100 Free CISA Practice Questions and Answers
100 questions for the CISA exam, each answer explained. Watch it here, try the questions yourself, or read the transcript.
Questions in this video
Tap an answer to see why it is right or wrong. Tap it again to reset.
Question 1 Play from 00:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Compliance with data classification policy is important but is a procedural outcome rather than the fundamental security reason.
Right, B is the answer.
Why B is right
The most important reason to classify a DRP as confidential is to reduce the risk of data leakage that could lead to an attack. A DRP contains critical infrastructure information, recovery procedures, failover locations, and system dependencies. If this plan were disclosed to malicious actors, they could exploit recovery procedures, target backup facilities, or time attacks to coincide with recovery windows. Preventing this disclosure is the primary security objective.
Not this one. Try another answer.
Why C is wrong
Business continuity best practice includes many elements beyond just confidentiality classification.
Not this one. Try another answer.
Why D is wrong
While protecting from unauthorized alteration is important, it addresses integrity rather than the primary risk of disclosure-based attacks.
Question 2 Play from 02:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Vendor selection and statements of work can be performed by the same person as these are primarily planning activities.
Not this one. Try another answer.
Why B is wrong
Invoices and reconciliations, while related, do not create the same direct payment risk as receipt and payment combined.
Not this one. Try another answer.
Why C is wrong
Purchase requisitions and purchase orders are sequential procurement steps that can reasonably be combined.
Right, D is the answer.
Why D is right
Goods receipts and payments present the greatest segregation of duties conflict because one individual could receive goods without proper authorization, then approve and process payment without anyone verifying that goods were actually received or that the invoice matches the goods received. This creates opportunity for fraud involving non-receipt of goods, quantity discrepancies, or unauthorized payments. The combination of these two functions directly controls cash disbursement.
Question 3 Play from 03:53
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Open USB ports on end-user PCs present the greatest concern for data leakage because they allow unauthorized copying of sensitive data to external devices without restriction. This is a direct and critical threat to confidentiality and information security. While unauthorized software installation and personal devices are also risks, data leakage is the most severe and commonly exploited vulnerability.
Not this one. Try another answer.
Why B is wrong
USB connections are unlikely to cause data corruption; they are designed for reliable data transfer.
Not this one. Try another answer.
Why C is wrong
While unauthorized software installation is a risk, it is secondary to the immediate threat of data loss.
Not this one. Try another answer.
Why D is wrong
Connection of personal devices is a symptom of the larger risk, not the primary concern itself.
Question 4 Play from 05:33
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
IT and business goals not being well defined is the greatest concern because it undermines all IT governance activities. Without clear, aligned goals, the organization cannot effectively direct IT investments, measure performance, manage risks, or ensure IT strategy supports business objectives. This is a foundational governance issue.
Not this one. Try another answer.
Why B is wrong
IT reporting to the CFO is an organizational structure choice that does not inherently indicate poor governance; many organizations function effectively with this structure.
Not this one. Try another answer.
Why C is wrong
Missing meeting minutes is a documentation deficiency that is a compliance issue but does not reflect underlying governance effectiveness.
Not this one. Try another answer.
Why D is wrong
Using separate frameworks for security and operations can be appropriate depending on organizational needs and does not necessarily indicate poor governance if coordinated effectively.
Question 5 Play from 07:29
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
During a post-implementation review, the absence of a maintenance plan is the most critical concern because it indicates lack of planning for ongoing system support, updates, and issue resolution. Without a maintenance plan, the organization cannot sustain system performance, security, and compliance over time. While minor defects, deployment delays, and budget overruns are concerns, they do not pose the same level of operational risk as the lack of a formal maintenance framework.
Not this one. Try another answer.
Why B is wrong
Minor defects are typically expected and can be resolved through normal maintenance processes.
Not this one. Try another answer.
Why C is wrong
Deployment delays are historical issues that do not impact ongoing system operations post-implementation.
Not this one. Try another answer.
Why D is wrong
Budget overruns, while financially concerning, do not affect the system's ability to function and be maintained going forward.
Question 6 Play from 09:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Change request analysis is typically a technical IT function, though users may participate.
Not this one. Try another answer.
Why B is wrong
Providing unit test data is important but supporting rather than primary responsibility.
Not this one. Try another answer.
Why C is wrong
Documentation updates are important but occur after approval decisions and are secondary to the approval decision itself.
Right, D is the answer.
Why D is right
Approving changes before implementation is the user department's most critical responsibility because they understand business requirements and can determine whether proposed changes will meet functional needs and avoid negative business impact. This approval gate prevents technically approved but operationally inappropriate changes from being deployed. While user departments provide test data, analyze requests, and update documentation, these are supporting activities; approval authority ensures their interests are protected.
Question 7 Play from 11:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
DBAs legitimately need access to sensitive information to perform their duties; the issue is controlling and monitoring that access, not preventing it entirely.
Right, B is the answer.
Why B is right
A database administrator should be prevented from having end user responsibilities to maintain proper segregation of duties. DBAs require access to production files and sensitive data as part of their legitimate role, and emergency user IDs may be necessary for disaster recovery. However, combining DBA duties with end user responsibilities creates a conflict of interest and increases the risk of unauthorized modifications or data manipulation without proper oversight.
Not this one. Try another answer.
Why C is wrong
DBAs must have access to production files to perform backup, recovery, maintenance, and troubleshooting functions.
Not this one. Try another answer.
Why D is wrong
Emergency user IDs are a necessary control for business continuity and disaster recovery scenarios.
Question 8 Play from 13:03
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A software escrow agreement is the appropriate mechanism to ensure access to source code when the vendor becomes unavailable or fails to support the product. It protects the organization's ability to maintain and support the software independently. This directly addresses the identified gap of missing source code deliverables.
Not this one. Try another answer.
Why B is wrong
An SLA addresses service levels and uptime commitments, not source code access.
Not this one. Try another answer.
Why C is wrong
Confidentiality and data protection clauses govern data handling, not source code delivery or access.
Not this one. Try another answer.
Why D is wrong
A right-to-audit clause permits auditing of vendor processes but does not specifically secure source code access.
Question 9 Play from 14:45
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Management sign-off represents approval but not objective performance determination; it reflects management perspective rather than independent verification.
Not this one. Try another answer.
Why B is wrong
Capability maturity models provide a framework for assessment but do not directly measure or objectively determine performance metrics.
Not this one. Try another answer.
Why C is wrong
Control self-assessment questionnaires are self-reported and inherently subjective, lacking the independence needed for objective determination.
Right, D is the answer.
Why D is right
Recalculated Key Performance Indicators (KPIs) enable objective determination of performance because the auditor independently verifies and recalculates metrics based on raw data, rather than relying on management reports. This provides independent, factual measurement free from bias or management interpretation. Management sign-off is subjective approval, CSA questionnaires are self-assessment and inherently biased, and capability maturity models are frameworks for assessment rather than objective performance measurement tools.
Question 10 Play from 16:50
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Phased implementation is gradual but each phase displaces the previous system; there is no extended overlap.
Not this one. Try another answer.
Why B is wrong
Modular implementation involves deploying modules incrementally, not maintaining parallel full systems.
Not this one. Try another answer.
Why C is wrong
Pilot implementation tests on a limited user group before full deployment, not a long overlap period.
Right, D is the answer.
Why D is right
The parallel approach runs old and new systems simultaneously, providing the longest overlap period. This allows users to work with both systems concurrently, providing fallback capability and maximum validation time. Phased implementation is gradual but doesn't maintain full parallel operation. Modular and pilot approaches are narrower in scope and don't create extended overlap of complete systems.
Show all 100 questionsShow fewer questions
Question 11 Play from 18:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Access control tables are security controls, not part of coding standards.
Not this one. Try another answer.
Why B is wrong
Data flow diagrams are system design artifacts, not a component of coding standards.
Right, C is the answer.
Why C is right
Coding standards provide field naming conventions that establish consistent naming practices across applications and systems. This promotes code readability, maintainability, and reduces errors from inconsistent variable or field naming. Field naming conventions are a core element of coding standards that developers follow during application development.
Not this one. Try another answer.
Why D is wrong
Program documentation is generated from code but is not itself a coding standard convention.
Question 12 Play from 19:55
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
An IS development methodology must incorporate risk management techniques to identify, assess, and mitigate risks throughout the development lifecycle. This ensures that security, compliance, and operational risks are systematically addressed during system design and implementation. While access control and incident management are important IT controls, they are not core components of a development methodology itself. Value- added activity analysis relates to business process optimization rather than development methodology.
Not this one. Try another answer.
Why B is wrong
Access control rules are operational security controls, not part of the development methodology framework.
Not this one. Try another answer.
Why C is wrong
Value-added activity analysis pertains to business process improvement, not software development methodology.
Not this one. Try another answer.
Why D is wrong
Incident management techniques are post-deployment operational controls, not part of the development process.
Question 13 Play from 21:50
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Operator error logs indicate system issues but do not demonstrate that requirements have been met.
Not this one. Try another answer.
Why B is wrong
Documentation alone does not prove requirements are actually met in practice.
Right, C is the answer.
Why C is right
User Acceptance Testing (UAT) provides the best evidence that user requirements have been met because it involves actual end-users validating that the system meets their specified requirements through practical testing and sign-off, providing concrete evidence of requirement fulfillment.
Not this one. Try another answer.
Why D is wrong
Management interviews are subjective and lack the objective evidence that UAT results provide.
Question 14 Play from 23:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Running multiple versions of the same OS on one host is actually a benefit of virtualization, enabling flexibility and testing.
Right, B is the answer.
Why B is right
A significant concern with virtualization is that performance issues or failures on the host system can degrade or disable all guest operating systems running on that host. This creates a single point of failure where multiple systems depend on one physical host, concentrating risk. A host system experiencing resource contention, overload, or hardware failure impacts all virtual machines simultaneously, unlike traditional distributed physical servers.
Not this one. Try another answer.
Why C is wrong
Decreased physical footprint is a key advantage of virtualization, not a concern.
Not this one. Try another answer.
Why D is wrong
Shared processing capacity across multiple operating systems is the intended design benefit of virtualization, not a concern.
Question 15 Play from 25:23
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Scanning provides detection but not prevention; emails could still be sent unencrypted if scanning is the only control.
Right, B is the answer.
Why B is right
Blocking outbound emails sent without encryption is the BEST preventive control because it enforces a technical requirement that prevents sensitive data from leaving the organization unprotected. This control operates at the point of transmission and cannot be bypassed by user choice, making it a mandatory safeguard. Scanning emails detects issues after the fact, encryption solutions require user adoption, and phishing tests address a different threat vector.
Not this one. Try another answer.
Why C is wrong
Phishing tests address credential compromise, not sensitive data exfiltration via email.
Not this one. Try another answer.
Why D is wrong
Providing encryption solutions without enforcement allows users to opt out, leaving the organization vulnerable.
Question 16 Play from 27:12
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The impact if corrective actions are not taken is the most important consideration for scheduling follow-up audits. High-impact findings require prompt follow-up because delayed remediation exposes the organization to greater risk. Risk-based scheduling ensures resources are focused where they matter most. The auditor's agreement on time commitment is a logistical constraint but not the primary determinant. Verification efforts with new auditors are procedural considerations. While control and detection risks are relevant, they are secondary to understanding the business impact of unresolved issues.
Not this one. Try another answer.
Why B is wrong
Auditor time availability is a logistical matter, not the primary driver of follow-up scheduling decisions.
Not this one. Try another answer.
Why C is wrong
Verification procedures are implementation details, not the main factor in scheduling decisions.
Not this one. Try another answer.
Why D is wrong
Control and detection risks are relevant but secondary to assessing the impact of unresolved findings.
Question 17 Play from 29:11
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The primary reason for using a hash function is to verify data integrity. Hash functions produce a fixed-length digest of data; if the data is altered, the hash changes, enabling detection of unauthorized modifications. Option B conflates hashing with encryption; hashing is not suitable for encrypting keys. Option C describes a use case but not the primary purpose. Option D relates to authentication/authorization, not the core cryptographic function of hashing.
Not this one. Try another answer.
Why B is wrong
Hash functions are not encryption mechanisms and should not be used to encrypt private keys; encryption algorithms serve that purpose.
Not this one. Try another answer.
Why C is wrong
While hash functions do create fixed-length values, this is a characteristic rather than the primary reason for their use.
Not this one. Try another answer.
Why D is wrong
Hash functions support authentication and integrity but authorization is a separate security function.
Question 18 Play from 31:01
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Analyzing logs in the server administration console provides comprehensive, continuous, and objective data about server availability and downtime over time. Logs capture all availability events, can be aggregated for trends, and are verifiable, providing the best assurance of actual server availability patterns compared to subjective user reports or limited manual checks.
Not this one. Try another answer.
Why B is wrong
User-reported downtime is subjective, often incomplete, and may miss unnoticed availability issues.
Not this one. Try another answer.
Why C is wrong
Planned outages are known events and don't reflect unexpected downtime or availability trends.
Not this one. Try another answer.
Why D is wrong
Manual daily pinging is sparse, inconsistent, and cannot capture downtime events between checks.
Question 19 Play from 32:46
Which of the following is the auditor's BEST recommendation prior to go-live?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Automating test scripts is helpful but comes after establishing what the test scripts should validate through a mock conversion.
Right, B is the answer.
Why B is right
A mock conversion test is the best pre-go-live recommendation because it simulates the actual conversion process in a controlled environment, allowing the team to identify and resolve issues before the real conversion occurs. This reduces the risk of data loss, corruption, or system failures during the actual go-live. While automating test scripts, reviewing procedures, and establishing baselines are all valuable activities, none directly simulates and validates the complete conversion process as effectively as a mock conversion test.
Not this one. Try another answer.
Why C is wrong
Reviewing test procedures is preparatory work that should occur before the mock conversion test.
Not this one. Try another answer.
Why D is wrong
Establishing a configuration baseline is important but does not directly test the conversion process itself.
Question 20 Play from 34:45
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Testing logical access controls is a later validation step after controls have been designed based on data classification.
Right, B is the answer.
Why B is right
Classification based on standards must be done first when creating a data protection program because it establishes which data requires protection and at what level. Classification provides the foundation for all subsequent decisions about access controls, DLP implementation, and security measures. Without understanding what data exists and its sensitivity, other controls cannot be properly designed or deployed.
Not this one. Try another answer.
Why C is wrong
DLP controls are implemented after understanding what data needs protection through classification.
Not this one. Try another answer.
Why D is wrong
IDS deployment is a technical measure that follows the foundational classification and protection strategy.
Question 21 Play from 36:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Prior experience in IS audit enhances competence and does not threaten independence.
Right, B is the answer.
Why B is right
Prior relationships with vendors create significant threats to auditor independence because the auditor may face pressure to favor the vendor, avoid critical findings, or be perceived as biased. This compromises the auditor's objectivity in evaluating vendor performance and related controls.
Not this one. Try another answer.
Why C is wrong
Prior knowledge of technology is beneficial to audit quality and does not create independence concerns.
Not this one. Try another answer.
Why D is wrong
Prior job responsibilities in IT may require careful management but are not the greatest threat to independence compared to vendor relationships.
Question 22 Play from 38:03
Which of the following would provide the BEST evidence to an IS auditor that the application is secure from external attack?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Database monitoring logs show operational activity but do not demonstrate vulnerability to external attacks.
Not this one. Try another answer.
Why B is wrong
Code reviews can identify potential issues but provide no evidence of actual security against real exploitation.
Right, C is the answer.
Why C is right
Penetration test results provide the best evidence of application security from external attack because they simulate real-world attack scenarios and demonstrate whether the application can withstand actual exploitation attempts. This is direct, practical evidence of security posture. Database logs show operational activity; code reviews identify potential vulnerabilities but not actual exploitability; and a firewall is a network control that doesn't prove application code security.
Not this one. Try another answer.
Why D is wrong
A firewall is a network perimeter control that does not prove the application itself is secure from attack.
Question 23 Play from 39:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Printout redirection is a temporary operational inconvenience, not a security concern.
Not this one. Try another answer.
Why B is wrong
Maintenance costs exceeding device value is a financial decision, not a security risk.
Not this one. Try another answer.
Why C is wrong
Business impact during maintenance is an availability concern but does not pose information security risks.
Right, D is the answer.
Why D is right
The greatest concern when a multi-function printer is sent offsite for maintenance is that internal memory does not automatically clear, which could expose sensitive data (cached documents, user information, scanned materials) to maintenance personnel or unauthorized access. This represents a direct security and confidentiality risk. Options A, B, and C are operational or financial concerns but do not pose security risks to sensitive information.
Question 24 Play from 41:48
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Monitoring execution of computer processing tasks is an operations responsibility, not QA.
Not this one. Try another answer.
Why B is wrong
Designing data protection procedures is a security design responsibility, not QA.
Right, C is the answer.
Why C is right
The QA group's primary responsibility is ensuring that program changes adhere to established standards, encompassing code review, change management compliance, configuration management, and validation that modifications meet organizational standards before deployment. This oversight ensures system integrity and consistency. Option A describes operational monitoring, option B describes data protection design, and option D describes output validation, which are distinct from the QA function of enforcing development standards.
Not this one. Try another answer.
Why D is wrong
Ensuring output completeness is a system validation and operations responsibility, not QA's primary focus on standards adherence.
Question 25 Play from 43:47
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
When examining fire suppression systems as part of environmental controls review, maintenance procedures are critical because they ensure the system remains operational and effective. Maintenance procedures directly impact system reliability and compliance with regulatory requirements. While onsite replacement availability, installation manuals, and insurance coverage have some relevance, maintenance procedures are the most essential consideration for assessing whether the fire suppression system can be properly maintained and relied upon to function when needed.
Not this one. Try another answer.
Why B is wrong
Onsite replacement availability is a logistical consideration but less critical than ensuring proper maintenance of existing systems.
Not this one. Try another answer.
Why C is wrong
Installation manuals are historical documentation; ongoing maintenance procedures are more important for current system viability.
Not this one. Try another answer.
Why D is wrong
Insurance coverage addresses financial responsibility but does not assess the technical adequacy of the fire suppression system itself.
Question 26 Play from 45:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Post-implementation reviews occur after completion and cannot mitigate risks to ongoing project execution.
Not this one. Try another answer.
Why B is wrong
Monitoring changes in risk factors is reactive and does not prevent or control requirement changes from being implemented.
Not this one. Try another answer.
Why C is wrong
Mid-term reviews assess current status but do not establish a preventive process for controlling changes as they are proposed.
Right, D is the answer.
Why D is right
Formal reviews of changes establish a controlled process that evaluates the impact, feasibility, and priority of requirement changes before implementation. This process mitigates risk by ensuring changes are understood, justified, and managed systematically rather than ad-hoc. Formal change reviews prevent uncontrolled requirement creep and help the project manager maintain project stability and timelines.
Question 27 Play from 47:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Specifying implementation dates is the auditee's responsibility in response to recommendations, not the auditor's role.
Right, B is the answer.
Why B is right
Ensuring that the facts presented in the audit report are correct is the most important function of an exit meeting. This final verification step with the auditee allows for clarification, correction of any factual errors, and confirmation of accuracy before the report is finalized, protecting the integrity of the audit and preventing disputes over the findings.
Not this one. Try another answer.
Why C is wrong
Communicating recommendations to senior management occurs after the exit meeting and is part of report distribution.
Not this one. Try another answer.
Why D is wrong
While input on corrective actions is valuable, ensuring factual accuracy of the report itself is the primary auditor responsibility in the exit meeting.
Question 28 Play from 49:18
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Critical business processes not being included in the BCP is the greatest concern because the purpose of business continuity is to ensure continuity of essential operations. If key processes are omitted, the BCP fundamentally fails at its objective, and the organization cannot recover critical functions during a disaster. This represents a gap in coverage that invalidates the entire continuity strategy.
Not this one. Try another answer.
Why B is wrong
Personnel awareness is important for BCP effectiveness but can be remedied through training; lack of awareness does not indicate the plan itself is inadequate.
Not this one. Try another answer.
Why C is wrong
Lack of testing evidence is a significant concern but represents a control over plan verification; the plan may still cover necessary processes.
Not this one. Try another answer.
Why D is wrong
Missing offsite storage is a control deficiency but is one specific element; it does not indicate whether the BCP addresses recovery of critical processes.
Question 29 Play from 51:21
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A Business Impact Analysis (BIA) is the most important prerequisite before developing a disaster recovery plan. The BIA identifies critical business functions, their interdependencies, acceptable downtime windows (RTO), and data loss tolerances (RPO). Without this analysis, the organization cannot prioritize recovery efforts or allocate resources effectively. The BIA provides the quantitative and qualitative data necessary to make informed decisions about which functions to recover first and at what cost. While IT inventory and risk assessment are useful, and staff skills are relevant, the BIA directly drives the recovery strategy and priorities.
Not this one. Try another answer.
Why B is wrong
IT inventory is helpful but comes after understanding business criticality determined by the BIA.
Not this one. Try another answer.
Why C is wrong
Skills gap analysis addresses execution capabilities but is secondary to understanding what needs to be recovered.
Not this one. Try another answer.
Why D is wrong
Risk assessment is valuable but the BIA is more directly tied to DRP development and prioritization.
Question 30 Play from 53:27
Which type of audit risk was MOST likely overlooked when planning the audit?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Statistical sampling risk relates to the precision of sample-based conclusions, not scope definition.
Not this one. Try another answer.
Why B is wrong
Detection risk concerns the auditor's ability to find exceptions through testing procedures, not scope omissions.
Not this one. Try another answer.
Why C is wrong
Control risk addresses the likelihood that controls won't prevent or detect issues, but this assumes the area was in scope.
Right, D is the answer.
Why D is right
Inherent risk represents the susceptibility of an area to error or irregularity before considering controls. When major weaknesses were not included in the audit scope, this indicates the auditor failed to properly identify and assess inherent risks in the system implementation area. This oversight in scope definition suggests inadequate inherent risk assessment during audit planning.
Question 31 Play from 55:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Removing malicious code is a corrective control, not a deterrent.
Right, B is the answer.
Why B is right
Distributing disciplinary policies is a deterrent control that reduces the likelihood of insider threats by making clear the consequences of misconduct. Deterrent controls work by discouraging bad behavior through knowledge of penalties. Removing malicious code (A) is a corrective control addressing existing threats. Contingency plans (C) and data recovery (D) are recovery controls addressing consequences, not preventing the threat from occurring.
Not this one. Try another answer.
Why C is wrong
Contingency plans are contingency controls, not deterrent controls.
Not this one. Try another answer.
Why D is wrong
Data recovery procedures are recovery controls, not preventive or deterrent controls.
