be accessed or exfiltrated through personal applications or uncontrolled areas of the device. Limiting access controls the threat symptomatically, monitoring detects breaches after they occur, and acceptable use policies provide no technical prevention.
Why the other options are wrong
- A. Limiting access and capabilities is a mitigating control but does not prevent data leakage if vulnerabilities exist.
- C. Monitoring detects compromises but does not prevent sensitive data from leaving the device.
- D. Acceptable use policies are administrative controls that cannot prevent technical data leakage without enforcement mechanisms.
Question 271
An IS auditor has discovered that a software system still in regular use is years out of date and no longer supported. The auditee has stated that it will take six months until the software is running on the current version. Which of the following is the BEST way to reduce the immediate risk associated with using an unsupported version of the software?
Show answer and explanation
Correct answer: D. Segregate the outdated software system from the main network.
Segregating the outdated software system from the main network is the best way to reduce immediate risk because it prevents attackers who exploit vulnerabilities in the unsupported version from pivoting to other organizational assets. Network isolation is a containment strategy that limits the blast radius of potential compromise. While the six-month upgrade timeline is underway, isolation provides the most effective risk reduction without waiting for patching or other incomplete controls.
Why the other options are wrong
- A. Applying patches to an unsupported version may address some known issues but does not protect against unpatched zero-days for which vendor support no longer exists.
- B. Monitoring network traffic can detect attacks but does not prevent exploitation; it is reactive rather than preventive.
- C. Closing unused ports reduces some attack surface but does not address vulnerabilities in active, required services on the unsupported version.
Question 272
Which cloud deployment model is MOST likely to be limited in scalability?
Show answer and explanation
Correct answer: B. Private
Private cloud deployment models are most limited in scalability because they are restricted to a single organization's infrastructure and resources. While private clouds offer control and security, they cannot easily scale beyond the capacity of the dedicated hardware and facilities. In contrast, public and hybrid clouds leverage shared vendor infrastructure with virtually unlimited scalability, and community clouds serve multiple organizations that can collectively benefit from shared scaling.
Why the other options are wrong
- A. Hybrid clouds combine public and private resources and can leverage the public cloud's scalability for peak demands.
- C. Community clouds serve multiple organizations and can scale across shared infrastructure more readily than private deployments.
- D. Public clouds are specifically designed for maximum scalability and elastic resource allocation.
Question 273
Which of the following methods would BEST ensure that IT strategy is in line with business strategy?
Show answer and explanation
Correct answer: D. IT value analysis
IT value analysis specifically evaluates how IT investments and initiatives create value for the business and contribute to strategic objectives. This method directly assesses alignment between IT initiatives and business strategy by measuring business value delivery.
Why the other options are wrong
- A. Break-even point analysis is a financial tool for cost-benefit evaluation but does not address strategic alignment.
- B. Business impact analysis focuses on disaster recovery priorities rather than strategic alignment of IT with business direction.
- C. Critical path analysis is a project management technique for scheduling but does not evaluate strategic alignment.
Question 274
A chief information officer (CIO) has asked an IS auditor to implement several security controls for an organization's IT processes and systems. The auditor should:
Show answer and explanation
Correct answer: B. communicate the conflict of interest to audit management.
An IS auditor must maintain independence and objectivity. When asked by a CIO to implement security controls, this creates a conflict of interest because the auditor would then be responsible for controls they later need to audit. The appropriate action is to communicate this conflict of interest to audit management, who can determine the proper course of action, such as assigning the implementation to non-audit personnel and ensuring the auditor maintains independence for future audits.
Why the other options are wrong
- A. An outright refusal without communicating the issue is not professional; the auditor should report the conflict to management.
- C. Performing the implementation and then auditing it violates the principle of independence and creates an obvious conflict.
- D. Executive management approval does not resolve the independence issue; this is an audit governance matter for audit management to address.
Question 275
An audit identified that a computer system is not assigning sequential purchase order numbers to order requests. The IS auditor is conducting an audit follow-up to determine if management has resolved this finding. Which of the following is the MOST reliable follow-up procedure?
Show answer and explanation
Correct answer: C. Inspect the system settings and transaction logs to determine if sequential order numbers are generated.
Inspecting system settings and reviewing transaction logs provides direct, objective evidence that sequential order numbers are actually being generated in practice. This is the most reliable approach because it involves examining the system itself and real data rather than relying on management representations or documentation. It confirms the control is functioning as intended through concrete verification rather than indirect evidence.
Why the other options are wrong
- A. Inquiry alone is hearsay and lacks independent verification; management may claim compliance without actual implementation.
- B. Change documentation shows what was planned but does not confirm the system is actually functioning correctly or that the configuration persists.
- D. Examining a sample of generated purchase orders may show current results but does not provide comprehensive evidence of consistent sequential numbering over time or system setting verification.
Question 276
Which of the following is the BEST way for an IS auditor to validate that employees have been made aware of the organization's information security policy?
Show answer and explanation
Correct answer: A. Interview employees to determine their level of understanding of the policy.
Interviewing employees to assess their understanding of the information security policy is the best validation method because it directly measures awareness at the individual level. Interviews allow auditors to probe depth of understanding, identify gaps, and confirm that awareness translates into actual knowledge. Comparing rosters against training attendance only confirms participation, not comprehension. Reviewing HR records for violations indicates non-compliance but not awareness. Reviewing training processes validates the delivery mechanism but not whether employees actually understood the content.
Why the other options are wrong
- B. Attendance records show participation but not whether employees understood or retained the policy content.
- C. Violations indicate non-compliance but provide no direct evidence of prior awareness.
- D. Process review validates training delivery methods but cannot confirm individual employee understanding.
Question 277
Which of the following MUST be completed as part of the annual audit planning process?
Show answer and explanation
Correct answer: C. Risk assessment
Risk assessment is a fundamental and mandatory component of annual audit planning. It involves identifying and evaluating risks to determine audit priorities, scope, and resource allocation. While fieldwork, risk control matrices, and BIAs may be part of the broader audit process, risk assessment specifically must be completed during the planning phase to establish the foundation for the entire audit engagement.
Why the other options are wrong
- A. Fieldwork is performed during the audit execution phase, not the planning phase.
- B. Risk control matrix development is typically part of risk analysis but is not specifically required as a separate mandatory planning deliverable.
- D. Business impact analysis is more relevant to business continuity planning than to the core audit planning process.
Question 278
An IS auditor reviewing a project to acquire an IT-based solution learns the risk associated with project failure has been assessed as high. What is the auditor's BEST course of action?
Show answer and explanation
Correct answer: D. Review the risk monitoring process during project execution.
When a project has been assessed with high failure risk, the auditor's best course of action is to review the risk monitoring process during project execution. This ensures that risks are being actively tracked, controlled, and escalated appropriately throughout the project lifecycle. Reviewing the monitoring process allows the auditor to verify that management has adequate visibility and can respond to emerging issues before they cause project failure.
Why the other options are wrong
- A. Reassessing costs does not address the underlying execution risks that led to the high-risk assessment.
- B. Benefits realization is typically assessed after project completion, not as an immediate response to high project failure risk.
- C. Simply informing management about losses is reactive; the auditor should verify that active monitoring controls are in place.
Question 279
An organization is disposing of a system containing sensitive data and has deleted all files from the hard disk. An IS auditor should be concerned because:
Show answer and explanation
Correct answer: D. deleting the files logically does not overwrite the files' physical data.
An IS auditor should be concerned because deleting files logically does not overwrite the files' physical data on the hard disk. Logical deletion only removes file system pointers, leaving the actual data recoverable through forensic tools. For proper disposal of sensitive data, physical data destruction or cryptographic sanitization is required. This is a critical security gap in the disposal process that could expose sensitive information.
Why the other options are wrong
- A. The concern is not that deleted data cannot be retrieved, it's precisely that it CAN be retrieved, making this wrong.
- B. While backups should ideally be deleted, the primary concern is the physical data remaining on the primary disk.
- C. Efficiency of the deletion method is not the auditor's primary concern; security of sensitive data destruction is.
Question 280
Which of the following metrics would be MOST useful to an IS auditor when assessing the resilience of an application programming interface (API)?
Show answer and explanation
Correct answer: C. Number of API calls expected versus actually received within a time interval
The number of API calls expected versus actually received measures availability and reliability, core attributes of resilience. A significant gap indicates the API is failing to respond to legitimate requests, directly reflecting whether the system can withstand and recover from failures. This metric reveals actual operational resilience in real conditions. The other metrics measure development quality, adoption, or patch activity but do not directly assess whether the API continues functioning under stress.
Why the other options are wrong
- A. Patch frequency is a maintenance indicator but does not measure whether the API is actually resilient during operation.
- B. Development defects are a quality metric but do not reflect the API's runtime resilience or availability performance.
- D. Developer adoption measures market success, not the technical resilience or reliability of the API itself.
Question 281
During a project meeting for the implementation of an enterprise resource planning (ERP). a new requirement is requested by the finance department. Which of the following would BEST indicate to an IS auditor that the resulting risk to the project has been assessed?
Show answer and explanation
Correct answer: B. The analysis of the cost and time impact of the requirement
An IS auditor assesses whether risk has been properly evaluated by examining whether the impact of new requirements has been analyzed. The analysis of cost and time impact demonstrates that a formal risk assessment process has occurred, showing how the requirement affects the project timeline and budget. This is the objective evidence that risk assessment has taken place.
Why the other options are wrong
- A. Project status in meeting minutes documents what happened but does not demonstrate that risk was formally assessed.
- C. Updated business requirements reflect what was requested but not whether the resulting risks were evaluated.
- D. Finance department approval grants permission but does not indicate that risk analysis was performed beforehand.
Question 282
An algorithm in an email program analyzes traffic to quarantine emails identified as spam. The algorithm in the program is BEST characterized as which type of control?
Show answer and explanation
Correct answer: C. Preventive
A preventive control stops unwanted events from occurring before they happen. Quarantining spam emails prevents unwanted communications from reaching the inbox, which is the essence of prevention. Detective controls identify issues after they occur, directive controls mandate actions, and corrective controls fix problems already detected.
Why the other options are wrong
- A. Detective controls identify problems after they occur, but quarantining prevents spam from reaching users in the first place.
- B. Directive controls mandate or enforce required actions, not specifically analyzing and blocking unwanted items.
- D. Corrective controls address and fix problems that have already been detected, rather than preventing them initially.
Question 283
An organization has outsourced the development of a core application. However, the organization plans to bring the support and future maintenance of the application back in-house. Which of the following findings should be the IS auditor's GREATEST concern?
Show answer and explanation
Correct answer: A. The data model is not clearly documented.
Unclear data model documentation is the IS auditor's greatest concern for in-house maintenance because without understanding the data structure, the internal team cannot effectively maintain, troubleshoot, or enhance the application. This directly impacts the organization's ability to support the core application long-term. The vendor location (B) is less relevant with proper documentation; lower outsourcing cost (C) is irrelevant to maintenance concerns; user training (D), while important, is less critical than technical documentation for support operations.
Why the other options are wrong
- B. Vendor location is less critical if proper documentation and knowledge transfer occur.
- C. Cost considerations are not an audit concern; focus should be on capability to support the application.
- D. User training, while important, is secondary to technical documentation needed by the support team.
Question 284
Which of the following is necessary for effective risk management in IT governance?
Show answer and explanation
Correct answer: C. Risk evaluation is embedded in management processes.
For IT risk management to be effective in governance, risk evaluation must be embedded directly into management processes and decision-making at all levels. This ensures risk considerations become part of normal business operations rather than isolated activities. While audit committee approval and overall strategy are important, embedding risk evaluation into management processes is the fundamental necessity for effectiveness across the organization.
Why the other options are wrong
- A. Local managers alone cannot be solely responsible; risk management requires coordinated governance across all levels.
- B. While audit committee approval is important, it is not the most fundamental necessity for effectiveness.
- D. IT risk management must be integrated with corporate risk management, not separated from it.
Question 285
Which of the following is a detective control?
Show answer and explanation
Correct answer: A. Verification of hash totals
Verification of hash totals is a detective control because it identifies errors or anomalies after they have occurred by comparing computed hash values to expected values. Detective controls operate after events have transpired and work to discover problems, violations, or discrepancies. Hash total verification detects when data has been lost, corrupted, or modified during processing.
Why the other options are wrong
- B. Programmed edit checks for data entry are preventive controls that stop invalid data from being entered in the first place.
- C. Pass cards for physical access are preventive controls that prevent unauthorized individuals from entering facilities.
- D. Backup procedures are preventive controls that mitigate the impact of potential data loss before disasters occur.
Question 286
Which of the following is MOST important when planning a network audit?
Show answer and explanation
Correct answer: B. Identification of existing nodes
Identification of existing nodes is the foundational first step in network auditing. You must establish an inventory of all devices, systems, and endpoints that should exist on the network before you can meaningfully assess security, detect rogue devices, analyze traffic, or validate configurations. Without this baseline, the auditor cannot determine what is authorized versus unauthorized or evaluate network coverage. The other activities are important follow-up steps but depend on first understanding what currently exists.
Why the other options are wrong
- A. Isolation of rogue access points is a remediation activity that comes after identification and analysis.
- C. Traffic content analysis requires first knowing which nodes should exist and can be performed after establishing the baseline.
- D. IP range determination is related to network configuration but is secondary to the fundamental requirement of knowing what nodes exist.
Question 287
An IS auditor reviewing the database controls for a new e-commerce system discovers a security weakness in the database configuration. Which of the following should be the IS auditor's NEXT course of action?
Show answer and explanation
Correct answer: B. Identify existing mitigating controls.
When discovering a security weakness, the auditor's next course of action should be to identify existing mitigating controls. Before escalating findings or recommending actions, the auditor must determine what existing controls may be compensating for the weakness, assess the residual risk, and understand the complete control environment. This information is essential for properly evaluating the significance of the finding and providing appropriate recommendations.
Why the other options are wrong
- A. Disclosing findings to management is premature before understanding what mitigating controls exist.
- C. Attempting to exploit the weakness is outside the auditor's scope and violates audit ethics and potentially legal boundaries.
- D. Assisting in drafting corrective actions compromises the auditor's independence and should only occur after findings are properly documented and reported.
Question 288
During an audit of an organization's financial statements, an IS auditor finds that the IT general controls are deficient. What should the IS auditor recommend?
Show answer and explanation
Correct answer: C. Increase the substantive testing of the financial balances.
When IT general controls are deficient, the IS auditor should increase substantive testing of financial balances to compensate. Since general controls (like access controls, change management, and segregation of duties) are weak, reliance on application controls alone is insufficient. Increased substantive testing provides direct evidence about the accuracy of financial data despite control weaknesses.
Why the other options are wrong
- A. Increasing compliance testing of application controls does not address the weakness in general controls.
- B. Placing greater reliance on application controls is inappropriate when general controls are deficient, as general controls provide the foundation.
- D. The control framework itself is deficient; greater reliance on it is not appropriate.
Question 289
An IS department is evaluated monthly on its cost-revenue ratio, user satisfaction rate, and computer downtime. This is BEST characterized as an application of:
Show answer and explanation
Correct answer: B. balanced scorecard.
The balanced scorecard framework evaluates organizational performance across multiple dimensions, financial (cost-revenue ratio), customer/stakeholder satisfaction (user satisfaction), and internal processes (computer downtime). This multi-perspective approach is the defining characteristic of a balanced scorecard, which moves beyond single-metric assessment to provide comprehensive performance visibility.
Why the other options are wrong
- A. Control self-assessment is a governance methodology for identifying and evaluating control effectiveness, not a performance measurement system.
- C. Value chain analysis examines business processes to identify competitive advantage; it does not structure performance metrics in this manner.
- D. Risk control framework addresses risk governance and mitigation, not performance measurement across financial, satisfaction, and operational metrics.
Question 290
Due to a high volume of customer orders, an organization plans to implement a new application for customers to use for online ordering. Which type of testing is MOST important to ensure the security of the application prior to go-live?
Show answer and explanation
Correct answer: C. Vulnerability testing
Vulnerability testing is the most critical security activity before go-live for a customer-facing application. It identifies security weaknesses, misconfigurations, and exploitable flaws that could be leveraged by attackers. While stress testing validates performance capacity, UAT confirms functional requirements, and regression testing ensures changes don't break existing functionality, none of these directly address security threats. Vulnerability testing must occur before production deployment to prevent security breaches that could compromise customer data and the organization's reputation.
Why the other options are wrong
- A. Stress testing validates system performance under load, not security vulnerabilities.
- B. UAT confirms the application meets business requirements but does not identify security weaknesses.
- D. Regression testing ensures changes don't break existing features but does not identify new security vulnerabilities.
Question 291
A USB device containing sensitive production data was lost by an employee, and its contents were subsequently found published online. Which of the following controls is the BEST recommendation to prevent a similar recurrence?
Show answer and explanation
Correct answer: B. Using a strong encryption algorithm
Using strong encryption is the best preventive control because it ensures that even if a USB device is lost and found, the sensitive data remains protected and unreadable without the encryption key. Encryption provides defense-in-depth security that protects data regardless of where the device goes or who accesses it, making it a fundamental control for protecting data at rest on portable media.
Why the other options are wrong
- A. Monitoring USB downloads does not prevent loss of already-stored data on the device and occurs too late in the incident chain.
- C. Training is important but is a detective/mitigating control; it cannot prevent determined theft or accidental loss.
- D. Electronic tracking helps locate the device but does not protect the data contents if the device is compromised.
Question 292
Which of the following security risks can be reduced by a properly configured network firewall?
Show answer and explanation
Correct answer: C. Denial of service (DoS) attacks
A properly configured firewall can reduce Denial of Service (DoS) attacks by implementing rate limiting, traffic filtering, and traffic shaping rules that can detect and block malicious traffic patterns before they overwhelm system resources. Firewalls operate at the network level where such volume-based attacks can be addressed.
Why the other options are wrong
- A. SQL injection attacks occur at the application layer, beyond typical firewall inspection capabilities.
- B. Phishing attacks are social engineering attacks delivered via email or web, not network-level threats a firewall can effectively block.
- D. Insider attacks originate from authorized users within the network, making them difficult for firewalls to detect or prevent based on network rules alone.
Question 293
Which of the following would be of GREATEST concern if noted during an audit of compliance with licensing agreements?
Show answer and explanation
Correct answer: D. The organization does not monitor upgrades to its software.
Failure to monitor software upgrades is the greatest compliance concern because upgrades often trigger new licensing obligations, increase the installed base requiring additional licenses, or activate features requiring separate license purchases. Without upgrade monitoring, an organization risks unknowingly operating in non-compliance. Centralized distribution is actually a best practice; vendor verification requirements are manageable; and while personal expensing bypasses tracking systems, it is a less systemic compliance risk than missing all upgrades organization-wide.
Why the other options are wrong
- A. Centralized server distribution is a best practice that supports license compliance monitoring.
- B. Monthly verification requirements from vendors are routine compliance activities that can be managed.
