option
Questions
ayuda
daypo
search.php

CISA Simulado 100

COMMENTS STATISTICS RECORDS
TAKE THE TEST
Title of test:
CISA Simulado 100

Description:
CISA Simulado 100

Creation Date: 2014/11/17

Category: Others

Number of questions: 100

Rating:(11)
Share the Test:
Nuevo ComentarioNuevo Comentario
New Comment
NO RECORDS
Content:

Which of the following BEST reduces the ability of one device to capture the packets that are meant for another device?. A. Filters. B. Switches. C. Routers. D. Firewalls.

The responsibility for authorizing access to application data should be with the: A. data custodian. B. database administrator (DBA). C. data owner. D. security administrator.

The responsibilities of a disaster recovery relocation team include: A. obtaining, packaging and shipping media and records to the recovery facilities, as well as establishing and overseeing an offsite storage schedule. B. locating a recovery site, if one has not been predetermined, and coordinating the transport of company employees to the recovery site. C. managing the relocation project and conducting a more detailed assessment of the damage to the facilities and equipment. D. coordinating the process of moving from the hot site to a new location or to the restored original location.

Which of the following processes should an IS auditor recommend to assist in the recording of baselines for software releases?. A. Change management. B. Backup and recovery. C. Incident management. D. Configuration management.

Which of the following is the GREATEST benefit to implementing open source software (OSS)?. A. Reduction of the total cost of ownership (TCO). B. Ability to more easily customize program source code. C. Mitigation of the risk of being locked into a single provider. D. Reduction of the effort of performing system upgrades.

Management considered two projections for its business continuity plan; plan A with two months to recover and plan B with eight months to recover. The recovery point objectives are the same in both plans. It is reasonable to expect that plan B projected higher: A. downtime costs. B. resumption costs. C. recovery costs. D. walk-through costs.

Which of the following would be considered an essential feature of a network management system?. A. A graphical interface to map the network topology. B. Capacity to interact with the Internet to solve the problems. C. Connectivity to a help desk for advice on difficult issues. D. An export facility for piping data to spreadsheets.

The BEST method of confirming the accuracy of a system tax calculation is by: A. detailed visual review and analysis of the source code of the calculation programs. B. recreating program logic using generalized audit software to calculate monthly totals. C. preparing simulated transactions for processing and comparing the results to predetermined results. D. automatic flowcharting and analysis of the source code of the calculation programs.

Which of the following functions is performed by a virtual private network (VPN)?. A. Hiding information from sniffers on the net. B. Enforcing security policies. C. Detecting misuse or mistakes. D. Regulating access.

In a small organization, developers may release emergency changes directly to production. Which of the following will BEST control the risk in this situation?. A. Approve and document the change the next business day. B. Limit developer access to production to a specific time frame. C. Obtain secondary approval before releasing to production. D. Disable the compiler option in the production machine.

An organization engages individuals to evaluate the functional performance of a web application by entering common data into the fields and comparing system output to expected results. Which of the following MOST accurately represents this testing methodology?. A. White box testing. B. Alpha testing. C. Black box testing. D. Sand box testing.

Which of the following is an object-oriented technology characteristic that permits an enhanced degree of security over data?. A. Inheritance. B. Dynamic warehousing. C. Encapsulation. D. Polymorphism.

Upon receipt of the initial signed digital certificate the user will decrypt the certificate with the public key of the: A. registration authority (RA). B. certificate authority (CA). C. certificate repository. D. receiver.

Which of the following is the BEST control to mitigate the risk of pharming attacks to an Internet banking application?. A. User registration and password policies. B. User security awareness. C. Use of intrusion detection/intrusion prevention systems (IDSs/IPSs). D. Domain name system (DNS) server security hardening.

An IS auditor learns that the new human resources (HR) manager of a small company is a former IT network administrator. Using his IT skills, the new HR manager has granted himself the ability to read employees' email and to monitor their web usage. The IS auditor should: A. document the issue and verify that no company policies have been violated. B. request that the HR manager's access be revoked immediately. C. do nothing because the company does not have a privacy policy. D. contact the company president and make the president aware of the issue.

An IS auditor is performing a review of a network, and users report that the network is slow and web pages periodically time out. The IS auditor confirms the users' feedback and reports the findings to the network manager. The most appropriate action for the network management team should be to FIRST: A. use a protocol analyzer to perform network analysis and review error logs of local area network (LAN) equipment. B. take steps to increase the bandwidth of the connection to the Internet. C. create a baseline using a protocol analyzer and implement quality of service (QoS) to ensure that critical business applications work as intended. D. implement virtual LANs (vLANs) to segment the network and ensure performance.

