Free ISACA CISA Übungsprüfungen - Seite 34 von 55

Question #331

An IS auditor finds that the process for removing access for terminated employees is not documented What is the MOST significant risk from this observation?

A . Procedures may not align with best practices
B . Human resources (HR) records may not match system access.
C . Unauthorized access cannot he identified.
D . Access rights may not be removed in a timely manner.

Lösung einblenden Lösung ausblenden

Question #332

Which of the following is the GREATEST concern associated with a high number of IT policy

exceptions approved by management?

A . The exceptions are likely to continue indefinitely.
B . The exceptions may result in noncompliance.
C . The exceptions may elevate the level of operational risk.
D . The exceptions may negatively impact process efficiency.

Lösung einblenden Lösung ausblenden

Question #333

During a security audit, an IS auditor is tasked with reviewing log entries obtained from an enterprise intrusion prevention system (IPS).

Which type of risk would be associated with the potential for the auditor to miss a sequence of logged events that could indicate an error in the IPS configuration?

A . Sampling risk
B . Detection risk
C . Control risk
D . Inherent risk

Lösung einblenden Lösung ausblenden

Question #334

Which of the following metrics is the BEST indicator of the performance of a web application?

A . Server thread count
B . Server uptime
C . Average response time
D . HTTP server error rate

Lösung einblenden Lösung ausblenden

Question #335

An IS auditor is evaluating an enterprise resource planning (ERP) migration from local systems to the cloud.

Who should be responsible for the data

classification in this project?

A . Information security officer
B . Database administrator (DBA)
C . Information owner
D . Data architect

Lösung einblenden Lösung ausblenden

Richtige Antwort: C
C

Explanation:

The best option for the question is C, information owner.

This is because:

The information owner is the person or entity that has the authority and responsibility for the business processes and functions that collect, use, store, and dispose of data1.

The information owner is accountable for ensuring that the data is handled in compliance with the applicable laws, regulations, policies, and standards, such as the GDPR and the PIPEDA1234.

The information owner is in the best position to determine the purpose and necessity of collecting and retaining data, as well as the risks and benefits associated with it1.

The information owner should consult with other stakeholders, such as the risk manager, the database administrator (DBA), and the privacy manager, to establish and implement appropriate data classification policies and procedures2.

Data classification is the process of organizing data in groups based on their attributes and characteristics, and then assigning class labels that describe a set of attributes that hold true for the corresponding data sets345.

Data classification helps organizations to identify, manage, protect, and understand their data, as well as to comply with modern data privacy regulations345.

Data classification also helps to determine appropriate user access levels, which means defining who can access, modify, share, or delete data based on their roles, responsibilities, and needs345.

Therefore, the information owner should be responsible for the data classification in an ERP migration project from local systems to the cloud (option C), as they have the authority and accountability for the data and its protection.

The other options are not correct because:

The information security officer (option A) is responsible for overseeing and coordinating the security policies and practices of the organization that involve data6. The information security officer should advise and assist the information owner on the best practices and standards for data security, but not determine the data classification.

The database administrator (DBA) (option B) is responsible for installing, configuring, monitoring, maintaining, and improving the performance of databases and data stores that contain data5. The DBA should support the information owner in implementing and enforcing the data classification policies and procedures, but not determine them.

The data architect (option D) is responsible for designing, modeling, and documenting the logical and physical structures of databases and data stores that contain data7. The data architect should collaborate with the information owner in creating and maintaining the data classification schema and metadata, but not determine them.

Question #336

Which of the following is the BEST disposal method for flash drives that previously stored confidential data?

A . Destruction
B . Degaussing
C . Cryptographic erasure
D . Overwriting

Lösung einblenden Lösung ausblenden

Question #337

An IS auditor is reviewing an organization’s information asset management process.

Which of the following would be of GREATEST concern to the auditor?

A . The process does not require specifying the physical locations of assets.
B . Process ownership has not been established.
C . The process does not include asset review.
D . Identification of asset value is not included in the process.

Lösung einblenden Lösung ausblenden

Question #338

During an audit of an organization’s risk management practices, an IS auditor finds several documented IT risk acceptances have not been renewed in a timely manner after the assigned expiration date.

When assessing the seventy of this finding, which mitigating factor would MOST significantly minimize the associated impact?

A . There are documented compensating controls over the business processes.
B . The risk acceptances were previously reviewed and approved by appropriate senior management
C . The business environment has not significantly changed since the risk acceptances were approved.
D . The risk acceptances with issues reflect a small percentage of the total population

Lösung einblenden Lösung ausblenden

Question #339

Which of the following should be GREATEST concern to an IS auditor reviewing data conversion and migration during the implementation of a new application system?

A . Data conversion was performed using manual processes.
B . Backups of the old system and data are not available online.
C . Unauthorized data modifications occurred during conversion.
D . The change management process was not formally documented

Lösung einblenden Lösung ausblenden

Question #340

When classifying information, it is MOST important to align the classification to:

A . business risk
B . security policy
C . data retention requirements
D . industry standards

Lösung einblenden Lösung ausblenden