- C. Personal expensing is a tracking and accountability issue but less likely to create widespread licensing violations than missed upgrades.
Question 294
Which of the following techniques is MOST appropriate for verifying application program controls?
Show answer and explanation
Correct answer: C. Use of test data
Test data is the most appropriate technique for verifying application program controls because it allows an auditor to execute the application logic with predefined inputs and validate that controls operate as designed without disrupting production systems. Test data can comprehensively verify all control paths and edge cases. While code review can examine control design, it doesn't verify operational execution; observation is limited to visible activities; and statistical sampling is more appropriate for transactional testing rather than control verification.
Why the other options are wrong
- A. Observation of data entry only provides visibility into user behavior, not verification of application program logic.
- B. Statistical sampling is appropriate for testing populations of transactions, not for verifying the controls within application code.
- D. Code review examines design but does not verify that controls actually execute correctly in the running application.
Question 295
An organization allows its employees to use personal mobile devices for work. Which of the following would BEST maintain information security without compromising employee privacy?
Show answer and explanation
Correct answer: A. Partitioning the work environment from personal space on devices
Partitioning work and personal environments on devices allows the organization to protect work data and enforce security controls on the work partition while respecting employee privacy by leaving personal space uncontrolled. This achieves security objectives without intrusive monitoring of personal activities. Preventing applications (B) is overly restrictive to personal use. Restricting personal use during work hours (C) is impractical and invasive. Generic security software (D) lacks the granularity to protect work data without invading personal privacy.
Why the other options are wrong
- B. Preventing application installation is overly restrictive and compromises employee personal device usage.
- C. Restricting personal use during work hours is impractical and doesn't address security architecture.
- D. Generic security software lacks the granularity to protect work data without monitoring personal space.
Question 296
An IS auditor learns the organization has experienced several server failures in its distributed environment. Which of the following is the BEST recommendation to limit the potential impact of server failures in the future?
Show answer and explanation
Correct answer: B. Clustering
Clustering directly addresses server failure impact by distributing workloads across multiple servers so that if one fails, others automatically assume the load with minimal or no service interruption. This is the standard technology for high availability in distributed environments. Failover power addresses electrical continuity, parallel testing is a change management technique, and redundant pathways improve network resilience but none specifically mitigate server failure impact like clustering does.
Why the other options are wrong
- A. Failover power ensures power availability but doesn't prevent or mitigate the impact of the server itself failing.
- C. Parallel testing is a change control procedure unrelated to managing existing server failures.
- D. Redundant pathways improve network resilience but don't address the failure of the servers themselves.
Question 297
Which of the following indicates that an internal audit organization is structured to support the independence and clarity of the reporting process?
Show answer and explanation
Correct answer: A. The internal audit manager has a reporting line to the audit committee.
Internal audit independence and proper reporting structure are fundamental to audit effectiveness. When the internal audit manager reports directly to the audit committee (a board-level body), this ensures independence from management influence and establishes a clear, unbiased reporting line that supports the integrity of the audit process. This direct reporting relationship prevents management from suppressing or filtering audit findings.
Why the other options are wrong
- B. Reporting functionally to senior management creates a conflict of interest and compromises independence, as management may influence audit scope or suppress unfavorable findings.
- C. Assessing internal controls is an audit responsibility, but this alone does not ensure independence; auditors must remain separate from operating the controls they evaluate.
- D. Auditors performing operational duties directly contradicts audit independence and creates bias in their assessment of those same operations.
Question 298
An organization shares some of its customers' personally identifiable information (PII) with third-party suppliers for business purposes. What is MOST important for the IS auditor to evaluate to ensure that risk associated with leakage of privacy-related data during transmission is effectively managed?
Show answer and explanation
Correct answer: B. The third party's privacy and data security policies
When sharing PII with third parties, an IS auditor's primary concern must be evaluating the third party's own privacy and data security policies and controls. This assessment determines whether the third party has adequate safeguards to protect data during transmission and storage. While encryption, NDAs, and SLAs are all relevant, they are secondary to first understanding and evaluating what security practices the third party actually has in place. The third party's policies and controls are the foundation upon which all other protective measures depend.
Why the other options are wrong
- A. Encryption and masking are important technical controls, but they don't address the fundamental need to evaluate the third party's overall security posture and policies.
- C. NDAs and indemnity agreements are legal protections but do not prevent data leakage; they only address liability after a breach occurs.
- D. SLAs address operational performance and uptime, not the security controls needed to prevent data leakage during transmission.
Question 299
Which of the following is the GREATEST risk associated with lack of IT involvement in the organization's strategic planning initiatives?
Show answer and explanation
Correct answer: B. IT strategies may not align with business strategies.
The GREATEST risk of lacking IT involvement in strategic planning is that IT strategies may not align with business strategies. This is the fundamental consequence, when IT is excluded from the planning table, IT decisions and investments end up disconnected from what the business actually needs. While option A (not considering emerging technologies) and D (business strategies not aligning with IT capabilities) are potential consequences, they are secondary outcomes. Option C reverses causality. The primary risk is misalignment between IT and business strategy.
Why the other options are wrong
- A. Considering emerging technologies is important but is addressed through proper IT strategy alignment with business needs, not the primary risk.
- C. This reverses the relationship; the primary issue is IT strategies not aligning with business, not whether business considers IT goals.
- D. This is a consequence of misalignment rather than the greatest direct risk of excluding IT from strategic planning.
Question 300
Which of the following is MOST important to review when planning for an IS audit of an organization's cross-border data transfers?
Show answer and explanation
Correct answer: B. Applicable regulatory requirements
Applicable regulatory requirements are the most critical element to review when auditing cross-border data transfers. Different jurisdictions have varying legal requirements for data residency, privacy protection, and transfer restrictions (GDPR, CCPA, etc.), making regulatory compliance the foundational concern that drives audit scope and acceptable transfer practices.
Why the other options are wrong
- A. Previous external audit reports provide context but may not address current regulations or the specific organization's cross-border transfer practices.
- C. Offshore supplier risk assessments are important for vendor management but are secondary to understanding the legal framework governing transfers.
- D. Long-term IS strategy is too broad and indirect; regulatory requirements are the immediate, binding constraint for cross-border data movement.
Question 301
During a software acquisition review, an IS auditor should recommend that there be a software escrow agreement when:
Show answer and explanation
Correct answer: B. the deliverables do not include the source code.
A software escrow agreement should be recommended when deliverables do not include source code. The purpose of escrow is to ensure the organization has access to source code if the vendor fails or goes out of business, allowing the organization to maintain and support the software independently. When source code is not provided, the organization is dependent on the vendor for all support and maintenance, creating significant business risk. Escrow protects the organization's investment by ensuring code availability under specified conditions.
Why the other options are wrong
- A. New products in the market are riskier, but this alone doesn't determine escrow necessity; established products without source code also need escrow protection.
- C. Absence of an SLA is a service-level concern but doesn't specifically address code availability risk that escrow protects against.
- D. Product life of less than 3 years is a duration concern but doesn't directly indicate the need for escrow protection compared to source code availability.
Question 302
A bank has a combination of corporate customer accounts (higher monetary value) and small business accounts (lower monetary value) as part of online banking. Which of the following is the BEST sampling approach for an IS auditor to use for these accounts?
Show answer and explanation
Correct answer: B. Stratified mean per unit sampling
Stratified mean per unit sampling is the best approach when the population has distinct subgroups with different monetary values or characteristics. The bank's accounts are naturally stratified into corporate accounts (higher value) and small business accounts (lower value). Stratified sampling ensures proper representation of each stratum and improves audit efficiency by focusing appropriate sample sizes on each group, providing better statistical precision than unstratified approaches.
Why the other options are wrong
- A. Unstratified sampling ignores the meaningful distinction between account types and loses the efficiency gains from stratification.
- C. Customer unit sampling is not a standard statistical sampling method and doesn't address the need to account for different monetary value categories.
- D. Difference estimation sampling is used when comparing recorded amounts to audited amounts, which is not the primary objective here.
Question 303
Which of the following is MOST important for an IS auditor to verify when evaluating an organization's data conversion and infrastructure migration plan?
Show answer and explanation
Correct answer: B. A rollback plan is included.
When evaluating a data conversion and infrastructure migration plan, the most critical element to verify is the inclusion of a rollback plan. A rollback plan is essential because it provides the ability to return to the previous state if the migration fails or causes unacceptable problems. This is the most important safeguard to ensure business continuity and minimize risk during a major migration.
Why the other options are wrong
- A. While a steering committee is good governance, it is not as critical as having a rollback plan.
- C. Code check review is relevant for application migration but is less critical than a rollback plan for data conversion.
- D. Strategic goals should be considered, but a rollback plan is more immediately important for operational safety.
Question 304
When auditing the security architecture of an online application, an IS auditor should FIRST review the:
Show answer and explanation
Correct answer: B. firewall standards.
When auditing the security architecture of an online application, an IS auditor should FIRST review firewall standards because standards establish the baseline requirements and expected configurations against which the actual firewall implementation should be evaluated. Standards provide the framework for assessing whether the firewall meets organizational requirements and best practices.
Why the other options are wrong
- A. Firewall location is relevant but should be evaluated against standards and requirements, not examined first in isolation.
- C. Firmware version is a technical detail that should be verified against standards and policies but is not the first audit priority.
- D. Firewall configuration should be evaluated against standards; reviewing standards first establishes the baseline for evaluating the actual configuration.
Question 305
Which of the following testing methods is MOST appropriate for assessing whether system integrity has been maintained after changes have been made?
Show answer and explanation
Correct answer: B. Regression testing
Regression testing is specifically designed to verify that existing functionality remains intact after changes have been made. It re-runs previous test cases to detect whether modifications introduced unintended side effects or broke previously working features. This is the direct and intended use case for assessing whether system integrity has been maintained. The other testing types focus on new functionality, component-level verification, or final acceptance rather than detecting regression in existing capabilities.
Why the other options are wrong
- A. Integration testing validates that components work together but is broader than assessing whether changes maintained existing integrity.
- C. Acceptance testing determines whether the system meets requirements but is typically a final gate, not a post-change integrity assessment.
- D. Unit testing focuses on individual code components and does not comprehensively assess whether changes affected overall system integrity.
Question 306
Which of the following is an indication of possible hacker activity involving voice communications?
Show answer and explanation
Correct answer: B. Outbound calls are found to significantly increase in frequency during non-business hours.
A significant increase in outbound calls during non-business hours is a strong indicator of hacker activity, as attackers may exploit compromised phone systems to make unauthorized long-distance or international calls to avoid detection during normal business monitoring. This pattern suggests malicious use of the PBX system.
Why the other options are wrong
- A. DISA being disabled is a security control measure, not an indication of hacker activity.
- C. Normal fluctuation of inbound calls based on time of day and day of week is expected business behavior.
- D. Increasing service desk call abandonment rates reflect normal call center patterns, not hacker activity involving voice communications.
Question 307
Which of the following is the MOST useful information for an IS auditor to review when formulating an audit plan for the organization's outsourced service provider?
Show answer and explanation
Correct answer: D. Independent audit reports
Independent audit reports (such as SOC 2 Type II or similar third-party audits) provide the most useful and objective information for formulating an audit plan. These reports contain verified, independent assessments of the service provider's controls, compliance, and security practices, which directly inform what areas the IS auditor should focus on and which controls can be relied upon.
Why the other options are wrong
- A. SLA reports measure service delivery metrics but do not provide detailed control environment information needed for audit planning.
- B. Control self-assessments are the service provider's own evaluation and lack independent verification, making them less reliable than third-party audits.
- C. The organization's procurement policy governs the outsourcing decision but provides no direct information about the service provider's actual controls or risks.
Question 308
Which of the following is the GREATEST risk associated with utilizing spreadsheets for financial reporting in end-user computing (EUC)?
Show answer and explanation
Correct answer: B. Lack of processing integrity
The greatest risk of using spreadsheets for financial reporting is the lack of processing integrity. Spreadsheets are prone to formula errors, uncontrolled changes, poor audit trails, and lack of version control, all compromising data integrity throughout the calculation and reporting process. While other risks exist (lack of password protection, operational incidents, regulatory violations), they are either secondary consequences or technical protections. Processing integrity directly addresses the core vulnerability that makes spreadsheets unsuitable for financial reporting: the inability to ensure calculations and data transformations are accurate and controlled.
Why the other options are wrong
- A. Password protection is a security measure but not the primary integrity concern with spreadsheets.
- C. Operational incidents are a consequence rather than the greatest inherent risk of spreadsheet use.
- D. Regulatory violations follow from lack of processing integrity but are not the root cause.
Question 309
Which of the following should be the MOST important consideration when conducting a review of IT portfolio management?
Show answer and explanation
Correct answer: D. Controls to minimize risk and maximize value for the IT portfolio
The MOST important consideration when reviewing IT portfolio management is controls to minimize risk and maximize value for the IT portfolio. This directly addresses the purpose of portfolio management, ensuring investments are aligned with business strategy while managing risk exposure and optimizing return on IT investments.
Why the other options are wrong
- A. While adherence to best practices is important, it is secondary to the primary objective of risk minimization and value maximization.
- B. Meeting frequency is a procedural matter and not the most important consideration for portfolio management effectiveness.
- C. Assigning responsibility is important for governance but is less critical than the overall control framework for risk and value management.
Question 310
Which of the following is the GREATEST advantage of vulnerability scanning over penetration testing?
Show answer and explanation
Correct answer: A. The testing process can be automated to cover large groups of assets
The primary advantage of vulnerability scanning is that it can be automated to efficiently assess large numbers of assets, systems, and networks at scale. Vulnerability scanners run predefined checks repeatedly and systematically across entire infrastructures without manual intervention. Penetration testing, by contrast, is manual, time-consuming, and typically limited to a smaller scope, making it impractical for comprehensive coverage of large asset groups.
Why the other options are wrong
- B. Penetration testing typically produces fewer false positives than automated scanners, which is an advantage of penetration testing, not scanning.
- C. Penetration testing is actually more effective for testing custom applications; scanners rely on signature-based detection.
- D. Vulnerability scanning and penetration testing use similar amounts of bandwidth; this is not a distinguishing advantage.
Question 311
An organization that has suffered a cyberattack is performing a forensic analysis of the affected users' computers. Which of the following should be of GREATEST concern for the IS auditor reviewing this process?
Show answer and explanation
Correct answer: A. The chain of custody has not been documented.
The chain of custody is the most critical concern in digital forensics. Undocumented chain of custody can render all evidence inadmissible in legal proceedings and compromises the integrity of the investigation. Without documented chain of custody, there is no proof that evidence was handled properly, not tampered with, or maintained in its original state. This is a fundamental legal and technical requirement that supersedes all other forensic concerns.
Why the other options are wrong
- B. Imaging is the standard, proper forensic method for collecting data.
- C. Audit involvement during extraction is appropriate and supports proper procedures.
- D. Legal engagement is important but secondary to maintaining evidence integrity through chain of custody documentation.
Question 312
Which of the following is MOST important to ensure when developing an effective security awareness program?
Show answer and explanation
Correct answer: C. Outcome metrics for the program are established.
Establishing outcome metrics is MOST important because it enables measurement of program effectiveness and determines whether the awareness initiative is actually changing user behavior and reducing security risk. Without metrics, the program cannot be evaluated, improved, or justified. While phishing exercises, professional trainers, and threat scenarios all support a good program, metrics are foundational to ensuring the program achieves its objectives.
Why the other options are wrong
- A. Phishing exercises are a valuable tactic but measuring effectiveness (metrics) is more fundamental than the tactic itself.
- B. Professional trainers are helpful but not as critical as having measurable outcomes to validate program success.
- D. Threat scenarios enhance content but outcome metrics are essential to verify that awareness actually improves.
Question 313
Which of the following would be the BEST criteria for monitoring an IT vendor’s service levels?
Show answer and explanation
Correct answer: A. Performance metrics
Performance metrics are the best criteria for monitoring IT vendor service levels because they provide objective, measurable data aligned with contractual service level agreements (SLAs). Metrics such as uptime, response time, and resolution time allow for quantitative assessment. Surprise visits (B) are infrequent and provide limited data; service auditor reports (C) are periodic assessments, not ongoing monitoring; and interviews (D) are subjective and lack the rigor needed for continuous oversight.
Why the other options are wrong
- B. Surprise visits are occasional assessment tools rather than continuous monitoring mechanisms for service levels.
- C. Service auditor reports provide periodic snapshots but are not the primary criteria for ongoing service level monitoring.
- D. Interviews are subjective and anecdotal; they cannot replace objective measurement of performance metrics.
Question 314
During a review of an organization's network threat response process, the IS auditor noticed that the majority of alerts were closed without resolution. Management responded that those alerts were unworkable due to lack of actionable intelligence, and therefore the support team is allowed to close them. What is the BEST way for the auditor to address this situation?
Show answer and explanation
Correct answer: A. Further review closed unactioned alerts to identify mishandling of threats.
The auditor must investigate closed alerts to verify whether they were truly unactionable or whether threats were being mishandled. Closing alerts without resolution is a control gap that requires deeper review. While management's stated reason is lack of actionable intelligence, the auditor's role is to test whether this justification is valid across all closed alerts or whether some represent actual security incidents that were improperly dismissed. This investigation provides evidence for the audit finding.
Why the other options are wrong
- B. Reopening alerts and reporting is a management action; the auditor's first step is to investigate whether the practice is actually compliant.
- C. Recommending improvements may be appropriate, but first the auditor must verify the extent and validity of the current practice through further review.
- D. Omitting the finding ignores a potential control weakness; the fact that a policy permits this does not mean the policy is adequate.
Question 315
Which of the following should an organization do to anticipate the effects of a disaster?
Show answer and explanation
Correct answer: A. Develop a business impact analysis (BIA)
A Business Impact Analysis (BIA) is the foundational tool used to anticipate the effects of a disaster by identifying critical business functions, assessing their impact if disrupted, and determining recovery priorities. This forward-looking analysis directly addresses the question's focus on anticipating disaster effects. While RPO and recovery procedures are important, they are defined after the BIA. Simulation tests existing plans but doesn't anticipate effects. Capability maturity models assess process maturity, not disaster anticipation.
Why the other options are wrong
- B. RPOs are targets set after understanding impact, not the primary method for anticipating disaster effects.
- C. Simulation tests existing recovery procedures but doesn't anticipate what effects will occur.
- D. Capability maturity assessment evaluates organizational process maturity, not disaster effect anticipation.
Question 316
An IS auditor discovers that validation controls in a web application have been moved from the server side into the browser to boost performance. This would MOST likely increase the risk of a successful attack by:
Show answer and explanation
Correct answer: C. structured query language (SQL) injection.
Moving validation controls from server-side to browser-side eliminates a critical security boundary. An attacker can bypass client-side validation entirely by intercepting and modifying requests before they reach the server, enabling SQL injection attacks. The validation that would normally prevent malicious SQL code from being submitted is no longer enforced at the server layer where it cannot be bypassed.