Applying a retention date on a file will ensure that: A. data cannot be read until the date is set. B. data will not be deleted before that date. C. backup copies are not retained after that date. D. datasets having the same name are differentiated.

Which of the following exposures associated with the spooling of sensitive reports for offline printing should an IS auditor consider to be the MOST serious?. A. Sensitive data can be read by operators. B. Data can be amended without authorization. C. Unauthorized report copies can be printed. D. Output can be lost in the event of system failure.

ABC Inc. offers a number of services though its web site. During one day, senior executives of ABC Inc. were surprised to discover that sensitive data on their servers were being leaked to unauthorized individuals on the Internet. Postincident investigations revealed that ABC Inc.'s key servers were infected with a Trojan. The incident occurred after deployment of a newly acquired module from a software vendor, which was tested on test servers in accordance with functional specifications. The incident had gone unnoticed for a period of about four weeks. A potential cause of the leak may have been malware embedded in the new module. Which of the following operational controls should have detected the incident sooner?. A. Intrusion detection system (IDS). B. Vulnerability scan process. C. Firewall rule set review. D. Access control monitoring.

A financial services enterprise has a small IT department, and individuals perform more than one role. Which of the following practices represents the GREATEST risk?. A. The developers promote code into the production environment. B. The business analyst writes the requirements and performs functional testing. C. The IT manager also performs systems administration. D. The database administrator (DBA) also performs data backups.

What is the BEST way to verify that a digital signature is valid?. A. Verify that the sender's public key certificate is from a trusted certificate authority (CA). B. Use a hash algorithm from the CA to determine whether the message has been tampered with. C. Verify the digital signature through a manual comparison of the hash value. D. Obtain the public key from the sender, and verify the digital signature.

Which of the following would BEST help prevent structured query language (SQL) injection attacks of a web application?. A. Built-in input validations exist within the application. B. Avoid queries to the database from web applications. C. Avoid use of Dynamic SQL within the programmed queries. D. All database queries are reviewed by the database administrator (DBA).

An IS auditor discovers that devices connected to the network have not been included in a network diagram that had been used to develop the scope of the audit. The chief information officer (CIO) explains that the diagram is being updated and awaiting final approval. The IS auditor should FIRST: A. expand the scope of the IS audit to include the devices that are not on the network diagram. B. evaluate the impact of the undocumented devices on the audit scope. C. note a control deficiency because the network diagram has not been updated. D. plan follow-up audits of the undocumented devices.

The IS auditor is reviewing an organization's human resources (HR) database implementation. The IS auditor discovers that the database servers are clustered for high availability, all default database accounts have been removed and database audit logs are kept and reviewed on a weekly basis. What other area should the IS auditor check to ensure that the databases are appropriately secured?. A. Database digital signatures. B. Database encryption nonces and other variables. C. Database media access control (MAC) address authentication. D. Database initialization parameters.

A substantive test to verify that tape library inventory records are accurate is: A. determining whether bar code readers are installed. B. determining whether the movement of tapes is authorized. C. conducting a physical count of the tape inventory. D. checking if receipts and issues of tapes are accurately recorded.

Which of the following BEST describes the objective of an IS auditor discussing the audit findings with the auditee?. A. Communicate results of the audit to senior management. B. Develop time lines for the implementation of suggested recommendations. C. Confirm the findings, and develop a course of corrective action. D. Identify compensating controls to the identified risk.

Which of the following protocols provides the BEST confidentiality protection for web-based e-commerce transactions while in transit over the Internet?. A. Secure Multipurpose Internet Mail Extensions (S/MIME). B. Secure Shell (SSH). C. Secure File Transfer Protocol (SFTP). D. Secure Sockets Layer (SSL).

Which of the following controls will MOST effectively detect the presence of bursts of errors in network transmissions?. A. Parity check. B. Echo check. C. Block sum check. D. Cyclic redundancy check (CRC).

Which of the following is the GREATEST risk of an organization using reciprocal agreements for disaster recovery between two business units?. A. The documents contain legal deficiencies. B. Both entities are vulnerable to the same incident. C. IT systems are not identical. D. One party has more frequent disruptions than the other.

Which of the following does a lack of adequate controls represent?. A. An impact. B. A vulnerability. C. An asset. D. A threat.

Which of the following is the GREATEST concern associated with the use of peer-to-peer computing?. A. Virus infection. B. Data leakage. C. Network performance issues. D. Unauthorized software usage.

During an audit, the IS auditor notes that the application developer also performs quality assurance testing on a particular application. Which of the following should the IS auditor do?. A. Recommend compensating controls. B. Review the code created by the developer. C. Analyze the quality assurance dashboards. D. Report the identified condition.

