ISACA CISA Übungsprüfungen
Zuletzt aktualisiert am 07.05.2025- Prüfungscode: CISA
- Prüfungsname: Certified Information Systems Auditor
- Zertifizierungsanbieter: ISACA
- Zuletzt aktualisiert am: 07.05.2025
Which of the following is the BEST audit procedure to determine whether a firewall is configured in compliance with the organization’s security policy?
- A . Reviewing the parameter settings
- B . Reviewing the system log
- C . Interviewing the firewall administrator
- D . Reviewing the actual procedures
Which of the following is the MOST significant risk that IS auditors are required to consider for each engagement?
- A . Process and resource inefficiencies
- B . Irregularities and illegal acts
- C . Noncompliance with organizational policies
- D . Misalignment with business objectives
An IS auditor is reviewing the installation of a new server. The IS auditor’s PRIMARY objective is to ensure that
- A . security parameters are set in accordance with the manufacturer s standards.
- B . a detailed business case was formally approved prior to the purchase.
- C . security parameters are set in accordance with the organization’s policies.
- D . the procurement project invited lenders from at least three different suppliers.
During a database management evaluation an IS auditor discovers that some accounts with database administrator (DBA) privileges have been assigned a default password with an unlimited number of failed login attempts.
Which of the following is the auditor’s BEST course of action?
- A . Identify accounts that have had excessive failed login attempts and request they be disabled
- B . Request the IT manager to change administrator security parameters and update the finding
- C . Document the finding and explain the risk of having administrator accounts with inappropriate security settings
An IS auditor is reviewing the security of a web-based customer relationship management (CRM) system that is directly accessed by customers via the Internet, which of the following should be a concern for the auditor?
- A . The system is hosted on an external third-party service provider’s server.
- B . The system is hosted in a hybrid-cloud platform managed by a service provider.
- C . The system is hosted within a demilitarized zone (DMZ) of a corporate network.
- D . The system is hosted within an internal segment of a corporate network.
An organization’s sensitive data is stored in a cloud computing environment and is encrypted.
Which of the following findings should be of GREATEST concern to an IS auditor?
- A . The encryption keys are not kept under dual control.
- B . The cloud vendor does not have multi-regional presence.
- C . Symmetric keys are used for encryption.
- D . Data encryption keys are accessible to the service provider.
A network analyst is monitoring the network after hours and detects activity that appears to be a brute-force attempt to compromise a critical server.
After reviewing the alerts to ensure their accuracy, what should be done NEXT?
- A . Perform a root cause analysis.
- B . Document all steps taken in a written report.
- C . Isolate the affected system.
- D . Invoke the incident response plan.
An organization’s information security policies should be developed PRIMARILY on the basis of:
- A . enterprise architecture (EA).
- B . industry best practices.
- C . a risk management process.
- D . past information security incidents.
Which of the following should an IS auditor review when evaluating information systems governance for a large organization?
- A . Approval processes for new system implementations
- B . Procedures for adding a new user to the invoice processing system
- C . Approval processes for updating the corporate website
- D . Procedures for regression testing system changes
Which of the following security measures will reduce the risk of propagation when a cyberattack
occurs?
- A . Perimeter firewall
- B . Data loss prevention (DLP) system
- C . Network segmentation
- D . Web application firewall (WAF)