Question 32 Play from 56:44
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Interface testing focuses on data flow between modules but is not specifically designed to catch new errors from changes.
Not this one. Try another answer.
Why B is wrong
Unit testing validates individual code units but may not catch integration-level errors introduced by changes.
Right, C is the answer.
Why C is right
Regression testing specifically re-executes previously passing tests after code changes to identify newly introduced errors. It ensures that modifications have not broken existing functionality, making it the most effective method for detecting errors that result directly from program changes.
Not this one. Try another answer.
Why D is wrong
Integration testing verifies component interaction but is broader than regression testing and less targeted at change-specific errors.
Question 33 Play from 58:16
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Documenting lessons learned is an important secondary outcome but not the primary purpose of the review.
Not this one. Try another answer.
Why B is wrong
Aligning objectives with business needs should occur during project initiation, not as the primary goal of post-implementation review.
Right, C is the answer.
Why C is right
The primary purpose of a post-implementation review is to evaluate whether the project has successfully achieved its original objectives as defined in the business case. This assessment determines the project's success and value delivery to the organization. While lessons learned (option A) are documented during post-implementation reviews, this is a secondary benefit rather than the primary reason. The primary focus must be on validating that intended outcomes were achieved.
Not this one. Try another answer.
Why D is wrong
Stakeholder sign-off is typically obtained during the project, not as the primary focus of a post-implementation review.
Question 34 Play from 1:00:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Water sprinklers cause significant damage to electronics and equipment, making them unsuitable for computer rooms.
Not this one. Try another answer.
Why B is wrong
Fire extinguishers require human operation and cannot work in unstaffed environments where fires go undetected initially.
Right, C is the answer.
Why C is right
Carbon dioxide (CO ) is the most appropriate fire suppression method for unstaffed â‚‚ computer rooms because it extinguishes fire without leaving residue, doesn't damage sensitive equipment, and poses no corrosion risk. CO is safe for unoccupied spaces and â‚‚ doesn't require cleanup like water-based systems. It's specifically designed for facilities with valuable equipment and no personnel present.
Not this one. Try another answer.
Why D is wrong
Dry pipe systems are better suited for areas with water damage concerns but are not specifically optimized for equipment protection like COâ‚‚ systems.
Question 35 Play from 1:02:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Cost-benefit analysis is important but secondary to ensuring the system meets security and control baselines.
Not this one. Try another answer.
Why B is wrong
Contingency planning for failure is valuable but doesn't address whether the system meets fundamental security requirements.
Right, C is the answer.
Why C is right
Ensuring security and control requirements have been specified is the most important step in reviewing an acquisition feasibility study because security and controls are foundational to the system's ability to meet business needs reliably and safely. Without specified security and control requirements, the acquisition may result in a system that fails to protect data, creates audit findings, or introduces vulnerabilities. This is a critical prerequisite that cannot be remedied after acquisition.
Not this one. Try another answer.
Why D is wrong
Audit rights are important contractually but don't assess whether the system itself meets required security and control standards.
Question 36 Play from 1:04:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While proxy servers may handle traffic, TLS termination for client connections occurs at the web server.
Right, B is the answer.
Why B is right
TLS certificates must be installed on web servers because they handle direct HTTPS connections with client browsers. When customers access the payment information update page through their phones, their browsers establish a TLS connection with the web server, which presents the certificate. The web server is the first point of encrypted communication with the client and is where the certificate must reside.
Not this one. Try another answer.
Why C is wrong
Database servers handle data storage and do not directly communicate with customers' browsers over HTTPS.
Not this one. Try another answer.
Why D is wrong
Application servers process business logic but do not directly handle client TLS connections; the web server does.
Question 37 Play from 1:05:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Irregular meetings are a concern but can be remedied; the structural absence of business representation is a fundamental governance flaw.
Not this one. Try another answer.
Why B is wrong
Consulting the board on procedural changes demonstrates appropriate escalation for significant matters.
Not this one. Try another answer.
Why C is wrong
Annual review of policies and standards, while infrequent, may be acceptable depending on organizational volatility and is less critical than business representation.
Right, D is the answer.
Why D is right
The absence of business-level representation on the IT steering committee is the greatest concern because the committee's purpose is to align IT investments with business objectives. Without business representatives, IT decisions may be made without understanding business priorities, leading to misalignment between IT projects and organizational strategy. This fundamentally undermines effective IT governance.
Question 38 Play from 1:07:46
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Record locking prevents concurrent updates to a specific record, not access to user files; the purpose is not to lock other users out arbitrarily.
Right, B is the answer.
Why B is right
Record-locking in a DBMS prevents concurrent updates by ensuring that only one user can modify a record at any given time. When a record is locked, other users attempting to access it for updates must wait until the lock is released. This eliminates data corruption from simultaneous conflicting writes and maintains data integrity and consistency during multi-user access.
Not this one. Try another answer.
Why C is wrong
Restricting changes to certain values is accomplished through field-level access controls or constraints, not record-level locking mechanisms.
Not this one. Try another answer.
Why D is wrong
Recording user activities is an audit logging function separate from record-locking; locking is a concurrency control, not an audit trail mechanism.
Question 39 Play from 1:09:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Integration of financial and audit tests is not the primary focus of ITF; it's specifically an audit technique.
Right, B is the answer.
Why B is right
The MAIN benefit of an Integrated Test Facility (ITF) is that it enables auditors to test without impacting production data by using embedded audit modules that process test transactions through the live system in parallel with production processing, isolating audit data separately. This allows real-time testing of application controls without contaminating actual business data.
Not this one. Try another answer.
Why C is wrong
While ITF can be cost-effective, the primary benefit is the ability to test without impacting production data, not cost savings.
Not this one. Try another answer.
Why D is wrong
ITF is for testing controls and data integrity, not specifically for investigating fraudulent transactions.
Question 40 Play from 1:11:36
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Minimized residual risk is the best indicator of risk management program effectiveness because residual risk represents what remains after controls are applied: the true measure of how well the organization has managed and mitigated its risks. Inherent risk cannot be eliminated (it's the natural risk of the activity), control risk minimization is narrower than overall program effectiveness, and risk quantification alone does not indicate whether management has been effective in reducing risk.
Not this one. Try another answer.
Why B is wrong
Inherent risk cannot be eliminated; it represents the natural risk of a business activity before controls are applied.
Not this one. Try another answer.
Why C is wrong
Control risk minimization is one aspect but does not capture overall program effectiveness in reducing residual risk.
Not this one. Try another answer.
Why D is wrong
Quantifying overall risk is useful but quantification alone does not demonstrate that the program is effective in reducing risk exposure.
Question 41 Play from 1:13:24
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Proper separation of duties reduces control risk but does not directly justify smaller sample sizes for accuracy testing; audit procedures must still be performed independently.
Not this one. Try another answer.
Why B is wrong
Auditor experience may improve efficiency but does not reduce the required sample size needed for statistical validity and adequate evidence gathering.
Not this one. Try another answer.
Why C is wrong
Data that can be directly changed by users indicates higher risk and control weakness, which would require a larger sample size, not smaller.
Right, D is the answer.
Why D is right
When testing the accuracy of transaction data, a smaller sample size is justified when the population is expected to be error-free because there is minimal risk of material misstatement. In such cases, the auditor can rely on a reduced sample since the likelihood of finding errors is very low, making extensive sampling unnecessary. This is a standard principle in audit sampling where sample size is inversely related to the expected error rate in the population.
Question 42 Play from 1:15:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Source code version control manages code changes but does not address scope management at the project level.
Right, B is the answer.
Why B is right
Project change management controls are the direct and most effective mitigation for scope creep risk. These controls establish formal processes for evaluating, approving, and implementing changes to project scope, preventing unauthorized or unmanaged additions. This is the explicit control designed to manage scope boundaries in software development projects.
Not this one. Try another answer.
Why C is wrong
An architecture review board may influence design decisions but is not primarily focused on preventing scope creep.
Not this one. Try another answer.
Why D is wrong
Configuration management tracks and controls system configurations but is not the primary control for managing project scope boundaries.
Question 43 Play from 1:17:12
Which of the following is the BEST solution for ensuring secure remote access to corporate resources?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Virtual desktops are a valid remote access solution but represent infrastructure deployment rather than the core secure access mechanism itself.
Right, B is the answer.
Why B is right
A Virtual Private Network (VPN) is the BEST comprehensive solution for secure remote access because it encrypts all traffic between the remote user and corporate resources, protecting data in transit and ensuring secure authentication to the corporate network. While multi-factor authentication and firewalls are important supporting controls, VPN is the foundational technology that enables secure remote access. Virtual desktops are an alternative approach but not as universally applicable.
Not this one. Try another answer.
Why C is wrong
Multi-factor authentication is an important security control but is a component of secure access, not the primary remote access solution.
Not this one. Try another answer.
Why D is wrong
Additional firewall rules provide perimeter defense but do not directly enable secure remote access to corporate resources.
Question 44 Play from 1:19:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Encryption protects data confidentiality but does not establish the association between users and public keys.
Not this one. Try another answer.
Why B is wrong
Nonrepudiation is a security service enabled by digital certificates but is not itself the mechanism for association.
Right, C is the answer.
Why C is right
A digital certificate reliably associates users with their public keys and includes attributes that uniquely identify the users. Digital certificates are issued by trusted Certificate Authorities and contain the user's public key, identifying information, validity period, and digital signature, creating a verifiable binding between the user's identity and their public key.
Not this one. Try another answer.
Why D is wrong
Multi-factor authentication verifies user identity through multiple factors but does not bind users to public keys.
Question 45 Play from 1:21:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Shredding is a disposal method but doesn't directly assure alignment with strategic business objectives.
Not this one. Try another answer.
Why B is wrong
Recycling addresses environmental sustainability but not the primary business objective of data protection.
Right, C is the answer.
Why C is right
Media sanitization policy provides the greatest assurance that data disposal controls support business objectives because proper sanitization ensures data is irretrievably destroyed, protecting confidentiality and compliance requirements. Sanitization addresses the core business objective of preventing unauthorized data access and supporting regulatory compliance, whereas labeling, shredding, and recycling are tactical execution methods rather than evidence of objective alignment.
Not this one. Try another answer.
Why D is wrong
Labeling is a tracking and administrative control, not evidence of strategic objective alignment.
Question 46 Play from 1:22:48
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
ITF is used for testing system controls, not detecting transaction anomalies.
Right, B is the answer.
Why B is right
Data analytics is the auditing technique used to detect anomalies and validate credit card transactions by analyzing patterns based on time, location, and date of purchase. This technique can identify suspicious transactions that deviate from normal spending patterns. ITF (A) is for testing system controls, hash totals (C) verify data integrity, and checksums (D) detect transmission errors: none of these techniques are designed to detect behavioral anomalies in transactions.
Not this one. Try another answer.
Why C is wrong
Hash totals verify data integrity, not detect temporal or geographic transaction anomalies.
Not this one. Try another answer.
Why D is wrong
Checksums detect transmission errors, not unusual transaction patterns.
Question 47 Play from 1:24:31
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Network-based IDS typically operates in passive monitoring mode, not active mode.
Not this one. Try another answer.
Why B is wrong
Network-based IDS systems are capable of detecting and alerting on DoS attacks.
Not this one. Try another answer.
Why C is wrong
Modern network-based IDS systems are designed to operate efficiently without consuming excessive network resources.
Right, D is the answer.
Why D is right
A network-based IDS cannot detect attacks originating on the server hosting the IDS itself because such traffic does not traverse the network interface that the IDS monitors. Attacks generated locally on the IDS host bypass network detection entirely, representing a fundamental blind spot in network-based monitoring.
Question 48 Play from 1:26:19
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Low-value transactions typically do not justify the cost of continuous auditing tools and monitoring.
Not this one. Try another answer.
Why B is wrong
Irregular transactions occur unpredictably and infrequently, making continuous monitoring less practical and cost-effective.
Right, C is the answer.
Why C is right
Real-time transactions are best suited for continuous auditing because they occur frequently and automatically within systems, making them ideal candidates for automated monitoring and testing. Real-time transactions have high volume and consistent processing patterns that allow continuous control testing to be cost-effective and practical. Low-value (A) and irregular (B) transactions may not justify continuous testing costs; manual transactions (D) are harder to automate and monitor continuously.
Not this one. Try another answer.
Why D is wrong
Manual transactions cannot be efficiently monitored through automated continuous auditing processes.
Question 49 Play from 1:28:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Wet pipe systems use water, which is inappropriate and damaging for data processing facilities; they are incompatible with this environment.
Not this one. Try another answer.
Why B is wrong
The type of fire suppression system linked is less critical than ensuring the detectors themselves are properly certified to function in a data center.
Right, C is the answer.
Why C is right
Industry certification ensures that smoke detectors meet established standards for sensitivity, reliability, and performance in data center environments. Proper certification guarantees the detectors will function correctly under the specific environmental conditions of a data processing facility (such as temperature control and air filtration), which is foundational to effectiveness.
Not this one. Try another answer.
Why D is wrong
Audible alarms are useful for notification but secondary to the detector's primary function of accurately sensing smoke; detection capability is more important than alarm type.
Question 50 Play from 1:30:04
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Flooding a site with excessive packets (DoS/DDoS attack) exploits an inherent weakness in firewall design: firewalls must allow legitimate traffic through, and they have finite capacity to process and filter packets. An attacker can saturate this capacity, causing the firewall and systems behind it to become unavailable. This is a fundamental architectural vulnerability rather than a configuration flaw. The other options describe attacks that succeed through other vulnerabilities or social engineering, not firewall weaknesses.
Not this one. Try another answer.
Why B is wrong
Intercepting packets and viewing passwords requires compromising network encryption or gaining network access; this is not a firewall weakness but a different attack vector.
Not this one. Try another answer.
Why C is wrong
Phishing exploits human behavior and trust, not firewall design weaknesses.
Not this one. Try another answer.
Why D is wrong
Dictionary attacks target password encryption algorithms and storage, not firewall vulnerabilities.
Question 51 Play from 1:32:05
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
KPIs can be useful without explicit management approval if they are well-designed and relevant to organizational goals.
Not this one. Try another answer.
Why B is wrong
Changing KPIs frequently undermines their usefulness; stable KPIs allow for meaningful trend analysis.
Right, C is the answer.
Why C is right
A KPI must have a target value to be useful because without a target, there is no way to measure success or determine if performance is acceptable. Targets provide the benchmark against which actual performance is compared. While approval (A), frequency of change (B), and measurability in percentages (D) may be desirable, they are not essential requirements; a KPI measured in raw numbers with a numeric target is equally valid and useful.
Not this one. Try another answer.
Why D is wrong
KPIs can be expressed in various units (dollars, counts, time, percentages) and remain valid and useful.
Question 52 Play from 1:33:50
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Version control for program documentation is a technical practice that supports change management but does not indicate effective overall change control governance.
Right, B is the answer.
Why B is right
User management formally approving change requests is the clearest indicator of an effective change control environment because it ensures that business stakeholders evaluate and authorize changes before implementation, establishing accountability and preventing unauthorized or inappropriate modifications to systems.
Not this one. Try another answer.
Why C is wrong
Automated release management is a technical efficiency measure but does not ensure that changes are properly evaluated and approved by appropriate stakeholders.
Not this one. Try another answer.
Why D is wrong
QA reporting to the application development manager represents a structural concern about independence and does not indicate effective change control processes.
Question 53 Play from 1:35:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Identification (knowing who the user is) requires authentication to be meaningful and secure.
Right, B is the answer.
Why B is right
Authentication is the most important feature of access control software because it verifies that users are who they claim to be. Without proper authentication, identification becomes meaningless, and subsequent controls like violation reporting and nonrepudiation cannot function reliably. Authentication is the foundational security control upon which all other access control functions depend.
Not this one. Try another answer.
Why C is wrong
Violation reporting is important for monitoring but depends on proper authentication and identification first.
Not this one. Try another answer.
Why D is wrong
Nonrepudiation is valuable for accountability but is secondary to ensuring only authorized users gain access.
Question 54 Play from 1:37:16
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Formal board approval is important for governance but is not the greatest concern if alignment with organizational goals exists.
Not this one. Try another answer.
Why B is wrong
KPIs are important for measurement and monitoring, but their absence is not as critical as misalignment with organizational goals.
Not this one. Try another answer.
Why C is wrong
An IT strategy committee is useful for governance but is not essential if the strategy is sound and properly supported.
Right, D is the answer.
Why D is right
The GREATEST concern when reviewing an IT strategic plan is that it does not support relevant organizational goals. An IT strategy must be aligned with and in service of the organization's overall business objectives. Without this alignment, IT investments and initiatives will not deliver value to the organization. While formal board approval, KPIs, and committee structure are important governance elements, they are secondary to ensuring the strategy is fundamentally aligned with organizational goals.
Question 55 Play from 1:39:13
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Upon completion of audit work, the IS auditor should first provide findings to the auditee (management of the audited area) to allow them to respond, provide context, and potentially correct any misunderstandings before final reporting to senior management. This ensures accuracy and fairness by giving the auditee an opportunity to comment on findings. Reporting directly to senior management before discussion with the auditee bypasses proper governance; reviewing working papers with the auditee is administrative; distributing summaries to the audit team is operational but occurs in parallel, not as the primary first step.
Not this one. Try another answer.
Why B is wrong
Reporting to senior management before discussion with the auditee violates the principle of giving the audited area opportunity to respond and validate findings.
Not this one. Try another answer.
Why C is wrong
Distributing summaries to audit team members is an internal administrative action, not the primary first step in formal reporting.
Not this one. Try another answer.
Why D is wrong
Reviewing working papers with the auditee is a detailed activity that follows initial findings discussion, not the primary reporting step.
Question 56 Play from 1:41:26
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Data exfiltration is the greatest risk when using APIs in third-party hosted virtual environments. APIs are common attack vectors that can be exploited to extract sensitive data, and in third-party cloud environments, the organization has less visibility and control over network monitoring and data flows. An attacker could use poorly secured APIs to bypass normal security controls and extract data, making this a critical confidentiality risk in cloud environments.
Not this one. Try another answer.
Why B is wrong
Lack of accountability relates to audit trails but is secondary to the direct risk of data theft.
Not this one. Try another answer.
Why C is wrong
Inability to test third-party APIs is a quality concern but does not directly pose the same level of immediate security risk.
Not this one. Try another answer.
Why D is wrong
Lack of redundancy affects availability but is not the greatest risk compared to confidentiality breaches through API exploitation.
Question 57 Play from 1:43:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Arranging a secondary site cannot be done effectively until the team is mobilized and informed through the call tree.
Not this one. Try another answer.
Why B is wrong
Risk analysis is important but premature before the team is even notified and mobilized to respond.
Not this one. Try another answer.
Why C is wrong
Data recovery cannot meaningfully begin until personnel are activated and coordinated through the established communication structure.
Right, D is the answer.
Why D is right
Activating the call tree should be done FIRST in a disaster scenario because it immediately notifies all relevant personnel of the emergency, enables communication channels, and initiates the disaster recovery plan. Without notifying the team and leadership, no coordinated response can begin. This logistical first step must precede all other actions like risk analysis, site arrangements, or data recovery.
Question 58 Play from 1:44:53
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Observing business processes is time-consuming and may not reveal all violations occurring across the system.
Not this one. Try another answer.
Why B is wrong
Developing a process to identify authorization conflicts requires significant setup time and is less efficient than reviewing existing system reports.
Right, C is the answer.
Why C is right
Reviewing a report of security rights in the system is the most efficient way to identify segregation of duties violations because it provides a systematic, comprehensive view of all user access rights and potential conflicts. This approach allows the auditor to analyze authorization matrices and identify incompatible duties assigned to the same user programmatically. This is faster and more thorough than manual observation or historical review of violations.
Not this one. Try another answer.
Why D is wrong
Examining recent violations is reactive and may miss existing conflicts that have not yet resulted in a detected violation.
Question 59 Play from 1:46:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Data flow diagrams show data movement between systems, not who performs specific duties.
Not this one. Try another answer.
Why B is wrong
Systems flowcharts depict system components and their interactions, not the assignment of duties to individuals.
Not this one. Try another answer.
Why C is wrong
Entity-relationship diagrams show database structure and relationships, not process duties or role assignments.
Right, D is the answer.
Why D is right
A process flowchart is most useful for detecting segregation of duties weaknesses because it maps the flow of activities, responsibilities, and decision points through a process, making it clear where one person or role performs conflicting duties. Process flowcharts show who performs what activities and in what sequence, making conflicts immediately visible. Data flow diagrams, systems flowcharts, and entity-relationship diagrams focus on data movement, system components, or data structures rather than the assignment of specific duties to roles.
Question 60 Play from 1:48:45
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Software cost estimation is a broader discipline that uses various techniques but is not specifically the best for measuring complexity.
Not this one. Try another answer.
Why B is wrong
Work breakdown structure is a planning and organization tool that decomposes work but does not directly estimate complexity.
Not this one. Try another answer.
Why C is wrong
Critical path analysis focuses on scheduling and dependencies, not on measuring inherent system complexity.
Right, D is the answer.
Why D is right
Function point analysis is a standardized, quantifiable methodology specifically designed to measure software complexity and scope by counting functional requirements and converting them into effort estimates. It provides objective complexity metrics based on actual system functionality rather than subjective assessments. This makes it the best choice for estimating complexity of large business applications.
Question 61 Play from 1:50:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An incident log documents problems but doesn't provide a structured framework for ongoing improvement.
Not this one. Try another answer.
Why B is wrong
A risk register identifies risks but doesn't serve as a tool for measuring or guiding process improvement progression.
Right, C is the answer.
Why C is right
A maturity model provides the best framework for enabling continual improvement because it establishes clear stages of capability development, allows measurement of current state against defined levels, and provides a roadmap for progression. This systematic approach is specifically designed to guide incremental improvements over time.
Not this one. Try another answer.
Why D is wrong
Benchmarking studies show how others perform but don't provide a structured internal improvement framework.
Question 62 Play from 1:52:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Sign-in procedures document arrivals but do not prevent unauthorized access or activity once visitors enter the facility.
Not this one. Try another answer.
Why B is wrong
Pre-approval establishes authorization but does not prevent the approved visitor from accessing restricted areas beyond their scope or wandering unsupervised.
Right, C is the answer.
Why C is right
Escorting visitors by an authorized employee is the most effective control for visitor access to data centers because it provides real-time supervision and accountability. The escort can prevent unauthorized access to restricted areas, monitor visitor activities, verify credentials, and ensure visitors follow security policies. This active human control is more effective than passive measures.
Not this one. Try another answer.
Why D is wrong
CCTV provides detection and recording of violations after they occur but does not actively prevent unauthorized access or control visitor movement in real-time.