An IS auditor is tasked to review the adequacy of an organization's technology recovery strategy. Which of the following factors would the auditor PRIMARILY review?. A. Recovery time objective (RTO). B. Business impact analysis (BIA). C. Ability to recover from severe disaster. D. Recovery point objective (RPO).

A rapid application development (RAD) methodology has been selected to implement a new enterprise resource planning (ERP) system. All of the project activities have been assigned to the contracted consulting company because internal employees are not available. What is the IS auditor's FIRST step to compensate for the lack of resources?. A. Review the project plan and approach. B. Ask the vendor to provide additional external staff. C. Recommend that the company hire more people. D. Stop the project until all human resources (HR) are available.

Which of the following is the PRIMARY objective of the business continuity plan (BCP) process?. A. To provide assurance to stakeholders that business operations will continue in the event of disaster. B. To establish an alternate site for IT services to meet predefined recovery time objectives (RTOs). C. To manage risk while recovering from an event that adversely affected operations. D. To meet the regulatory compliance requirements in the event of natural disaster.

What is a risk associated with attempting to control physical access to sensitive areas such as computer rooms using card keys or locks?. A. Unauthorized individuals wait for controlled doors to open and walk in behind those authorized. B. The contingency plan for the organization cannot effectively test controlled access practices. C. Access cards, keys and pads can be easily duplicated allowing easy compromise of the control. D. Removing access for those who are no longer authorized is complex.

Integrating business continuity planning (BCP) into IT project management aids in: A. the retrofitting of the business continuity requirements. B. the development of a more comprehensive set of requirements. C. the development of a transaction flowchart. D. ensuring the application meets the user's needs.

Which of the following is the MOST important action in recovering from a cyberattack?. A. Creating an incident response team. B. Using cyberforensic investigators. C. Executing a business continuity plan. D. Filing an insurance claim.

An IS auditor discovers that some hard drives disposed of by an enterprise were not sanitized in a manner that would reasonably ensure the data could not be recovered. In addition, the enterprise does not have a written policy on data disposal. The IS auditor should FIRST: A. draft an audit finding, and discuss it with the auditor in charge. B. determine the sensitivity of the information on the hard drives. C. discuss with the IT manager the best practice in data disposal. D. develop an appropriate data disposal policy for the enterprise.

Which of the following is the PRIMARY objective of an IT performance measurement process?. A. Minimize errors. B. Gather performance data. C. Establish performance baselines. D. Optimize performance.

An organization has established a guest network for visitor access. Which of the following should be of GREATEST concern to an IS auditor?. A. A login screen is not displayed for guest users. B. The guest network is not segregated from the production network. C. Guest users who are logged in are not isolated from each other. D. A single factor authentication technique is used to grant access.

Which of the following BEST encrypts data on mobile devices?. A. Elliptical curve cryptography (ECC). B. Data encryption standard (DES). C. Advanced encryption standard (AES). D. The blowfish algorithm.

The technique used to ensure security in virtual private networks (VPNs) is: A. encapsulation. B. wrapping. C. transform. D. encryption.

An IS auditor reviewing wireless network security determines that the Dynamic Host Configuration Protocol (DHCP) is disabled at all wireless access points. This practice: A. reduces the risk of unauthorized access to the network. B. is not suitable for small networks. C. automatically provides an IP address to anyone. D. increases the risk associated with Wireless Encryption Protocol (WEP).

Which of the following is of GREATEST concern to an IS auditor when performing an audit of a client relationship management (CRM) system migration project?. A. The technical migration is planned for a Friday preceding a long weekend, and the time window is too short for completing all tasks. B. Employees pilot-testing the system are concerned that the data representation in the new system is completely different from the old system. C. A single implementation is planned, immediately decommissioning the legacy system. D. Five weeks prior to the target date, there are still numerous defects in the printing functionality of the new system's software.

A new business application requires deviation from the standard configuration of the operating system (OS). What activity should the IS auditor recommend to the security manager as a FIRST response?. A. Initial rejection of the request because it is against the security policy. B. Approval of the exception to policy to meet business needs. C. Assessment of the risk and identification of compensating controls. D. Revision of the OS baseline configuration.

While evaluating software development practices in an organization, an IS auditor notes that the quality assurance (QA) function reports to project management. The MOST important concern for an IS auditor is the: A. effectiveness of the QA function because it should interact between project management and user management. B. efficiency of the QA function because it should interact with the project implementation team. C. effectiveness of the project manager because the project manager should interact with the QA function. D. efficiency of the project manager because the QA function will need to communicate with the project implementation team.