Why the other options are wrong
- A. DoS attacks are not specifically enabled by moving validation to the client; they exploit resource exhaustion, not input validation weaknesses.
- B. Phishing is a social engineering attack unrelated to the location of validation controls.
- D. Buffer overflow attacks depend on how data is processed in memory, not on where input validation occurs.
Question 317
Which of the following must be in place before an IS auditor initiates audit follow-up activities?
Show answer and explanation
Correct answer: A. A management response in the final report with a committed implementation date
Before initiating follow-up activities, an IS auditor must have management's formal commitment to remediate findings with a specific implementation date. This ensures there is organizational commitment and accountability for addressing audit findings. Without management's response and committed timeline, follow-up activities lack a foundation for tracking remediation progress and verifying completion.
Why the other options are wrong
- B. A heat map is a useful visualization tool but not a prerequisite for initiating follow-up; it is typically part of reporting, not a requirement before follow-up begins.
- C. Supporting evidence should have been gathered during the audit itself, not before follow-up activities; it supports the findings already issued.
- D. Resource availability is important for implementing remediation but is a consideration for the action plan, not a prerequisite for beginning follow-up activities.
Question 318
Which of the following BEST enables alignment of IT with business objectives?
Show answer and explanation
Correct answer: D. Leveraging an IT governance framework
An IT governance framework provides the structured approach and mechanisms that systematically align IT strategy, processes, and decisions with business objectives. It establishes the governance structures and accountability needed for alignment. Option A (benchmarking) provides comparative data but not alignment mechanisms. Option B (risk assessment) identifies risks but doesn't align IT with objectives. Option C (KPIs) measures outcomes but doesn't establish alignment structures.
Why the other options are wrong
- A. Benchmarking shows how peer organizations perform but doesn't directly align an organization's IT with its own business objectives.
- B. A risk assessment identifies threats and vulnerabilities but doesn't establish alignment between IT and business objectives.
- C. KPIs measure performance but don't establish the governance structures needed to drive alignment.
Question 319
Which of the following is the MOST important prerequisite for implementing a data loss prevention (DLP) tool?
Show answer and explanation
Correct answer: A. Identifying where existing data resides and establishing a data classification matrix
The most important prerequisite for implementing a DLP tool is identifying where existing data resides and establishing a data classification matrix. Without understanding what data exists, where it is stored, and how it should be classified by sensitivity level, a DLP tool cannot be effectively configured to protect the right assets. This foundational knowledge is necessary before any DLP policies, technical controls, or user requirements can be meaningfully designed.
Why the other options are wrong
- B. Requiring users to save files in secured folders is a file management practice but does not address the foundational prerequisite of data inventory and classification.
- C. Reviewing historical data transfer logs helps understand behavior patterns but is secondary to first knowing what data exists and how it should be protected.
- D. Developing DLP policy and user acknowledgment is important but cannot be done effectively without first completing the data discovery and classification work.
Question 320
At the end of each business day, a business-critical application generates a report of financial transactions greater than a certain value, and an employee then checks these transactions for errors. What type of control is in place?
Show answer and explanation
Correct answer: D. Detective
A detective control identifies errors or problems after they occur. The end-of-day report identifies transactions that have already been generated, and the employee checks them after the fact for errors. This is classic detective control activity, finding problems post-occurrence. Preventive controls (B) stop problems before they happen. Corrective controls (C) fix problems after detection. Deterrent controls (A) discourage violations.
Why the other options are wrong
- A. Deterrent controls discourage unwanted behavior through threat or consequence; this control doesn't deter violations.
- B. Preventive controls stop errors from occurring; this control operates after transactions are already recorded.
- C. Corrective controls restore systems to normal after an incident; this is detection and review, not correction.
Question 321
An IS audit manager was temporarily tasked with supervising a project manager assigned to the organization's payroll application upgrade. Upon returning to the audit department, the audit manager has been asked to perform an audit to validate the implementation of the payroll application. The audit manager is the only one in the audit department with IT project management experience. What is the BEST course of action?
Show answer and explanation
Correct answer: C. Outsource the audit to independent and qualified resources
An auditor who supervised the project being audited has lost independence and cannot objectively evaluate implementation. The fundamental principle of auditing requires independence from the activities being audited. Outsourcing to independent, qualified resources is the only way to maintain audit credibility and integrity while ensuring the audit is properly performed by someone without conflicts of interest.
Why the other options are wrong
- A. Transferring to an inexperienced auditor sacrifices audit quality and doesn't solve the independence issue of the original auditor.
- B. Having the compromised auditor perform final review still violates independence principles.
- D. The lack of others with experience does not justify compromising audit independence, the core principle of auditing.
Question 322
During the planning stage of a compliance audit, an IS auditor discovers that a bank's inventory of compliance requirements does not include recent regulatory changes related to managing data risk. What should the auditor do FIRST?
Show answer and explanation
Correct answer: A. Ask management why the regulatory changes have not been included.
The auditor should first ask management directly why recent regulatory changes have not been incorporated into their compliance inventory. This allows for clarification, understanding of any legitimate reasons, and establishes whether this is an oversight requiring correction. This is the logical first step in audit communication before escalating concerns or excluding requirements. Premature reporting, involving legal department, or excluding requirements from scope would bypass the opportunity for management explanation.
Why the other options are wrong
- B. Reporting to the CIO before discussing with management bypasses the management inquiry process and assumes the omission is a reportable finding.
- C. Discussing with legal department before understanding management's position wastes time and jumps to external consultation prematurely.
- D. Excluding recent regulatory changes from audit scope is inappropriate and leaves the organization potentially non-compliant without audit oversight.
Question 323
An IS auditor has found that an organization is unable to add new servers on demand in a cost-efficient manner. Which of the following is the auditor's BEST recommendation?
Show answer and explanation
Correct answer: B. Build a virtual environment.
Building a virtual environment is the best recommendation because virtualization enables cost-efficient, on-demand server provisioning without requiring large capital expenditures or lengthy procurement cycles. Virtual environments allow rapid scaling of resources to match demand. Hiring temporary workers addresses labor, not the infrastructure scalability problem; increasing existing capacity limits flexibility; upgrading hardware is expensive and doesn't solve the on-demand cost efficiency issue.
Why the other options are wrong
- A. Temporary contract workers do not solve the fundamental problem of inability to add servers on demand efficiently.
- C. Increasing existing system capacity does not address cost efficiency and limits the ability to scale down when needed.
- D. Upgrading hardware is expensive and does not inherently solve the cost-efficiency or on-demand provisioning problem.
Question 324
Which of the following should be of GREATEST concern to an IS auditor reviewing a system software development project based on agile practices?
Show answer and explanation
Correct answer: A. Lack of change management documentation
The lack of change management documentation is of greatest concern when auditing agile projects. Agile methodologies prioritize working software and responding to change, which can result in inadequate documentation of changes, version control, and approval trails. This creates audit and compliance risks. While UAT, production releases, and secure coding are important, agile teams often handle these through their iterative processes; however, the documentation gap from rapid change cycles is the most challenging audit concern.
Why the other options are wrong
- B. UAT sign-off occurs in agile through continuous user involvement and acceptance criteria, though perhaps less formally documented.
- C. Weekly production releases are typical for agile and are not a weakness that would concern an auditor.
- D. Secure coding practices are important but are separate from the agile methodology itself; concerns would be addressed through code review processes.
Question 325
In a typical system development life cycle (SDLC), which group is PRIMARILY responsible for confirming compliance with requirements?
Show answer and explanation
Correct answer: C. Quality assurance (QA)
Quality assurance (QA) is the primary function responsible for testing, validating, and confirming that the developed system meets all specified requirements. QA performs systematic verification against requirements throughout the SDLC, while other groups have different responsibilities: steering committees oversee governance, risk management addresses risk, and internal audit evaluates controls post-implementation.
Why the other options are wrong
- A. Steering committees provide governance and oversight but do not perform the detailed technical verification of compliance with requirements.
- B. Risk management identifies and mitigates risks but does not verify requirements compliance.
- D. Internal audit reviews controls and governance after implementation, not during development when requirements verification is primary.
Question 326
Which of the following is the PRIMARY role of the IS auditor in an organization's information classification process?
Show answer and explanation
Correct answer: B. Validating that assets are protected according to assigned classification
The primary role of the IS auditor in the information classification process is to validate that assets are protected according to their assigned classification. This is a verification and assurance function, auditors assess whether the organization is actually implementing the security controls that correspond to each classification level, rather than defining the classifications themselves or managing the assets.
Why the other options are wrong
- A. Securing information assets is the responsibility of information security management, not the IS auditor.
- C. While regulatory alignment is important, the auditor's primary role is validation of protection, not ensuring regulatory alignment.
- D. Defining classification levels is a management responsibility; the auditor validates the process, not defines it.
Question 327
Which of the following would be of GREATEST concern to an IS auditor reviewing backup and recovery controls?
Show answer and explanation
Correct answer: D. Restores from backups are not periodically tested.
Not periodically testing restore procedures is the greatest concern because it means the organization cannot verify that backups are actually usable and can recover data when needed. A backup that cannot be restored is worthless and creates a false sense of security. Regular restore testing is essential to ensure recovery time objectives (RTO) and recovery point objectives (RPO) can be met during an actual disaster.
Why the other options are wrong
- A. While documentation is important for operational procedures, undocumented backups can still function if tested.
- B. Storing both weekly and monthly backups onsite is acceptable if offsite copies also exist; the location alone is not the greatest concern.
- C. External hard drives can be a valid backup medium; the medium type is less critical than verifying the backups work.
Question 328
An organization is shifting to a remote workforce. In preparation, the IT department is performing stress and capacity testing of remote access infrastructure and systems. What type of control is being implemented?
Show answer and explanation
Correct answer: C. Preventive
Stress and capacity testing is a preventive control that identifies and mitigates potential failures before they occur in production. By testing the infrastructure before the remote workforce transition, the organization prevents problems from affecting business operations, rather than detecting issues after they happen or correcting them after detection.
Why the other options are wrong
- A. Directive controls mandate or instruct specific actions; testing does not direct behavior but rather verifies system capability.
- B. Detective controls identify issues after they occur; testing prevents issues before they reach production.
- D. Compensating controls provide alternative security measures; testing is a primary preventive measure for this scenario.
Question 329
A finance group recently implemented new technologies and processes. Which type of IS audit would provide the GREATEST level of assurance that the department's objectives have been met?
Show answer and explanation
Correct answer: C. Integrated audit
An integrated audit provides the greatest assurance that departmental objectives have been met because it combines financial, operational, and IT perspectives to comprehensively evaluate whether new technologies and processes achieve intended outcomes across all dimensions. A financial audit (A) focuses narrowly on financial controls; a performance audit (B) emphasizes operational efficiency but may miss financial or IT aspects; a cyber audit (D) is specialized and wouldn't address overall departmental objectives.
Why the other options are wrong
- A. A financial audit only evaluates financial controls and reporting, not whether broader departmental objectives are achieved.
- B. A performance audit focuses on operational efficiency and effectiveness but doesn't comprehensively address financial and IT governance dimensions.
- D. A cyber audit is specialized in security controls but wouldn't provide assurance that the finance department's overall objectives have been met.
Question 330
To develop meaningful recommendations for findings, which of the following is MOST important for an IS auditor to determine and understand?
Show answer and explanation
Correct answer: D. Root cause
Understanding the root cause of a finding is most critical for developing meaningful recommendations because it addresses why the issue exists. Without knowing the root cause, auditors risk recommending surface-level fixes that do not prevent recurrence. Root cause analysis enables auditors to recommend corrective actions that address the underlying problem rather than merely treating symptoms. While criteria, responsible parties, and impact are important for documenting findings, root cause is essential for crafting effective, actionable recommendations.
Why the other options are wrong
- A. Criteria define what should be in place but do not explain why the gap exists.
- B. Identifying the responsible party is important for accountability but does not inform the substance of recommendations.
- C. Understanding impact justifies the urgency of remediation but does not inform what the remediation should be.
Question 331
Which of the following is the BEST compensating control when segregation of duties is lacking in a small IS department?
Show answer and explanation
Correct answer: A. Transaction log review
Transaction log review is the best compensating control because it provides detective review and oversight of transactions performed by individuals with combined duties. By systematically reviewing transaction logs, an auditor or supervisor can identify unauthorized, unusual, or fraudulent activities that occur when segregation of duties is absent. This provides accountability and creates a deterrent effect. Background checks are preventive hiring controls; mandatory holidays reduce opportunity but don't detect violations; user awareness training is educational but not a detective control.
Why the other options are wrong
- B. Background checks are preventive hiring controls that do not compensate for lack of segregation during ongoing operations.
- C. Mandatory holidays reduce continuous fraud opportunity but do not actively detect violations of segregation principles.
- D. User awareness training educates but does not provide the systematic oversight needed to compensate for missing segregation.
Question 332
A system administrator recently informed the IS auditor about the occurrence of several unsuccessful intrusion attempts from outside the organization. Which of the following is MOST effective in detecting such an intrusion?
Show answer and explanation
Correct answer: A. Periodically reviewing log files
Periodically reviewing log files is the most effective method for detecting intrusion attempts because logs capture all connection attempts and activities, allowing auditors to identify and analyze unauthorized access patterns and attack signatures. This detective control directly examines evidence of intrusion attempts after they occur, making it the most practical and effective audit approach.
Why the other options are wrong
- B. Configuring a router as a firewall is a preventive control that blocks traffic but does not help detect attempts that reach the network.
- C. Biometrics-based authentication protects access to systems but does not detect external intrusion attempts.
- D. Smart cards and one-time passwords authenticate legitimate users but do not help detect unauthorized intrusion attempts from outside.
Question 333
During an ongoing audit, management requests a briefing on the findings to date. Which of the following is the IS auditor's BEST course of action?
Show answer and explanation
Correct answer: D. Present observations for discussion only.
Presenting observations for discussion only maintains audit independence and allows management to understand findings while avoiding premature conclusions before the audit is complete. This permits the auditee to provide context and corrections during the audit process itself, which is appropriate and expected. Waiting until the final report denies timely feedback; requesting management responses improperly involves those being audited; reviewing working papers crosses professional boundaries regarding audit documentation.
Why the other options are wrong
- A. Delaying all discussion until the final report prevents timely resolution of issues and feedback opportunities.
- B. Requesting formal management responses during the audit process is premature and inappropriate; this occurs after findings are finalized.
- C. Sharing working papers directly with auditees compromises audit documentation independence and confidentiality.
Question 334
What is the PRIMARY benefit of an audit approach which requires reported findings to be issued together with related action plans, owners, and target dates?
Show answer and explanation
Correct answer: A. It establishes accountability for the action plans.
Requiring action plans, owners, and target dates with reported findings establishes clear accountability because specific individuals are assigned responsibility for remediation with defined timelines. This creates a chain of accountability that can be tracked and enforced during follow-up activities. While option C (easier follow-up) is a secondary benefit and option B (consensus) may occur, the PRIMARY benefit is establishing accountability through assignment of specific owners and measurable deadlines.
Why the other options are wrong
- B. Consensus between auditors and auditees is desirable but not the primary benefit of including action plan details.
- C. Easier follow-up is a consequence of established accountability, not the primary benefit itself.
- D. Factual accuracy of findings is determined during the audit process itself, not by adding action plans to the report.
Question 335
A month after a company purchased and implemented system and performance monitoring software, reports were too large and therefore were not reviewed or acted upon. The MOST effective plan of action would be to:
Show answer and explanation
Correct answer: B. use analytical tools to produce exception reports from the system and performance monitoring software.
Using analytical tools to produce exception reports is the most effective action because it transforms overwhelming data volumes into actionable insights by filtering and highlighting only significant issues. This makes reports reviewable and usable without replacing the tool or losing monitoring capability.
Why the other options are wrong
- A. Evaluating replacement software wastes time and money when the existing tool can be properly configured.
- C. Reinstalling the same software without configuration changes will reproduce the same problem.
- D. Restricting functionality to security-only events eliminates valuable performance monitoring that supports business objectives.
Question 336
The use of cookies constitutes the MOST significant security threat when they are used for:
Show answer and explanation
Correct answer: C. authenticating using username and password.
Cookies used for authentication with username and password present the greatest security threat because stolen or compromised cookies can be used for session hijacking and unauthorized access without needing the original credentials. An attacker gaining access to authentication cookies has immediate account access.
Why the other options are wrong
- A. Public key retrieval from a CA using cookies presents minimal risk as public keys are meant to be distributed.
- B. Email and IP address information in cookies, while a privacy concern, does not directly enable authentication bypass.
- D. File downloads via cookies have lower security impact compared to authentication bypass scenarios.
Question 337
Which of the following is the MOST efficient way to assess the controls in a service provider's environment?
Show answer and explanation
Correct answer: D. Obtain an independent auditor's report from the service provider.
An independent auditor's report (such as a SOC 2 or SOC 3 report) from the service provider is the most efficient and reliable way to assess controls because it provides an objective, third-party evaluation of the service provider's control environment. This approach is more comprehensive and credible than relying on the provider's own assessments.
Why the other options are wrong
- A. Internal audit reviews lack independence and may not cover all critical control areas relevant to the organization's concerns.
- B. Control self-assessments by the provider lack objectivity and independence, making them less reliable than third-party audits.
- C. The MSA documents contractual obligations but does not provide evidence that controls are actually operating effectively.
Question 338
Which of the following is the BEST evidence that an organization's IT strategy is aligned to its business objectives?
Show answer and explanation
Correct answer: B. The IT strategy is modified in response to organizational changes.
The best evidence of IT strategy alignment to business objectives is demonstrated through IT strategy modifications that respond to organizational changes. This shows that IT strategy is dynamic and continuously aligned with evolving business needs, rather than static or merely approved. A significant impact (A) may indicate influence but not alignment; best practices (C) don't ensure business alignment; and executive approval (D) is necessary but insufficient as approval doesn't prove ongoing alignment.
Why the other options are wrong
- A. Impact doesn't necessarily mean alignment, IT could have significant influence while pursuing its own agenda rather than supporting business objectives.
- C. Following IT best practices is important but doesn't guarantee the strategy serves the organization's specific business objectives.
- D. Executive approval is a baseline requirement but doesn't demonstrate actual alignment or effectiveness in supporting business goals.
Question 339
Which of the following provides the MOST reliable method of preventing unauthorized logon?
Show answer and explanation
Correct answer: C. Issuing authentication tokens
Authentication tokens provide the most reliable technical control for preventing unauthorized logon by implementing multi-factor authentication and dynamic credential generation that cannot be easily compromised. Tokens are inherently resistant to password guessing, interception, and reuse attacks. Limiting after-hours usage is a weak administrative control easily circumvented. Policy reinforcement relies on user compliance and doesn't provide technical prevention. Automatic password generators create passwords but users can still share or compromise them.
Why the other options are wrong
- A. After-hours access restrictions are weak controls that don't technically prevent unauthorized logon.
- B. Policy reinforcement depends on user behavior and compliance, not technical prevention mechanisms.