Question 63 Play from 1:54:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Password protection is a security measure but not the primary integrity concern with spreadsheets.
Right, B is the answer.
Why B is right
The greatest risk of using spreadsheets for financial reporting is the lack of processing integrity. Spreadsheets are prone to formula errors, uncontrolled changes, poor audit trails, and lack of version control: all compromising data integrity throughout the calculation and reporting process. While other risks exist (lack of password protection, operational incidents, regulatory violations), they are either secondary consequences or technical protections. Processing integrity directly addresses the core vulnerability that makes spreadsheets unsuitable for financial reporting: the inability to ensure calculations and data transformations are accurate and controlled.
Not this one. Try another answer.
Why C is wrong
Operational incidents are a consequence rather than the greatest inherent risk of spreadsheet use.
Not this one. Try another answer.
Why D is wrong
Regulatory violations follow from lack of processing integrity but are not the root cause.
Question 64 Play from 1:56:05
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Account lockout policies most effectively reduce brute force success by preventing attackers from making unlimited password attempts. After a set number of failed attempts, the account is locked, stopping the attack dead rather than merely slowing it down or requiring stronger passwords.
Not this one. Try another answer.
Why B is wrong
Account timeouts log users out but do not prevent repeated login attempts from the same or different sessions.
Not this one. Try another answer.
Why C is wrong
Frequent password changes do not prevent brute force attacks on the current password during the change interval.
Not this one. Try another answer.
Why D is wrong
Longer passwords increase complexity but a determined attacker can still attempt many combinations; lockout policies prevent the attempt volume itself.
Question 65 Play from 1:57:43
Which of the following is the MOST important process to help ensure the application provides accurate calculations?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Quality assurance (QA) is the most critical process for ensuring an application provides accurate calculations. QA encompasses comprehensive testing, validation, and verification procedures specifically designed to catch errors and defects before deployment. While change management, KPI monitoring, and configuration management are all important for application management, they do not directly address the accuracy of calculations: QA testing does.
Not this one. Try another answer.
Why B is wrong
Change management controls how modifications are made but does not verify the accuracy of calculations themselves.
Not this one. Try another answer.
Why C is wrong
KPI monitoring tracks performance metrics after deployment but cannot ensure calculations are accurate during development.
Not this one. Try another answer.
Why D is wrong
Configuration management maintains system configurations but does not validate calculation accuracy.
Question 66 Play from 1:59:42
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A third-party review of the cloud provider's change management process provides the most credible and objective evidence of effectiveness. Third parties are independent, use standardized audit criteria, and their findings are unbiased. This external validation is far more reliable than internal vendor documents, meeting minutes, or CEO assurances, which could be self-serving or incomplete.
Not this one. Try another answer.
Why B is wrong
Meeting minutes are internal documentation and don't prove process effectiveness; attendees are not independent.
Not this one. Try another answer.
Why C is wrong
Policy documents show what should happen, not what actually happens or whether the process is effective.
Not this one. Try another answer.
Why D is wrong
Management assurances lack objectivity and provide no independent verification of actual change management effectiveness.
Question 67 Play from 2:01:34
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Integration testing validates that components work together but is broader than assessing whether changes maintained existing integrity.
Right, B is the answer.
Why B is right
Regression testing is specifically designed to verify that existing functionality remains intact after changes have been made. It re-runs previous test cases to detect whether modifications introduced unintended side effects or broke previously working features. This is the direct and intended use case for assessing whether system integrity has been maintained. The other testing types focus on new functionality, component-level verification, or final acceptance rather than detecting regression in existing capabilities.
Not this one. Try another answer.
Why C is wrong
Acceptance testing determines whether the system meets requirements but is typically a final gate, not a post-change integrity assessment.
Not this one. Try another answer.
Why D is wrong
Unit testing focuses on individual code components and does not comprehensively assess whether changes affected overall system integrity.
Question 68 Play from 2:03:25
Which type of control has been implemented?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Segregation of duties with job definitions and role restrictions is a preventive control designed to stop errors and fraud before they occur. By structuring the organization so that incompatible duties are separated, the control mechanism prevents unauthorized or erroneous transactions from being completed. Detective controls find problems after occurrence, physical controls protect assets, and corrective controls remedy issues after they are detected.
Not this one. Try another answer.
Why B is wrong
Detective controls identify problems that have already occurred; SOD prevents problems from happening.
Not this one. Try another answer.
Why C is wrong
Physical controls protect tangible assets; SOD is an administrative control over processes and responsibilities.
Not this one. Try another answer.
Why D is wrong
Corrective controls fix problems after they occur; SOD stops problems from occurring in the first place.
Question 69 Play from 2:05:04
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Loss or damage to organizational assets represents the greatest risk in a mobile workforce environment because mobile devices and assets operating outside the secure facility perimeter are inherently more vulnerable to theft, loss, and physical damage. This directly impacts confidentiality, integrity, and availability of critical business information and equipment.
Not this one. Try another answer.
Why B is wrong
While policy compliance is a concern, it can be addressed through training and monitoring and is less critical than protecting physical assets and data.
Not this one. Try another answer.
Why C is wrong
Productivity and accountability, though important operational concerns, are secondary to preventing loss of critical business assets and data.
Not this one. Try another answer.
Why D is wrong
Remote access to data is a capability that mobile workforces require and is manageable through proper security controls, not a primary risk.
Question 70 Play from 2:06:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Decreasing response time is not the primary purpose of clustering; load balancing is a secondary benefit.
Not this one. Try another answer.
Why B is wrong
RTO improvement is an outcome of resiliency, not the primary reason for implementing clustering.
Right, C is the answer.
Why C is right
The primary purpose of clustering is to improve system resiliency by providing redundancy and failover capabilities. While clustering can also improve response time and theoretically support faster backups, these are secondary benefits. RTO improvement is achieved through failover mechanisms within clustering, but resiliency is the fundamental architectural benefit that clustering delivers.
Not this one. Try another answer.
Why D is wrong
Faster backups are not a primary benefit of clustering; backup speed depends on backup infrastructure and strategy.
Question 71 Play from 2:08:35
What should the IS auditor recommend?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A database query retrieves data but does not inherently provide the stratified sampling logic needed for this requirement.
Right, B is the answer.
Why B is right
Generalized audit software (GAS) is designed to handle complex sampling requirements including stratified sampling, where the 80 largest balances are selected deterministically while the remainder is randomly sampled. GAS provides the functionality needed for this mixed sampling approach. A database query (A) is a data extraction tool but not a sampling methodology; an ITF (C) is for testing controls, not sampling; and a random number generator (D) cannot stratify by balance size.
Not this one. Try another answer.
Why C is wrong
An integrated test facility is a control testing tool within applications, not a sampling selection mechanism.
Not this one. Try another answer.
Why D is wrong
A random number generator alone cannot apply the stratification criterion of selecting the 80 largest items deterministically.
Question 72 Play from 2:10:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Business involvement is helpful but doesn't ensure focus on the most critical risk areas.
Not this one. Try another answer.
Why B is wrong
Minimizing cost and time is secondary to ensuring adequate coverage of critical risks.
Not this one. Try another answer.
Why C is wrong
Aligning with management priorities may not address the highest business risks if priorities are misaligned with risk exposure.
Right, D is the answer.
Why D is right
Understanding the relationship between IT and business risks is most important when defining audit scope because it ensures audit resources are directed toward areas with the greatest potential business impact. This risk-based approach ensures the audit focuses on what matters most to the organization's objectives and survival, rather than being driven by cost considerations, management priorities alone, or business involvement without risk context.
Question 73 Play from 2:12:31
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
An IT strategy committee's primary governance role is advising senior management on IT- related risks and strategic decisions. This role positions the committee as an advisory and oversight body that helps executive leadership make informed decisions about IT investments, risks, and strategic direction. This is consistent with sound IT governance frameworks where strategy committees provide guidance and risk assessment to senior management.
Not this one. Try another answer.
Why B is wrong
Quality assurance for IT business functions is typically performed by dedicated QA teams, not a strategy committee.
Not this one. Try another answer.
Why C is wrong
Executing IT-enabled programs is an operational responsibility, not a strategic governance committee function.
Not this one. Try another answer.
Why D is wrong
While ROI evaluation may be discussed, evaluating return on IT investment is more of a financial or portfolio management function rather than the core role of a strategy advisory committee.
Question 74 Play from 2:14:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A perimeter firewall controls traffic at network boundaries but does not specifically detect or prevent sensitive data exfiltration within authorized connections.
Not this one. Try another answer.
Why B is wrong
Hashing is a one-way cryptographic function used for data integrity and password storage, not for preventing exfiltration of sensitive data.
Not this one. Try another answer.
Why C is wrong
Network access controls manage who can connect to the network but do not specifically prevent authorized users from exfiltrating data once connected.
Right, D is the answer.
Why D is right
A Data Loss Prevention (DLP) system is specifically designed to monitor, detect, and block unauthorized attempts to transfer sensitive data outside the organization. DLP systems work at multiple layers (endpoint, network, email) to prevent exfiltration during cyberattacks by identifying sensitive data patterns and enforcing policies to stop their movement. This directly addresses the exfiltration risk, whereas other options address different security concerns.
Question 75 Play from 2:16:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Server thread count is an internal resource metric that does not directly indicate user-perceived performance.
Not this one. Try another answer.
Why B is wrong
Uptime measures availability, not performance quality or speed of the application.
Not this one. Try another answer.
Why C is wrong
HTTP error rate measures reliability and error conditions rather than the speed and responsiveness of successful requests.
Right, D is the answer.
Why D is right
Average response time is the most direct measure of user experience and application performance from an end-user perspective. It captures the overall application behavior under load and usage patterns. Server thread count is an internal resource metric, uptime only measures availability (not performance quality), and HTTP error rate measures reliability rather than performance speed.
Question 76 Play from 2:18:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SQL injection attacks occur at the application layer, beyond typical firewall inspection capabilities.
Not this one. Try another answer.
Why B is wrong
Phishing attacks are social engineering attacks delivered via email or web, not network-level threats a firewall can effectively block.
Right, C is the answer.
Why C is right
A properly configured firewall can reduce Denial of Service (DoS) attacks by implementing rate limiting, traffic filtering, and traffic shaping rules that can detect and block malicious traffic patterns before they overwhelm system resources. Firewalls operate at the network level where such volume-based attacks can be addressed.
Not this one. Try another answer.
Why D is wrong
Insider attacks originate from authorized users within the network, making them difficult for firewalls to detect or prevent based on network rules alone.
Question 77 Play from 2:19:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While exceptions may continue indefinitely, the concern about continuation is secondary to the underlying risk they create.
Not this one. Try another answer.
Why B is wrong
Exceptions may sometimes improve efficiency by removing overly restrictive controls, so this is not consistently a concern.
Right, C is the answer.
Why C is right
A high number of approved policy exceptions elevates operational risk because each exception represents a deviation from established security or operational controls. Exceptions create gaps in risk mitigation, increase the organization's vulnerability to threats and errors, and compound when multiple exceptions interact. While noncompliance is possible, the immediate and broader concern is the cumulative elevation of operational risk exposure.
Not this one. Try another answer.
Why D is wrong
While exceptions could lead to noncompliance depending on the regulation, the greater concern is operational risk; noncompliance is a potential consequence rather than the direct concern.
Question 78 Play from 2:21:49
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Benefits realization analysis is most appropriately conducted during the post- implementation review phase because this is when actual results can be measured against the planned benefits and business case. At this stage, the system has been operational long enough to generate meaningful performance data, allowing auditors to assess whether promised benefits have been achieved. Earlier phases involve projections rather than actual realization.
Not this one. Try another answer.
Why B is wrong
Design review phase occurs before implementation and cannot measure actual benefits realization.
Not this one. Try another answer.
Why C is wrong
UAT phase measures functional correctness, not actual business benefits realization in the operational environment.
Not this one. Try another answer.
Why D is wrong
Final implementation phase is too early to assess whether promised business benefits have been realized.
Question 79 Play from 2:23:34
Which of the following actions performed during the audit would have BEST supported the findings?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Penetration testing provides the strongest evidence supporting inadequate network controls by demonstrating actual exploitation of the weaknesses and proving they pose real risk. Penetration testing moves beyond identifying vulnerabilities to proving they are exploitable, which powerfully refutes the argument that no incident has occurred. This active testing proves control inadequacy through demonstrated attack success, whereas vulnerability assessments only identify potential weaknesses, threat assessments evaluate likelihood, and compliance testing verifies adherence to standards.
Not this one. Try another answer.
Why B is wrong
Threat risk assessment evaluates risk likelihood but does not prove controls are inadequate through active demonstration.
Not this one. Try another answer.
Why C is wrong
Compliance testing verifies adherence to standards but does not demonstrate that control weaknesses pose actual exploitable risk.
Not this one. Try another answer.
Why D is wrong
Vulnerability assessment identifies weaknesses but does not prove they are exploitable or pose actual risk without penetration testing.
Question 80 Play from 2:25:40
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Management sign-off of test documentation is important for governance but doesn't verify that monitoring actually works correctly.
Not this one. Try another answer.
Why B is wrong
Dual controls in processes are good practice but don't directly address whether the monitoring tool is configured to detect issues.
Right, C is the answer.
Why C is right
The configuration of the monitoring tool is most important because it directly determines whether the automated system is actually detecting the transactions and events it is designed to monitor. Incorrect configuration could result in the monitoring process failing silently while appearing to function. A properly configured tool ensures that controls are actually operating as intended and that the continuous monitoring provides valid assurance.
Not this one. Try another answer.
Why D is wrong
Service resiliency is important for availability but doesn't address whether the monitoring configuration is correct.
Question 81 Play from 2:27:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
BPR typically pursues dramatic improvements rather than incremental changes; incremental improvement is continuous improvement, not reengineering.
Not this one. Try another answer.
Why B is wrong
Organizational structure changes are often consequences of BPR but not the primary objective.
Not this one. Try another answer.
Why C is wrong
System improvements are tools to support BPR but are secondary to the primary goal of performance enhancement.
Right, D is the answer.
Why D is right
Business process reengineering fundamentally aims to achieve significant performance improvements and efficiency gains through radical redesign of processes. Performance efficiencies encompass productivity gains, cost reduction, and quality improvements: the core objectives of BPR. While organizational structure changes and system improvements may occur as consequences, they are means to the end of achieving performance efficiencies.
Question 82 Play from 2:29:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Reviewing the RFP is important but occurs after the feasibility study is approved, not during the audit of feasibility itself.
Not this one. Try another answer.
Why B is wrong
Legal counsel review of vendor contracts is a procurement function, not an IS auditor's responsibility during feasibility assessment.
Right, C is the answer.
Why C is right
During a feasibility study audit, the IS auditor's primary concern is validating that the proposed project is economically viable and realistic. Reviewing cost-benefit documentation for reasonableness directly assesses whether the project makes financial sense and whether the costs justify the benefits. This is a core audit responsibility at the feasibility stage before significant resources are committed.
Not this one. Try another answer.
Why D is wrong
Project team qualifications are evaluated during project planning phases, not during the initial feasibility study audit.
Question 83 Play from 2:31:15
Which of the following features in the system interfaces is MOST important to provide assurance that the money is going to the right bank account?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Audit logging records what happened but does not prevent money from being sent to the wrong account.
Not this one. Try another answer.
Why B is wrong
Nonrepudiation prevents denial of an action but does not specifically verify that the destination account is correct.
Not this one. Try another answer.
Why C is wrong
Encryption protects data confidentiality in transit but does not verify the authenticity or correctness of the bank account information.
Right, D is the answer.
Why D is right
Digital signatures provide non-repudiation and authentication, ensuring that the disbursement instruction originates from an authorized source and cannot be denied. They also prevent tampering with the bank account information in transit. Digital signatures specifically verify the authenticity and integrity of the instruction to route money to the correct account, providing assurance that the funds reach the intended destination.
Question 84 Play from 2:33:03
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Benchmarking shows how peer organizations perform but doesn't directly align an organization's IT with its own business objectives.
Not this one. Try another answer.
Why B is wrong
A risk assessment identifies threats and vulnerabilities but doesn't establish alignment between IT and business objectives.
Not this one. Try another answer.
Why C is wrong
KPIs measure performance but don't establish the governance structures needed to drive alignment.
Right, D is the answer.
Why D is right
An IT governance framework provides the structured approach and mechanisms that systematically align IT strategy, processes, and decisions with business objectives. It establishes the governance structures and accountability needed for alignment. Option A (benchmarking) provides comparative data but not alignment mechanisms. Option B (risk assessment) identifies risks but doesn't align IT with objectives. Option C (KPIs) measures outcomes but doesn't establish alignment structures.
Question 85 Play from 2:34:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Escalation procedures are reactive mechanisms that support response but don't prevent future incidents.
Right, B is the answer.
Why B is right
Lessons learned exercises directly extract knowledge from incidents and translate it into actionable improvements to prevent similar future incidents. This is a proactive, forward- looking activity that creates organizational learning. While escalation procedures, management involvement, and host isolation are all important incident response activities, only lessons learned exercises systematically convert incident experience into preventive measures.
Not this one. Try another answer.
Why C is wrong
Management involvement supports the response process but doesn't specifically contribute to prevention.
Not this one. Try another answer.
Why D is wrong
Isolating hosts is a containment tactic that addresses the current incident, not future prevention.
Question 86 Play from 2:36:45
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Recovery time objective measures how quickly systems must be restored, not how much data loss is acceptable.
Right, B is the answer.
Why B is right
Recovery point objective (RPO) directly quantifies the maximum acceptable amount of data loss by specifying the point in time to which systems and data must be recovered. RPO is measured in terms of time (e.g., 4 hours of acceptable data loss) and defines the organization's tolerance for data loss in a disaster scenario. RTO measures recovery time, not data loss; backup software availability does not quantify acceptable loss; MTTR measures repair speed, not loss tolerance.
Not this one. Try another answer.
Why C is wrong
Backup software availability is a technical capability, not a metric for quantifying acceptable data loss.
Not this one. Try another answer.
Why D is wrong
Mean time to recover measures restoration speed, not the acceptable amount of lost data.
Question 87 Play from 2:38:40
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Resource allocation during emergency is important but secondary to whether the systems can actually run on the partner's infrastructure.
Right, B is the answer.
Why B is right
Hardware and software compatibility between the two organizations is critical because a reciprocal disaster recovery agreement assumes each company can run the other's systems and data. Incompatible systems, architectures, or software versions would make recovery impossible or ineffective. Resource allocation, policy differences, and testing frequency are important but secondary to ensuring the systems can actually function together during recovery operations.
Not this one. Try another answer.
Why C is wrong
Policy and procedure differences are operational concerns but do not prevent technical recovery if systems are compatible.
Not this one. Try another answer.
Why D is wrong
Testing frequency ensures readiness but the primary concern is whether the systems are compatible enough to function together.
Question 88 Play from 2:40:36
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A decreased number of calls to the help desk could indicate fewer incidents, but it doesn't measure how effectively incidents are being resolved.
Not this one. Try another answer.
Why B is wrong
An increased number of incidents reviewed by IT management may indicate better oversight but doesn't demonstrate faster or more effective resolution.
Right, C is the answer.
Why C is right
Decreased time for incident resolution is the best indicator that an incident management process is effective because it directly measures the process's primary objective: to restore normal operations as quickly as possible. Faster resolution reduces business impact and demonstrates that the process is working well, whereas other metrics may reflect volume or resource factors rather than process effectiveness.
Not this one. Try another answer.
Why D is wrong
An increased number of reported critical incidents suggests more problems are being recognized, not that the process is effective at resolving them.
Question 89 Play from 2:42:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A gateway is a more general term and may perform multiple functions; router is the specific device providing the described IP address functionality.
Not this one. Try another answer.
Why B is wrong
A switch operates within a network to connect devices locally; it does not sit on the perimeter or manage public/private IP address translation.
Not this one. Try another answer.
Why C is wrong
An IPS is a security device focused on threat detection and prevention; it does not perform the IP address translation function described.
Right, D is the answer.
Why D is right
A router is the device that sits on the perimeter of a corporate or home network, obtaining a public IP address from the Internet Service Provider and then generating and assigning private IP addresses internally to devices on the local network. Routers perform this NAT (Network Address Translation) function as their primary role at the network perimeter.
Question 90 Play from 2:44:11
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Encryption is the mechanism that protects confidentiality by rendering information unreadable to unauthorized parties. It transforms plaintext into ciphertext that cannot be decrypted without the appropriate key. SHA-1, digital certificates, and digital signatures serve other security functions (integrity, authentication, non-repudiation) but do not directly protect confidentiality by hiding the content of messages.
Not this one. Try another answer.
Why B is wrong
SHA-1 is a hashing algorithm used for integrity verification and authentication, not confidentiality protection.
Not this one. Try another answer.
Why C is wrong
Digital certificates are used for authentication and key distribution, not for encrypting message content to protect confidentiality.
Not this one. Try another answer.
Why D is wrong
Digital signatures provide authentication and non-repudiation, not confidentiality of the message content.
Question 91 Play from 2:45:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Comparing programs to approved changes is a change control function, not the core QA responsibility.
Right, B is the answer.
Why B is right
The primary responsibility of application systems QA is to ensure that developed programs adhere to organizational standards, best practices, coding guidelines, and quality benchmarks. QA acts as an independent verification function separate from development. Option A is quality control (comparing to approved changes), C and D describe development activities rather than QA's independent assurance role.
Not this one. Try another answer.
Why C is wrong
Assisting programmers in design is a development support role, not QA's independent assurance function.
Not this one. Try another answer.
Why D is wrong
Designing and developing applications is a development function; QA should be independent of development to provide objective assurance.
Question 92 Play from 2:47:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Digital signatures validate data integrity but do not dynamically validate modifications in real-time; this describes monitoring mechanisms, not the signature itself.
Not this one. Try another answer.
Why B is wrong
Digital signatures are under the control of the sender (who holds the private key), not the receiver.
Not this one. Try another answer.
Why C is wrong
While digital signatures can support authorization, this is a function they enable rather than what they fundamentally are.
Right, D is the answer.
Why D is right
A digital signature is mathematically unique to the sender who created it, derived from their private key. This uniqueness is the core characteristic that enables authentication (proving who sent it) and non-repudiation (the sender cannot deny having sent it). While digital signatures can validate that data has not been modified, option A is imprecise; option B mischaracterizes control; and option C, though related to capability, is less fundamental than the unique sender identification that defines a digital signature.
Question 93 Play from 2:49:44
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Reduced security incidents indicate security program effectiveness but not overall IT infrastructure governance.
Not this one. Try another answer.
Why B is wrong
Security awareness programs are control activities, not measures of governance effectiveness.
Right, C is the answer.