An organization has recently installed a security patch, which crashed the production server. To minimize the probability of this occurring again, an IS auditor should: A. apply the patch according to the patch's release notes. B. ensure that a good change management process is in place. C. thoroughly test the patch before sending it to production. D. approve the patch after doing a risk assessment.

Which of the following would BEST prevent power outages?. A. A power transfer system. B. Dual power leads. C. A power generator. D. An uninterruptible power supply.

Which of the following is a prevalent risk in the development of end-user computing (EUC) applications?. A. Applications may not be subject to testing and IT general controls. B. Development and maintenance costs may be increased. C. Application development time may be increased. D. Decision-making may be impaired due to diminished responsiveness to requests for information.

An IS auditor of a large organization is reviewing the roles and responsibilities for the IS function and has found some individuals serving multiple roles. Which one of the following combinations of roles should be of GREATEST concern for the IS auditor?. A. Network administrators are responsible for quality assurance. B. Security administrators are system programmers. C. End users are security administrators for critical applications. D. Systems analysts are database administrators.

Which of the following should be of GREATEST concern for an organization that is migrating from its local area network (LAN) to a completely wireless network?. A. Wireless user authentication. B. Interception of company information. C. Adequately trained personnel to support the wireless network. D. Interception of the wireless signal outside of boundary walls.

An advantage of using sanitized live transactions in test data is that: A. all transaction types will be included. B. every error condition is likely to be tested. C. no special routines are required to assess the results. D. test transactions are representative of live processing.

The IS auditor is reviewing prior findings from an IT audit of a hospital. One finding indicates that the organization was using email to communicate sensitive patient issues. The IT manager indicates that to address this finding, the organization has implemented digital signatures for all email users. What should the IS auditor's response be?. A. Digital signatures are not adequate to protect confidentiality. B. Digital signatures are adequate to protect confidentiality. C. The auditor should gather more information about the specific implementation. D. The auditor should recommend implementation of digital watermarking for secure email.

Which of the following is the MOST critical step to perform when planning an IS audit?. A. Review findings from prior audits. B. Develop plans to conduct a physical security review of the data center facility. C. Review IS security policies and procedures. D. Perform a risk assessment.

A decision support system (DSS): A. is aimed at solving highly structured problems. B. combines the use of models with nontraditional data access and retrieval functions. C. emphasizes flexibility in the decision making approach of users. D. supports only structured decision making tasks.

During a postimplementation review of a firewall upgrade project, an IS auditor discovered that several ports were left open that were not required for business purposes. It was determined that the ports were opened for a test server that was no longer being used. What is the BEST control to recommend so that this situation will not recur?. A. Firewall rule changes should happen only if the changes are properly documented. B. Test servers should never be connected via the production firewall. C. IT management should engage a third party to review the firewall rules and to conduct a penetration test on a quarterly basis. D. The security administrator should perform periodic reviews to validate firewall rules.

An IS auditor reviewing access controls for a client-server environment should FIRST: A. evaluate the encryption technique. B. identify the network access points. C. review the identity management system. D. review the application level access controls.

The goal of IT risk analysis is to: A. enable the alignment of IT risk management with enterprise risk management (ERM). B. enable the prioritization of risk responses. C. satisfy legal and regulatory compliance requirements. D. identify known threats and vulnerabilities to information assets.

When are errors in the process of granting logical access to a financial accounting application MOST likely to be identified?. A. During an IS audit. B. After implementation of an identity management solution. C. During account reconciliations. D. During periodic review of access by the business owner.

Which of the following methods of suppressing a fire in a data center is the MOST effective and environmentally friendly?. A. Halon gas. B. Wet-pipe sprinklers. C. Dry-pipe sprinklers. D. Carbon dioxide gas.

The internal audit team is auditing controls over sales returns and is concerned about fraud. Which of the following sampling methods would BEST assist the auditors?. A. Stop-or-go. B. Classical variable. C. Discovery. D. Probability-proportional-to-size.

An IS auditor is assigned to perform a postimplementation review of an application system. Which of the following situations may have impaired the independence of the IS auditor? The IS auditor: A. implemented a specific functionality during the development of the application system. B. designed an embedded audit module exclusively for auditing the application system. C. participated as a member of the application system project team, but did not have operational responsibilities. D. provided consulting advice concerning application system best practices.

An investment advisor emails periodic newsletters to clients and wants reasonable assurance that no one has modified the newsletter. This objective can be achieved by: A. encrypting the hash of the newsletter using the advisor's private key. B. encrypting the hash of the newsletter using the advisor's public key. C. digitally signing the document using the advisor's private key. D. encrypting the newsletter using the advisor's private key.

