Free ISACA CISA Übungsprüfungen - Seite 14 von 55

Question #131

During a pre-deployment assessment, what is the BEST indication that a business case will lead to the achievement of business objectives?

A . The business case reflects stakeholder requirements.
B . The business case is based on a proven methodology.
C . The business case passed a quality review by an independent party.
D . The business case identifies specific plans for cost allocation.

Lösung einblenden Lösung ausblenden

Richtige Antwort: A
A

Explanation:

During a pre-deployment assessment, the best indication that a business case will lead to the achievement of business objectives is that the business case reflects stakeholder requirements. A business case is a document that explains the rationale, benefits, costs, and risks of a proposed project or initiative. A business case should align with the strategic goals and vision of the organization and address the needs and expectations of the stakeholders who are involved in or affected by the project12.

Stakeholder requirements are the conditions or capabilities that stakeholders expect from a project or its outcomes. Stakeholders can include customers, users, employees, managers, suppliers, regulators, and others who have an interest or stake in the project. Stakeholder requirements should be identified, analyzed, prioritized, validated, and documented throughout the project lifecycle34.

The business case should reflect stakeholder requirements because they provide the basis for defining the project scope, objectives, deliverables, quality standards, success criteria, and benefits realization. By reflecting stakeholder requirements, the business case can demonstrate how the project will add value to the organization and its stakeholders, justify the investment and resources required for the project, and facilitate the decision-making and approval process for the project5 .

Therefore, during a pre-deployment assessment, an IS auditor should look for evidence that the business case reflects stakeholder requirements as the best indication that the business case will lead to the achievement of business objectives.

References:

How to Write a Business Case (Template Included) – ProjectManager

How to Write a Business Case | Smartsheet

What are Stakeholder Requirements? | PM Study Circle

Stakeholder Requirements – Project Management Knowledge

Business Case vs Business Requirements – Difference Between

[Business Case Development – Project Management Docs]

Question #132

An organization has replaced all of the storage devices at its primary data center with new higher-capacity units The replaced devices have been installed at the disaster recovery site to replace older units An IS auditor s PRIMARY concern would be whether

A . the recovery site devices can handle the storage requirements
B . hardware maintenance contract is in place for both old and new storage devices
C . the procurement was in accordance with corporate policies and procedures
D . the relocation plan has been communicated to all concerned parties

Lösung einblenden Lösung ausblenden

Question #133

During an audit of a financial application, it was determined that many terminated users‘ accounts were not disabled.

Which of the following should be the IS auditor’s NEXT step?

A . Perform substantive testing of terminated users‘ access rights.
B . Perform a review of terminated users‘ account activity
C . Communicate risks to the application owner.
D . Conclude that IT general controls ate ineffective.

Lösung einblenden Lösung ausblenden

Question #134

Which of the following would be MOST helpful to an IS auditor performing a risk assessment of an application programming interface (API) that feeds credit scores from a well-known commercial credit agency into an organizational system?

A . A data dictionary of the transferred data
B . A technical design document for the interface configuration
C . The most recent audit report from the credit agency
D . The approved business case for the API

Lösung einblenden Lösung ausblenden

Question #135

Backup procedures for an organization’s critical data are considered to be which type of control?

A . Directive
B . Corrective
C . Detective
D . Compensating

Lösung einblenden Lösung ausblenden

Question #136

Which of the following is the MOST significant risk when an application uses individual end-user accounts to access the underlying database?

A . Multiple connects to the database are used and slow the process_
B . User accounts may remain active after a termination.
C . Users may be able to circumvent application controls.
D . Application may not capture a complete audit trail.

Lösung einblenden Lösung ausblenden

Richtige Antwort: C
C

Explanation:

The most significant risk when an application uses individual end-user accounts to access the underlying database is that users may be able to circumvent application controls. Application controls are the policies, procedures, and mechanisms that ensure the accuracy, completeness, validity, and authorization of transactions and data within an application. Application controls can include input validation, output verification, processing logic, reconciliation, exception handling, and audit trails. Application controls can help prevent or detect errors, fraud, or unauthorized access or modification of data.

However, if an application uses individual end-user accounts to access the underlying database, it means that the users have direct access to the database without going through the application layer.

This can expose the database to potential risks such as:

Users may be able to bypass the application controls and manipulate the data in the database directly using SQL commands or other tools. For example, users may be able to change their own or others’ salaries, grades, or balances without proper authorization or validation.

Users may be able to access or disclose sensitive or confidential data that they are not supposed to see or share. For example, users may be able to view other users’ personal information, passwords, or credit card numbers.

Users may be able to introduce errors or inconsistencies in the data by entering invalid or incorrect data or by deleting or modifying existing data. For example, users may be able to create duplicate records, break referential integrity, or cause data loss or corruption.

Users may be able to compromise the security and performance of the database by creating unauthorized objects, granting excessive privileges, executing malicious code, or consuming excessive resources. For example, users may be able to create backdoors, viruses, or denial-of-service attacks.

Therefore, using individual end-user accounts to access the underlying database can pose a serious threat to the integrity, confidentiality, availability, and reliability of the data and the application.

The other options are not as significant as option

C. Multiple connects to the database are used and slow the process is a performance issue that can affect the efficiency and responsiveness of the application and the database, but it does not necessarily compromise the data quality or security. User accounts may remain active after a termination is a security issue that can increase the risk of unauthorized access or misuse of data by former employees or others who have access to their credentials, but it can be mitigated by implementing proper account management and monitoring processes. Application may not capture a complete audit trail is a compliance issue that can affect the accountability and traceability of transactions and data within the application and the database, but it does not directly affect the data accuracy or protection.

References:

Should application users be database users? – Stack Overflow1

An Approach Toward Sarbanes-Oxley ITGC Risk Assessment – ISACA2

ISACA CISA Certified Information Systems Auditor Exam … – PUPUWEB3

Why inactive accounts are a security risk | Stratosphere4

Question #137

The PRIMARY advantage of object-oriented technology is enhanced:

A . efficiency due to the re-use of elements of logic.
B . management of sequential program execution for data access.
C . grouping of objects into methods for data access.
D . management of a restricted variety of data types for a data object.

Lösung einblenden Lösung ausblenden

Question #138

When building or upgrading enterprise cryptographic infrastructure, which of the following is the MOST critical requirement for growing business environments?

A . Service discovery
B . Backup and restoration capabilities
C . Network throttling
D . Scalable architectures and systems

Lösung einblenden Lösung ausblenden

Question #139

Which of the following is MOST important to the effectiveness of smoke detectors installed in a data processing facility?

A . Detectors trigger audible alarms when activated.
B . Detectors have the correct industry certification.
C . Detectors are linked to dry pipe fire suppression systems.
D . Detectors are linked to wet pipe fire suppression systems.

Lösung einblenden Lösung ausblenden

Question #140

To enable the alignment of IT staff development plans with IT strategy, which of the following should be done FIRST?

A . Review IT staff job descriptions for alignment
B . Develop quarterly training for each IT staff member.
C . Identify required IT skill sets that support key business processes
D . Include strategic objectives m IT staff performance objectives

Lösung einblenden Lösung ausblenden