Why C is right
The best indication of effective governance over IT infrastructure is the ability to deliver continuous, reliable performance. This demonstrates that governance structures, processes, and controls are working together effectively to ensure systems operate as intended, meet business requirements, and maintain availability. While security incidents (A) declining is positive, it's more specific to security governance. Annual training (B) is a control activity, not a governance outcome. Server quantity (D) is irrelevant to governance effectiveness.
Not this one. Try another answer.
Why D is wrong
The number of servers has no correlation with governance quality or effectiveness.
Question 94 Play from 2:51:38
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Resource management addresses personnel and asset allocation but does not provide the cross-project governance needed for multiple simultaneous initiatives.
Not this one. Try another answer.
Why B is wrong
Portfolio management manages investments across the entire organization's projects; program management is more specific to coordinated project groups.
Not this one. Try another answer.
Why C is wrong
Change management handles configuration and change control but does not coordinate multiple projects or their interdependencies.
Right, D is the answer.
Why D is right
Program management is the discipline that oversees multiple related projects (programs) executed simultaneously to achieve strategic objectives. When running multiple IT projects for a DLP initiative, program management provides the governance, coordination, and risk oversight across all projects to ensure they work cohesively and minimize overall risk. This is distinct from managing individual project resources or handling change requests: it requires the holistic orchestration that program management provides.
Question 95 Play from 2:53:38
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
End user training relates to operational capability but does not address the technical control needed to manage replication conflicts.
Not this one. Try another answer.
Why B is wrong
Backing up the source database at both sites does not address how conflicts during active replication are resolved.
Not this one. Try another answer.
Why C is wrong
Identical user rights may be desirable but are not the essential technical control for managing replication conflicts.
Right, D is the answer.
Why D is right
When implementing two-way database replication, the critical control is managing conflicts that arise when the same data is modified on both sites simultaneously. Conflict resolution mechanisms are essential to maintain data integrity and consistency across replicated databases. While other options may be helpful, they are not the primary audit concern for ensuring replication effectiveness.
Question 96 Play from 2:55:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
KRIs being calculated internally by the IT team, while potentially a control design consideration, does not necessarily prevent effective risk monitoring if the results are reviewed.
Not this one. Try another answer.
Why B is wrong
IT investment exceeding industry benchmarks is a resource allocation question but does not directly indicate an unmanaged risk.
Right, C is the answer.
Why C is right
IT key risk indicators (KRIs) that are not periodically reviewed present the highest priority finding because KRIs are essential control mechanisms that alert management to emerging risks. If KRIs are not reviewed regularly, management loses visibility into critical IT risks and cannot respond proactively to deteriorating conditions. This represents a breakdown in the fundamental risk monitoring and governance process.
Not this one. Try another answer.
Why D is wrong
While the board's agenda excluding IT project progress is a governance gap, lacking KRI reviews is a more direct failure in risk identification and management.
Question 97 Play from 2:57:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Annual board meetings are infrequent and do not provide systematic evidence of functional alignment with corporate mission.
Not this one. Try another answer.
Why B is wrong
Biweekly reporting is a communication frequency but does not demonstrate that IT functions actually support corporate objectives.
Not this one. Try another answer.
Why C is wrong
Quarterly steering committee meetings are governance forums but do not inherently demonstrate that IT functionality aligns with mission.
Right, D is the answer.
Why D is right
Analysis of IT department functionality directly demonstrates whether IT operations align with and support the corporate mission by evaluating how effectively IT delivers capabilities that advance organizational objectives. This substantive analysis provides concrete evidence of alignment, whereas the other options are merely communication frequencies or meeting structures that do not necessarily indicate actual strategic alignment.
Question 98 Play from 2:59:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Industry best practices provide useful reference points but do not account for organization-specific risks and priorities.
Not this one. Try another answer.
Why B is wrong
Enterprise architecture describes technical structure but does not identify risks or drive policy content and requirements.
Right, C is the answer.
Why C is right
A risk management process is the primary foundation for developing security policies because it identifies the organization's specific threats, vulnerabilities, and asset values, allowing policies to be tailored to actual organizational risk. While industry best practices inform standards and baselines, they must be adapted to each organization's unique risk profile. Policies derived from risk management ensure resources are allocated to control the risks most material to the organization.
Not this one. Try another answer.
Why D is wrong
Past incidents provide useful lessons but address only historical events; risk management provides forward-looking, comprehensive coverage.
Question 99 Play from 3:01:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Multiple follow-up audits increase audit frequency but do not inherently improve quality; quality must be built into each engagement.
Right, B is the answer.
Why B is right
The most important element of quality control in auditing is the responsibility of leadership for ensuring and maintaining quality standards. Leadership sets the tone, establishes quality standards, allocates resources, and ensures compliance with professional standards. This foundational commitment at the leadership level is what enables all other quality control measures to be effective.
Not this one. Try another answer.
Why C is wrong
While team assignment is part of quality control, it is an operational implementation detail, not the most important element.
Not this one. Try another answer.
Why D is wrong
Resolution procedures address disagreements but are secondary to the fundamental leadership responsibility for quality oversight.
Question 100 Play from 3:03:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Mean alert time measures detection speed but not the full resolution capability or effectiveness.
Not this one. Try another answer.
Why B is wrong
Number of incidents reported reflects reporting culture, not management effectiveness; more reports could indicate worse security.
Not this one. Try another answer.
Why C is wrong
Time between incidents measures overall security posture but is influenced by many factors beyond incident management program quality.
Right, D is the answer.
Why D is right
Incident resolution meantime (MTTR) is the best performance indicator for incident management effectiveness because it directly measures how quickly the organization returns to normal operations and minimizes business impact. This metric reflects the entire incident lifecycle: detection, response, and recovery. While other metrics provide supporting data, MTTR is the most direct measure of program effectiveness and business value.
Transcript
Play from 00:00 Question 1. Which of the following is the MOST important reason to classify a disaster recovery plan (DRP) as confidential? Here are the options. Option A. Ensure compliance with the data classification policy. Option B. Reduce the risk of data leakage that could lead to an attack. Option C. Comply with business continuity best practice. Option D. Protect the plan from unauthorized alteration. Pause the video now if you want time to think about the answer.
The correct answer is B. Reduce the risk of data leakage that could lead to an attack. The most important reason to classify a DRP as confidential is to reduce the risk of data leakage that could lead to an attack. A DRP contains critical infrastructure information, recovery procedures, failover locations, and system dependencies. If this plan were disclosed to malicious actors, they could exploit recovery procedures, target backup facilities, or time attacks to coincide with recovery windows. Preventing this disclosure is the primary security objective. Now, why are the other options incorrect? Option A is incorrect. Compliance with data classification policy is important but is a procedural outcome rather than the fundamental security reason. Option C is incorrect. Business continuity best practice includes many elements beyond just confidentiality classification. Option D is incorrect. While protecting from unauthorized alteration is important, it addresses integrity rather than the primary risk of disclosure-based attacks. Therefore, B, Reduce the risk of data leakage that could lead to an attack, is the correct answer.
Play from 02:00 Question 2. Which of the following areas of responsibility would cause the GREATEST segregation of duties conflict if the individual who performs the related tasks also has approval authority? Here are the options. Option A. Vendor selection and statements of work. Option B. Invoices and reconciliations. Option C. Purchase requisitions and purchase orders. Option D. Goods receipts and payments. Pause the video now if you want time to think about the answer.
The correct answer is D. Goods receipts and payments. Goods receipts and payments present the greatest segregation of duties conflict because one individual could receive goods without proper authorization, then approve and process payment without anyone verifying that goods were actually received or that the invoice matches the goods received. This creates opportunity for fraud involving non-receipt of goods, quantity discrepancies, or unauthorized payments. The combination of these two functions directly controls cash disbursement. Now, why are the other options incorrect? Option A is incorrect. Vendor selection and statements of work can be performed by the same person as these are primarily planning activities. Option B is incorrect. Invoices and reconciliations, while related, do not create the same direct payment risk as receipt and payment combined. Option C is incorrect. Purchase requisitions and purchase orders are sequential procurement steps that can reasonably be combined. Therefore, D, Goods receipts and payments, is the correct answer.
Play from 03:53 Question 3. Which of the following is of GREATEST concern with open USB ports on end-user PCs? Here are the options. Option A. Data leakage. Option B. Data corruption. Option C. Installation of unauthorized software. Option D. Connection of a personal device. Pause the video now if you want time to think about the answer.
The correct answer is A. Data leakage. Open USB ports on end-user PCs present the greatest concern for data leakage because they allow unauthorized copying of sensitive data to external devices without restriction. This is a direct and critical threat to confidentiality and information security. While unauthorized software installation and personal devices are also risks, data leakage is the most severe and commonly exploited vulnerability. Now, why are the other options incorrect? Option B is incorrect. USB connections are unlikely to cause data corruption; they are designed for reliable data transfer. Option C is incorrect. While unauthorized software installation is a risk, it is secondary to the immediate threat of data loss. Option D is incorrect. Connection of personal devices is a symptom of the larger risk, not the primary concern itself. Therefore, A, Data leakage, is the correct answer.
Show full transcriptShow less
Play from 05:33 Question 4. Which of the following should be the GREATEST concern to an IS auditor performing an IT governance review? Here are the options. Option A. IT and business goals are not well defined. Option B. IT reports to the chief financial officer (CFO). Option C. The IT steering committee does not capture meeting minutes. Option D. IT security and IT operations are using two separate frameworks. Pause the video now if you want time to think about the answer.
The correct answer is A. IT and business goals are not well defined. IT and business goals not being well defined is the greatest concern because it undermines all IT governance activities. Without clear, aligned goals, the organization cannot effectively direct IT investments, measure performance, manage risks, or ensure IT strategy supports business objectives. This is a foundational governance issue. Now, why are the other options incorrect? Option B is incorrect. IT reporting to the CFO is an organizational structure choice that does not inherently indicate poor governance; many organizations function effectively with this structure. Option C is incorrect. Missing meeting minutes is a documentation deficiency that is a compliance issue but does not reflect underlying governance effectiveness. Option D is incorrect. Using separate frameworks for security and operations can be appropriate depending on organizational needs and does not necessarily indicate poor governance if coordinated effectively. Therefore, A, IT and business goals are not well defined, is the correct answer.
Play from 07:29 Question 5. Which of the following should an IS auditor be MOST concerned with during a post- implementation review? Here are the options. Option A. The system does not have a maintenance plan. Option B. The system contains several minor defects. Option C. The system deployment was delayed by three weeks. Option D. The system was over budget by 15%. Pause the video now if you want time to think about the answer.
The correct answer is A. The system does not have a maintenance plan. During a post-implementation review, the absence of a maintenance plan is the most critical concern because it indicates lack of planning for ongoing system support, updates, and issue resolution. Without a maintenance plan, the organization cannot sustain system performance, security, and compliance over time. While minor defects, deployment delays, and budget overruns are concerns, they do not pose the same level of operational risk as the lack of a formal maintenance framework. Now, why are the other options incorrect? Option B is incorrect. Minor defects are typically expected and can be resolved through normal maintenance processes. Option C is incorrect. Deployment delays are historical issues that do not impact ongoing system operations post-implementation. Option D is incorrect. Budget overruns, while financially concerning, do not affect the system's ability to function and be maintained going forward. Therefore, A, The system does not have a maintenance plan, is the correct answer.
Play from 09:20 Question 6. Which of the following is the MOST important responsibility of user departments associated with program changes? Here are the options. Option A. Analyzing change requests. Option B. Providing unit test data. Option C. Updating documentation to reflect latest changes. Option D. Approving changes before implementation. Pause the video now if you want time to think about the answer.
The correct answer is D. Approving changes before implementation. Approving changes before implementation is the user department's most critical responsibility because they understand business requirements and can determine whether proposed changes will meet functional needs and avoid negative business impact. This approval gate prevents technically approved but operationally inappropriate changes from being deployed. While user departments provide test data, analyze requests, and update documentation, these are supporting activities; approval authority ensures their interests are protected. Now, why are the other options incorrect? Option A is incorrect. Change request analysis is typically a technical IT function, though users may participate. Option B is incorrect. Providing unit test data is important but supporting rather than primary responsibility. Option C is incorrect. Documentation updates are important but occur after approval decisions and are secondary to the approval decision itself. Therefore, D, Approving changes before implementation, is the correct answer.
Play from 11:10 Question 7. A database administrator (DBA) should be prevented from: Here are the options. Option A. accessing sensitive information. Option B. having end user responsibilities. Option C. having access to production files. Option D. using an emergency user ID. Pause the video now if you want time to think about the answer.
The correct answer is B. having end user responsibilities. A database administrator should be prevented from having end user responsibilities to maintain proper segregation of duties. DBAs require access to production files and sensitive data as part of their legitimate role, and emergency user IDs may be necessary for disaster recovery. However, combining DBA duties with end user responsibilities creates a conflict of interest and increases the risk of unauthorized modifications or data manipulation without proper oversight. Now, why are the other options incorrect? Option A is incorrect. DBAs legitimately need access to sensitive information to perform their duties; the issue is controlling and monitoring that access, not preventing it entirely. Option C is incorrect. DBAs must have access to production files to perform backup, recovery, maintenance, and troubleshooting functions. Option D is incorrect. Emergency user IDs are a necessary control for business continuity and disaster recovery scenarios. Therefore, B, having end user responsibilities, is the correct answer.
Play from 13:03 Question 8. An IS auditor determines that the vendor's deliverables do not include the source code for a newly acquired product. To address this issue, which of the following should the auditor recommend be included in the contract? Here are the options. Option A. Software escrow agreement. Option B. Service level agreement (SLA). Option C. Confidentiality and data protection clauses. Option D. Right-to-audit clause. Pause the video now if you want time to think about the answer.
The correct answer is A. Software escrow agreement. A software escrow agreement is the appropriate mechanism to ensure access to source code when the vendor becomes unavailable or fails to support the product. It protects the organization's ability to maintain and support the software independently. This directly addresses the identified gap of missing source code deliverables. Now, why are the other options incorrect? Option B is incorrect. An SLA addresses service levels and uptime commitments, not source code access. Option C is incorrect. Confidentiality and data protection clauses govern data handling, not source code delivery or access. Option D is incorrect. A right-to-audit clause permits auditing of vendor processes but does not specifically secure source code access. Therefore, A, Software escrow agreement, is the correct answer.
Play from 14:45 Question 9. Which of the following BEST enables an IS auditor to objectively determine the performance of an IT business process? Here are the options. Option A. Management sign-off on performance reports. Option B. Capability maturity models. Option C. Control self-assessment (CSA) questionnaire. Option D. Recalculated key performance indicators (KPIs). Pause the video now if you want time to think about the answer.
The correct answer is D. Recalculated key performance indicators (KPIs). Recalculated Key Performance Indicators (KPIs) enable objective determination of performance because the auditor independently verifies and recalculates metrics based on raw data, rather than relying on management reports. This provides independent, factual measurement free from bias or management interpretation. Management sign-off is subjective approval, CSA questionnaires are self-assessment and inherently biased, and capability maturity models are frameworks for assessment rather than objective performance measurement tools. Now, why are the other options incorrect? Option A is incorrect. Management sign-off represents approval but not objective performance determination; it reflects management perspective rather than independent verification. Option B is incorrect. Capability maturity models provide a framework for assessment but do not directly measure or objectively determine performance metrics. Option C is incorrect. Control self-assessment questionnaires are self-reported and inherently subjective, lacking the independence needed for objective determination. Therefore, D, Recalculated key performance indicators (KPIs), is the correct answer.
Play from 16:50 Question 10. Which of the following system implementation approaches allows for the LONGEST overlap period between the old and new systems? Here are the options. Option A. Phased. Option B. Modular. Option C. Pilot. Option D. Parallel. Pause the video now if you want time to think about the answer.
The correct answer is D. Parallel. The parallel approach runs old and new systems simultaneously, providing the longest overlap period. This allows users to work with both systems concurrently, providing fallback capability and maximum validation time. Phased implementation is gradual but doesn't maintain full parallel operation. Modular and pilot approaches are narrower in scope and don't create extended overlap of complete systems. Now, why are the other options incorrect? Option A is incorrect. Phased implementation is gradual but each phase displaces the previous system; there is no extended overlap. Option B is incorrect. Modular implementation involves deploying modules incrementally, not maintaining parallel full systems. Option C is incorrect. Pilot implementation tests on a limited user group before full deployment, not a long overlap period. Therefore, D, Parallel, is the correct answer.
Play from 18:26 Question 11. Coding standards provide which of the following? Here are the options. Option A. Access control tables. Option B. Data flow diagrams. Option C. Field naming conventions. Option D. Program documentation. Pause the video now if you want time to think about the answer.
The correct answer is C. Field naming conventions. Coding standards provide field naming conventions that establish consistent naming practices across applications and systems. This promotes code readability, maintainability, and reduces errors from inconsistent variable or field naming. Field naming conventions are a core element of coding standards that developers follow during application development. Now, why are the other options incorrect? Option A is incorrect. Access control tables are security controls, not part of coding standards. Option B is incorrect. Data flow diagrams are system design artifacts, not a component of coding standards. Option D is incorrect. Program documentation is generated from code but is not itself a coding standard convention. Therefore, C, Field naming conventions, is the correct answer.
Play from 19:55 Question 12. In a review of the organization standards and guidelines for IT management, which of the following should be included in an IS development methodology? Here are the options. Option A. Risk management techniques. Option B. Access control rules. Option C. Value-added activity analysis. Option D. Incident management techniques. Pause the video now if you want time to think about the answer.
The correct answer is A. Risk management techniques. An IS development methodology must incorporate risk management techniques to identify, assess, and mitigate risks throughout the development lifecycle. This ensures that security, compliance, and operational risks are systematically addressed during system design and implementation. While access control and incident management are important IT controls, they are not core components of a development methodology itself. Value- added activity analysis relates to business process optimization rather than development methodology. Now, why are the other options incorrect? Option B is incorrect. Access control rules are operational security controls, not part of the development methodology framework. Option C is incorrect. Value-added activity analysis pertains to business process improvement, not software development methodology. Option D is incorrect. Incident management techniques are post-deployment operational controls, not part of the development process. Therefore, A, Risk management techniques, is the correct answer.
Play from 21:50 Question 13. During a post-implementation review, which of the following provides the BEST evidence that user requirements have been met? Here are the options. Option A. Operator error logs. Option B. End-user documentation. Option C. User acceptance testing (UAT). Option D. Management interviews. Pause the video now if you want time to think about the answer.
The correct answer is C. User acceptance testing (UAT). User Acceptance Testing (UAT) provides the best evidence that user requirements have been met because it involves actual end-users validating that the system meets their specified requirements through practical testing and sign-off, providing concrete evidence of requirement fulfillment. Now, why are the other options incorrect? Option A is incorrect. Operator error logs indicate system issues but do not demonstrate that requirements have been met. Option B is incorrect. Documentation alone does not prove requirements are actually met in practice. Option D is incorrect. Management interviews are subjective and lack the objective evidence that UAT results provide. Therefore, C, User acceptance testing (UAT), is the correct answer.
Play from 23:26 Question 14. Which of the following is a concern associated with virtualization? Here are the options. Option A. One host may have multiple versions of the same operating system. Option B. Performance issues with the host could impact the guest operating systems. Option C. The physical footprint of servers could decrease within the data center. Option D. Processing capacity may be shared across multiple operating systems. Pause the video now if you want time to think about the answer.
The correct answer is B. Performance issues with the host could impact the guest operating systems. A significant concern with virtualization is that performance issues or failures on the host system can degrade or disable all guest operating systems running on that host. This creates a single point of failure where multiple systems depend on one physical host, concentrating risk. A host system experiencing resource contention, overload, or hardware failure impacts all virtual machines simultaneously, unlike traditional distributed physical servers. Now, why are the other options incorrect? Option A is incorrect. Running multiple versions of the same OS on one host is actually a benefit of virtualization, enabling flexibility and testing. Option C is incorrect. Decreased physical footprint is a key advantage of virtualization, not a concern. Option D is incorrect. Shared processing capacity across multiple operating systems is the intended design benefit of virtualization, not a concern. Therefore, B, Performance issues with the host could impact the guest operating systems, is the correct answer.
Play from 25:23 Question 15. Which of the following is the BEST control to help prevent sensitive data leaving an organization via email? Here are the options. Option A. Scanning outgoing emails. Option B. Blocking outbound emails sent without encryption. Option C. Conducting periodic phishing tests. Option D. Providing encryption solutions for employees. Pause the video now if you want time to think about the answer.
The correct answer is B. Blocking outbound emails sent without encryption. Blocking outbound emails sent without encryption is the BEST preventive control because it enforces a technical requirement that prevents sensitive data from leaving the organization unprotected. This control operates at the point of transmission and cannot be bypassed by user choice, making it a mandatory safeguard. Scanning emails detects issues after the fact, encryption solutions require user adoption, and phishing tests address a different threat vector. Now, why are the other options incorrect? Option A is incorrect. Scanning provides detection but not prevention; emails could still be sent unencrypted if scanning is the only control. Option C is incorrect. Phishing tests address credential compromise, not sensitive data exfiltration via email. Option D is incorrect. Providing encryption solutions without enforcement allows users to opt out, leaving the organization vulnerable. Therefore, B, Blocking outbound emails sent without encryption, is the correct answer.
Play from 27:12 Question 16. Which of the following is MOST important to consider when scheduling follow-up audits? Here are the options. Option A. The impact if corrective actions are not taken. Option B. The amount of time the auditee has agreed to spend with auditors. Option C. The efforts required for independent verification with new auditors. Option D. Controls and detection risks related to the observations. Pause the video now if you want time to think about the answer.
The correct answer is A. The impact if corrective actions are not taken. The impact if corrective actions are not taken is the most important consideration for scheduling follow-up audits. High-impact findings require prompt follow-up because delayed remediation exposes the organization to greater risk. Risk-based scheduling ensures resources are focused where they matter most. The auditor's agreement on time commitment is a logistical constraint but not the primary determinant. Verification efforts with new auditors are procedural considerations. While control and detection risks are relevant, they are secondary to understanding the business impact of unresolved issues. Now, why are the other options incorrect? Option B is incorrect. Auditor time availability is a logistical matter, not the primary driver of follow-up scheduling decisions. Option C is incorrect. Verification procedures are implementation details, not the main factor in scheduling decisions. Option D is incorrect. Control and detection risks are relevant but secondary to assessing the impact of unresolved findings. Therefore, A, The impact if corrective actions are not taken, is the correct answer.
Play from 29:11 Question 17. Which of the following is the PRIMARY reason for using a hash function? Here are the options. Option A. To verify the integrity of data. Option B. To encrypt private keys. Option C. To create a fixed length value of a public key. Option D. To authorize the receiver of data. Pause the video now if you want time to think about the answer.