- D. Password generators improve password complexity but don't prevent logon if credentials are compromised.
Question 340
An IT governance body wants to determine whether IT service delivery is based on consistently effective processes. Which of the following is the BEST approach?
Show answer and explanation
Correct answer: A. Develop a maturity model.
A maturity model is the BEST approach to determine whether IT service delivery is based on consistently effective processes because it establishes a structured framework to assess the capability and consistency of processes across multiple levels of sophistication. It provides a clear baseline for where processes stand and identifies the path to improvement. While KPIs (B) measure performance and CSA (D) involves self-assessment, a maturity model specifically addresses the consistency and effectiveness of processes at an organizational level.
Why the other options are wrong
- B. KPIs measure performance outcomes but do not directly assess whether underlying processes are consistently effective.
- C. Gap analysis identifies differences between current and desired states but does not establish a framework for process maturity.
- D. CSA relies on self-reporting which may lack objectivity in assessing true process consistency and effectiveness.
Question 341
Which of the following should be of GREATEST concern to an IS auditor reviewing data conversion and migration during the implementation of a new application system?
Show answer and explanation
Correct answer: B. Unauthorized data modifications occurred during conversion.
Unauthorized data modifications during conversion represent a critical integrity and control breach that could corrupt the new system with inaccurate or fraudulent data from inception. This directly threatens data reliability and regulatory compliance of the new application. Manual processes increase risk but are manageable with controls; lack of formal documentation is a process weakness but not a direct threat to data integrity; and offline backups of old systems are archival considerations.
Why the other options are wrong
- A. While manual data conversion processes introduce greater risk, they are not inherently problematic if properly controlled and validated.
- C. Lack of formal documentation represents a process control weakness but does not directly compromise the integrity of converted data.
- D. Unavailable online backups of the old system affect archival capabilities but not the integrity and accuracy of data migrated to the new system.
Question 342
An IS auditor finds that firewalls are outdated and not supported by vendors. Which of the following should be the auditor's NEXT course of action?
Show answer and explanation
Correct answer: B. Determine the risk of not replacing the firewall.
Before taking any reporting or mitigation action, an auditor must first determine and understand the actual risk posed by the outdated firewalls. This risk assessment establishes the business impact and urgency, which then informs whether escalation, mitigation planning, or other responses are appropriate. Risk determination is the foundational step in the audit process.
Why the other options are wrong
- A. Reporting security posture prematurely, before assessing risk, skips critical analysis.
- C. Identifying mitigating controls is premature without first understanding the risk level.
- D. The firewall's value is less relevant than understanding the risk of its absence or obsolescence.
Question 343
Which of the following BEST addresses the availability of an online store?
Show answer and explanation
Correct answer: C. Clustered architecture
Clustered architecture BEST addresses availability by distributing workload across multiple interconnected systems that can failover to one another, ensuring continuous service even if individual nodes fail. This directly enables high availability and service continuity for online stores. Online backups (A) address recovery, not current availability. A mirrored site (B) provides redundancy but requires more complex failover mechanisms. RAID level 5 (D) provides data protection but does not address application or service availability.
Why the other options are wrong
- A. Online backups support disaster recovery and data protection, not real-time availability.
- B. A mirrored site provides redundancy but requires additional failover infrastructure to ensure availability.
- D. RAID level 5 protects data from storage failure but does not directly address application service availability.
Question 344
An IS auditor reviewing a job scheduling tool notices performance and reliability problems. Which of the following is MOST likely affecting the tool?
Show answer and explanation
Correct answer: C. Maintenance patches and the latest enhancement upgrades are missing
Missing maintenance patches and enhancement upgrades are the most likely cause of performance and reliability problems in a job scheduling tool. Patches address bugs, vulnerabilities, and stability issues that accumulate over time. Without current patches and upgrades, the tool will likely experience degraded performance, failures, and reliability issues. Password complexity and staffing levels would not typically cause tool-level performance problems, and business-critical classification affects support priority but not inherent tool performance.
Why the other options are wrong
- A. Administrator password requirements affect access security, not the performance and reliability of the scheduling tool itself.
- B. Reduced support staff affects response time and maintenance quality but is not the direct technical cause of performance problems.
- D. Classification as business-critical affects resource allocation and priority, not the technical cause of existing performance issues.
Question 345
Which of the following is the BEST way for an IS auditor to determine how well an information security program has been implemented throughout the organization?
Show answer and explanation
Correct answer: D. Evaluate the integration of security best practices into business workflow.
Evaluating how well security best practices are integrated into business workflow directly measures implementation effectiveness across the organization. This approach assesses whether security controls and practices have been operationalized and embedded in daily processes rather than existing in isolation. Training percentages and content reviews measure awareness and policy completeness, while risk assessments measure current risk posture rather than program implementation quality.
Why the other options are wrong
- A. Training participation percentage measures awareness but not the effectiveness or depth of implementation.
- B. Reviewing training content evaluates policy completeness, not whether the program has been implemented throughout the organization.
- C. Risk assessments measure current vulnerabilities and risk levels but not the implementation quality of the security program itself.
Question 346
While executing follow-up activities, an IS auditor is concerned that management has implemented corrective actions that are different from those originally discussed and agreed with the audit function. In order to resolve the situation, the IS auditor's BEST course of action would be to:
Show answer and explanation
Correct answer: A. determine whether the alternative controls sufficiently mitigate the risk.
The auditor's best course of action is to evaluate whether the alternative controls implemented by management provide equivalent or better risk mitigation compared to the originally agreed controls. The audit objective is risk remediation, not control prescription; if alternative controls achieve the control objective effectively, they may be acceptable. This professional judgment approach is more constructive than escalation without analysis.
Why the other options are wrong
- B. Postponing follow-up and escalating without first evaluating control effectiveness is premature and inefficient.
- C. Re-prioritizing without assessing whether the new controls work is inappropriate and may damage audit credibility.
- D. Delaying resolution until the next audit cycle leaves the current audit work incomplete and issues unresolved.
Question 347
If enabled within firewall rules, which of the following services would present the GREATEST risk?
Show answer and explanation
Correct answer: A. File transfer protocol (FTP)
FTP (File Transfer Protocol) presents the greatest risk because it transmits credentials and data in cleartext without encryption, making credentials easily captured through network sniffing. Additionally, FTP is vulnerable to various attacks and is an older protocol with known security weaknesses. Modern alternatives like SFTP or FTPS provide encrypted alternatives, but FTP itself is fundamentally insecure by design.
Why the other options are wrong
- B. SOAP is an application-layer protocol for XML-based web services; while it can have vulnerabilities, it supports encryption and authentication mechanisms.
- C. HTTP transmits in cleartext but is typically used for non-sensitive data; organizations employ HTTPS for sensitive transactions, mitigating risk through TLS encryption.
- D. SMTP is mail transmission protocol; while it can be exploited for spam or relay attacks, it does not inherently transmit authentication credentials in cleartext like FTP does.
Question 348
A company has implemented an IT segregation of duties policy. In a role-based environment, which of the following roles may be assigned to an application developer?
Show answer and explanation
Correct answer: A. Emergency support
Emergency support is the role that may be assigned to an application developer while maintaining segregation of duties. Emergency support is typically a temporary, limited-scope role used for incident response and doesn't create standing conflicts with development responsibilities. The other roles (system administration, IT operator, database administration) involve production control, operational access, or system configuration authority that would conflict with a developer's ability to modify code.
Why the other options are wrong
- B. System administration grants broad production control that conflicts with development authority over application code.
- C. IT operator role involves production system control that segregates from the developer's ability to make changes.
- D. Database administration provides data access and configuration authority that conflicts with developer access to modify and test code.
Question 349
An IS auditor would MOST likely recommend that IT management use a balanced scorecard to:
Show answer and explanation
Correct answer: A. assess IT functions and processes.
A balanced scorecard is a strategic management tool designed to assess the performance of IT functions and processes across multiple dimensions (financial, customer, internal processes, learning and growth). It provides a comprehensive view of IT performance and alignment with business objectives. While it can support quality assessment, training, and performance evaluation indirectly, its primary purpose and best use is to assess and measure IT functions and processes holistically.
Why the other options are wrong
- B. Quality standards compliance is one measurement area within a scorecard, not its primary purpose.
- C. Training and education are operational activities; a balanced scorecard measures performance rather than delivering training.
- D. While a scorecard includes performance metrics, its broader strategic purpose is assessing IT functions overall, not just individual staff performance.
Question 350
An IS auditor has been asked to perform a post-implementation assessment of a new corporate human resources (HR) system. Which of the following control areas would be MOST important to review for the protection of employee information?
Show answer and explanation
Correct answer: B. Authentication mechanisms
Authentication mechanisms are the foundational control that protects employee information from unauthorized access. While data retention, system architecture, and logging are all important, authentication is the primary gatekeeper that prevents unauthorized users from accessing sensitive employee data in the first place. Without proper authentication controls, no other security measure can be effective.
Why the other options are wrong
- A. Data retention practices are important for compliance but are secondary to preventing unauthorized access in the first place.
- C. System architecture is a technical consideration but does not directly protect against unauthorized access to employee information.
- D. Logging capabilities are important for detection and forensics but do not prevent unauthorized access to sensitive data.
Question 351
In a 24/7 processing environment, a database contains several privileged application accounts with passwords set to "never expire." Which of the following recommendations would BEST address the risk with minimal disruption to the business?
Show answer and explanation
Correct answer: B. Introduce database access monitoring into the environment.
Introducing database access monitoring is the BEST recommendation because it addresses the security risk with minimal business disruption in a 24/7 environment. Monitoring provides visibility into privileged account usage and can detect suspicious activity without requiring system changes or downtime, while still managing the risk of accounts with non-expiring passwords.
Why the other options are wrong
- A. Scheduling downtime for password changes creates operational disruption in a 24/7 environment and may not be feasible.
- C. Modifying policy to allow non-expiring passwords on privileged accounts weakens security controls rather than addressing the risk.
- D. Modifying applications to eliminate direct database access is a major architectural change that creates significant disruption despite being ideal long-term.
Question 352
After an employee termination, a network account was removed, but the application account remained active. To keep this issue from recurring, which of the following is the BEST recommendation?
Show answer and explanation
Correct answer: A. Integrate application accounts with network single sign-on.
Integrating application accounts with network single sign-on (SSO) ensures that when a network account is terminated, the application access is automatically revoked at the same time. This eliminates the gap where network accounts are removed but application accounts remain active, addressing the root cause of the problem systematically rather than relying on manual processes or periodic checks.
Why the other options are wrong
- B. Periodic access reviews only detect orphaned accounts after the fact; they don't prevent the problem from occurring in the first place.
- C. Retraining staff may improve execution but doesn't solve the structural problem of accounts not being synchronized.
- D. Shared accounts are a security anti-pattern that increases risk and accountability issues rather than improving account termination procedures.
Question 353
Which of the following is MOST important for an IS auditor to confirm when reviewing an organization's plans to implement robotic process automation (RPA) to automate routine business tasks?
Show answer and explanation
Correct answer: B. The end-to-end process is understood and documented.
Before implementing RPA, the IS auditor must ensure that the end-to-end process is fully understood and documented. Without clear process documentation, RPA automation risks automating inefficient or incorrect procedures, creating control gaps, and failing to achieve intended benefits. This understanding is prerequisite to evaluating whether RPA is appropriate and how controls should be designed.
Why the other options are wrong
- A. Industry benchmarking is useful but not as critical as understanding the organization's own processes.
- C. An RFP may not even be necessary if existing solutions are evaluated; it's premature before process understanding.
- D. While roles and responsibilities are important, they follow logically after the end-to-end process is understood.
Question 354
A help desk has been contacted regarding a lost business mobile device. The FIRST course of action should be to:
Show answer and explanation
Correct answer: B. verify the user's identity through a challenge response system.
The first course of action must be to verify the person reporting the loss is actually the legitimate user, using a challenge-response or identity verification system. This prevents a malicious actor from using a false loss report to trigger remote wipe or other actions that could destroy evidence or compromise legitimate access. Only after confirming the genuine user should the help desk proceed with remote location, investigation, or legal review.
Why the other options are wrong
- A. Consulting legal regarding IP loss is premature before confirming the device is actually lost and understanding what data was on it.
- C. Launching a security investigation should follow identity verification and assessment of the threat.
- D. Remote location should be attempted after verifying the user's identity to avoid acting on false reports.
Question 355
An IS auditor wants to determine who has oversight of staff performing a specific task and is referencing the organization's RACI chart. Which of the following roles within the chart would provide this information?
Show answer and explanation
Correct answer: A. Accountable
In a RACI matrix, the 'Accountable' role represents the person who has ultimate ownership and oversight responsibility for a task. This person is answerable for its completion and ensures others do their jobs. When an auditor needs to identify who has oversight of staff performing a task, they are looking for the Accountable party.
Why the other options are wrong
- B. Consulted means people whose input is sought; they provide information but don't have oversight.
- C. Responsible means people who do the actual work; they execute the task but don't provide oversight.
- D. Informed means people kept in the loop; they are notified of progress but have no oversight role.
Question 356
Prior to a follow-up engagement, an IS auditor learns that management has decided to accept a level of residual risk related to an audit finding without remediation. The IS auditor is concerned about management's decision. Which of the following should be the IS auditor's NEXT course of action?
Show answer and explanation
Correct answer: D. Report the issue to IS audit management.
When an IS auditor disagrees with management's risk acceptance decision on an audit finding, the appropriate escalation path is to report the issue to IS audit management (the auditor's chain of command). This allows audit leadership to determine whether further escalation to the board or executive management is warranted, maintaining proper governance while respecting the audit function's reporting hierarchy.
Why the other options are wrong
- A. Going directly to executive management bypasses the auditor's own management chain.
- B. Reporting directly to the board is premature and should occur only after audit management evaluates the concern.
- C. Simply accepting the decision without escalating abandons the auditor's responsibility to ensure risks are appropriately addressed.
Question 357
Which of the following BEST ensures the confidentiality of sensitive data during transmission?
Show answer and explanation
Correct answer: C. Sending data over public networks using Transport Layer Security (TLS)
Transport Layer Security (TLS) provides encryption for data in transit, which is the standard cryptographic mechanism for ensuring confidentiality of sensitive data during transmission over networks. TLS encrypts the entire communication channel regardless of whether the network is public or private, protecting against eavesdropping and interception attacks.
Why the other options are wrong
- A. Passwords protecting data over VLANs does not ensure encryption; VLANs provide network segmentation but not confidentiality of transmitted data.
- B. Proxy servers provide routing and anonymity features but do not inherently encrypt data to ensure confidentiality during transmission.
- D. Restricting by destination IP addresses is an access control measure that does not provide encryption or confidentiality protection.
Question 358
A review of Internet security disclosed that users have individual user accounts with Internet service providers (ISPs) and use these accounts for downloading business data. The organization wants to ensure that only the corporate network is used. The organization should FIRST:
Show answer and explanation
Correct answer: C. include a statement in its security policy about Internet use.
Before implementing technical controls like proxy servers or monitoring, an organization must FIRST establish a clear security policy that defines acceptable Internet use and restricts personal ISP accounts for business data. The policy provides the governance framework and legal basis for all subsequent technical and operational controls. Without policy in place, technical measures lack organizational authority and clear guidelines.
Why the other options are wrong
- A. Proxy filtering is a technical implementation that should follow policy establishment, not precede it.
- B. Manual logging is a reactive monitoring approach that doesn't establish the foundational rules for Internet use.
- D. Monitoring remote access is appropriate after policy defines what constitutes acceptable use.
Question 359
Which of the following activities provides an IS auditor with the MOST insight regarding potential single person dependencies that might exist within the organization?
Show answer and explanation
Correct answer: C. Mapping IT processes to roles
Mapping IT processes to roles directly reveals which critical functions depend on individual employees, showing process-to-person relationships and identifying key-person risks. This is a proactive structural analysis that explicitly uncovers dependencies. While interviews and vacation reviews provide some insight, they are indirect methods. User activity logs show what people do, not who is irreplaceable for specific processes.
Why the other options are wrong
- A. Vacation patterns only indirectly suggest who might be critical; someone who never takes vacation might simply be disengaged rather than essential.
- B. Senior management may lack detailed knowledge of operational process dependencies at the individual contributor level.
- D. User activity logs show work performed but do not identify which roles are single points of failure for critical processes.
Question 360
Which of the following is the BEST indicator to measure service quality of change and incident management processes outsourced to an external provider?
Show answer and explanation
Correct answer: D. Percentage of requests resolved within the service level agreement (SLA)
The percentage of requests resolved within the Service Level Agreement (SLA) is the best overall indicator of service quality because it directly measures whether the provider is meeting the contractually agreed performance standards. This metric combines timeliness, effectiveness, and adherence to commitments, making it the most comprehensive indicator of whether the outsourced provider is delivering acceptable service quality.
Why the other options are wrong
- A. Total number of resolved requests measures volume but not quality or whether resolutions met agreed standards.
- B. Average wait time is one component of quality but does not measure whether requests were actually resolved correctly or within SLA targets.
- C. Reopened requests indicate quality issues but represent only failed resolutions, not the overall success rate of the service.
Question 361
Which of the following is the BEST source of information for assessing the effectiveness of IT process monitoring?
Show answer and explanation
Correct answer: A. Performance data
Performance data is the best source for assessing the effectiveness of IT process monitoring because it provides objective, measurable evidence of how processes are performing against defined metrics and thresholds. This data directly reflects the outcomes that monitoring is designed to track and control.
Why the other options are wrong
- B. Participative management techniques provide qualitative input but lack the objective measurement needed to assess monitoring effectiveness.
- C. QA reviews evaluate quality but are a separate function from the monitoring data itself.
- D. Real-time audit software is a tool for monitoring but the performance data it generates is what actually assesses effectiveness.
Question 362
Which of the following approaches would utilize data analytics to facilitate the testing of a new account creation process?
Show answer and explanation
Correct answer: B. Review new account applications submitted in the past month for invalid dates of birth.
Reviewing new account applications submitted in the past month for invalid dates of birth utilizes data analytics to test the account creation process. This approach analyzes historical data to identify whether the system accepted invalid entries that should have been rejected, providing evidence of whether validation controls are functioning properly. This is a data-driven testing method that examines actual system behavior and outputs rather than requirements, configuration, or manual testing.
Why the other options are wrong
- A. Reviewing business requirements documents is a compliance check, not a data analytics approach to testing.
- C. Attempting to submit invalid applications is manual testing, not a data analytics approach.
- D. Evaluating configuration settings is a technical review, not analyzing data to test process outcomes.
Question 363
Which of the following is the BEST recommendation to prevent fraudulent electronic funds transfers by accounts payable employees?