The correct answer is A. To verify the integrity of data. The primary reason for using a hash function is to verify data integrity. Hash functions produce a fixed-length digest of data; if the data is altered, the hash changes, enabling detection of unauthorized modifications. Option B conflates hashing with encryption; hashing is not suitable for encrypting keys. Option C describes a use case but not the primary purpose. Option D relates to authentication/authorization, not the core cryptographic function of hashing. Now, why are the other options incorrect? Option B is incorrect. Hash functions are not encryption mechanisms and should not be used to encrypt private keys; encryption algorithms serve that purpose. Option C is incorrect. While hash functions do create fixed-length values, this is a characteristic rather than the primary reason for their use. Option D is incorrect. Hash functions support authentication and integrity but authorization is a separate security function. Therefore, A, To verify the integrity of data, is the correct answer.
Play from 31:01 Question 18. Which of the following techniques provides the BEST assurance of server availability over time? Here are the options. Option A. Analyzing logs in the server administration console. Option B. Reviewing reported downtime from users. Option C. Evaluating downtime based on planned outages. Option D. Manually pinging the server on a daily basis. Pause the video now if you want time to think about the answer.
The correct answer is A. Analyzing logs in the server administration console. Analyzing logs in the server administration console provides comprehensive, continuous, and objective data about server availability and downtime over time. Logs capture all availability events, can be aggregated for trends, and are verifiable, providing the best assurance of actual server availability patterns compared to subjective user reports or limited manual checks. Now, why are the other options incorrect? Option B is incorrect. User-reported downtime is subjective, often incomplete, and may miss unnoticed availability issues. Option C is incorrect. Planned outages are known events and don't reflect unexpected downtime or availability trends. Option D is incorrect. Manual daily pinging is sparse, inconsistent, and cannot capture downtime events between checks. Therefore, A, Analyzing logs in the server administration console, is the correct answer.
Play from 32:46 Question 19. An IS auditor is reviewing a data conversion project. Which of the following is the auditor's BEST recommendation prior to go-live? Here are the options. Option A. Automate the test scripts. Option B. Conduct a mock conversion test. Option C. Review test procedures and scenarios. Option D. Establish a configuration baseline. Pause the video now if you want time to think about the answer.
The correct answer is B. Conduct a mock conversion test. A mock conversion test is the best pre-go-live recommendation because it simulates the actual conversion process in a controlled environment, allowing the team to identify and resolve issues before the real conversion occurs. This reduces the risk of data loss, corruption, or system failures during the actual go-live. While automating test scripts, reviewing procedures, and establishing baselines are all valuable activities, none directly simulates and validates the complete conversion process as effectively as a mock conversion test. Now, why are the other options incorrect? Option A is incorrect. Automating test scripts is helpful but comes after establishing what the test scripts should validate through a mock conversion. Option C is incorrect. Reviewing test procedures is preparatory work that should occur before the mock conversion test. Option D is incorrect. Establishing a configuration baseline is important but does not directly test the conversion process itself. Therefore, B, Conduct a mock conversion test, is the correct answer.
Play from 34:45 Question 20. Which of the following should be done FIRST when creating a data protection program? Here are the options. Option A. Test logical access controls for effectiveness. Option B. Perform classification based on standards. Option C. Implement data loss prevention (DLP) controls. Option D. Deploy intrusion detection systems (IDS). Pause the video now if you want time to think about the answer.
The correct answer is B. Perform classification based on standards. Classification based on standards must be done first when creating a data protection program because it establishes which data requires protection and at what level. Classification provides the foundation for all subsequent decisions about access controls, DLP implementation, and security measures. Without understanding what data exists and its sensitivity, other controls cannot be properly designed or deployed. Now, why are the other options incorrect? Option A is incorrect. Testing logical access controls is a later validation step after controls have been designed based on data classification. Option C is incorrect. DLP controls are implemented after understanding what data needs protection through classification. Option D is incorrect. IDS deployment is a technical measure that follows the foundational classification and protection strategy. Therefore, B, Perform classification based on standards, is the correct answer.
Play from 36:30 Question 21. Which of the following has the GREATEST potential impact on the independence of an IS auditor? Here are the options. Option A. Prior experience in IS audit. Option B. Prior relationship with vendors. Option C. Prior knowledge of technology. Option D. Prior job responsibilities. Pause the video now if you want time to think about the answer.
The correct answer is B. Prior relationship with vendors. Prior relationships with vendors create significant threats to auditor independence because the auditor may face pressure to favor the vendor, avoid critical findings, or be perceived as biased. This compromises the auditor's objectivity in evaluating vendor performance and related controls. Now, why are the other options incorrect? Option A is incorrect. Prior experience in IS audit enhances competence and does not threaten independence. Option C is incorrect. Prior knowledge of technology is beneficial to audit quality and does not create independence concerns. Option D is incorrect. Prior job responsibilities in IT may require careful management but are not the greatest threat to independence compared to vendor relationships. Therefore, B, Prior relationship with vendors, is the correct answer.
Play from 38:03 Question 22. A web application is developed in-house by an organization. Which of the following would provide the BEST evidence to an IS auditor that the application is secure from external attack? Here are the options. Option A. Database application monitoring logs. Option B. Code review by a third party. Option C. Penetration test results. Option D. Web application firewall implementation. Pause the video now if you want time to think about the answer.
The correct answer is C. Penetration test results. Penetration test results provide the best evidence of application security from external attack because they simulate real-world attack scenarios and demonstrate whether the application can withstand actual exploitation attempts. This is direct, practical evidence of security posture. Database logs show operational activity; code reviews identify potential vulnerabilities but not actual exploitability; and a firewall is a network control that doesn't prove application code security. Now, why are the other options incorrect? Option A is incorrect. Database monitoring logs show operational activity but do not demonstrate vulnerability to external attacks. Option B is incorrect. Code reviews can identify potential issues but provide no evidence of actual security against real exploitation. Option D is incorrect. A firewall is a network perimeter control that does not prove the application itself is secure from attack. Therefore, C, Penetration test results, is the correct answer.
Play from 39:58 Question 23. Which of the following would be of GREATEST concern to an IS auditor when a multi- function printer device is sent offsite for maintenance? Here are the options. Option A. The printout has to be redirected to another department. Option B. Maintenance costs exceed the value of the device. Option C. Business impact during the maintenance period. Option D. Internal memory does not automatically clear. Pause the video now if you want time to think about the answer.
The correct answer is D. Internal memory does not automatically clear. The greatest concern when a multi-function printer is sent offsite for maintenance is that internal memory does not automatically clear, which could expose sensitive data (cached documents, user information, scanned materials) to maintenance personnel or unauthorized access. This represents a direct security and confidentiality risk. Options A, B, and C are operational or financial concerns but do not pose security risks to sensitive information. Now, why are the other options incorrect? Option A is incorrect. Printout redirection is a temporary operational inconvenience, not a security concern. Option B is incorrect. Maintenance costs exceeding device value is a financial decision, not a security risk. Option C is incorrect. Business impact during maintenance is an availability concern but does not pose information security risks. Therefore, D, Internal memory does not automatically clear, is the correct answer.
Play from 41:48 Question 24. The IS quality assurance (QA) group is responsible for: Here are the options. Option A. monitoring the execution of computer processing tasks. Option B. designing procedures to protect data against accidental disclosure. Option C. ensuring that program changes adhere to established standards. Option D. ensuring that the output received from system processing is complete. Pause the video now if you want time to think about the answer.
The correct answer is C. ensuring that program changes adhere to established standards. The QA group's primary responsibility is ensuring that program changes adhere to established standards, encompassing code review, change management compliance, configuration management, and validation that modifications meet organizational standards before deployment. This oversight ensures system integrity and consistency. Option A describes operational monitoring, option B describes data protection design, and option D describes output validation, which are distinct from the QA function of enforcing development standards. Now, why are the other options incorrect? Option A is incorrect. Monitoring execution of computer processing tasks is an operations responsibility, not QA. Option B is incorrect. Designing data protection procedures is a security design responsibility, not QA. Option D is incorrect. Ensuring output completeness is a system validation and operations responsibility, not QA's primary focus on standards adherence. Therefore, C, ensuring that program changes adhere to established standards, is the correct answer.
Play from 43:47 Question 25. Which of the following should be considered when examining fire suppression systems as part of a data center environmental controls review? Here are the options. Option A. Maintenance procedures. Option B. Onsite replacement availability. Option C. Installation manuals. Option D. Insurance coverage. Pause the video now if you want time to think about the answer.
The correct answer is A. Maintenance procedures. When examining fire suppression systems as part of environmental controls review, maintenance procedures are critical because they ensure the system remains operational and effective. Maintenance procedures directly impact system reliability and compliance with regulatory requirements. While onsite replacement availability, installation manuals, and insurance coverage have some relevance, maintenance procedures are the most essential consideration for assessing whether the fire suppression system can be properly maintained and relied upon to function when needed. Now, why are the other options incorrect? Option B is incorrect. Onsite replacement availability is a logistical consideration but less critical than ensuring proper maintenance of existing systems. Option C is incorrect. Installation manuals are historical documentation; ongoing maintenance procedures are more important for current system viability. Option D is incorrect. Insurance coverage addresses financial responsibility but does not assess the technical adequacy of the fire suppression system itself. Therefore, A, Maintenance procedures, is the correct answer.
Play from 45:37 Question 26. Which of the following is MOST helpful to a project manager in mitigating risk associated with frequent changes in project requirements? Here are the options. Option A. Conducting post-implementation reviews. Option B. Monitoring changes in risk factors. Option C. Performing mid-term project reviews. Option D. Implementing formal reviews of changes. Pause the video now if you want time to think about the answer.
The correct answer is D. Implementing formal reviews of changes. Formal reviews of changes establish a controlled process that evaluates the impact, feasibility, and priority of requirement changes before implementation. This process mitigates risk by ensuring changes are understood, justified, and managed systematically rather than ad-hoc. Formal change reviews prevent uncontrolled requirement creep and help the project manager maintain project stability and timelines. Now, why are the other options incorrect? Option A is incorrect. Post-implementation reviews occur after completion and cannot mitigate risks to ongoing project execution. Option B is incorrect. Monitoring changes in risk factors is reactive and does not prevent or control requirement changes from being implemented. Option C is incorrect. Mid-term reviews assess current status but do not establish a preventive process for controlling changes as they are proposed. Therefore, D, Implementing formal reviews of changes, is the correct answer.
Play from 47:28 Question 27. Which of the following is MOST important for an IS auditor to do during an exit meeting with an auditee? Here are the options. Option A. Specify implementation dates for the recommendations. Option B. Ensure that the facts presented in the report are correct. Option C. Communicate the recommendations to senior management. Option D. Request input in determining corrective action. Pause the video now if you want time to think about the answer.
The correct answer is B. Ensure that the facts presented in the report are correct. Ensuring that the facts presented in the audit report are correct is the most important function of an exit meeting. This final verification step with the auditee allows for clarification, correction of any factual errors, and confirmation of accuracy before the report is finalized, protecting the integrity of the audit and preventing disputes over the findings. Now, why are the other options incorrect? Option A is incorrect. Specifying implementation dates is the auditee's responsibility in response to recommendations, not the auditor's role. Option C is incorrect. Communicating recommendations to senior management occurs after the exit meeting and is part of report distribution. Option D is incorrect. While input on corrective actions is valuable, ensuring factual accuracy of the report itself is the primary auditor responsibility in the exit meeting. Therefore, B, Ensure that the facts presented in the report are correct, is the correct answer.
Play from 49:18 Question 28. Which of the following should be an IS auditor's GREATEST concern when reviewing a business continuity plan (BCP)? Here are the options. Option A. Some critical business processes are not included in the BCP. Option B. Business unit personnel are not aware of the BCP. Option C. There is no evidence that the BCP has been tested. Option D. An offsite storage location is not documented in the BCP. Pause the video now if you want time to think about the answer.
The correct answer is A. Some critical business processes are not included in the BCP. Critical business processes not being included in the BCP is the greatest concern because the purpose of business continuity is to ensure continuity of essential operations. If key processes are omitted, the BCP fundamentally fails at its objective, and the organization cannot recover critical functions during a disaster. This represents a gap in coverage that invalidates the entire continuity strategy. Now, why are the other options incorrect? Option B is incorrect. Personnel awareness is important for BCP effectiveness but can be remedied through training; lack of awareness does not indicate the plan itself is inadequate. Option C is incorrect. Lack of testing evidence is a significant concern but represents a control over plan verification; the plan may still cover necessary processes. Option D is incorrect. Missing offsite storage is a control deficiency but is one specific element; it does not indicate whether the BCP addresses recovery of critical processes. Therefore, A, Some critical business processes are not included in the BCP, is the correct answer.
Play from 51:21 Question 29. Which of the following is MOST important for an organization to complete prior to developing its disaster recovery plan (DRP)? Here are the options. Option A. Business impact analysis (BIA). Option B. Comprehensive IT inventory. Option C. Support staff skills gap analysis. Option D. Risk assessment. Pause the video now if you want time to think about the answer.
The correct answer is A. Business impact analysis (BIA). A Business Impact Analysis (BIA) is the most important prerequisite before developing a disaster recovery plan. The BIA identifies critical business functions, their interdependencies, acceptable downtime windows (RTO), and data loss tolerances (RPO). Without this analysis, the organization cannot prioritize recovery efforts or allocate resources effectively. The BIA provides the quantitative and qualitative data necessary to make informed decisions about which functions to recover first and at what cost. While IT inventory and risk assessment are useful, and staff skills are relevant, the BIA directly drives the recovery strategy and priorities. Now, why are the other options incorrect? Option B is incorrect. IT inventory is helpful but comes after understanding business criticality determined by the BIA. Option C is incorrect. Skills gap analysis addresses execution capabilities but is secondary to understanding what needs to be recovered. Option D is incorrect. Risk assessment is valuable but the BIA is more directly tied to DRP development and prioritization. Therefore, A, Business impact analysis (BIA), is the correct answer.
Play from 53:27 Question 30. IS audit management reviewed the audit work done for a system implementation and determined that the weaknesses responsible for a major issue were not in the audit scope. Which type of audit risk was MOST likely overlooked when planning the audit? Here are the options. Option A. Statistical sampling risk. Option B. Detection risk. Option C. Control risk. Option D. Inherent risk. Pause the video now if you want time to think about the answer.
The correct answer is D. Inherent risk. Inherent risk represents the susceptibility of an area to error or irregularity before considering controls. When major weaknesses were not included in the audit scope, this indicates the auditor failed to properly identify and assess inherent risks in the system implementation area. This oversight in scope definition suggests inadequate inherent risk assessment during audit planning. Now, why are the other options incorrect? Option A is incorrect. Statistical sampling risk relates to the precision of sample-based conclusions, not scope definition. Option B is incorrect. Detection risk concerns the auditor's ability to find exceptions through testing procedures, not scope omissions. Option C is incorrect. Control risk addresses the likelihood that controls won't prevent or detect issues, but this assumes the area was in scope. Therefore, D, Inherent risk, is the correct answer.
Play from 55:07 Question 31. Which of the following is a deterrent security control that reduces the likelihood of an insider threat event? Here are the options. Option A. Removing malicious code. Option B. Distributing disciplinary policies. Option C. Creating contingency plans. Option D. Executing data recovery procedures. Pause the video now if you want time to think about the answer.
The correct answer is B. Distributing disciplinary policies. Distributing disciplinary policies is a deterrent control that reduces the likelihood of insider threats by making clear the consequences of misconduct. Deterrent controls work by discouraging bad behavior through knowledge of penalties. Removing malicious code (A) is a corrective control addressing existing threats. Contingency plans (C) and data recovery (D) are recovery controls addressing consequences, not preventing the threat from occurring. Now, why are the other options incorrect? Option A is incorrect. Removing malicious code is a corrective control, not a deterrent. Option C is incorrect. Contingency plans are contingency controls, not deterrent controls. Option D is incorrect. Data recovery procedures are recovery controls, not preventive or deterrent controls. Therefore, B, Distributing disciplinary policies, is the correct answer.
Play from 56:44 Question 32. Which of the following is the MOST effective method to identify new errors introduced as a result of program changes? Here are the options. Option A. Interface testing. Option B. Unit testing. Option C. Regression testing. Option D. Integration testing. Pause the video now if you want time to think about the answer.
The correct answer is C. Regression testing. Regression testing specifically re-executes previously passing tests after code changes to identify newly introduced errors. It ensures that modifications have not broken existing functionality, making it the most effective method for detecting errors that result directly from program changes. Now, why are the other options incorrect? Option A is incorrect. Interface testing focuses on data flow between modules but is not specifically designed to catch new errors from changes. Option B is incorrect. Unit testing validates individual code units but may not catch integration-level errors introduced by changes. Option D is incorrect. Integration testing verifies component interaction but is broader than regression testing and less targeted at change-specific errors. Therefore, C, Regression testing, is the correct answer.
Play from 58:16 Question 33. Which of the following is the PRIMARY reason for an IS auditor to conduct post- implementation reviews? Here are the options. Option A. To document lessons learned to improve future project delivery. Option B. To align project objectives with business needs. Option C. To determine whether project objectives in the business case have been achieved. Option D. To ensure key stakeholder sign-off has been obtained. Pause the video now if you want time to think about the answer.
The correct answer is C. To determine whether project objectives in the business case have been achieved. The primary purpose of a post-implementation review is to evaluate whether the project has successfully achieved its original objectives as defined in the business case. This assessment determines the project's success and value delivery to the organization. While lessons learned (option A) are documented during post-implementation reviews, this is a secondary benefit rather than the primary reason. The primary focus must be on validating that intended outcomes were achieved. Now, why are the other options incorrect? Option A is incorrect. Documenting lessons learned is an important secondary outcome but not the primary purpose of the review. Option B is incorrect. Aligning objectives with business needs should occur during project initiation, not as the primary goal of post-implementation review. Option D is incorrect. Stakeholder sign-off is typically obtained during the project, not as the primary focus of a post-implementation review. Therefore, C, To determine whether project objectives in the business case have been achieved, is the correct answer.
Play from 1:00:20 Question 34. Which of the following is the MOST appropriate and effective fire suppression method for an unstaffed computer room? Here are the options. Option A. Water sprinkler. Option B. Fire extinguishers. Option C. Carbon dioxide (CO ). Option D. Dry pipe. Pause the video now if you want time to think about the answer.
The correct answer is C. Carbon dioxide (CO ). Carbon dioxide (CO ) is the most appropriate fire suppression method for unstaffed â‚‚ computer rooms because it extinguishes fire without leaving residue, doesn't damage sensitive equipment, and poses no corrosion risk. CO is safe for unoccupied spaces and â‚‚ doesn't require cleanup like water-based systems. It's specifically designed for facilities with valuable equipment and no personnel present. Now, why are the other options incorrect? Option A is incorrect. Water sprinklers cause significant damage to electronics and equipment, making them unsuitable for computer rooms. Option B is incorrect. Fire extinguishers require human operation and cannot work in unstaffed environments where fires go undetected initially. Option D is incorrect. Dry pipe systems are better suited for areas with water damage concerns but are not specifically optimized for equipment protection like COâ‚‚ systems. Therefore, C, Carbon dioxide (CO ), is the correct answer.
Play from 1:02:04 Question 35. In the review of a feasibility study for an IS acquisition, the MOST important step is to: Here are the options. Option A. determine whether the cost-benefits are achievable. Option B. ensure that a contingency plan is in place should the project fail. Option C. determine whether security and control requirements have been specified. Option D. ensure that the right to audit the vendor has been considered. Pause the video now if you want time to think about the answer.
The correct answer is C. determine whether security and control requirements have been specified. Ensuring security and control requirements have been specified is the most important step in reviewing an acquisition feasibility study because security and controls are foundational to the system's ability to meet business needs reliably and safely. Without specified security and control requirements, the acquisition may result in a system that fails to protect data, creates audit findings, or introduces vulnerabilities. This is a critical prerequisite that cannot be remedied after acquisition. Now, why are the other options incorrect? Option A is incorrect. Cost-benefit analysis is important but secondary to ensuring the system meets security and control baselines. Option B is incorrect. Contingency planning for failure is valuable but doesn't address whether the system meets fundamental security requirements. Option D is incorrect. Audit rights are important contractually but don't assess whether the system itself meets required security and control standards. Therefore, C, determine whether security and control requirements have been specified, is the correct answer.
Play from 1:04:02 Question 36. An e-commerce company wants to ensure customers can update payment information securely through their phones. On which servers should Transport Layer Security (TLS) certificates be installed? Here are the options. Option A. Proxy servers. Option B. Web servers. Option C. Database servers. Option D. Application servers. Pause the video now if you want time to think about the answer.
The correct answer is B. Web servers. TLS certificates must be installed on web servers because they handle direct HTTPS connections with client browsers. When customers access the payment information update page through their phones, their browsers establish a TLS connection with the web server, which presents the certificate. The web server is the first point of encrypted communication with the client and is where the certificate must reside. Now, why are the other options incorrect? Option A is incorrect. While proxy servers may handle traffic, TLS termination for client connections occurs at the web server. Option C is incorrect. Database servers handle data storage and do not directly communicate with customers' browsers over HTTPS. Option D is incorrect. Application servers process business logic but do not directly handle client TLS connections; the web server does. Therefore, B, Web servers, is the correct answer.
Play from 1:05:47 Question 37. An IS auditor reviewing an IT organization should be MOST concerned if the IT steering committee: Here are the options. Option A. does not meet regularly for oversight of IT investments and projects. Option B. consults the board of directors on procedural and standard changes. Option C. reviews IT-related policies and standards only once per year. Option D. does not include business-level representation. Pause the video now if you want time to think about the answer.
The correct answer is D. does not include business-level representation. The absence of business-level representation on the IT steering committee is the greatest concern because the committee's purpose is to align IT investments with business objectives. Without business representatives, IT decisions may be made without understanding business priorities, leading to misalignment between IT projects and organizational strategy. This fundamentally undermines effective IT governance. Now, why are the other options incorrect? Option A is incorrect. Irregular meetings are a concern but can be remedied; the structural absence of business representation is a fundamental governance flaw. Option B is incorrect. Consulting the board on procedural changes demonstrates appropriate escalation for significant matters. Option C is incorrect. Annual review of policies and standards, while infrequent, may be acceptable depending on organizational volatility and is less critical than business representation. Therefore, D, does not include business-level representation, is the correct answer.
Play from 1:07:46 Question 38. The record-locking option of a database management system (DBMS) serves to: Here are the options. Option A. allow users to lock others out of their files. Option B. eliminate the risk of concurrent updates to a record. Option C. restrict users from changing certain values within records. Option D. allow database administrators (DBAs) to record the activities of users. Pause the video now if you want time to think about the answer.