Show answer and explanation
Correct answer: D. Dual control
Dual control (requiring two authorized parties for approval/execution of electronic funds transfers) is the BEST preventive control against fraudulent transfers by accounts payable employees. It prevents a single individual from initiating unauthorized payments. Periodic vendor reviews (A) are detective controls occurring after transactions. Independent reconciliation (B) is detective, catching discrepancies after processing. Re-keying monetary amounts (C) adds verification but doesn't prevent unauthorized initiation. Dual control is preventive and directly addresses the risk.
Why the other options are wrong
- A. Periodic vendor reviews are detective controls that catch issues after transactions occur.
- B. Independent reconciliation is a detective control, not preventive.
- C. Re-keying amounts provides verification but does not prevent unauthorized transactions by employees.
Question 364
Which of the following would an IS auditor consider the GREATEST risk associated with a mobile workforce environment?
Show answer and explanation
Correct answer: A. Loss or damage to the organization's assets
Loss or damage to organizational assets represents the greatest risk in a mobile workforce environment because mobile devices and assets operating outside the secure facility perimeter are inherently more vulnerable to theft, loss, and physical damage. This directly impacts confidentiality, integrity, and availability of critical business information and equipment.
Why the other options are wrong
- B. While policy compliance is a concern, it can be addressed through training and monitoring and is less critical than protecting physical assets and data.
- C. Productivity and accountability, though important operational concerns, are secondary to preventing loss of critical business assets and data.
- D. Remote access to data is a capability that mobile workforces require and is manageable through proper security controls, not a primary risk.
Question 365
Which of the following findings would be of GREATEST concern when auditing an organization's end-user computing (EUC)?
Show answer and explanation
Correct answer: B. Inability to monitor EUC audit logs and activities
The inability to monitor EUC audit logs and activities represents the greatest concern because without visibility into what end users are doing with computing resources, the organization cannot detect errors, fraud, security breaches, or policy violations. This directly undermines the organization's ability to maintain control over financial data and system integrity. While reduced IT oversight, errors in financial statements, and inconsistent patching are all problematic, they can potentially be identified through other means, but lack of audit trail visibility prevents any meaningful detection or investigation of issues.
Why the other options are wrong
- A. Reduced oversight is concerning but can be compensated for through other monitoring mechanisms.
- C. Errors in financial statements are a symptom of control failure but not the root cause that prevents detection.
- D. Inconsistent patching is a control weakness but less critical than the inability to audit and monitor activities.
Question 366
An organization uses multiple offsite data center facilities. Which of the following is MOST important to consider when choosing related backup devices and media?
Show answer and explanation
Correct answer: B. Standardization
Standardization is most important when managing multiple offsite data center facilities because it ensures consistency in backup procedures, simplifies training and operations, enables interoperability across sites, reduces complexity in disaster recovery scenarios, and minimizes vendor lock-in. Standardized devices and media allow seamless failover and recovery between facilities without compatibility issues.
Why the other options are wrong
- A. While costs matter, operational consistency and reliability are more critical for backup infrastructure serving multiple facilities.
- C. Backup media capacity is important but is determined by data requirements; standardization ensures all locations can handle consistent workloads.
- D. Restoration speed is a performance consideration but is secondary to having standardized, compatible systems across all offsite locations.
Question 367
A third-party consultant is managing the replacement of an accounting system. Which of the following should be the IS auditor's GREATEST concern?
Show answer and explanation
Correct answer: B. Data migration is not part of the contracted activities.
Data migration not being part of contracted activities is the greatest concern because it creates a critical gap in responsibility and oversight. Migrating accounting data accurately is essential for system integrity, compliance, and financial reporting, and if no one owns this activity, data loss or corruption could occur. Without explicit data migration controls and accountability, the new system cannot function properly.
Why the other options are wrong
- A. Year-end timing is challenging but manageable with proper planning and not inherently the greatest risk.
- C. Third-party testing is acceptable if proper independence and coverage are established.
- D. User department managing access rights is standard practice and not necessarily problematic if properly governed.
Question 368
When conducting a post-implementation review of a new software application, an IS auditor should be MOST concerned with an increasing number of:
Show answer and explanation
Correct answer: C. operational errors impacting service delivery.
During a post-implementation review, an increasing number of operational errors impacting service delivery is the most concerning finding because it directly indicates that the application is not meeting its intended purpose and is causing business impact. This signals fundamental problems with functionality, stability, or operational readiness.
Why the other options are wrong
- A. Change requests for new services indicate feature requests, which are normal and less critical than operational failures.
- B. Updates to the operations manual are administrative adjustments and less concerning than service delivery failures.
- D. Help desk calls requesting enhancements are feedback for future improvements, not indicators of implementation problems.
Question 369
During the discussion of a draft audit report, IT management provided suitable evidence that a process has been implemented for a control that had been concluded by the IS auditor as ineffective. Which of the following is the auditor's BEST action?
Show answer and explanation
Correct answer: B. Add comments about the action taken by IT management in the report.
When management provides evidence during the exit interview that a control has been implemented after the audit work was completed, the auditor should document this new action in the report comments rather than retroactively changing the original conclusion. This maintains the audit's integrity by preserving the timing of findings while acknowledging management's responsive action. Re-performing the audit (D) is unnecessary given the timing. Deferring evaluation to follow-up (A) misses the opportunity to acknowledge management's immediate response. Changing the conclusion (C) without re-performance compromises audit credibility.
Why the other options are wrong
- A. Deferring evaluation ignores the opportunity to document management's immediate corrective response.
- C. Changing conclusions without re-performing the audit procedure compromises the audit's integrity.
- D. Re-performing the entire audit is unnecessary when simple documentation of the new evidence suffices.
Question 370
Which of the following is MOST important for an IS auditor to test when reviewing market data received from external providers?
Show answer and explanation
Correct answer: C. Data quality controls
Data quality controls are the most critical test because external market data from providers is often used in critical business decisions. Verifying data quality, completeness, accuracy, timeliness, and consistency, ensures the organization can rely on data received from external sources before it is loaded or used.
Why the other options are wrong
- A. Data transformation configurations are important but secondary to ensuring the source data quality is acceptable.
- B. Data loading controls ensure data is correctly transferred into systems but do not validate the quality of the source data itself.
- D. Data encryption configurations protect data security but do not validate the accuracy or quality of the data content.
Question 371
The PRIMARY objective of IT service level management is to:
Show answer and explanation
Correct answer: C. satisfy customer requirements.
The primary objective of IT service level management is to ensure that IT services meet or exceed customer expectations and requirements. While cost control, operations management, and awareness are all important secondary outcomes, the fundamental purpose of SLM is to establish and maintain agreed-upon service levels that satisfy the business and customers who depend on those services.
Why the other options are wrong
- A. Cost control is a benefit of SLM but not its primary objective.
- B. Managing computer operations is an operational activity, not the primary objective of SLM.
- D. Increasing awareness is a secondary benefit, not the primary objective.
Question 372
An IS auditor finds that an organization's data loss prevention (DLP) system is configured to use vendor default settings to identify violations. The auditor's MAIN concern should be that:
Show answer and explanation
Correct answer: B. violations may not be categorized according to the organization's risk profile.
Vendor default settings are generic and not calibrated to an organization's specific risk profile, business context, and threat landscape. This misalignment means violations may not be categorized according to what the organization actually considers risky, resulting in either over-blocking of legitimate activities or under-detection of real threats. Default settings fail to reflect organizational priorities and risk tolerance.
Why the other options are wrong
- A. Review timing is a process issue, not the main concern with default DLP settings.
- C. False positives are a consequence of poor configuration but secondary to the lack of risk-based categorization.
- D. Retention policies are separate from the violation identification and categorization function of DLP.
Question 373
After discussing findings with an auditee, an IS auditor is required to obtain approval of the report from the CEO before issuing it to the audit committee. This requirement PRIMARILY affects the IS auditor's:
Show answer and explanation
Correct answer: C. independence
Requiring the IS auditor to obtain CEO approval before issuing a report to the audit committee primarily affects the auditor's independence. Independence requires that auditors report directly to those charged with governance (the audit committee) without management interference. When a CEO can approve or potentially restrict report issuance, it creates a threat to the auditor's ability to communicate findings freely. This arrangement suggests the auditor may self-censor findings to obtain management approval, which is the definition of compromised independence. This requirement undermines the auditor's ability to operate objectively and without management influence, which is essential for effective internal audit function.
Why the other options are wrong
- A. CEO approval does not directly affect the auditor's judgment in conducting the audit or analyzing findings.
- B. While this requirement may reduce effectiveness, the primary concern is the threat to independence.
- D. Integrity relates to honesty and ethical conduct; this requirement primarily affects independence rather than integrity.
Question 374
Which of the following is the MOST important factor when an organization is developing information security policies and procedures?
Show answer and explanation
Correct answer: B. Alignment with an information security framework
Alignment with an information security framework is the MOST important factor because it ensures policies are comprehensive, logically structured, and based on established best practices. A framework provides the foundational architecture ensuring all necessary areas are covered and policies work cohesively. While consultation, mission alignment, and regulatory compliance are all important, they are most effective when organized within a recognized framework that ensures nothing is missed and everything is properly integrated.
Why the other options are wrong
- A. Consultation with security staff is important for expertise but does not guarantee comprehensive coverage without a guiding framework.
- C. Inclusion of mission and objectives provides context but without a framework structure, policies may be incomplete or misaligned.
- D. Regulatory compliance is essential but addresses only legal requirements and may miss important areas not specifically mandated by regulations.
Question 375
Which of the following is MOST important with regard to an application development acceptance test?
Show answer and explanation
Correct answer: A. User management approves the test design before the test is started.
The most important aspect of an application acceptance test is that user management approves the test design before testing begins. This ensures stakeholder alignment on what constitutes acceptable functionality and establishes clear pass/fail criteria. User approval of test design is a governance requirement that establishes accountability and prevents scope misalignment. While data validation, QA oversight, and programmer involvement are all relevant activities, none are as critical to acceptance testing success as obtaining user approval of test design upfront.
Why the other options are wrong
- B. Data file validation is part of conversion testing, which occurs after acceptance testing passes.
- C. While QA may manage testing execution, acceptance testing is fundamentally a user responsibility and validation.
- D. Programming team involvement is useful for troubleshooting but is not the most important aspect of acceptance testing.
Question 376
Which of the following is the BEST indicator for measuring performance of the IT help desk function?
Show answer and explanation
Correct answer: B. Number of reopened tickets
The number of reopened tickets is the best indicator of help desk performance because it directly measures first-contact resolution quality and customer satisfaction. High reopened ticket rates indicate that issues are not being properly resolved the first time, requiring additional effort and reflecting poor service quality. This metric directly correlates with efficiency and effectiveness of help desk staff.
Why the other options are wrong
- A. Percentage of problems raised from incidents is a classification metric that does not directly measure resolution quality or performance effectiveness.
- C. Number of incidents reported measures volume, not quality of resolution or performance efficiency.
- D. Mean time to categorize tickets measures triage speed but not actual problem resolution quality, which is the core function of help desk services.
Question 377
A proper audit trail of changes to server start-up procedures would include evidence of:
Show answer and explanation
Correct answer: B. operator overrides.
An audit trail for server start-up procedure changes must capture operator overrides, instances where personnel bypass or circumvent normal procedures. This evidence documents who made exceptions, when they occurred, and why, which is essential for compliance, accountability, and detecting unauthorized modifications to critical server initialization sequences. Overrides represent deviations from approved procedures and are key audit evidence.
Why the other options are wrong
- A. Program execution logs are related to runtime activity, not to changes made to start-up procedures themselves.
- C. Subsystem structure refers to the architectural components of systems, not to procedural changes or operator actions during initialization.
- D. Security control options are configuration settings, but operator overrides represent the actual deviations and exceptions that occur in practice, which is more critical audit evidence.
Question 378
In the case of a disaster where the data center is no longer available, which of the following tasks should be done FIRST?
Show answer and explanation
Correct answer: D. Activate the call tree
Activating the call tree should be done FIRST in a disaster scenario because it immediately notifies all relevant personnel of the emergency, enables communication channels, and initiates the disaster recovery plan. Without notifying the team and leadership, no coordinated response can begin. This logistical first step must precede all other actions like risk analysis, site arrangements, or data recovery.
Why the other options are wrong
- A. Arranging a secondary site cannot be done effectively until the team is mobilized and informed through the call tree.
- B. Risk analysis is important but premature before the team is even notified and mobilized to respond.
- C. Data recovery cannot meaningfully begin until personnel are activated and coordinated through the established communication structure.
Question 379
Which of the following is the MOST important prerequisite for the protection of physical information assets in a data center?
Show answer and explanation
Correct answer: B. Complete and accurate list of information assets that have been deployed
An accurate and complete inventory of deployed information assets is the foundational prerequisite for protection; you cannot protect what you do not know you have. Without knowing what assets exist and where they are located, no protection program can be effective. IT staff knowledge, segregation of duties, and backup generator testing are all important controls, but they are secondary to first establishing what assets require protection.
Why the other options are wrong
- A. Staff knowledge supports protection efforts but does not establish the baseline of what assets exist and need protection.
- C. Segregation of duties in ordering and receiving is an important control but only works after assets have been identified and are being managed.
- D. Backup generators support continuity but are not a prerequisite for the initial protection of physical assets in the data center.
Question 380
An organization is modernizing its technology policy framework to demonstrate compliance with external industry standards. Which of the following would be MOST useful to an IS auditor for validating the outcome?
Show answer and explanation
Correct answer: A. Mapping of relevant standards against the organization's controls
Mapping relevant standards against the organization's controls directly validates whether the modernized framework actually achieves compliance with external standards. This is concrete evidence of alignment between policy and requirements. Option B (policy exceptions) is an inventory, not validation. Option C (external recommendations) is advisory rather than validating actual outcomes. Option D (peer benchmarking) provides context but not proof of compliance with the specific industry standards.
Why the other options are wrong
- B. An inventory of exceptions documents what's not compliant, rather than validating what is compliant.
- C. Third-party recommendations are guidance only and don't validate the organization's actual compliance outcome.
- D. Peer benchmarking provides comparative context but doesn't validate compliance with external standards.
Question 381
Prior to the migration of acquired software into production, it is MOST important that the IS auditor review the:
Show answer and explanation
Correct answer: A. user acceptance test (UAT) report.
Prior to production migration, the IS auditor must review the User Acceptance Testing (UAT) report because UAT provides evidence that the acquired software actually functions as required and meets business expectations in a realistic environment. The UAT report is the authoritative verification that the software is ready for production use. While vendor testing reports, system documentation, and source code escrow agreements are all relevant to the overall software acquisition process, the UAT report is the critical gate that confirms functional fitness for production deployment.
Why the other options are wrong
- B. Vendor testing reports reflect the vendor's environment, not the organization's actual operational context.
- C. System documentation describes what the software should do but does not confirm it actually works as intended.
- D. Source code escrow agreements are important for risk management but do not assess whether the software is ready for production.
Question 382
An organization considers implementing a system that uses a technology that is not in line with the organization's IT strategy. Which of the following is the BEST justification for deviating from the IT strategy?
Show answer and explanation
Correct answer: D. The business benefits are achieved even with extra costs.
The best justification for deviating from IT strategy is when business benefits outweigh the costs and risks of the deviation. Business value and achieving organizational objectives must ultimately justify any strategic exceptions. State-of-the-art technology, cost reduction, and staff familiarity are secondary considerations compared to delivering measurable business benefits that offset the extra costs and strategy misalignment.
Why the other options are wrong
- A. Using state-of-the-art technology is not sufficient justification; it may introduce risk and complexity without business value.
- B. Reduced cost alone doesn't justify deviation if the system misaligns with strategy; the cost benefit must address business objectives.
- C. Staff familiarity is a minor convenience factor and doesn't justify strategic deviation or the extra costs incurred.
Question 383
Which of the following would be the MOST significant factor when choosing among several backup system alternatives with different restoration speeds?
Show answer and explanation
Correct answer: C. Recovery time objective (RTO)
Recovery Time Objective (RTO) directly measures how quickly a system must be restored, which is the most significant factor when comparing backup systems with different restoration speeds. Since the question specifically asks about choosing among alternatives with different restoration speeds, RTO is the relevant metric that determines if a system meets business requirements. MTBF measures failure frequency, not recovery speed. RPO measures data loss tolerance, not restoration speed. MTO is outdated terminology rarely used in modern disaster recovery planning.
Why the other options are wrong
- A. MTBF measures how often failures occur, not how quickly systems can be restored after a failure.
- B. RPO measures acceptable data loss between backups, not the speed of restoration from backup.
- D. MTO is not a standard metric; RTO is the correct contemporary measure for restoration speed requirements.
Question 384
Which of the following would an IS auditor recommend as the MOST effective preventive control to reduce the risk of data leakage?
Show answer and explanation
Correct answer: C. Ensure that paper documents are disposed securely.
Secure disposal of paper documents is a preventive control that directly stops data leakage at the source by ensuring physical documents cannot be recovered or accessed by unauthorized parties. While digital watermarks, IDS, and logging are useful controls, they are primarily detective or reactive in nature, they identify after-the-fact that a breach may have occurred rather than preventing it. Secure disposal prevents the initial opportunity for leakage from physical media.
Why the other options are wrong
- A. Digital watermarks are detective controls that identify unauthorized use after copying, not preventive controls that stop leakage.
- B. An IDS is a detective control that identifies intrusions after they occur, not a preventive control that stops data leakage.
- D. Application logs are detective controls that record changes; they do not prevent data leakage from occurring.
Question 385
In which phase of the internal audit process is contact established with the individuals responsible for the business processes in scope for review?
Show answer and explanation
Correct answer: B. Planning phase
Contact with individuals responsible for business processes in scope is established during the planning phase. This initial engagement is essential to understand the audit scope, identify key stakeholders, gather preliminary information about processes, and establish expectations and timelines before audit execution begins.
Why the other options are wrong
- A. The execution phase involves conducting the actual audit work, not establishing initial contact.
- C. The selection phase pertains to selecting audit subjects and areas, not contacting process owners.
- D. The follow-up phase occurs after the audit to monitor corrective actions, not for initial contact.
Question 386
An employee loses a mobile device resulting in loss of sensitive corporate data. Which of the following would have BEST prevented data leakage?
Show answer and explanation
Correct answer: A. Data encryption on the mobile device
Data encryption on the mobile device is the best preventive measure because it renders stolen data unreadable and unusable without the decryption key, thus eliminating the harm from data leakage regardless of how the device is lost or compromised. While remote wipe and awareness training are valuable controls, they cannot recover already-lost data. Remote wipe only works if initiated before data access, and training cannot prevent all device losses. Encryption prevents leakage by making the data inherently protected.
Why the other options are wrong
- B. Remote wipe only prevents further access after the loss is discovered and reported, but cannot protect data already accessed or copied by a thief.
- C. Awareness training reduces the probability of loss but cannot prevent a determined thief from stealing a lost device or accessing unencrypted data.
- D. Complex passwords protect against unauthorized use but do not prevent a thief from accessing unencrypted data or cloning the device entirely.
Question 387
What is the BEST control to address SQL injection vulnerabilities?
Show answer and explanation
Correct answer: B. Input validation
Input validation is the best control to address SQL injection vulnerabilities. By validating and filtering all user inputs before they are used in SQL queries, organizations can prevent malicious SQL code from being inserted into database commands. This includes checking data type, length, format, and rejecting or sanitizing any input that doesn't conform to expected patterns. Input validation addresses the root cause of SQL injection at the point where the vulnerability can be exploited.
Why the other options are wrong
- A. Digital signatures authenticate the origin and integrity of data but do not prevent SQL injection attacks.
- C. Unicode translation does not address the fundamental issue of unsanitized user input being incorporated into SQL queries.
- D. SSL encryption protects data in transit but does not prevent SQL injection, which occurs at the application layer when malicious input is processed by the database.
Question 388
What is the PRIMARY purpose of documenting audit objectives when preparing for an engagement?
Show answer and explanation
Correct answer: D. To address the overall risk associated with the activity under review
The primary purpose of documenting audit objectives is to address the overall risk associated with the activity under review. Audit objectives are derived from the risk assessment and define the scope and focus of testing needed to evaluate whether risks are adequately managed and controlled. Well-documented objectives ensure the audit comprehensively addresses material risks and provides appropriate assurance.
Why the other options are wrong
- A. While identifying high-risk areas is important, it's typically a result of risk assessment that precedes and informs objectives rather than the primary purpose of documenting objectives.
- B. Maximizing resource use is an operational benefit of clear objectives, but not the primary purpose of documenting them.
- C. Scheduling meetings is a logistical task that follows from objectives rather than being the primary purpose of documenting them.
Question 389
Which of the following is the PRIMARY role of key performance indicators (KPIs) in supporting business process effectiveness?
Show answer and explanation
Correct answer: C. To enable conclusions about the performance of the processes and target variances for follow-up analysis
The primary role of KPIs is to enable conclusions about process performance and identify variances that require follow-up analysis. KPIs provide measurable metrics to assess whether processes are meeting their objectives and to highlight areas needing attention. Option A describes process optimization which is a use of KPIs but not their primary purpose; B focuses on cost-benefit analysis of tools; D addresses software functionality testing, not process effectiveness measurement.
Why the other options are wrong
- A. While KPIs can support optimization, their primary role is measurement and evaluation, not workflow analysis.
- B. Cost-benefit analysis of monitoring tools is secondary to the primary purpose of evaluating process performance.
- D. Software functionality assessment is unrelated to the primary purpose of KPIs in measuring business process effectiveness.
Question 390
The use of which of the following is an inherent risk in the application container infrastructure?
Show answer and explanation
Correct answer: C. Shared kernel
A shared kernel is an inherent risk in container infrastructure because multiple containers share the same operating system kernel. Unlike virtual machines which each have their own kernel, containers running on the same host share the host's kernel. A vulnerability or compromise in the shared kernel can potentially affect all containers on that host, creating a significant security risk that is fundamental to the container architecture.
Why the other options are wrong
- A. Data sharing between containers is not inherent; it is controlled by design and configuration choices.
- B. Shared registries are repositories for container images and are not an inherent structural risk of container infrastructure itself.
- D. The host operating system is a supporting component; the fundamental architectural risk is the shared kernel layer.
Question 391
Which of the following would BEST ensure that a backup copy is available for restoration of mission critical data after a disaster?
Show answer and explanation
Correct answer: D. Periodically test backups stored in a remote location.
Periodically testing backups stored in a remote location best ensures that mission-critical data can actually be restored after a disaster. Testing verifies that backups are valid, restorable, and accessible when needed, addressing the core requirement of availability. While options A and B involve good practices, they don't guarantee usability; option C focuses only on incremental backups, which are incomplete without full backups. Testing in a remote location confirms both the backup integrity and the disaster recovery capability.
Why the other options are wrong
- A. Using multiple backup types is good practice but does not guarantee that backups are valid or can be successfully restored.
- B. Full automation ensures consistency but does not verify that backups can actually be restored when needed.
- C. Electronic vaults for incremental backups are insufficient without testing and without full backups to restore from.
Question 392
When reviewing a project to replace multiple manual data entry systems with an artificial intelligence (Al) system, the IS auditor should be MOST concerned with the impact Al will have on:
Show answer and explanation
Correct answer: B. enterprise architecture (EA).
When replacing multiple manual data entry systems with an AI system, the impact on enterprise architecture (EA) is of greatest audit concern. This transformation involves fundamental changes to system integration, data flows, processing logic, technical infrastructure, and interdependencies across the organization. EA encompasses how systems, processes, and technology align across the enterprise, and an AI replacement requires comprehensive evaluation of these architectural implications.
Why the other options are wrong
- A. Future task updates are important but represent a minor operational concern compared to enterprise-wide architectural implications.
- C. Task capacity output is a performance metric but is secondary to understanding the broader system architecture changes.
- D. Employee retention is a human resources concern, not the primary IT audit focus when evaluating system replacement impact.
Question 393
Which of the following is the BEST indicator that an application system's agreed-upon level of service has been met?
Show answer and explanation
Correct answer: A. Transaction response time
Transaction response time is the best direct indicator of whether agreed-upon service levels have been met. Service level agreements typically define specific response time thresholds that directly impact user experience and system performance. Response time is a measurable, user-facing metric that reflects actual service delivery. Bandwidth usage, CPU utilization, and security incidents are operational metrics that may contribute to understanding performance but don't directly measure SLA compliance.
Why the other options are wrong
- B. Bandwidth logs are infrastructure metrics, not direct SLA indicators.
- C. CPU utilization is an operational metric, not a measure of agreed service levels.
- D. Security incidents are important but unrelated to standard SLA metrics.
Question 394
Which of the following is the MOST important activity in the data classification process?
Show answer and explanation
Correct answer: C. Identifying risk associated with the data
Identifying risk associated with the data is the most important activity in data classification because it forms the foundation for all subsequent classification decisions and controls. Risk assessment determines the criticality and sensitivity level of data, which drives appropriate classification levels, handling requirements, and control implementation. Without understanding the risks posed by unprotected or mishandled data, the classification effort lacks purpose and proper prioritization.
Why the other options are wrong
- A. Determining data owner accountability occurs after classification to establish governance, not as the primary foundation.
- B. Labeling data is a mechanical activity that follows classification decisions based on identified risks.
- D. Evaluating control adequacy is a post-classification activity that depends on risk identification.
Question 395
An IS auditor is reviewing an organization’s incident management processes and procedures. Which of the following observations should be the auditor’s GREATEST concern?
Show answer and explanation
Correct answer: D. Ineffective incident detection
Ineffective incident detection is the GREATEST concern because undetected incidents represent complete failure of the incident management lifecycle, if incidents are not detected, they cannot be responded to, investigated, or resolved. This creates maximum exposure and risk. Classification, prioritization, and post-incident reviews all depend on incidents first being detected; without detection, these downstream processes are irrelevant.
Why the other options are wrong
- A. Ineffective classification impacts prioritization accuracy but detected incidents can still be responded to even with classification issues.
- B. Ineffective post-incident review reduces learning but incidents can still be detected, contained, and resolved.
- C. Ineffective prioritization may allocate resources suboptimally but incidents are still detected and managed to some degree.
Question 396
Reconciliations have identified data discrepancies between an enterprise data warehouse and a revenue system for key financial reports. What is the GREATEST risk to the organization in this situation?
Show answer and explanation
Correct answer: D. Decisions may be made based on incorrect information.
The greatest risk when financial data discrepancies exist between systems is that decisions may be made based on incorrect information. This directly impacts business decisions, strategy, and potentially compliance. While the reports may be delayed or undetected fraud could occur, the fundamental risk is that any decisions made using unreliable financial data could harm the organization. This is a higher-order risk than operational delays or fraud detection.
Why the other options are wrong
- A. Reports may still be produced; they would simply contain inaccurate data.
- B. Delays are operational impacts but not the greatest risk compared to decision-making based on wrong data.
- C. Undetected fraud is a concern but the immediate risk is using unreliable data for any organizational decisions.
Question 397
Which of the following would BEST help to ensure the availability of data stored with a cloud provider?
Show answer and explanation
Correct answer: C. Defining service level agreements (SLAs) in the contract
Service level agreements (SLAs) define specific commitments regarding availability, uptime guarantees, performance metrics, and remedies for failures. SLAs provide contractual enforcement mechanisms and measurable standards that ensure the cloud provider is obligated to maintain availability. While disaster recovery sites and backups are operational measures, they lack enforceability without SLA terms. Reporting processes and formats address documentation but do not directly ensure availability.
Why the other options are wrong
- A. A disaster recovery site is important operationally but without SLA commitments, there is no contractual guarantee it will be maintained or activated.
- B. Daily backups are a good operational practice but without SLA requirements, there is no enforcement mechanism or guarantee of effectiveness.
- D. Reporting process definitions address how information is communicated but do not directly prevent or assure availability of the data itself.
Question 398
An organization plans to receive an automated data feed into its enterprise data warehouse from a third-party service provider. Which of the following would be the BEST way to prevent accepting bad data?
Show answer and explanation
Correct answer: D. Implement business rules to reject invalid data.
Implementing business rules to reject invalid data is the most proactive and direct control to prevent bad data from entering the data warehouse. Business rules act as automated gates that validate incoming data against predefined criteria before acceptance, stopping invalid data at the point of entry rather than requiring cleanup afterward. This is a preventive control that addresses the root cause of data quality issues.
Why the other options are wrong
- A. Data cleansing tools address data quality after problems exist; they are reactive rather than preventive.
- B. Appointing data quality champions is an organizational structure but does not directly prevent invalid data from being accepted automatically.
- C. Error codes from failed feeds only report what went wrong but don't automatically prevent acceptance of bad data.
Question 399
Which of the following is the PRIMARY purpose of conducting follow-up audits for material observations?
Show answer and explanation
Correct answer: C. To validate remediation efforts
The PRIMARY purpose of follow-up audits for material observations is to validate that management has remediated the identified findings and that corrective actions are effective. This ensures accountability and confirms risks have been addressed. Assessing evidence for reporting (A) is done in the initial audit, validating correctness of findings (B) occurs during the initial audit's investigation, and assessing audit environment risk (D) is not the specific purpose of follow-up audits.
Why the other options are wrong
- A. Assessing evidence for findings is part of the initial audit, not the follow-up audit.
- B. Validating the correctness of reported findings occurs during the initial audit investigation.
- D. Assessing risk of the audit environment is not the specific purpose of follow-up audits for findings.
Question 400
Which of the following will be the MOST effective method to verify that a service vendor keeps control levels as required by the client?
Show answer and explanation
Correct answer: C. Conduct periodic on-site assessments using agreed-upon criteria.
Periodic on-site assessments using agreed-upon criteria provide direct, verifiable evidence of whether the vendor maintains required controls. This independent verification method allows the client to observe and test controls in operation, confirming compliance with contractual requirements through objective assessment.
Why the other options are wrong
- A. Self-assessments are vendor-provided and lack the independence needed to verify control maintenance.
- B. SLA review is important but does not verify actual control implementation or effectiveness.
- D. Vulnerability assessments test for security weaknesses but do not directly verify control-level compliance.
Question 401
Which of the following types of firewalls provide the GREATEST degree of control against hacker intrusion?
Show answer and explanation
Correct answer: C. Application level gateway
An application level gateway (also called application firewall) provides the greatest degree of control against hacker intrusion because it operates at Layer 7 (application layer) and can understand and filter based on actual application protocols and content. This allows it to detect and block sophisticated attacks that exploit application vulnerabilities, whereas lower-layer firewalls only examine headers and basic packet information.
Why the other options are wrong
- A. Packet filtering routers operate at Layer 3-4 and only examine header information, lacking the ability to understand application-level threats.
- B. Circuit gateways operate at the session layer and provide basic connection control but lack application-level intelligence for detecting complex attacks.
- D. Screening routers are essentially packet filters with slightly enhanced capabilities but still operate at low network layers without application awareness.
Question 402
Which of the following is the MOST effective way for an IS auditor to evaluate whether an organization is well positioned to defend against an advanced persistent threat (APT)?
Show answer and explanation
Correct answer: D. Assess the skill set with in the security function.
The most effective way to evaluate an organization's ability to defend against advanced persistent threats is to assess the skill set within the security function. APTs are sophisticated attacks that require experienced, knowledgeable security personnel to detect, respond to, and mitigate. Skilled security professionals can implement detection strategies, respond to incidents, and adapt defenses, capabilities that directly determine APT resilience. While monitoring and correlated data (option C) are important technical controls, organizational capability ultimately depends on human expertise. Insurance and IP address verification are insufficient measures of actual defensive capability.
Why the other options are wrong
- A. Cyber insurance transfers financial risk but does not evaluate or enhance the organization's technical ability to defend against APTs.
- B. Reviewing external IP addresses is a basic network monitoring task insufficient for evaluating comprehensive APT defense capability.
- C. While correlated security monitoring data is an important technical control, security function skill set is the more fundamental determinant of APT defense effectiveness.
Question 403
During an IT general controls audit of a high-risk area where both internal and external audit teams are reviewing the same areas simultaneously, which of the following is the BEST approach to optimize resources?
Show answer and explanation
Correct answer: A. Leverage the work performed by external audit for the internal audit testing.
Leveraging the work performed by external audit for internal audit testing is the best approach to optimize resources when both teams audit the same high-risk areas simultaneously. This avoids duplication of effort, reduces overall audit burden on the organization, and allows the internal audit team to validate external work or focus on complementary areas. Both teams must coordinate and document this reliance, but the principle is sound resource management. Simultaneous independent work is inefficient; rolling forward audits creates risk exposure; requesting external rely on internal work reverses the typical authority relationship in most frameworks.
Why the other options are wrong
- B. Performing the same work simultaneously by both teams is duplicative and wastes audit resources without added value.
- C. Rolling forward audits to the next year creates a control gap and unnecessary risk in a high-risk area.
- D. External auditors typically have independence requirements that make relying on internal work less standard than internal relying on external work.
Question 404
An organization maintains an inventory of the IT applications used by its staff. Which of the following would pose the GREATEST concern with regard to the quality of the inventory data?
Show answer and explanation
Correct answer: C. The application owner and contact information fields are not required to be completed.
Missing required fields for application owner and contact information represents a critical data quality failure. Without this core data, the inventory cannot effectively be maintained, updated, or leveraged for management decisions. An incomplete owner field means nobody can be held accountable for updating or certifying the application data, making the entire inventory unreliable. While intranet availability is a distribution choice, missing risk rankings is a missing attribute (not a quality defect), and lack of recertification is a process gap, incomplete required fields directly undermine the usability and integrity of the inventory data itself.
Why the other options are wrong
- A. Intranet availability is a distribution mechanism and does not affect data quality.
- B. Missing risk ranking is a missing optional attribute, not a data quality issue affecting the core inventory.
- D. Lack of recertification is a process weakness but does not directly impact the current data quality.
Question 405
Which of the following is an executive management concern that could be addressed by the implementation of a security metrics dashboard?
Show answer and explanation
Correct answer: A. Effectiveness of the security program
A security metrics dashboard addressing the effectiveness of the security program directly supports executive management's need to assess whether security investments are achieving their intended goals. Executive management is concerned with high-level strategic outcomes: whether the security program is actually protecting the organization, reducing risk, and delivering value. Effectiveness metrics demonstrate program maturity, control performance, and risk reduction, critical information for executive decision-making about security strategy and resource allocation.
Why the other options are wrong
- B. False positives are an operational metric relevant to security teams, not a primary executive management concern.
- C. Total budgeted hours is a resource allocation question, not a measure of program effectiveness or outcome.
- D. While benchmarking is useful, it is comparison data rather than a direct measure of the organization's own program effectiveness.
Question 406
Which of the following is MOST important to determine when conducting a post-implementation review?
Show answer and explanation
Correct answer: B. Whether success criteria have been achieved
Determining whether success criteria have been achieved is the most important aspect of a post-implementation review because it directly measures whether the project delivered the intended business value and met stakeholder expectations. Success criteria validation is foundational, it determines if the implementation was ultimately successful before evaluating secondary concerns like standards compliance or budget adherence.
Why the other options are wrong
- A. While IT standards compliance is important, it is a technical control measure, not the primary measure of project success.
- C. Documenting lessons learned is valuable for future improvements but is a secondary activity that follows assessment of actual outcomes.
- D. Budget compliance is important but does not measure whether the solution actually met business objectives and user needs.
Question 407
One benefit of return on investment (ROI) analysis in IT decision making is that it provides the:
Show answer and explanation
Correct answer: C. basis for allocating financial resources.
ROI (Return on Investment) analysis is fundamentally a financial decision-making tool that helps organizations determine which investments provide the best returns relative to their costs. By comparing ROI across different IT investments, management can allocate financial resources to projects that deliver the greatest value, making it the basis for resource allocation decisions.
Why the other options are wrong
- A. ROI analysis may consider replacement costs but is not specifically designed to provide just replacement costs.
- B. Total Cost of Ownership (TCO) is the metric used to estimate cost of ownership, not ROI.
- D. ROI analysis provides a basis for direct resource allocation, not specifically for allocating indirect costs.
Question 408
Which of the following is MOST important for an IS auditor to assess during a post-implementation review of a newly modified IT application developed in-house?
Show answer and explanation
Correct answer: B. Sufficiency of implemented controls
During a post-implementation review of a newly modified in-house application, the auditor's primary concern must be verifying that the implemented controls are sufficient to protect the application and its data. While rollback plans, user manuals, and resource management are relevant to implementation, assessing whether controls have been properly designed and embedded to mitigate identified risks is the core audit responsibility and most critical to ensure the application operates securely and reliably.
Why the other options are wrong
- A. Rollback plans are important for the implementation phase but are not the primary focus of a post-implementation review.
- C. User manual updates are administrative tasks, not an audit concern for assessing application integrity and security.
- D. Resource management plans relate to project execution, not post-implementation control validation.
Question 409
Which of the following provides the BEST evidence that a third-party service provider's information security controls are effective?
Show answer and explanation
Correct answer: B. An audit report of the controls by the service provider's external auditor
An external audit report by the service provider's external auditor provides the strongest independent evidence that controls are effective. External auditors conduct objective, rigorous assessments and are professionally bound to accuracy. This third-party verification is far more credible than internal documentation, interviews with service provider staff, or policies. External audit reports, such as SOC 2 Type II reports, represent tested evidence of control effectiveness over time, making them the best evidence available to an organization evaluating a vendor.
Why the other options are wrong
- A. Documentation of security controls shows what exists but provides no evidence of whether controls actually function effectively.
- C. An interview with the information security officer is a subjective conversation with an interested party and provides no independent verification of effectiveness.
- D. Policies and procedures describe intended controls but do not demonstrate that they are actually implemented or operating effectively.
Question 410
An IS auditor is evaluating controls for monitoring the regulatory compliance of a third party that provides IT services to the organization. Which of the following should be the auditor's GREATEST concern?