The correct answer is B. eliminate the risk of concurrent updates to a record. Record-locking in a DBMS prevents concurrent updates by ensuring that only one user can modify a record at any given time. When a record is locked, other users attempting to access it for updates must wait until the lock is released. This eliminates data corruption from simultaneous conflicting writes and maintains data integrity and consistency during multi-user access. Now, why are the other options incorrect? Option A is incorrect. Record locking prevents concurrent updates to a specific record, not access to user files; the purpose is not to lock other users out arbitrarily. Option C is incorrect. Restricting changes to certain values is accomplished through field-level access controls or constraints, not record-level locking mechanisms. Option D is incorrect. Recording user activities is an audit logging function separate from record-locking; locking is a concurrency control, not an audit trail mechanism. Therefore, B, eliminate the risk of concurrent updates to a record, is the correct answer.
Play from 1:09:42 Question 39. The MAIN benefit of using an integrated test facility (ITF) as an online auditing technique is that it enables: Here are the options. Option A. the integration of financial and audit tests. Option B. auditors to test without impacting production data. Option C. a cost-effective approach to application controls audit. Option D. auditors to investigate fraudulent transactions. Pause the video now if you want time to think about the answer.
The correct answer is B. auditors to test without impacting production data. The MAIN benefit of an Integrated Test Facility (ITF) is that it enables auditors to test without impacting production data by using embedded audit modules that process test transactions through the live system in parallel with production processing, isolating audit data separately. This allows real-time testing of application controls without contaminating actual business data. Now, why are the other options incorrect? Option A is incorrect. Integration of financial and audit tests is not the primary focus of ITF; it's specifically an audit technique. Option C is incorrect. While ITF can be cost-effective, the primary benefit is the ability to test without impacting production data, not cost savings. Option D is incorrect. ITF is for testing controls and data integrity, not specifically for investigating fraudulent transactions. Therefore, B, auditors to test without impacting production data, is the correct answer.
Play from 1:11:36 Question 40. Which of the following BEST indicates the effectiveness of an organization's risk management program? Here are the options. Option A. Residual risk is minimized. Option B. Inherent risk is eliminated. Option C. Control risk is minimized. Option D. Overall risk is quantified. Pause the video now if you want time to think about the answer.
The correct answer is A. Residual risk is minimized. Minimized residual risk is the best indicator of risk management program effectiveness because residual risk represents what remains after controls are applied: the true measure of how well the organization has managed and mitigated its risks. Inherent risk cannot be eliminated (it's the natural risk of the activity), control risk minimization is narrower than overall program effectiveness, and risk quantification alone does not indicate whether management has been effective in reducing risk. Now, why are the other options incorrect? Option B is incorrect. Inherent risk cannot be eliminated; it represents the natural risk of a business activity before controls are applied. Option C is incorrect. Control risk minimization is one aspect but does not capture overall program effectiveness in reducing residual risk. Option D is incorrect. Quantifying overall risk is useful but quantification alone does not demonstrate that the program is effective in reducing risk exposure. Therefore, A, Residual risk is minimized, is the correct answer.
Play from 1:13:24 Question 41. When testing the accuracy of transaction data, which of the following situations BEST justifies the use of a smaller sample size? Here are the options. Option A. Proper separation of duties is in place. Option B. The IS audit staff has a high level of experience. Option C. The data can be directly changed by users. Option D. It is expected that the population is error-free. Pause the video now if you want time to think about the answer.
The correct answer is D. It is expected that the population is error-free. When testing the accuracy of transaction data, a smaller sample size is justified when the population is expected to be error-free because there is minimal risk of material misstatement. In such cases, the auditor can rely on a reduced sample since the likelihood of finding errors is very low, making extensive sampling unnecessary. This is a standard principle in audit sampling where sample size is inversely related to the expected error rate in the population. Now, why are the other options incorrect? Option A is incorrect. Proper separation of duties reduces control risk but does not directly justify smaller sample sizes for accuracy testing; audit procedures must still be performed independently. Option B is incorrect. Auditor experience may improve efficiency but does not reduce the required sample size needed for statistical validity and adequate evidence gathering. Option C is incorrect. Data that can be directly changed by users indicates higher risk and control weakness, which would require a larger sample size, not smaller. Therefore, D, It is expected that the population is error-free, is the correct answer.
Play from 1:15:28 Question 42. An IS auditor should look for which of the following to ensure the risk associated with scope creep has been mitigated during software development? Here are the options. Option A. Source code version control. Option B. Project change management controls. Option C. Existence of an architecture review board. Option D. Configuration management. Pause the video now if you want time to think about the answer.
The correct answer is B. Project change management controls. Project change management controls are the direct and most effective mitigation for scope creep risk. These controls establish formal processes for evaluating, approving, and implementing changes to project scope, preventing unauthorized or unmanaged additions. This is the explicit control designed to manage scope boundaries in software development projects. Now, why are the other options incorrect? Option A is incorrect. Source code version control manages code changes but does not address scope management at the project level. Option C is incorrect. An architecture review board may influence design decisions but is not primarily focused on preventing scope creep. Option D is incorrect. Configuration management tracks and controls system configurations but is not the primary control for managing project scope boundaries. Therefore, B, Project change management controls, is the correct answer.
Play from 1:17:12 Question 43. An organization is planning to implement a work-from-home policy that allows users to work remotely as needed. Which of the following is the BEST solution for ensuring secure remote access to corporate resources? Here are the options. Option A. Virtual desktop. Option B. Virtual private network (VPN). Option C. Multi-factor authentication. Option D. Additional firewall rules. Pause the video now if you want time to think about the answer.
The correct answer is B. Virtual private network (VPN). A Virtual Private Network (VPN) is the BEST comprehensive solution for secure remote access because it encrypts all traffic between the remote user and corporate resources, protecting data in transit and ensuring secure authentication to the corporate network. While multi-factor authentication and firewalls are important supporting controls, VPN is the foundational technology that enables secure remote access. Virtual desktops are an alternative approach but not as universally applicable. Now, why are the other options incorrect? Option A is incorrect. Virtual desktops are a valid remote access solution but represent infrastructure deployment rather than the core secure access mechanism itself. Option C is incorrect. Multi-factor authentication is an important security control but is a component of secure access, not the primary remote access solution. Option D is incorrect. Additional firewall rules provide perimeter defense but do not directly enable secure remote access to corporate resources. Therefore, B, Virtual private network (VPN), is the correct answer.
Play from 1:19:14 Question 44. Which of the following reliably associates users with their public keys and includes attributes that uniquely identify the users? Here are the options. Option A. Encryption. Option B. Nonrepudiation. Option C. Digital certificate. Option D. Multi-factor authentication (MFA). Pause the video now if you want time to think about the answer.
The correct answer is C. Digital certificate. A digital certificate reliably associates users with their public keys and includes attributes that uniquely identify the users. Digital certificates are issued by trusted Certificate Authorities and contain the user's public key, identifying information, validity period, and digital signature, creating a verifiable binding between the user's identity and their public key. Now, why are the other options incorrect? Option A is incorrect. Encryption protects data confidentiality but does not establish the association between users and public keys. Option B is incorrect. Nonrepudiation is a security service enabled by digital certificates but is not itself the mechanism for association. Option D is incorrect. Multi-factor authentication verifies user identity through multiple factors but does not bind users to public keys. Therefore, C, Digital certificate, is the correct answer.
Play from 1:21:00 Question 45. Which of the following would provide an IS auditor with the GREATEST assurance that data disposal controls support business strategic objectives? Here are the options. Option A. Media shredding policy. Option B. Media recycling policy. Option C. Media sanitization policy. Option D. Media labeling policy. Pause the video now if you want time to think about the answer.
The correct answer is C. Media sanitization policy. Media sanitization policy provides the greatest assurance that data disposal controls support business objectives because proper sanitization ensures data is irretrievably destroyed, protecting confidentiality and compliance requirements. Sanitization addresses the core business objective of preventing unauthorized data access and supporting regulatory compliance, whereas labeling, shredding, and recycling are tactical execution methods rather than evidence of objective alignment. Now, why are the other options incorrect? Option A is incorrect. Shredding is a disposal method but doesn't directly assure alignment with strategic business objectives. Option B is incorrect. Recycling addresses environmental sustainability but not the primary business objective of data protection. Option D is incorrect. Labeling is a tracking and administrative control, not evidence of strategic objective alignment. Therefore, C, Media sanitization policy, is the correct answer.
Play from 1:22:48 Question 46. Which of the following auditing techniques would be used to detect the validity of a credit card transaction based on time, location, and date of purchase? Here are the options. Option A. Integrated test facility (ITF). Option B. Data analytics. Option C. Hash totals. Option D. Check sums. Pause the video now if you want time to think about the answer.
The correct answer is B. Data analytics. Data analytics is the auditing technique used to detect anomalies and validate credit card transactions by analyzing patterns based on time, location, and date of purchase. This technique can identify suspicious transactions that deviate from normal spending patterns. ITF (A) is for testing system controls, hash totals (C) verify data integrity, and checksums (D) detect transmission errors: none of these techniques are designed to detect behavioral anomalies in transactions. Now, why are the other options incorrect? Option A is incorrect. ITF is used for testing system controls, not detecting transaction anomalies. Option C is incorrect. Hash totals verify data integrity, not detect temporal or geographic transaction anomalies. Option D is incorrect. Checksums detect transmission errors, not unusual transaction patterns. Therefore, B, Data analytics, is the correct answer.
Play from 1:24:31 Question 47. The GREATEST limitation of a network-based intrusion detection system (IDS) is that it: Here are the options. Option A. provides only for active rather than passive IDS monitoring. Option B. does not monitor for denial of service (DoS) attacks. Option C. consumes excessive network resources for detection. Option D. does not detect attacks originating on the server hosting the IDS. Pause the video now if you want time to think about the answer.
The correct answer is D. does not detect attacks originating on the server hosting the IDS. A network-based IDS cannot detect attacks originating on the server hosting the IDS itself because such traffic does not traverse the network interface that the IDS monitors. Attacks generated locally on the IDS host bypass network detection entirely, representing a fundamental blind spot in network-based monitoring. Now, why are the other options incorrect? Option A is incorrect. Network-based IDS typically operates in passive monitoring mode, not active mode. Option B is incorrect. Network-based IDS systems are capable of detecting and alerting on DoS attacks. Option C is incorrect. Modern network-based IDS systems are designed to operate efficiently without consuming excessive network resources. Therefore, D, does not detect attacks originating on the server hosting the IDS, is the correct answer.
Play from 1:26:19 Question 48. Which of the following are BEST suited for continuous auditing? Here are the options. Option A. Low-value transactions. Option B. Irregular transactions. Option C. Real-time transactions. Option D. Manual transactions. Pause the video now if you want time to think about the answer.
The correct answer is C. Real-time transactions. Real-time transactions are best suited for continuous auditing because they occur frequently and automatically within systems, making them ideal candidates for automated monitoring and testing. Real-time transactions have high volume and consistent processing patterns that allow continuous control testing to be cost-effective and practical. Low-value (A) and irregular (B) transactions may not justify continuous testing costs; manual transactions (D) are harder to automate and monitor continuously. Now, why are the other options incorrect? Option A is incorrect. Low-value transactions typically do not justify the cost of continuous auditing tools and monitoring. Option B is incorrect. Irregular transactions occur unpredictably and infrequently, making continuous monitoring less practical and cost-effective. Option D is incorrect. Manual transactions cannot be efficiently monitored through automated continuous auditing processes. Therefore, C, Real-time transactions, is the correct answer.
Play from 1:28:04 Question 49. Which of the following is MOST important to the effectiveness of smoke detectors installed in a data processing facility? Here are the options. Option A. Detectors are linked to wet pipe fire suppression systems. Option B. Detectors are linked to dry pipe fire suppression systems. Option C. Detectors have the correct industry certification. Option D. Detectors trigger audible alarms when activated. Pause the video now if you want time to think about the answer.
The correct answer is C. Detectors have the correct industry certification. Industry certification ensures that smoke detectors meet established standards for sensitivity, reliability, and performance in data center environments. Proper certification guarantees the detectors will function correctly under the specific environmental conditions of a data processing facility (such as temperature control and air filtration), which is foundational to effectiveness. Now, why are the other options incorrect? Option A is incorrect. Wet pipe systems use water, which is inappropriate and damaging for data processing facilities; they are incompatible with this environment. Option B is incorrect. The type of fire suppression system linked is less critical than ensuring the detectors themselves are properly certified to function in a data center. Option D is incorrect. Audible alarms are useful for notification but secondary to the detector's primary function of accurately sensing smoke; detection capability is more important than alarm type. Therefore, C, Detectors have the correct industry certification, is the correct answer.
Play from 1:30:04 Question 50. Which of the following attack techniques will succeed because of an inherent security weakness in an Internet firewall? Here are the options. Option A. Flooding the site with an excessive number of packets. Option B. Intercepting packets and viewing passwords. Option C. Phishing. Option D. Using a dictionary attack of encrypted passwords. Pause the video now if you want time to think about the answer.
The correct answer is A. Flooding the site with an excessive number of packets. Flooding a site with excessive packets (DoS/DDoS attack) exploits an inherent weakness in firewall design: firewalls must allow legitimate traffic through, and they have finite capacity to process and filter packets. An attacker can saturate this capacity, causing the firewall and systems behind it to become unavailable. This is a fundamental architectural vulnerability rather than a configuration flaw. The other options describe attacks that succeed through other vulnerabilities or social engineering, not firewall weaknesses. Now, why are the other options incorrect? Option B is incorrect. Intercepting packets and viewing passwords requires compromising network encryption or gaining network access; this is not a firewall weakness but a different attack vector. Option C is incorrect. Phishing exploits human behavior and trust, not firewall design weaknesses. Option D is incorrect. Dictionary attacks target password encryption algorithms and storage, not firewall vulnerabilities. Therefore, A, Flooding the site with an excessive number of packets, is the correct answer.
Play from 1:32:05 Question 51. In order to be useful, a key performance indicator (KPI) MUST: Here are the options. Option A. be approved by management. Option B. be changed frequently to reflect organizational strategy. Option C. have a target value. Option D. be measurable in percentages. Pause the video now if you want time to think about the answer.
The correct answer is C. have a target value. A KPI must have a target value to be useful because without a target, there is no way to measure success or determine if performance is acceptable. Targets provide the benchmark against which actual performance is compared. While approval (A), frequency of change (B), and measurability in percentages (D) may be desirable, they are not essential requirements; a KPI measured in raw numbers with a numeric target is equally valid and useful. Now, why are the other options incorrect? Option A is incorrect. KPIs can be useful without explicit management approval if they are well-designed and relevant to organizational goals. Option B is incorrect. Changing KPIs frequently undermines their usefulness; stable KPIs allow for meaningful trend analysis. Option D is incorrect. KPIs can be expressed in various units (dollars, counts, time, percentages) and remain valid and useful. Therefore, C, have a target value, is the correct answer.
Play from 1:33:50 Question 52. Which of the following indicates an effective change control environment? Here are the options. Option A. There is version control for the program documentation. Option B. User management formally approves change requests. Option C. Release management is automated. Option D. The quality assurance (QA) group reports to the application development manager. Pause the video now if you want time to think about the answer.
The correct answer is B. User management formally approves change requests. User management formally approving change requests is the clearest indicator of an effective change control environment because it ensures that business stakeholders evaluate and authorize changes before implementation, establishing accountability and preventing unauthorized or inappropriate modifications to systems. Now, why are the other options incorrect? Option A is incorrect. Version control for program documentation is a technical practice that supports change management but does not indicate effective overall change control governance. Option C is incorrect. Automated release management is a technical efficiency measure but does not ensure that changes are properly evaluated and approved by appropriate stakeholders. Option D is incorrect. QA reporting to the application development manager represents a structural concern about independence and does not indicate effective change control processes. Therefore, B, User management formally approves change requests, is the correct answer.
Play from 1:35:37 Question 53. Which of the following is the MOST important feature of access control software? Here are the options. Option A. Identification. Option B. Authentication. Option C. Violation reporting. Option D. Nonrepudiation. Pause the video now if you want time to think about the answer.
The correct answer is B. Authentication. Authentication is the most important feature of access control software because it verifies that users are who they claim to be. Without proper authentication, identification becomes meaningless, and subsequent controls like violation reporting and nonrepudiation cannot function reliably. Authentication is the foundational security control upon which all other access control functions depend. Now, why are the other options incorrect? Option A is incorrect. Identification (knowing who the user is) requires authentication to be meaningful and secure. Option C is incorrect. Violation reporting is important for monitoring but depends on proper authentication and identification first. Option D is incorrect. Nonrepudiation is valuable for accountability but is secondary to ensuring only authorized users gain access. Therefore, B, Authentication, is the correct answer.
Play from 1:37:16 Question 54. When reviewing an IT strategic plan, the GREATEST concern would be that: Here are the options. Option A. the plan was not formally approved by the board of directors. Option B. there are no key performance indicators (KPIs). Option C. an IT strategy committee has not been created. Option D. the plan does not support relevant organizational goals. Pause the video now if you want time to think about the answer.
The correct answer is D. the plan does not support relevant organizational goals. The GREATEST concern when reviewing an IT strategic plan is that it does not support relevant organizational goals. An IT strategy must be aligned with and in service of the organization's overall business objectives. Without this alignment, IT investments and initiatives will not deliver value to the organization. While formal board approval, KPIs, and committee structure are important governance elements, they are secondary to ensuring the strategy is fundamentally aligned with organizational goals. Now, why are the other options incorrect? Option A is incorrect. Formal board approval is important for governance but is not the greatest concern if alignment with organizational goals exists. Option B is incorrect. KPIs are important for measurement and monitoring, but their absence is not as critical as misalignment with organizational goals. Option C is incorrect. An IT strategy committee is useful for governance but is not essential if the strategy is sound and properly supported. Therefore, D, the plan does not support relevant organizational goals, is the correct answer.
Play from 1:39:13 Question 55. Upon completion of audit work, an IS auditor should: Here are the options. Option A. provide a report to the auditee stating the initial findings. Option B. provide a report to senior management prior to discussion with the auditee. Option C. distribute a summary of general findings to the members of the auditing team. Option D. review the working papers with the auditee. Pause the video now if you want time to think about the answer.
The correct answer is A. provide a report to the auditee stating the initial findings. Upon completion of audit work, the IS auditor should first provide findings to the auditee (management of the audited area) to allow them to respond, provide context, and potentially correct any misunderstandings before final reporting to senior management. This ensures accuracy and fairness by giving the auditee an opportunity to comment on findings. Reporting directly to senior management before discussion with the auditee bypasses proper governance; reviewing working papers with the auditee is administrative; distributing summaries to the audit team is operational but occurs in parallel, not as the primary first step. Now, why are the other options incorrect? Option B is incorrect. Reporting to senior management before discussion with the auditee violates the principle of giving the audited area opportunity to respond and validate findings. Option C is incorrect. Distributing summaries to audit team members is an internal administrative action, not the primary first step in formal reporting. Option D is incorrect. Reviewing working papers with the auditee is a detailed activity that follows initial findings discussion, not the primary reporting step. Therefore, A, provide a report to the auditee stating the initial findings, is the correct answer.
Play from 1:41:26 Question 56. Which of the following is the GREATEST risk when using application programming interfaces (APIS) in a third-party hosted virtual environment? Here are the options. Option A. Data exfiltration. Option B. Lack of accountability. Option C. Inability to test third-party APIs. Option D. Lack of redundancy. Pause the video now if you want time to think about the answer.
The correct answer is A. Data exfiltration. Data exfiltration is the greatest risk when using APIs in third-party hosted virtual environments. APIs are common attack vectors that can be exploited to extract sensitive data, and in third-party cloud environments, the organization has less visibility and control over network monitoring and data flows. An attacker could use poorly secured APIs to bypass normal security controls and extract data, making this a critical confidentiality risk in cloud environments. Now, why are the other options incorrect? Option B is incorrect. Lack of accountability relates to audit trails but is secondary to the direct risk of data theft. Option C is incorrect. Inability to test third-party APIs is a quality concern but does not directly pose the same level of immediate security risk. Option D is incorrect. Lack of redundancy affects availability but is not the greatest risk compared to confidentiality breaches through API exploitation. Therefore, A, Data exfiltration, is the correct answer.
Play from 1:43:12 Question 57. In the case of a disaster where the data center is no longer available, which of the following tasks should be done FIRST? Here are the options. Option A. Arrange for a secondary site. Option B. Analyze risk. Option C. Perform data recovery. Option D. Activate the call tree. Pause the video now if you want time to think about the answer.
The correct answer is D. Activate the call tree. Activating the call tree should be done FIRST in a disaster scenario because it immediately notifies all relevant personnel of the emergency, enables communication channels, and initiates the disaster recovery plan. Without notifying the team and leadership, no coordinated response can begin. This logistical first step must precede all other actions like risk analysis, site arrangements, or data recovery. Now, why are the other options incorrect? Option A is incorrect. Arranging a secondary site cannot be done effectively until the team is mobilized and informed through the call tree. Option B is incorrect. Risk analysis is important but premature before the team is even notified and mobilized to respond. Option C is incorrect. Data recovery cannot meaningfully begin until personnel are activated and coordinated through the established communication structure. Therefore, D, Activate the call tree, is the correct answer.
Play from 1:44:53 Question 58. Which of the following is the MOST efficient way to identify segregation of duties violations in a new system? Here are the options. Option A. Observe the performance of business processes. Option B. Develop a process to identify authorization conflicts. Option C. Review a report of security rights in the system. Option D. Examine recent system access rights violations. Pause the video now if you want time to think about the answer.
The correct answer is C. Review a report of security rights in the system. Reviewing a report of security rights in the system is the most efficient way to identify segregation of duties violations because it provides a systematic, comprehensive view of all user access rights and potential conflicts. This approach allows the auditor to analyze authorization matrices and identify incompatible duties assigned to the same user programmatically. This is faster and more thorough than manual observation or historical review of violations. Now, why are the other options incorrect? Option A is incorrect. Observing business processes is time-consuming and may not reveal all violations occurring across the system. Option B is incorrect. Developing a process to identify authorization conflicts requires significant setup time and is less efficient than reviewing existing system reports. Option D is incorrect. Examining recent violations is reactive and may miss existing conflicts that have not yet resulted in a detected violation. Therefore, C, Review a report of security rights in the system, is the correct answer.
Play from 1:46:56 Question 59. Which of the following documents would be MOST useful in detecting a weakness in segregation of duties? Here are the options. Option A. Data flow diagram. Option B. Systems flowchart. Option C. Entity-relationship diagram. Option D. Process flowchart. Pause the video now if you want time to think about the answer.