Show answer and explanation
Correct answer: D. The organization has not communicated regulatory requirements to the third party.
If regulatory requirements have not been communicated to the third party, they cannot reasonably be expected to comply with them, making this a foundational control gap. Without this communication, all other compliance activities lack direction. A gap analysis, disclosed noncompliance (which is being monitored), and policy review are important but secondary to ensuring the third party understands what compliance is expected.
Why the other options are wrong
- A. A gap analysis is important but can be conducted after requirements are communicated.
- B. A disclosed policy issue shows the monitoring process is working to surface problems.
- C. While important, reviewing policies is secondary to ensuring requirements were first communicated.
Question 411
The performance, risks, and capabilities of an IT infrastructure are BEST measured using a:
Show answer and explanation
Correct answer: D. balanced scorecard.
A balanced scorecard is a comprehensive performance management tool that measures IT infrastructure across multiple dimensions, including financial, operational, customer, and learning perspectives, capturing performance, risks, and capabilities holistically. It provides balanced visibility across diverse metrics in a single framework. A risk management review focuses only on risks, a CSA on control compliance, and an SLA on specific service commitments; none provide the comprehensive, multi-dimensional measurement that a balanced scorecard offers.
Why the other options are wrong
- A. A risk management review focuses on risks alone, not performance and capabilities.
- B. A control self-assessment focuses on control effectiveness, not overall infrastructure performance.
- C. An SLA measures specific service commitments but does not comprehensively measure risks or broader capabilities.
Question 412
Which of the following approaches provides the BEST assurance and user confidence when an organization migrates data to a more complex enterprise resource planning (ERP) system?
Show answer and explanation
Correct answer: B. Parallel processing
Parallel processing provides the best assurance and user confidence when migrating to a complex ERP system. Running both the legacy and new ERP systems simultaneously allows users to compare outputs, validate data accuracy and completeness, and build confidence in the new system before full cutover. This approach provides direct evidence that the new system produces correct results and allows immediate fallback if issues are discovered. User confidence is maximized because they can independently verify correctness.
Why the other options are wrong
- A. User acceptance testing validates functionality but does not provide ongoing assurance during the actual migration and transition period.
- C. Phased changeover reduces risk but extends the migration timeline and does not provide the immediate comparative assurance of parallel processing.
- D. Pilot testing in one area provides localized validation but not the comprehensive assurance across the full user base that parallel processing delivers.
Question 413
Which of the following is the MOST reliable way for an IS auditor to evaluate the operational effectiveness of an organization's data loss prevention (DLP) controls?
Show answer and explanation
Correct answer: B. Verify that confidential files cannot be transmitted to a personal USB device.
The most reliable way to evaluate operational effectiveness is to conduct actual testing of the controls in action. Verifying that confidential files cannot be transmitted to a personal USB device is a practical, hands-on test that directly measures whether the DLP control is functioning as intended in real-world scenarios. Option A relies on interviews which may not reflect actual system performance. Option C only confirms installation, not effectiveness. Option D reviews classification standards but doesn't test actual DLP enforcement.
Why the other options are wrong
- A. Interviews identify vulnerabilities but do not directly test whether DLP controls are actually preventing data loss in practice.
- C. Verifying software installation only confirms the tool exists, not that it is operationally effective at preventing data loss.
- D. Reviewing data classification practices does not evaluate whether DLP controls are actually working to prevent unauthorized data transmission.
Question 414
What should an IS auditor do FIRST upon discovering that a service provider did not notify its customers of a security breach?
Show answer and explanation
Correct answer: D. Notify audit management of the finding.
When an IS auditor discovers a significant compliance or security issue such as failure to notify customers of a breach, the FIRST step is to notify audit management through proper internal channels. This allows management to determine appropriate remediation steps, escalation to legal/compliance, and notification strategies. Notifying law enforcement or the media directly, or issuing the report without internal notification, bypasses the proper governance structure and could expose the organization to additional liability.
Why the other options are wrong
- A. Notifying law enforcement is premature and not the auditor's direct responsibility; management must coordinate this response.
- B. Requiring notification without management approval and coordination is outside the auditor's authority.
- C. Issuing the audit report before management notification violates proper audit governance and internal reporting protocols.
Question 415
Capacity management enables organizations to:
Show answer and explanation
Correct answer: C. identify the extent to which components need to be upgraded.
Capacity management is the IT service management practice of ensuring IT infrastructure and resources are sufficient to meet current and future demand. Its primary purpose is to identify when components, systems, or infrastructure are approaching limits and need upgrades to maintain performance. This enables proactive planning for technology investments. While capacity management may involve network capacity and inform business discussions, its core function is identifying upgrade needs before capacity constraints impact service delivery.
Why the other options are wrong
- A. While capacity management includes network considerations, it does not specifically 'establish' network capacity; it monitors and forecasts needs.
- B. Forecasting technology trends is strategic planning, not the core function of capacity management, which focuses on existing infrastructure adequacy.
- D. Determining business transaction volumes is part of capacity planning input, but capacity management's primary output is identifying upgrade needs, not measuring transaction volumes.
Question 416
Which of the following is the PRIMARY benefit of performing a maturity model assessment?
Show answer and explanation
Correct answer: C. It acts as a measuring tool and progress indicator.
The primary benefit of a maturity model assessment is that it acts as a measuring tool to evaluate current state and a progress indicator to track improvements over time. While it may identify weaknesses and facilitate improvement planning, the fundamental purpose is to measure and benchmark current capabilities against a standardized scale and monitor progress toward higher maturity levels. This measurement and tracking function is the core benefit that enables all other improvements.
Why the other options are wrong
- A. Identifying weaknesses is a secondary output, not the primary benefit; identification alone without measuring progress is incomplete.
- B. Facilitating improvement planning is a use of the assessment results, not the primary benefit of the assessment itself.
- D. Ensuring organizational consistency is an outcome of improvements, not the primary benefit of conducting the assessment.
Question 417
Which of the following is MOST useful for determining whether the goals of IT are aligned with the organization's goals?
Show answer and explanation
Correct answer: C. Balanced scorecard
A balanced scorecard is most useful for determining alignment between IT and organizational goals because it provides a structured framework that translates organizational strategy into measurable objectives across multiple perspectives (financial, customer, internal processes, and learning). It directly measures how IT contributes to overall business goals, whereas other options provide tools for different purposes such as planning, measurement, or visualization.
Why the other options are wrong
- A. Enterprise architecture focuses on technical structure and design rather than measuring strategic alignment.
- B. KPIs measure performance of specific metrics but do not inherently establish the relationship between IT and organizational goals.
- D. Enterprise dashboards visualize data and metrics but do not provide the strategic framework needed to determine goal alignment.
Question 418
For an organization that has plans to implement web-based trading, it would be MOST important for an IS auditor to verify the organization's information security plan includes:
Show answer and explanation
Correct answer: C. security requirements for the new application.
When implementing a web-based trading system, security requirements for the new application are the most critical element to verify is included in the information security plan. This encompasses authentication, encryption, data protection, and transaction integrity requirements specific to the trading application's unique risks and regulatory obligations. Security requirements drive all subsequent implementation decisions and controls.
Why the other options are wrong
- A. Security training is important but is a supporting activity, not as fundamental as defining the application's security requirements.
- B. Firewall configuration is a tactical control implementation detail that should be derived from security requirements, not the primary focus for verification.
- D. Password attributes are a component of access control but are too narrow in scope compared to comprehensive security requirements for a trading application.
Question 419
For the implementation of a program change in a production environment, the MOST important approval required is from:
Show answer and explanation
Correct answer: C. user management
User management approval is the most critical because users are the owners of business processes and can assess whether a change will negatively impact operations, functionality, or business goals. Users understand business requirements and can determine if the change aligns with business needs and acceptable risk levels. Without user approval, technically sound changes may create business disruptions.
Why the other options are wrong
- A. Security administrator approval is important for security review but does not represent the business owner perspective needed to assess operational impact.
- B. Project manager approval relates to project governance but not to whether the change should proceed in production from a business standpoint.
- D. IS management approval is important but represents the IT perspective, whereas user management represents the business impact perspective.
Question 420
Which of the following is the BEST way to address potential data privacy concerns associated with inadvertent disclosure of machine identifier information contained within security logs?
Show answer and explanation
Correct answer: B. Limit the use of logs to only those purposes for which they were collected.
Limiting the use of logs to only those purposes for which they were collected is the best way to address data privacy concerns. This principle of purpose limitation prevents inadvertent disclosure and unauthorized use of sensitive machine identifier information. By restricting usage to legitimate business purposes identified during collection, organizations minimize privacy risks and maintain compliance with data protection standards.
Why the other options are wrong
- A. Collecting only from business-critical servers does not address the privacy concern of inadvertent disclosure of machine identifiers already in logs.
- C. Limiting collection to periods of increased security activity does not address privacy concerns about data already collected and does not prevent misuse.
- D. Restricting transfer to online storage does not address privacy concerns related to the content of logs or how they are used once collected.
Question 421
When assessing whether an organization's IT performance measures are comparable to other organizations in the same industry, which of the following would be MOST helpful to review?
Show answer and explanation
Correct answer: C. Benchmarking surveys
Benchmarking surveys are specifically designed to compare an organization's IT performance metrics against industry peers and competitors. They provide external reference points to determine relative performance levels. While balanced scorecards measure internal performance, IT governance frameworks establish processes, and utilization reports track resource usage, none directly answer whether the organization is comparable to industry standards.
Why the other options are wrong
- A. A balanced scorecard measures internal performance against organizational objectives, not industry comparisons.
- B. IT governance frameworks establish processes and controls but do not provide industry comparison data.
- D. Utilization reports track internal resource usage but lack external industry comparison context.
Question 422
Following a recent internal data breach, an IS auditor was asked to evaluate information security practices within the organization. Which of the following findings would be MOST important to report to senior management?
Show answer and explanation
Correct answer: B. Security education and awareness workshops have not been completed.
Following a data breach, security education and awareness gaps are the most critical finding to report because human behavior and user awareness are fundamental to preventing future breaches. This represents a systemic control weakness affecting all employees. While password complexity standards (Option D) are important technical controls, they are more easily remediated. Lack of technical knowledge and non-compete agreements are less directly related to preventing the type of breach that occurred.
Why the other options are wrong
- A. Non-compete agreements address employee retention and competitive risk, not information security practices.
- C. While technical knowledge is valuable, the breach typically indicates a procedural or awareness failure rather than technical knowledge gaps.
- D. Password complexity is a technical control issue, but security awareness and education address the behavioral root causes of most breaches.
Question 423
An organization has adopted a backup and recovery strategy that involves copying on-premise virtual machine (VM) images to a cloud service provider. Which of the following provides the BEST assurance that VMs can be recovered in the event of a disaster?
Show answer and explanation
Correct answer: B. Periodic on-site restoration of VM images obtained from the cloud provider
Periodic on-site restoration testing of VM images from the cloud provider is the only option that validates the entire recovery process end-to-end. Testing actual restoration proves that backups are viable, recovery procedures work, and the organization can genuinely recover in a disaster. A DRP is necessary but insufficient without testing; storage procurement ensures capacity but not recoverability; and audit rights don't validate functional recovery capability.
Why the other options are wrong
- A. A DRP with defined roles is essential governance but does not guarantee the technical ability to actually restore VMs.
- C. Adequate storage capacity is a prerequisite but does not assure the backups can be successfully restored.
- D. Audit rights in the contract provide oversight but do not directly test or validate recovery capability.
Question 424
Which of the following is the PRIMARY reason for using a hash function?
Show answer and explanation
Correct answer: A. To verify the integrity of data
The primary reason for using a hash function is to verify data integrity. Hash functions produce a fixed-length digest of data; if the data is altered, the hash changes, enabling detection of unauthorized modifications. Option B conflates hashing with encryption; hashing is not suitable for encrypting keys. Option C describes a use case but not the primary purpose. Option D relates to authentication/authorization, not the core cryptographic function of hashing.
Why the other options are wrong
- B. Hash functions are not encryption mechanisms and should not be used to encrypt private keys; encryption algorithms serve that purpose.
- C. While hash functions do create fixed-length values, this is a characteristic rather than the primary reason for their use.
- D. Hash functions support authentication and integrity but authorization is a separate security function.
Question 425
An IS auditor finds ad hoc vulnerability scanning is in place with no clear alignment to the organization's wider security threat and vulnerability management program. Which of the following would BEST enable the organization to work toward improvement in this area?
Show answer and explanation
Correct answer: C. Using a capability maturity model to identify a path to an optimized program
Using a capability maturity model (CMM) provides a structured framework to assess the current state of vulnerability management and identify a roadmap toward optimization. CMMs define progressive levels of sophistication and help organizations understand gaps between ad hoc processes and mature programs. Outsourcing (A) avoids addressing the alignment issue, maintaining a catalog (B) is a tactical tool rather than a strategic improvement framework, and security logging (D) addresses detection but not program structure or alignment.
Why the other options are wrong
- A. Outsourcing transfers the function but does not address the root issue of lack of alignment and structure within the organization.
- B. Maintaining a vulnerability catalog is a component of a mature program but does not provide the framework needed to improve overall capability.
- D. Security logging improves detection capabilities but does not establish the strategic alignment and programmatic structure needed.
Question 426
Coding standards provide which of the following?
Show answer and explanation
Correct answer: C. Field naming conventions
Coding standards provide field naming conventions that establish consistent naming practices across applications and systems. This promotes code readability, maintainability, and reduces errors from inconsistent variable or field naming. Field naming conventions are a core element of coding standards that developers follow during application development.
Why the other options are wrong
- A. Access control tables are security controls, not part of coding standards.
- B. Data flow diagrams are system design artifacts, not a component of coding standards.
- D. Program documentation is generated from code but is not itself a coding standard convention.
Question 427
An IS auditor performing an application development review attends development team meetings. The IS auditor's independence will be compromised if the IS auditor:
Show answer and explanation
Correct answer: D. designs and executes the user's acceptance test plan.
An IS auditor's independence is compromised if the auditor designs and executes the user's acceptance test plan. This represents active participation in the system development and validation process, placing the auditor in the position of being responsible for assurance of work they themselves performed. This creates a conflict of interest and violates the principle of independent audit, the auditor cannot objectively evaluate controls and processes they have directly designed or implemented.
Why the other options are wrong
- A. Assisting in developing an ITF is a technical support activity that may compromise independence but is less directly problematic than designing UAT.
- B. Re-performing test procedures conducted by the development team is a standard audit procedure and demonstrates independent verification.
- C. Reviewing the results of system tests performed by others is within the auditor's role and does not compromise independence.
Question 428
An information systems security officer's PRIMARY responsibility for business process applications is to:
Show answer and explanation
Correct answer: C. ensure access rules agree with policies.
The primary responsibility of an information systems security officer regarding business process applications is to ensure that access rules align with and support the organization's established security policies. This involves validating that access controls are implemented consistently with policy requirements, which is the core security governance function. The other options represent either subordinate activities or functions outside the primary responsibility.
Why the other options are wrong
- A. Creating role-based rules is an implementation task, not the primary responsibility of oversight.
- B. Policy approval is typically a senior management or board function, not the security officer's primary role.
- D. Authorizing emergency access is an operational task, not the primary responsibility.
Question 429
An employee transfers from an organization's risk management department to become the lead IS auditor. While in the risk management department, the employee helped develop the key performance indicators (KPIs) now used by the organization. Which of the following would pose the GREATEST threat to the independence of this auditor?
Show answer and explanation
Correct answer: A. Evaluating the effectiveness of IT risk management processes
Evaluating the effectiveness of IT risk management processes poses the greatest threat to independence because the auditor previously helped develop the KPIs used to measure those processes. This creates a self-review threat where the auditor would be evaluating work they helped create, which undermines the objective assessment required of an auditor. Recommending controls (option B) addresses identified risks but doesn't directly evaluate the auditor's previous work. Developing new KPIs (option C) and training (option D) involve forward-looking work, not evaluation of the auditor's prior contributions, making them less threatening to independence than assessing the effectiveness of controls the auditor helped establish.
Why the other options are wrong
- B. Recommending controls to address identified risks is an appropriate auditor function and does not directly evaluate the auditor's previous work.
- C. Developing new KPIs for the audit team is future-oriented work that does not involve reviewing the auditor's prior contributions to risk management.
- D. Training on IT risk management processes is an educational function that does not require the auditor to evaluate their own previous work.
Question 430
Management has asked internal audit to prioritize and perform a specialized cybersecurity audit, but the IS audit team has no experience in this area. Which of the following is the BEST course of action?
Show answer and explanation
Correct answer: C. Perform the audit as requested using third-party support.
When internal audit lacks expertise in a specialized area but management has prioritized an audit, the best course of action is to proceed with the audit using third-party support. This allows the audit to be performed as requested without unnecessary delay while ensuring appropriate expertise is applied. Using external specialists maintains audit quality and schedule.
Why the other options are wrong
- A. Delaying indefinitely for training is impractical and fails to meet management's priority.
- B. Waiting to hire an experienced auditor causes extended delay when expert support can be engaged immediately.
- D. Using only the most experienced internal auditors without external support may still leave a significant expertise gap in specialized cybersecurity matters.
Question 431
Which of the following is the BEST way to ensure payment transaction data is restricted to the appropriate users?
Show answer and explanation
Correct answer: A. Implementing role-based access at the application level
Role-based access control (RBAC) at the application level is the most effective and comprehensive approach to restricting payment transaction data because it enforces access restrictions based on user roles and responsibilities at the point where transactions are processed. This ensures only authorized users can access specific transaction types and data. Network security software operates at a different layer and lacks the granular control needed for application-specific data restrictions. A single menu does not provide proper access control, and two-factor authentication addresses authentication strength rather than authorization to specific data.
Why the other options are wrong
- B. Network security software controls connectivity but cannot enforce granular application-level access restrictions.
- C. A single menu approach does not prevent unauthorized access to sensitive transactions.
- D. Two-factor authentication improves authentication but does not restrict which users can access which transactions.
Question 432
An organization is planning to re-purpose workstations that were used to handle confidential information. Which of the following would be the IS auditor's BEST recommendation to dispose of this information?
Show answer and explanation
Correct answer: A. Overwrite the disks with random data.
Overwriting disks with random data is the most reliable method to ensure confidential information cannot be recovered. This method physically overwrites all data sectors, making data recovery impossible even with forensic tools. While degaussing (C) can work for magnetic media, it may not be suitable for all modern storage types. Reformatting (B) and deleting partitions (D) only remove logical references to data but leave the actual data intact and recoverable.
Why the other options are wrong
- B. Reformatting only removes the file system structure but leaves data recoverable with forensic tools.
- C. Degaussing may damage equipment and is less effective on modern SSDs and encrypted storage.
- D. Deleting partitions only removes logical pointers; the underlying data remains on the disk and can be recovered.
Question 433
Which of the following should be defined in an audit charter?
Show answer and explanation
Correct answer: B. Audit authority
Audit authority should be defined in an audit charter. The charter establishes the auditor's independence, reporting relationships, and power to access information and personnel necessary to conduct audits. Audit authority is a foundational element that enables the audit function to operate effectively and credibly within the organization.
Why the other options are wrong
- A. Audit methodology is typically detailed in audit standards and procedures, not the charter itself.
- C. Audit results are outputs from conducting audits, not content defined in the charter.
- D. While an audit schedule may be referenced, it is too operational and detailed for the charter document.
Question 434
Which of the following is MOST important to review when evaluating the performance of a critical web application?
Show answer and explanation
Correct answer: A. Business-defined application response times
Business-defined application response times represent the actual performance requirements that the business needs met. This is the baseline against which all application performance must be measured to ensure it meets business objectives. While other factors provide context, the specific performance targets defined by the business are what determine whether the critical application is actually performing adequately for its intended purpose.
Why the other options are wrong
- B. Customer satisfaction surveys are subjective feedback that may not align with actual performance metrics or technical requirements.
- C. Roles and responsibilities for reporting are administrative process matters, not performance evaluation itself.
- D. Cloud monitoring strategy is a tool consideration; the actual business response time requirements are more fundamental to evaluation.
Question 435
Which of the following is the BEST point in time to conduct a post-implementation review (PIR)?
Show answer and explanation
Correct answer: C. After a full processing cycle
A post-implementation review should be conducted after a full processing cycle to allow sufficient time for the application to operate under normal and varied conditions, enabling auditors to assess whether controls function effectively throughout all business scenarios and cycles. This timing provides more reliable data than immediate deployment and captures real-world performance better than an arbitrary timeline like six weeks.
Why the other options are wrong
- A. Aligning to an annual cycle ignores the need for timely assessment and may delay critical reviews.
- B. Immediately after deployment provides insufficient operational data to properly evaluate control effectiveness.
- D. Six weeks is arbitrary and may not align with the application's actual processing cycles or business requirements.
Question 436
An emergency power-off switch should:
Show answer and explanation
Correct answer: C. be protected.
An emergency power-off switch should be protected to prevent accidental or unauthorized activation that could disrupt critical operations. Protection mechanisms such as covers or guarding ensure that the switch can only be used in genuine emergencies. A protected switch balances accessibility for legitimate emergency use with protection against inadvertent or malicious activation.
Why the other options are wrong
- A. The switch should be in the computer room where critical equipment is located so it can be activated quickly in an emergency.
- B. The switch must be identified and clearly marked so authorized personnel can locate it immediately during an emergency.
- D. While illumination could be helpful, protection is the primary requirement; illumination is secondary to preventing accidental activation.
Question 437
An organization that has decided to approve the use of end-user computing (EUC) should FIRST ensure:
Show answer and explanation
Correct answer: A. an EUC policy is developed.
Developing an EUC policy must be the first step because it establishes the governance framework, acceptable use standards, and control requirements for the entire program. The policy provides the foundation for all subsequent decisions, including what controls are appropriate, what use cases are acceptable, and how the program will be managed. Without a policy in place, approval of EUC use would lack clear guidelines and governance structure.
Why the other options are wrong
- B. Reviewing existing controls is premature before establishing policy requirements that define what controls should exist.
- C. Business impact analysis is important for specific use cases but comes after establishing the policy framework that governs EUC.
- D. Assessing use cases and documentation follows policy development because the policy establishes the criteria for assessment.
Question 438
Which type of attack poses the GREATEST risk to an organization's most sensitive data?
Show answer and explanation
Correct answer: B. Insider attack
Insider attacks pose the greatest risk to sensitive data because insiders have legitimate access, deep knowledge of security controls, and understanding of where valuable data resides. They can bypass many external defenses and are difficult to detect. While other attacks are serious, insiders can cause the most comprehensive and damaging breaches with the highest confidence of success.
Why the other options are wrong
- A. Spear phishing requires successful user deception and can be mitigated by security awareness training.
- C. Password attacks can be defended against through strong password policies and multi-factor authentication.
- D. Eavesdropping can be prevented through encryption and secure communication protocols.
Question 439
During the implementation of a new system, an IS auditor must assess whether certain automated calculations comply with the regulatory requirements. Which of the following is the BEST way to obtain this assurance?
Show answer and explanation
Correct answer: A. Re-perform the calculation with audit software.
Re-performing calculations with audit software provides direct, independent verification that the automated calculations produce compliant results. This is the most reliable audit technique for assessing accuracy and compliance of calculations. Reviewing source code verifies logic but not actual execution; sign-offs indicate approval but not compliance accuracy; and UAT results show functional testing but may not specifically verify regulatory compliance calculations.
Why the other options are wrong
- B. Source code review can identify logical errors but does not directly verify that calculations actually produce compliant results in practice.
- C. Sign-off documentation shows approval decisions but provides no assurance that calculations actually comply with regulatory requirements.
- D. UAT results demonstrate system functionality but do not specifically verify regulatory compliance of calculations.
Question 440
An externally facing system containing sensitive data is configured such that users have either read-only or administrator rights. Most users of the system have administrator access. Which of the following is the GREATEST risk associated with this situation?
Show answer and explanation
Correct answer: A. Users can make unauthorized changes.
The greatest risk when most users have administrator access is unauthorized changes to the system. Administrator rights allow users to modify configurations, settings, and data, which directly violates the principle of least privilege. While option D (viewing sensitive data) is also possible with admin access, the question emphasizes the configuration flaw itself, excessive administrative privileges, which creates the highest risk for unauthorized modifications. The primary concern from a security standpoint is preventing uncontrolled changes to a sensitive system.
Why the other options are wrong
- B. Exporting logs is a secondary concern and not the primary risk from excessive admin access.
- C. Installing open-licensed software is less critical than preventing unauthorized system changes.
- D. While admins can view sensitive data, the configuration flaw's greatest risk is enabling unauthorized changes, not data viewing.
Question 441
A disaster recovery plan (DRP) should include steps for:
Show answer and explanation
Correct answer: C. obtaining replacement supplies
A disaster recovery plan must include practical steps for obtaining replacement supplies and resources needed to restore operations after a disaster. This is an essential operational component of the recovery process. Risk assessment and quantification occur before DRP development as part of the business continuity planning methodology, not as DRP steps themselves. Contract negotiation is a preparatory activity, and application control requirements are part of system design, not DRP steps.
Why the other options are wrong
- A. Negotiating contracts with consultants is preparatory work before DRP development, not a step within the DRP itself.
- B. Identifying application control requirements is part of system design and audit scope, not a DRP step.
- D. Risk assessment occurs before DRP development to justify the plan; it is not a step within the DRP execution.
Question 442
On a public-key cryptosystem when there is no previous knowledge between parties, which of the following will BEST help to prevent one person from using a fictitious key to impersonate someone else?
Show answer and explanation
Correct answer: A. Send a certificate that can be verified by a certification authority with the public key.
A digital certificate issued and verified by a trusted certification authority (CA) provides cryptographic proof of identity binding the public key to the owner. The CA's verification ensures that the public key truly belongs to the claimed individual, preventing impersonation through fictitious keys. This is the fundamental solution to the identity verification problem in public-key systems without prior knowledge. The certificate can be verified by checking the CA's digital signature, establishing a chain of trust.
Why the other options are wrong
- B. Encrypting the sender's public key with the recipient's public key does not verify the sender's identity or prevent impersonation.
- C. Sending the public key prior to connection does not authenticate whose key it actually is or prevent someone from substituting a fictitious key.
- D. Using a private-key cryptosystem for the public key does not provide verification that the key belongs to the claimed party and undermines the public-key system's advantages.
Question 443
An IS auditor should ensure that an application's audit trail:
Show answer and explanation
Correct answer: A. has adequate security.
An application's audit trail must have adequate security controls to ensure its integrity, confidentiality, and availability. If the audit trail is not properly secured, it can be tampered with, deleted, or compromised, which destroys its evidentiary value and undermines the ability to detect fraud or unauthorized activities. Adequate security includes access restrictions, encryption, and immutability protections. While online accessibility, operational efficiency, and comprehensive logging are relevant considerations, they are secondary to ensuring the audit trail itself cannot be compromised.
Why the other options are wrong
- B. While online accessibility may be convenient, audit trails can be accessed offline or through controlled secure channels; accessibility is less critical than security.
- C. Although operational efficiency matters, security controls cannot be compromised for performance; security is the priority.
- D. Logging all database records is important for completeness but is not as critical as ensuring the logs that are created cannot be altered or destroyed.
Question 444
Evaluating application development projects against a defined maturity model enables an IS auditor to determine whether:
Show answer and explanation
Correct answer: C. the development function follows a robust process
A maturity model evaluation determines whether the development function follows a robust, well-defined process. Maturity models (such as CMMI) assess the sophistication and effectiveness of development processes themselves, how standardized, repeatable, and controlled they are. While a robust process may lead to better security and outcomes, the direct assessment of a maturity model measures process robustness and efficiency, not the achievement of specific objectives.
Why the other options are wrong
- A. Security requirements are one aspect evaluated within a process, but maturity models assess overall process robustness, not specific security design effectiveness.
- B. While maturity models can inform efficiency, their primary purpose is assessing process robustness and capability levels, not just efficiency.
- D. Maturity models evaluate process capability, not the probability of meeting specific project objectives, which depend on many other factors beyond process maturity.
Question 445
Invoking a business continuity plan (BCP) is demonstrating which type of control?
Show answer and explanation
Correct answer: B. Corrective
A business continuity plan represents a corrective control because it is invoked after a disruption has occurred to restore business operations and minimize impact. Corrective controls address problems after they happen. Preventive controls stop problems before they occur, detective controls identify problems, and directive controls guide behavior, none of these accurately describe BCP invocation.
Why the other options are wrong
- A. Preventive controls prevent incidents from occurring; BCP is triggered after an incident has already disrupted operations.
- C. Directive controls guide or mandate behavior; BCP execution is reactive, not prescriptive in nature.
- D. Detective controls identify that something has gone wrong; BCP implements recovery after detection.
Question 446
Which of the following would BEST demonstrate that an effective disaster recovery plan (DRP) is in place?
Show answer and explanation
Correct answer: A. Full operational test
A full operational test (also called a full-scale or full simulation test) most effectively demonstrates that a DRP is truly effective because it actually executes the recovery plan in a realistic environment, identifying gaps and validating actual recovery times and procedures. Annual walk-throughs are less rigorous, periodic risk assessments don't test the plan itself, and backup testing only addresses one component. Only a full operational test provides definitive proof that the entire plan works end-to-end.
Why the other options are wrong
- B. Periodic risk assessment identifies vulnerabilities but does not test whether the DRP actually functions or works.
- C. Annual walk-through testing is less comprehensive than full operational testing and does not validate actual system recovery.
- D. Frequent backup testing validates only one component of the DRP, not the completeness of the entire recovery process.
Question 447
While reviewing an organization's business continuity plan (BCP), an IS auditor observes that a recently developed application is not included. The IS auditor should:
Show answer and explanation
Correct answer: A. ensure that the criticality of the application is determined.
The IS auditor should ensure that the criticality of the application is determined first because not all applications are mission-critical and warrant inclusion in the BCP. The proper audit procedure is to assess and document the application's business impact before concluding the BCP is incomplete or making recommendations, ensuring decisions are based on actual risk assessment rather than assumptions.
Why the other options are wrong
- B. Immediately reporting the BCP as incomplete is premature without first determining whether the application is actually critical enough to warrant BCP inclusion.
- C. Recommending inclusion without first assessing criticality could lead to unnecessary BCP expansion or could miss that the application truly is critical.
- D. Ignoring the observation violates the auditor's duty to evaluate risk; criticality should be determined objectively rather than assumed.
Question 448
Which of the following BEST describes an audit risk?
Show answer and explanation
Correct answer: A. The financial report may contain undetected material errors.
Audit risk is the risk that an auditor will fail to detect material errors or misstatements in financial reports. It represents the possibility that the audit opinion is incorrect because errors went undetected despite the audit process. This is the technical definition of audit risk in the context of IT and financial auditing standards.
Why the other options are wrong
- B. Employee misappropriation of funds is an inherent risk or fraud risk within the organization, not the audit risk itself.
- C. Being sued for false accusations is a business or legal risk, not audit risk.
- D. Employees not taking vacation may be an indicator of control weakness, but it is not a definition of audit risk.
Question 449
Which of the following is the BEST method to safeguard data on an organization's laptop computers?
Show answer and explanation
Correct answer: B. Full disk encryption
Full disk encryption is the best method to safeguard laptop data because it protects data at rest, which is the primary vulnerability for mobile devices that can be stolen or lost. Encryption renders data unreadable without the encryption key regardless of physical access. Two-factor authentication (A) primarily protects access to accounts but doesn't protect stored data; disabled USB ports (C) prevents some attack vectors but not theft or loss; biometric access (D) is a good control but encryption provides stronger data protection if the device is compromised.
Why the other options are wrong
- A. Two-factor authentication protects account access but doesn't protect data stored on the laptop if the device is physically stolen.
- C. Disabling USB ports prevents certain attack vectors but doesn't protect data if the entire laptop is lost or stolen.
- D. Biometric controls are valuable for authentication but don't protect data confidentiality if the device is compromised; encryption is more fundamental.
Question 450
A legacy application is running on an operating system that is no longer supported by the vendor. If the organization continues to use the current application, which of the following should be the IS auditor's GREATEST concern?
Show answer and explanation
Correct answer: A. Potential exploitation of zero-day vulnerabilities in the system
The auditor's greatest concern with running a legacy application on unsupported operating systems is the potential for exploitation of zero-day vulnerabilities. Without vendor support, security patches are unavailable, leaving the system exposed to both known and unknown vulnerabilities. This creates significant security risk that directly impacts confidentiality, integrity, and availability of systems and data.
Why the other options are wrong
- B. Database updates are a functionality concern, not the primary security risk.
- C. Maintenance costs are an operational concern but secondary to security risks.
- D. License issues are contractual concerns, not the primary risk to system security.
Question 451
Which of the following is the PRIMARY purpose of conducting an IS audit follow-up?
Show answer and explanation
Correct answer: C. To determine the effectiveness of management's responses to risk
The primary purpose of conducting an IS audit follow-up is to determine the effectiveness of management's responses to risk. Follow-up audits assess whether the corrective actions and remediation measures that management implemented actually resolved the identified control deficiencies and reduced associated risks to acceptable levels.
Why the other options are wrong
- A. Aligning IS audit activities with business objectives is a planning consideration, not the purpose of follow-up audits.
- B. While follow-up may inform prioritization, determining the effectiveness of management's responses is the primary purpose.
- D. Obtaining agreement on action plan status is useful but is a secondary administrative objective compared to assessing effectiveness of risk mitigation.
Question 452
Which of the following is the GREATEST risk associated with conducting penetration testing on a business-critical application production environment?
Show answer and explanation
Correct answer: B. Data integrity may become compromised.
The greatest risk of penetration testing on production business-critical applications is compromising data integrity. Actual attacks and exploitations conducted in the live environment could inadvertently corrupt, modify, or delete real data, resulting in immediate business harm. While test environments may differ in results and advance notification is important, the actual compromise of production data is the most severe consequence that could directly impact the organization's operations and data.
Why the other options are wrong
- A. Results differing from test environments is a known limitation of penetration testing, not a risk of the testing itself.
- C. Lack of advance notification is a procedural concern, not the greatest risk to the system itself.
- D. Audit standards compliance is a governance concern, not the primary operational risk to the production environment.
Question 453
Which of the following presents the GREATEST challenge to the alignment of business and IT?
Show answer and explanation
Correct answer: D. Lack of chief information officer (CIO) involvement in board meetings
CIO involvement in board meetings is critical for business-IT alignment because the board sets overall organizational strategy and makes strategic decisions. Without CIO participation at this level, IT strategy cannot be effectively informed by and integrated with business strategy, creating a fundamental misalignment gap. While the other options present challenges (security involvement, committee structure, budget constraints), the absence of IT leadership in top-level strategic discussions represents the greatest structural barrier to alignment.
Why the other options are wrong
- A. While security involvement in strategy is important, its absence is less critical to overall business-IT alignment than lack of IT leadership presence.
- B. A CIO-chaired IT steering committee actually supports alignment rather than hindering it, though ideally business representatives should also be well-represented.
- C. Budget constraints are a practical challenge but can be managed through better prioritization; lack of strategic involvement is a deeper alignment problem.
Question 454
When reviewing the functionality of an intrusion detection system (IDS), the IS auditor should be MOST concerned if:
Show answer and explanation
Correct answer: D. actual attacks have not been identified.
An IS auditor should be MOST concerned if actual attacks have not been identified because this represents a fundamental failure of the IDS, the system is not detecting real threats that are occurring. This is a critical security gap. In contrast, increased legitimate packets being blocked (A) and false positives (B) are operational issues that impact usability but not detection capability, and increased detected events (C) actually suggests the system is functioning. A system that misses actual attacks cannot fulfill its core purpose regardless of other metrics.
Why the other options are wrong
- A. Blocking legitimate packets is a usability and operational concern but doesn't indicate the IDS is failing to detect actual threats.
- B. False positives generate alert fatigue and operational burden but are less critical than missing actual attacks.
- C. Increased detected events suggests the IDS is actively identifying potential threats, which is a positive indicator.
Question 455
An IS auditor has found that a vendor has gone out of business and the escrow has an older version of the source code. What is the auditor's BEST recommendation for the organization?
Show answer and explanation
Correct answer: A. Perform an analysis to determine the business risk.
When a vendor goes out of business and only an older source code version is available via escrow, the auditor's best initial recommendation is to perform a business risk analysis to determine the organization's exposure and strategic options. This assessment will inform whether the organization should attempt to maintain the application, invest in modernization, seek alternative solutions, or accept the risk. This is the foundational step that should precede any specific remediation action.
Why the other options are wrong
- B. Developing a maintenance plan without assessing risk first may commit resources to an unviable solution.
- C. Bringing escrow code up to date is resource-intensive and may not be feasible or the best use of resources until risks are understood.
- D. Analyzing a new application skips the critical step of determining whether this level of investment is warranted.
Question 456
Which of the following are used in a firewall to protect the entity’s internal resources?
Show answer and explanation
Correct answer: C. Internet Protocol (IP) address restrictions
IP address restrictions are a fundamental firewall control that protects internal resources by allowing only traffic from approved source addresses to reach protected systems. Failover services (A) relate to availability rather than firewall protection, remote access servers (B) are separate infrastructure components, and SSL (D) is an encryption protocol used with firewalls but not intrinsically part of the firewall's protection mechanism itself.
Why the other options are wrong
- A. Failover services provide redundancy and availability, not the primary protection mechanism of a firewall.
- B. Remote access servers are a separate infrastructure component, not a firewall protection mechanism.
- D. SSL provides encryption for data in transit but is not a firewall-specific protection control.
That was 456 of 1,823.
The full ISACA CISA pack has all 1,823 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 911 free as one PDF by email. Get the Half Pack →