The correct answer is D. Process flowchart. A process flowchart is most useful for detecting segregation of duties weaknesses because it maps the flow of activities, responsibilities, and decision points through a process, making it clear where one person or role performs conflicting duties. Process flowcharts show who performs what activities and in what sequence, making conflicts immediately visible. Data flow diagrams, systems flowcharts, and entity-relationship diagrams focus on data movement, system components, or data structures rather than the assignment of specific duties to roles. Now, why are the other options incorrect? Option A is incorrect. Data flow diagrams show data movement between systems, not who performs specific duties. Option B is incorrect. Systems flowcharts depict system components and their interactions, not the assignment of duties to individuals. Option C is incorrect. Entity-relationship diagrams show database structure and relationships, not process duties or role assignments. Therefore, D, Process flowchart, is the correct answer.
Play from 1:48:45 Question 60. Which of the following is the BEST methodology to use for estimating the complexity of developing a large business application? Here are the options. Option A. Software cost estimation. Option B. Work breakdown structure. Option C. Critical path analysis. Option D. Function point analysis. Pause the video now if you want time to think about the answer.
The correct answer is D. Function point analysis. Function point analysis is a standardized, quantifiable methodology specifically designed to measure software complexity and scope by counting functional requirements and converting them into effort estimates. It provides objective complexity metrics based on actual system functionality rather than subjective assessments. This makes it the best choice for estimating complexity of large business applications. Now, why are the other options incorrect? Option A is incorrect. Software cost estimation is a broader discipline that uses various techniques but is not specifically the best for measuring complexity. Option B is incorrect. Work breakdown structure is a planning and organization tool that decomposes work but does not directly estimate complexity. Option C is incorrect. Critical path analysis focuses on scheduling and dependencies, not on measuring inherent system complexity. Therefore, D, Function point analysis, is the correct answer.
Play from 1:50:28 Question 61. Which of the following would be MOST useful to an IS auditor when making recommendations to enable continual improvement of IT processes over time? Here are the options. Option A. IT incident log. Option B. IT risk register. Option C. Maturity model. Option D. Benchmarking studies. Pause the video now if you want time to think about the answer.
The correct answer is C. Maturity model. A maturity model provides the best framework for enabling continual improvement because it establishes clear stages of capability development, allows measurement of current state against defined levels, and provides a roadmap for progression. This systematic approach is specifically designed to guide incremental improvements over time. Now, why are the other options incorrect? Option A is incorrect. An incident log documents problems but doesn't provide a structured framework for ongoing improvement. Option B is incorrect. A risk register identifies risks but doesn't serve as a tool for measuring or guiding process improvement progression. Option D is incorrect. Benchmarking studies show how others perform but don't provide a structured internal improvement framework. Therefore, C, Maturity model, is the correct answer.
Play from 1:52:07 Question 62. Which of the following is MOST effective for controlling visitor access to a data center? Here are the options. Option A. Visitors sign in at the front desk upon arrival. Option B. Pre-approval of entry requests. Option C. Visitors are escorted by an authorized employee. Option D. Closed-circuit television (CCTV) is used to monitor the facilities. Pause the video now if you want time to think about the answer.
The correct answer is C. Visitors are escorted by an authorized employee. Escorting visitors by an authorized employee is the most effective control for visitor access to data centers because it provides real-time supervision and accountability. The escort can prevent unauthorized access to restricted areas, monitor visitor activities, verify credentials, and ensure visitors follow security policies. This active human control is more effective than passive measures. Now, why are the other options incorrect? Option A is incorrect. Sign-in procedures document arrivals but do not prevent unauthorized access or activity once visitors enter the facility. Option B is incorrect. Pre-approval establishes authorization but does not prevent the approved visitor from accessing restricted areas beyond their scope or wandering unsupervised. Option D is incorrect. CCTV provides detection and recording of violations after they occur but does not actively prevent unauthorized access or control visitor movement in real-time. Therefore, C, Visitors are escorted by an authorized employee, is the correct answer.
Play from 1:54:04 Question 63. Which of the following is the GREATEST risk associated with utilizing spreadsheets for financial reporting in end-user computing (EUC)? Here are the options. Option A. Lack of password protection. Option B. Lack of processing integrity. Option C. Increase in operational incidents. Option D. Increase in regulatory violations. Pause the video now if you want time to think about the answer.
The correct answer is B. Lack of processing integrity. The greatest risk of using spreadsheets for financial reporting is the lack of processing integrity. Spreadsheets are prone to formula errors, uncontrolled changes, poor audit trails, and lack of version control: all compromising data integrity throughout the calculation and reporting process. While other risks exist (lack of password protection, operational incidents, regulatory violations), they are either secondary consequences or technical protections. Processing integrity directly addresses the core vulnerability that makes spreadsheets unsuitable for financial reporting: the inability to ensure calculations and data transformations are accurate and controlled. Now, why are the other options incorrect? Option A is incorrect. Password protection is a security measure but not the primary integrity concern with spreadsheets. Option C is incorrect. Operational incidents are a consequence rather than the greatest inherent risk of spreadsheet use. Option D is incorrect. Regulatory violations follow from lack of processing integrity but are not the root cause. Therefore, B, Lack of processing integrity, is the correct answer.
Play from 1:56:05 Question 64. Which of the following MOST effectively reduces the probability of a brute force attack being successful? Here are the options. Option A. Establishing an account lockout policy. Option B. Establishing account activity timeouts. Option C. Increasing password change frequency. Option D. Requiring minimum password length. Pause the video now if you want time to think about the answer.
The correct answer is A. Establishing an account lockout policy. Account lockout policies most effectively reduce brute force success by preventing attackers from making unlimited password attempts. After a set number of failed attempts, the account is locked, stopping the attack dead rather than merely slowing it down or requiring stronger passwords. Now, why are the other options incorrect? Option B is incorrect. Account timeouts log users out but do not prevent repeated login attempts from the same or different sessions. Option C is incorrect. Frequent password changes do not prevent brute force attacks on the current password during the change interval. Option D is incorrect. Longer passwords increase complexity but a determined attacker can still attempt many combinations; lockout policies prevent the attempt volume itself. Therefore, A, Establishing an account lockout policy, is the correct answer.
Play from 1:57:43 Question 65. An organization has engaged a third party to implement an application to perform business-critical calculations. Which of the following is the MOST important process to help ensure the application provides accurate calculations? Here are the options. Option A. Quality assurance (QA). Option B. Change management. Option C. Key performance indicator (KPI) monitoring. Option D. Configuration management. Pause the video now if you want time to think about the answer.
The correct answer is A. Quality assurance (QA). Quality assurance (QA) is the most critical process for ensuring an application provides accurate calculations. QA encompasses comprehensive testing, validation, and verification procedures specifically designed to catch errors and defects before deployment. While change management, KPI monitoring, and configuration management are all important for application management, they do not directly address the accuracy of calculations: QA testing does. Now, why are the other options incorrect? Option B is incorrect. Change management controls how modifications are made but does not verify the accuracy of calculations themselves. Option C is incorrect. KPI monitoring tracks performance metrics after deployment but cannot ensure calculations are accurate during development. Option D is incorrect. Configuration management maintains system configurations but does not validate calculation accuracy. Therefore, A, Quality assurance (QA), is the correct answer.
Play from 1:59:42 Question 66. Which of the following would provide the BEST evidence that a cloud provider's change management process is effective? Here are the options. Option A. The results of a third-party review provided by the vendor. Option B. Minutes from regular change management meetings with the vendor. Option C. A copy of change management policies provided by the vendor. Option D. Written assurances from the vendor's CEO and CIO. Pause the video now if you want time to think about the answer.
The correct answer is A. The results of a third-party review provided by the vendor. A third-party review of the cloud provider's change management process provides the most credible and objective evidence of effectiveness. Third parties are independent, use standardized audit criteria, and their findings are unbiased. This external validation is far more reliable than internal vendor documents, meeting minutes, or CEO assurances, which could be self-serving or incomplete. Now, why are the other options incorrect? Option B is incorrect. Meeting minutes are internal documentation and don't prove process effectiveness; attendees are not independent. Option C is incorrect. Policy documents show what should happen, not what actually happens or whether the process is effective. Option D is incorrect. Management assurances lack objectivity and provide no independent verification of actual change management effectiveness. Therefore, A, The results of a third-party review provided by the vendor, is the correct answer.
Play from 2:01:34 Question 67. Which of the following testing methods is MOST appropriate for assessing whether system integrity has been maintained after changes have been made? Here are the options. Option A. Integration testing. Option B. Regression testing. Option C. Acceptance testing. Option D. Unit testing. Pause the video now if you want time to think about the answer.
The correct answer is B. Regression testing. Regression testing is specifically designed to verify that existing functionality remains intact after changes have been made. It re-runs previous test cases to detect whether modifications introduced unintended side effects or broke previously working features. This is the direct and intended use case for assessing whether system integrity has been maintained. The other testing types focus on new functionality, component-level verification, or final acceptance rather than detecting regression in existing capabilities. Now, why are the other options incorrect? Option A is incorrect. Integration testing validates that components work together but is broader than assessing whether changes maintained existing integrity. Option C is incorrect. Acceptance testing determines whether the system meets requirements but is typically a final gate, not a post-change integrity assessment. Option D is incorrect. Unit testing focuses on individual code components and does not comprehensively assess whether changes affected overall system integrity. Therefore, B, Regression testing, is the correct answer.
Play from 2:03:25 Question 68. An organization has implemented segregation of duties with appropriate job definitions and restrictions on overlapping roles. Which type of control has been implemented? Here are the options. Option A. Preventive. Option B. Detective. Option C. Physical. Option D. Corrective. Pause the video now if you want time to think about the answer.
The correct answer is A. Preventive. Segregation of duties with job definitions and role restrictions is a preventive control designed to stop errors and fraud before they occur. By structuring the organization so that incompatible duties are separated, the control mechanism prevents unauthorized or erroneous transactions from being completed. Detective controls find problems after occurrence, physical controls protect assets, and corrective controls remedy issues after they are detected. Now, why are the other options incorrect? Option B is incorrect. Detective controls identify problems that have already occurred; SOD prevents problems from happening. Option C is incorrect. Physical controls protect tangible assets; SOD is an administrative control over processes and responsibilities. Option D is incorrect. Corrective controls fix problems after they occur; SOD stops problems from occurring in the first place. Therefore, A, Preventive, is the correct answer.
Play from 2:05:04 Question 69. Which of the following would an IS auditor consider the GREATEST risk associated with a mobile workforce environment? Here are the options. Option A. Loss or damage to the organization's assets. Option B. Lack of compliance with organizational policies. Option C. Decrease in employee productivity and accountability. Option D. Inability to access data remotely. Pause the video now if you want time to think about the answer.
The correct answer is A. Loss or damage to the organization's assets. Loss or damage to organizational assets represents the greatest risk in a mobile workforce environment because mobile devices and assets operating outside the secure facility perimeter are inherently more vulnerable to theft, loss, and physical damage. This directly impacts confidentiality, integrity, and availability of critical business information and equipment. Now, why are the other options incorrect? Option B is incorrect. While policy compliance is a concern, it can be addressed through training and monitoring and is less critical than protecting physical assets and data. Option C is incorrect. Productivity and accountability, though important operational concerns, are secondary to preventing loss of critical business assets and data. Option D is incorrect. Remote access to data is a capability that mobile workforces require and is manageable through proper security controls, not a primary risk. Therefore, A, Loss or damage to the organization's assets, is the correct answer.
Play from 2:06:54 Question 70. Which of the following is the BEST reason for an organization to use clustering? Here are the options. Option A. To decrease system response time. Option B. To improve the recovery time objective (RTO). Option C. To improve system resiliency. Option D. To facilitate faster backups. Pause the video now if you want time to think about the answer.
The correct answer is C. To improve system resiliency. The primary purpose of clustering is to improve system resiliency by providing redundancy and failover capabilities. While clustering can also improve response time and theoretically support faster backups, these are secondary benefits. RTO improvement is achieved through failover mechanisms within clustering, but resiliency is the fundamental architectural benefit that clustering delivers. Now, why are the other options incorrect? Option A is incorrect. Decreasing response time is not the primary purpose of clustering; load balancing is a secondary benefit. Option B is incorrect. RTO improvement is an outcome of resiliency, not the primary reason for implementing clustering. Option D is incorrect. Faster backups are not a primary benefit of clustering; backup speed depends on backup infrastructure and strategy. Therefore, C, To improve system resiliency, is the correct answer.
Play from 2:08:35 Question 71. A sample for testing must include the 80 largest client balances and a random sample of the rest. What should the IS auditor recommend? Here are the options. Option A. Query the database. Option B. Use generalized audit software. Option C. Develop an integrated test facility (ITF). Option D. Leverage a random number generator. Pause the video now if you want time to think about the answer.
The correct answer is B. Use generalized audit software. Generalized audit software (GAS) is designed to handle complex sampling requirements including stratified sampling, where the 80 largest balances are selected deterministically while the remainder is randomly sampled. GAS provides the functionality needed for this mixed sampling approach. A database query (A) is a data extraction tool but not a sampling methodology; an ITF (C) is for testing controls, not sampling; and a random number generator (D) cannot stratify by balance size. Now, why are the other options incorrect? Option A is incorrect. A database query retrieves data but does not inherently provide the stratified sampling logic needed for this requirement. Option C is incorrect. An integrated test facility is a control testing tool within applications, not a sampling selection mechanism. Option D is incorrect. A random number generator alone cannot apply the stratification criterion of selecting the 80 largest items deterministically. Therefore, B, Use generalized audit software, is the correct answer.
Play from 2:10:37 Question 72. Which of the following is MOST important when defining the IS audit scope? Here are the options. Option A. Involving business in the formulation of the scope statement. Option B. Minimizing the time and cost to the organization of IS audit procedures. Option C. Aligning the IS audit procedures with IT management priorities. Option D. Understanding the relationship between IT and business risks. Pause the video now if you want time to think about the answer.
The correct answer is D. Understanding the relationship between IT and business risks. Understanding the relationship between IT and business risks is most important when defining audit scope because it ensures audit resources are directed toward areas with the greatest potential business impact. This risk-based approach ensures the audit focuses on what matters most to the organization's objectives and survival, rather than being driven by cost considerations, management priorities alone, or business involvement without risk context. Now, why are the other options incorrect? Option A is incorrect. Business involvement is helpful but doesn't ensure focus on the most critical risk areas. Option B is incorrect. Minimizing cost and time is secondary to ensuring adequate coverage of critical risks. Option C is incorrect. Aligning with management priorities may not address the highest business risks if priorities are misaligned with risk exposure. Therefore, D, Understanding the relationship between IT and business risks, is the correct answer.
Play from 2:12:31 Question 73. Which of the following should an IS auditor expect to see as a role of an IT strategy committee during the review of an organization's IT governance framework? Here are the options. Option A. Advising senior management on IT-related risk. Option B. Performing quality assurance (QA) for IT business functions. Option C. Executing IT-enabled programs. Option D. Evaluating return on IT investment. Pause the video now if you want time to think about the answer.
The correct answer is A. Advising senior management on IT-related risk. An IT strategy committee's primary governance role is advising senior management on IT- related risks and strategic decisions. This role positions the committee as an advisory and oversight body that helps executive leadership make informed decisions about IT investments, risks, and strategic direction. This is consistent with sound IT governance frameworks where strategy committees provide guidance and risk assessment to senior management. Now, why are the other options incorrect? Option B is incorrect. Quality assurance for IT business functions is typically performed by dedicated QA teams, not a strategy committee. Option C is incorrect. Executing IT-enabled programs is an operational responsibility, not a strategic governance committee function. Option D is incorrect. While ROI evaluation may be discussed, evaluating return on IT investment is more of a financial or portfolio management function rather than the core role of a strategy advisory committee. Therefore, A, Advising senior management on IT-related risk, is the correct answer.
Play from 2:14:33 Question 74. Which of the following measures BEST mitigates the risk of exfiltration during a cyberattack? Here are the options. Option A. Perimeter firewall. Option B. Hashing of sensitive data. Option C. Network access controls (NAC). Option D. Data loss prevention (DLP) system. Pause the video now if you want time to think about the answer.
The correct answer is D. Data loss prevention (DLP) system. A Data Loss Prevention (DLP) system is specifically designed to monitor, detect, and block unauthorized attempts to transfer sensitive data outside the organization. DLP systems work at multiple layers (endpoint, network, email) to prevent exfiltration during cyberattacks by identifying sensitive data patterns and enforcing policies to stop their movement. This directly addresses the exfiltration risk, whereas other options address different security concerns. Now, why are the other options incorrect? Option A is incorrect. A perimeter firewall controls traffic at network boundaries but does not specifically detect or prevent sensitive data exfiltration within authorized connections. Option B is incorrect. Hashing is a one-way cryptographic function used for data integrity and password storage, not for preventing exfiltration of sensitive data. Option C is incorrect. Network access controls manage who can connect to the network but do not specifically prevent authorized users from exfiltrating data once connected. Therefore, D, Data loss prevention (DLP) system, is the correct answer.
Play from 2:16:33 Question 75. Which of the following metrics is the BEST indicator of the performance of a web application? Here are the options. Option A. Server thread count. Option B. Server uptime. Option C. HTTP server error rate. Option D. Average response time. Pause the video now if you want time to think about the answer.
The correct answer is D. Average response time. Average response time is the most direct measure of user experience and application performance from an end-user perspective. It captures the overall application behavior under load and usage patterns. Server thread count is an internal resource metric, uptime only measures availability (not performance quality), and HTTP error rate measures reliability rather than performance speed. Now, why are the other options incorrect? Option A is incorrect. Server thread count is an internal resource metric that does not directly indicate user-perceived performance. Option B is incorrect. Uptime measures availability, not performance quality or speed of the application. Option C is incorrect. HTTP error rate measures reliability and error conditions rather than the speed and responsiveness of successful requests. Therefore, D, Average response time, is the correct answer.
Play from 2:18:08 Question 76. Which of the following security risks can be reduced by a properly configured network firewall? Here are the options. Option A. SQL injection attacks. Option B. Phishing attacks. Option C. Denial of service (DoS) attacks. Option D. Insider attacks. Pause the video now if you want time to think about the answer.
The correct answer is C. Denial of service (DoS) attacks. A properly configured firewall can reduce Denial of Service (DoS) attacks by implementing rate limiting, traffic filtering, and traffic shaping rules that can detect and block malicious traffic patterns before they overwhelm system resources. Firewalls operate at the network level where such volume-based attacks can be addressed. Now, why are the other options incorrect? Option A is incorrect. SQL injection attacks occur at the application layer, beyond typical firewall inspection capabilities. Option B is incorrect. Phishing attacks are social engineering attacks delivered via email or web, not network-level threats a firewall can effectively block. Option D is incorrect. Insider attacks originate from authorized users within the network, making them difficult for firewalls to detect or prevent based on network rules alone. Therefore, C, Denial of service (DoS) attacks, is the correct answer.
Play from 2:19:47 Question 77. Which of the following is the GREATEST concern associated with a high number of IT policy exceptions approved by management? Here are the options. Option A. The exceptions are likely to continue indefinitely. Option B. The exceptions may negatively impact process efficiency. Option C. The exceptions may elevate the level of operational risk. Option D. The exceptions may result in noncompliance. Pause the video now if you want time to think about the answer.
The correct answer is C. The exceptions may elevate the level of operational risk. A high number of approved policy exceptions elevates operational risk because each exception represents a deviation from established security or operational controls. Exceptions create gaps in risk mitigation, increase the organization's vulnerability to threats and errors, and compound when multiple exceptions interact. While noncompliance is possible, the immediate and broader concern is the cumulative elevation of operational risk exposure. Now, why are the other options incorrect? Option A is incorrect. While exceptions may continue indefinitely, the concern about continuation is secondary to the underlying risk they create. Option B is incorrect. Exceptions may sometimes improve efficiency by removing overly restrictive controls, so this is not consistently a concern. Option D is incorrect. While exceptions could lead to noncompliance depending on the regulation, the greater concern is operational risk; noncompliance is a potential consequence rather than the direct concern. Therefore, C, The exceptions may elevate the level of operational risk, is the correct answer.
Play from 2:21:49 Question 78. During which IT project phase is it MOST appropriate to conduct a benefits realization analysis? Here are the options. Option A. Post-implementation review phase. Option B. Design review phase. Option C. User acceptance testing (UAT) phase. Option D. Final implementation phase. Pause the video now if you want time to think about the answer.
The correct answer is A. Post-implementation review phase. Benefits realization analysis is most appropriately conducted during the post- implementation review phase because this is when actual results can be measured against the planned benefits and business case. At this stage, the system has been operational long enough to generate meaningful performance data, allowing auditors to assess whether promised benefits have been achieved. Earlier phases involve projections rather than actual realization. Now, why are the other options incorrect? Option B is incorrect. Design review phase occurs before implementation and cannot measure actual benefits realization. Option C is incorrect. UAT phase measures functional correctness, not actual business benefits realization in the operational environment. Option D is incorrect. Final implementation phase is too early to assess whether promised business benefits have been realized. Therefore, A, Post-implementation review phase, is the correct answer.
Play from 2:23:34 Question 79. An IS audit report highlighting inadequate network internal controls is challenged because no serious incident has ever occurred. Which of the following actions performed during the audit would have BEST supported the findings? Here are the options. Option A. Penetration testing. Option B. Threat risk assessment. Option C. Compliance testing. Option D. Vulnerability assessment. Pause the video now if you want time to think about the answer.
The correct answer is A. Penetration testing. Penetration testing provides the strongest evidence supporting inadequate network controls by demonstrating actual exploitation of the weaknesses and proving they pose real risk. Penetration testing moves beyond identifying vulnerabilities to proving they are exploitable, which powerfully refutes the argument that no incident has occurred. This active testing proves control inadequacy through demonstrated attack success, whereas vulnerability assessments only identify potential weaknesses, threat assessments evaluate likelihood, and compliance testing verifies adherence to standards. Now, why are the other options incorrect? Option B is incorrect. Threat risk assessment evaluates risk likelihood but does not prove controls are inadequate through active demonstration. Option C is incorrect. Compliance testing verifies adherence to standards but does not demonstrate that control weaknesses pose actual exploitable risk. Option D is incorrect. Vulnerability assessment identifies weaknesses but does not prove they are exploitable or pose actual risk without penetration testing. Therefore, A, Penetration testing, is the correct answer.
Play from 2:25:40 Question 80. Which of the following is MOST important for an IS auditor to review during an audit of an automated continuous monitoring process being used by the finance department? Here are the options. Option A. Management sign-off of test documentation. Option B. Dual control and approvals embedded in processes. Option C. Configuration of the monitoring tool. Option D. Resiliency of the monitoring service. Pause the video now if you want time to think about the answer.
The correct answer is C. Configuration of the monitoring tool. The configuration of the monitoring tool is most important because it directly determines whether the automated system is actually detecting the transactions and events it is designed to monitor. Incorrect configuration could result in the monitoring process failing silently while appearing to function. A properly configured tool ensures that controls are actually operating as intended and that the continuous monitoring provides valid assurance. Now, why are the other options incorrect? Option A is incorrect. Management sign-off of test documentation is important for governance but doesn't verify that monitoring actually works correctly. Option B is incorrect. Dual controls in processes are good practice but don't directly address whether the monitoring tool is configured to detect issues. Option D is incorrect. Service resiliency is important for availability but doesn't address whether the monitoring configuration is correct. Therefore, C, Configuration of the monitoring tool, is the correct answer.
Play from 2:27:32 Question 81. The objectives of business process reengineering (BPR) should PRIMARILY include: Here are the options. Option A. incremental changes in productivity. Option B. organizational structure changes. Option C. system improvements. Option D. performance efficiencies. Pause the video now if you want time to think about the answer.
The correct answer is D. performance efficiencies. Business process reengineering fundamentally aims to achieve significant performance improvements and efficiency gains through radical redesign of processes. Performance efficiencies encompass productivity gains, cost reduction, and quality improvements: the core objectives of BPR. While organizational structure changes and system improvements may occur as consequences, they are means to the end of achieving performance efficiencies. Now, why are the other options incorrect? Option A is incorrect. BPR typically pursues dramatic improvements rather than incremental changes; incremental improvement is continuous improvement, not reengineering. Option B is incorrect. Organizational structure changes are often consequences of BPR but not the primary objective. Option C is incorrect. System improvements are tools to support BPR but are secondary to the primary goal of performance enhancement. Therefore, D, performance efficiencies, is the correct answer.
Play from 2:29:18 Question 82. When auditing the feasibility study of a system development project, the IS auditor should: Here are the options. Option A. review the request for proposal (RFP) to ensure that it covers the scope of work. Option B. ensure that vendor contracts are reviewed by legal counsel. Option C. review cost-benefit documentation for reasonableness. Option D. review qualifications of key members of the project team. Pause the video now if you want time to think about the answer.
The correct answer is C. review cost-benefit documentation for reasonableness. During a feasibility study audit, the IS auditor's primary concern is validating that the proposed project is economically viable and realistic. Reviewing cost-benefit documentation for reasonableness directly assesses whether the project makes financial sense and whether the costs justify the benefits. This is a core audit responsibility at the feasibility stage before significant resources are committed. Now, why are the other options incorrect? Option A is incorrect. Reviewing the RFP is important but occurs after the feasibility study is approved, not during the audit of feasibility itself. Option B is incorrect. Legal counsel review of vendor contracts is a procurement function, not an IS auditor's responsibility during feasibility assessment. Option D is incorrect. Project team qualifications are evaluated during project planning phases, not during the initial feasibility study audit. Therefore, C, review cost-benefit documentation for reasonableness, is the correct answer.
Play from 2:31:15 Question 83. An organization uses system interfaces to disburse money to various banks. Which of the following features in the system interfaces is MOST important to provide assurance that the money is going to the right bank account? Here are the options. Option A. Audit logging. Option B. Nonrepudiation. Option C. Encryption. Option D. Digital signature. Pause the video now if you want time to think about the answer.
The correct answer is D. Digital signature. Digital signatures provide non-repudiation and authentication, ensuring that the disbursement instruction originates from an authorized source and cannot be denied. They also prevent tampering with the bank account information in transit. Digital signatures specifically verify the authenticity and integrity of the instruction to route money to the correct account, providing assurance that the funds reach the intended destination. Now, why are the other options incorrect? Option A is incorrect. Audit logging records what happened but does not prevent money from being sent to the wrong account. Option B is incorrect. Nonrepudiation prevents denial of an action but does not specifically verify that the destination account is correct. Option C is incorrect. Encryption protects data confidentiality in transit but does not verify the authenticity or correctness of the bank account information. Therefore, D, Digital signature, is the correct answer.
Play from 2:33:03 Question 84. Which of the following BEST enables alignment of IT with business objectives? Here are the options. Option A. Benchmarking against peer organizations. Option B. Completing an IT risk assessment. Option C. Developing key performance indicators (KPIs). Option D. Leveraging an IT governance framework. Pause the video now if you want time to think about the answer.
The correct answer is D. Leveraging an IT governance framework. An IT governance framework provides the structured approach and mechanisms that systematically align IT strategy, processes, and decisions with business objectives. It establishes the governance structures and accountability needed for alignment. Option A (benchmarking) provides comparative data but not alignment mechanisms. Option B (risk assessment) identifies risks but doesn't align IT with objectives. Option C (KPIs) measures outcomes but doesn't establish alignment structures. Now, why are the other options incorrect? Option A is incorrect. Benchmarking shows how peer organizations perform but doesn't directly align an organization's IT with its own business objectives. Option B is incorrect. A risk assessment identifies threats and vulnerabilities but doesn't establish alignment between IT and business objectives. Option C is incorrect. KPIs measure performance but don't establish the governance structures needed to drive alignment. Therefore, D, Leveraging an IT governance framework, is the correct answer.
Play from 2:34:56 Question 85. Which of the following incident response team activities contributes the MOST to preventing future incidents? Here are the options. Option A. Establishing escalation procedures. Option B. Participating in lessons learned exercises. Option C. Involving management in the response process. Option D. Isolating affected hosts. Pause the video now if you want time to think about the answer.
The correct answer is B. Participating in lessons learned exercises. Lessons learned exercises directly extract knowledge from incidents and translate it into actionable improvements to prevent similar future incidents. This is a proactive, forward- looking activity that creates organizational learning. While escalation procedures, management involvement, and host isolation are all important incident response activities, only lessons learned exercises systematically convert incident experience into preventive measures. Now, why are the other options incorrect? Option A is incorrect. Escalation procedures are reactive mechanisms that support response but don't prevent future incidents. Option C is incorrect. Management involvement supports the response process but doesn't specifically contribute to prevention. Option D is incorrect. Isolating hosts is a containment tactic that addresses the current incident, not future prevention. Therefore, B, Participating in lessons learned exercises, is the correct answer.
Play from 2:36:45 Question 86. Which of the following BEST enables an organization to quantify acceptable data loss in the event of a disaster? Here are the options. Option A. Recovery time objective (RTO). Option B. Recovery point objective (RPO). Option C. Availability of backup software. Option D. Mean time to recover (MTTR). Pause the video now if you want time to think about the answer.
The correct answer is B. Recovery point objective (RPO). Recovery point objective (RPO) directly quantifies the maximum acceptable amount of data loss by specifying the point in time to which systems and data must be recovered. RPO is measured in terms of time (e.g., 4 hours of acceptable data loss) and defines the organization's tolerance for data loss in a disaster scenario. RTO measures recovery time, not data loss; backup software availability does not quantify acceptable loss; MTTR measures repair speed, not loss tolerance. Now, why are the other options incorrect? Option A is incorrect. Recovery time objective measures how quickly systems must be restored, not how much data loss is acceptable. Option C is incorrect. Backup software availability is a technical capability, not a metric for quantifying acceptable data loss. Option D is incorrect. Mean time to recover measures restoration speed, not the acceptable amount of lost data. Therefore, B, Recovery point objective (RPO), is the correct answer.
Play from 2:38:40 Question 87. During an audit of a reciprocal disaster recovery agreement between two companies, the IS auditor would be MOST concerned with the: Here are the options. Option A. allocation of resources during an emergency. Option B. maintenance of hardware and software compatibility. Option C. differences in IS policies and procedures. Option D. frequency of system testing. Pause the video now if you want time to think about the answer.
The correct answer is B. maintenance of hardware and software compatibility. Hardware and software compatibility between the two organizations is critical because a reciprocal disaster recovery agreement assumes each company can run the other's systems and data. Incompatible systems, architectures, or software versions would make recovery impossible or ineffective. Resource allocation, policy differences, and testing frequency are important but secondary to ensuring the systems can actually function together during recovery operations. Now, why are the other options incorrect? Option A is incorrect. Resource allocation during emergency is important but secondary to whether the systems can actually run on the partner's infrastructure. Option C is incorrect. Policy and procedure differences are operational concerns but do not prevent technical recovery if systems are compatible. Option D is incorrect. Testing frequency ensures readiness but the primary concern is whether the systems are compatible enough to function together. Therefore, B, maintenance of hardware and software compatibility, is the correct answer.
Play from 2:40:36 Question 88. Which of the following BEST indicates that an incident management process is effective? Here are the options. Option A. Decreased number of calls to the help desk. Option B. Increased number of incidents reviewed by IT management. Option C. Decreased time for incident resolution. Option D. Increased number of reported critical incidents. Pause the video now if you want time to think about the answer.
The correct answer is C. Decreased time for incident resolution. Decreased time for incident resolution is the best indicator that an incident management process is effective because it directly measures the process's primary objective: to restore normal operations as quickly as possible. Faster resolution reduces business impact and demonstrates that the process is working well, whereas other metrics may reflect volume or resource factors rather than process effectiveness. Now, why are the other options incorrect? Option A is incorrect. A decreased number of calls to the help desk could indicate fewer incidents, but it doesn't measure how effectively incidents are being resolved. Option B is incorrect. An increased number of incidents reviewed by IT management may indicate better oversight but doesn't demonstrate faster or more effective resolution. Option D is incorrect. An increased number of reported critical incidents suggests more problems are being recognized, not that the process is effective at resolving them. Therefore, C, Decreased time for incident resolution, is the correct answer.
Play from 2:42:26 Question 89. Which type of device sits on the perimeter of a corporate or home network, where it obtains a public IP address and then generates private IP addresses internally? Here are the options. Option A. Gateway. Option B. Switch. Option C. Intrusion prevention system (IPS). Option D. Router. Pause the video now if you want time to think about the answer.
The correct answer is D. Router. A router is the device that sits on the perimeter of a corporate or home network, obtaining a public IP address from the Internet Service Provider and then generating and assigning private IP addresses internally to devices on the local network. Routers perform this NAT (Network Address Translation) function as their primary role at the network perimeter. Now, why are the other options incorrect? Option A is incorrect. A gateway is a more general term and may perform multiple functions; router is the specific device providing the described IP address functionality. Option B is incorrect. A switch operates within a network to connect devices locally; it does not sit on the perimeter or manage public/private IP address translation. Option C is incorrect. An IPS is a security device focused on threat detection and prevention; it does not perform the IP address translation function described. Therefore, D, Router, is the correct answer.
Play from 2:44:11 Question 90. Which of the following would protect the confidentiality of information sent in email messages? Here are the options. Option A. Encryption. Option B. Secure Hash Algorithm 1 (SHA-1). Option C. Digital certificates. Option D. Digital signatures. Pause the video now if you want time to think about the answer.
The correct answer is A. Encryption. Encryption is the mechanism that protects confidentiality by rendering information unreadable to unauthorized parties. It transforms plaintext into ciphertext that cannot be decrypted without the appropriate key. SHA-1, digital certificates, and digital signatures serve other security functions (integrity, authentication, non-repudiation) but do not directly protect confidentiality by hiding the content of messages. Now, why are the other options incorrect? Option B is incorrect. SHA-1 is a hashing algorithm used for integrity verification and authentication, not confidentiality protection. Option C is incorrect. Digital certificates are used for authentication and key distribution, not for encrypting message content to protect confidentiality. Option D is incorrect. Digital signatures provide authentication and non-repudiation, not confidentiality of the message content. Therefore, A, Encryption, is the correct answer.
Play from 2:45:57 Question 91. The application systems quality assurance (QA) function should: Here are the options. Option A. compare programs to approved system changes. Option B. ensure adherence of programs to standards. Option C. assist programmers in designing and developing applications. Option D. design and develop quality applications by employing system development methodology. Pause the video now if you want time to think about the answer.
The correct answer is B. ensure adherence of programs to standards. The primary responsibility of application systems QA is to ensure that developed programs adhere to organizational standards, best practices, coding guidelines, and quality benchmarks. QA acts as an independent verification function separate from development. Option A is quality control (comparing to approved changes), C and D describe development activities rather than QA's independent assurance role. Now, why are the other options incorrect? Option A is incorrect. Comparing programs to approved changes is a change control function, not the core QA responsibility. Option C is incorrect. Assisting programmers in design is a development support role, not QA's independent assurance function. Option D is incorrect. Designing and developing applications is a development function; QA should be independent of development to provide objective assurance. Therefore, B, ensure adherence of programs to standards, is the correct answer.
Play from 2:47:52 Question 92. Which of the following BEST describes a digital signature? Here are the options. Option A. It dynamically validates modifications of data. Option B. It is under control of the receiver. Option C. It is capable of authorization. Option D. It is unique to the sender using it. Pause the video now if you want time to think about the answer.
The correct answer is D. It is unique to the sender using it. A digital signature is mathematically unique to the sender who created it, derived from their private key. This uniqueness is the core characteristic that enables authentication (proving who sent it) and non-repudiation (the sender cannot deny having sent it). While digital signatures can validate that data has not been modified, option A is imprecise; option B mischaracterizes control; and option C, though related to capability, is less fundamental than the unique sender identification that defines a digital signature. Now, why are the other options incorrect? Option A is incorrect. Digital signatures validate data integrity but do not dynamically validate modifications in real-time; this describes monitoring mechanisms, not the signature itself. Option B is incorrect. Digital signatures are under the control of the sender (who holds the private key), not the receiver. Option C is incorrect. While digital signatures can support authorization, this is a function they enable rather than what they fundamentally are. Therefore, D, It is unique to the sender using it, is the correct answer.
Play from 2:49:44 Question 93. Which of the following is the BEST indication of effective governance over IT infrastructure? Here are the options. Option A. A decrease in the number of information security incidents. Option B. A requirement for annual security awareness programs. Option C. The ability to deliver continuous, reliable performance. Option D. An increase in the number of IT infrastructure servers. Pause the video now if you want time to think about the answer.
The correct answer is C. The ability to deliver continuous, reliable performance. The best indication of effective governance over IT infrastructure is the ability to deliver continuous, reliable performance. This demonstrates that governance structures, processes, and controls are working together effectively to ensure systems operate as intended, meet business requirements, and maintain availability. While security incidents (A) declining is positive, it's more specific to security governance. Annual training (B) is a control activity, not a governance outcome. Server quantity (D) is irrelevant to governance effectiveness. Now, why are the other options incorrect? Option A is incorrect. Reduced security incidents indicate security program effectiveness but not overall IT infrastructure governance. Option B is incorrect. Security awareness programs are control activities, not measures of governance effectiveness. Option D is incorrect. The number of servers has no correlation with governance quality or effectiveness. Therefore, C, The ability to deliver continuous, reliable performance, is the correct answer.
Play from 2:51:38 Question 94. When multiple IT projects have to be run simultaneously for a data loss prevention (DLP) initiative, which of the following should be introduced to BEST minimize the associated risk? Here are the options. Option A. Resource management. Option B. Portfolio management. Option C. Change management. Option D. Program management. Pause the video now if you want time to think about the answer.
The correct answer is D. Program management. Program management is the discipline that oversees multiple related projects (programs) executed simultaneously to achieve strategic objectives. When running multiple IT projects for a DLP initiative, program management provides the governance, coordination, and risk oversight across all projects to ensure they work cohesively and minimize overall risk. This is distinct from managing individual project resources or handling change requests: it requires the holistic orchestration that program management provides. Now, why are the other options incorrect? Option A is incorrect. Resource management addresses personnel and asset allocation but does not provide the cross-project governance needed for multiple simultaneous initiatives. Option B is incorrect. Portfolio management manages investments across the entire organization's projects; program management is more specific to coordinated project groups. Option C is incorrect. Change management handles configuration and change control but does not coordinate multiple projects or their interdependencies. Therefore, D, Program management, is the correct answer.
Play from 2:53:38 Question 95. When assessing a proposed project for the two-way replication of a customer database with a remote call center, the IS auditor should ensure that: Here are the options. Option A. end users are trained in the replication process. Option B. the source database is backed up on both sites. Option C. user rights are identical on both databases. Option D. database conflicts are managed during replication. Pause the video now if you want time to think about the answer.
The correct answer is D. database conflicts are managed during replication. When implementing two-way database replication, the critical control is managing conflicts that arise when the same data is modified on both sites simultaneously. Conflict resolution mechanisms are essential to maintain data integrity and consistency across replicated databases. While other options may be helpful, they are not the primary audit concern for ensuring replication effectiveness. Now, why are the other options incorrect? Option A is incorrect. End user training relates to operational capability but does not address the technical control needed to manage replication conflicts. Option B is incorrect. Backing up the source database at both sites does not address how conflicts during active replication are resolved. Option C is incorrect. Identical user rights may be desirable but are not the essential technical control for managing replication conflicts. Therefore, D, database conflicts are managed during replication, is the correct answer.
Play from 2:55:30 Question 96. Which of the following audit findings should be given the HIGHEST priority? Here are the options. Option A. IT key risk indicators (KRIs) are calculated internally by the IT team. Option B. The organization's IT investment exceeds industry benchmarks. Option C. IT key risk indicators (KRIs) are not periodically reviewed. Option D. The board’s agenda does not include the progress of IT projects. Pause the video now if you want time to think about the answer.
The correct answer is C. IT key risk indicators (KRIs) are not periodically reviewed. IT key risk indicators (KRIs) that are not periodically reviewed present the highest priority finding because KRIs are essential control mechanisms that alert management to emerging risks. If KRIs are not reviewed regularly, management loses visibility into critical IT risks and cannot respond proactively to deteriorating conditions. This represents a breakdown in the fundamental risk monitoring and governance process. Now, why are the other options incorrect? Option A is incorrect. KRIs being calculated internally by the IT team, while potentially a control design consideration, does not necessarily prevent effective risk monitoring if the results are reviewed. Option B is incorrect. IT investment exceeding industry benchmarks is a resource allocation question but does not directly indicate an unmanaged risk. Option D is incorrect. While the board's agenda excluding IT project progress is a governance gap, lacking KRI reviews is a more direct failure in risk identification and management. Therefore, C, IT key risk indicators (KRIs) are not periodically reviewed, is the correct answer.
Play from 2:57:39 Question 97. Which of the following BEST demonstrates alignment of the IT department with the corporate mission? Here are the options. Option A. Annual board meetings. Option B. Biweekly reporting to senior management. Option C. Quarterly steering committee meetings. Option D. Analysis of IT department functionality. Pause the video now if you want time to think about the answer.
The correct answer is D. Analysis of IT department functionality. Analysis of IT department functionality directly demonstrates whether IT operations align with and support the corporate mission by evaluating how effectively IT delivers capabilities that advance organizational objectives. This substantive analysis provides concrete evidence of alignment, whereas the other options are merely communication frequencies or meeting structures that do not necessarily indicate actual strategic alignment. Now, why are the other options incorrect? Option A is incorrect. Annual board meetings are infrequent and do not provide systematic evidence of functional alignment with corporate mission. Option B is incorrect. Biweekly reporting is a communication frequency but does not demonstrate that IT functions actually support corporate objectives. Option C is incorrect. Quarterly steering committee meetings are governance forums but do not inherently demonstrate that IT functionality aligns with mission. Therefore, D, Analysis of IT department functionality, is the correct answer.
Play from 2:59:26 Question 98. An organization's information security policies should be developed PRIMARILY on the basis of: Here are the options. Option A. industry best practices. Option B. enterprise architecture (EA). Option C. a risk management process. Option D. past information security incidents. Pause the video now if you want time to think about the answer.
The correct answer is C. a risk management process. A risk management process is the primary foundation for developing security policies because it identifies the organization's specific threats, vulnerabilities, and asset values, allowing policies to be tailored to actual organizational risk. While industry best practices inform standards and baselines, they must be adapted to each organization's unique risk profile. Policies derived from risk management ensure resources are allocated to control the risks most material to the organization. Now, why are the other options incorrect? Option A is incorrect. Industry best practices provide useful reference points but do not account for organization-specific risks and priorities. Option B is incorrect. Enterprise architecture describes technical structure but does not identify risks or drive policy content and requirements. Option D is incorrect. Past incidents provide useful lessons but address only historical events; risk management provides forward-looking, comprehensive coverage. Therefore, C, a risk management process, is the correct answer.
Play from 3:01:20 Question 99. Which of the following is the MOST important element of quality control with respect to an audit engagement? Here are the options. Option A. Increase of audit quality through multiple follow-up audits. Option B. Responsibility of leadership for quality in audits. Option C. Assignment of engagement teams for audits. Option D. Resolution procedures for differences of opinion in audits. Pause the video now if you want time to think about the answer.
The correct answer is B. Responsibility of leadership for quality in audits. The most important element of quality control in auditing is the responsibility of leadership for ensuring and maintaining quality standards. Leadership sets the tone, establishes quality standards, allocates resources, and ensures compliance with professional standards. This foundational commitment at the leadership level is what enables all other quality control measures to be effective. Now, why are the other options incorrect? Option A is incorrect. Multiple follow-up audits increase audit frequency but do not inherently improve quality; quality must be built into each engagement. Option C is incorrect. While team assignment is part of quality control, it is an operational implementation detail, not the most important element. Option D is incorrect. Resolution procedures address disagreements but are secondary to the fundamental leadership responsibility for quality oversight. Therefore, B, Responsibility of leadership for quality in audits, is the correct answer.
Play from 3:03:10 Question 100. Which of the following is the BEST performance indicator for the effectiveness of an incident management program? Here are the options. Option A. Incident alert meantime. Option B. Number of incidents reported. Option C. Average time between incidents. Option D. Incident resolution meantime. Pause the video now if you want time to think about the answer.
The correct answer is D. Incident resolution meantime. Incident resolution meantime (MTTR) is the best performance indicator for incident management effectiveness because it directly measures how quickly the organization returns to normal operations and minimizes business impact. This metric reflects the entire incident lifecycle: detection, response, and recovery. While other metrics provide supporting data, MTTR is the most direct measure of program effectiveness and business value. Now, why are the other options incorrect? Option A is incorrect. Mean alert time measures detection speed but not the full resolution capability or effectiveness. Option B is incorrect. Number of incidents reported reflects reporting culture, not management effectiveness; more reports could indicate worse security. Option C is incorrect. Time between incidents measures overall security posture but is influenced by many factors beyond incident management program quality. Therefore, D, Incident resolution meantime, is the correct answer.