Before implementing an IT balanced scorecard (BSC), an organization must: A. deliver effective and efficient services. B. define key performance indicators. C. provide business value to IT projects. D. control IT expenses.

Which of the following types of firewalls provide the GREATEST degree and granularity of control?. A. Screening router. B. Packet filter. C. Application gateway. D. Circuit gateway.

A retail outlet has introduced radio frequency identification (RFID) tags to create unique serial numbers for all products. Which of the following is the PRIMARY concern associated with this initiative?. A. Issues of privacy. B. Wavelength can be absorbed by the human body. C. RFID tags may not be removable. D. RFID eliminates line-of-sight reading.

The frequent updating of which of the following is key to the continued effectiveness of a disaster recovery plan (DRP)?. A. Contact information of key personnel. B. Server inventory documentation. C. Individual roles and responsibilities. D. Procedures for declaring a disaster.

Which of the following should be the MOST important consideration when deciding on areas of priority for IT governance implementations?. A. Process maturity. B. Performance indicators. C. Business risk. D. Assurance reports.

Which of the following has the MOST significant impact on the success of an application systems implementation?. A. The prototyping application development methodology. B. Compliance with applicable external requirements. C. The overall organizational environment. D. The software reengineering technique.

An IS auditor should use statistical sampling and not judgmental (nonstatistical) sampling, when: A. the probability of error must be objectively quantified. B. the auditor wishes to avoid sampling risk. C. generalized audit software is unavailable. D. the tolerable error rate cannot be determined.

Which of the following is the most important element in the design of a data warehouse?. A. Quality of the metadata. B. Speed of the transactions. C. Volatility of the data. D. Vulnerability of the system.

An IS audit department is considering implementing continuous auditing techniques for a multinational retail enterprise that processes a large volume of transactions per day. A PRIMARY benefit of continuous auditing is that: A. effective preventive controls are enforced. B. system integrity is ensured. C. errors can be corrected in a timely fashion. D. fraud can be detected more quickly.

The effect of which of the following should have priority in planning the scope and objectives of an IS audit?. A. Applicable statutory requirements. B. Applicable corporate standards. C. Applicable industry best practices. D. Organizational policies and procedures.

Which of the following is an example of a passive attack initiated through the Internet?. A. Traffic analysis. B. Masquerading. C. Denial of service. D. Email spoofing.

A laptop computer belonging to a company database administrator (DBA) and containing a file of production database passwords has been stolen. What should the organization do FIRST?. A. Send a report to the IS audit department. B. Change the name of the DBA account. C. Suspend the DBA account. D. Change the database password.

Which of the following provides the GREATEST assurance of message authenticity?. A. The prehash code is derived mathematically from the message being sent. B. The prehash code is encrypted using the sender's private key. C. The prehash code and the message are encrypted using the secret key. D. The sender attains the recipient's public key and verifies the authenticity of its digital certificate with a certificate authority.

Which of the following is the BEST reason for integrating the testing of noncritical systems in disaster recovery plans (DRPs) with business continuity plans (BCPs)?. A. To ensure that DRPs are aligned to the business impact analysis (BIA). B. Infrastructure recovery personnel can be assisted by business subject matter experts. C. BCPs may assume the existence of capabilities that are not in DRPs. D. To provide business executives with knowledge of disaster recovery capabilities.

Which of the following is the GREATEST risk of an inadequate policy definition for ownership of data and systems?. A. User management coordination does not exist. B. Specific user accountability cannot be established. C. Unauthorized users may have access to originate, modify or delete data. D. Audit recommendations may not be implemented.

Regarding a disaster recovery plan, the role of an IS auditor should include: A. identifying critical applications. B. determining the external service providers involved in a recovery test. C. observing the tests of the disaster recovery plan. D. determining the criteria for establishing a recovery time objective (RTO).

Disabling which of the following would make wireless local area networks MORE secure against unauthorized access?. A. MAC (Media Access Control) address filtering. B. WPA (Wi-Fi Protected Access Protocol). C. LEAP (Lightweight Extensible Authentication Protocol). D. SSID (service set identifier) broadcasting.

Which of the following is MOST critical when creating data for testing the logic in a new or modified application system?. A. A sufficient quantity of data for each test case. B. Data representing conditions that are expected in actual processing. C. Completing the test on schedule. D. A random sample of actual data.

During a security audit of IT processes, an IS auditor found that documented security procedures did not exist. The IS auditor should: A. create the procedures document. B. terminate the audit. C. conduct compliance testing. D. identify and evaluate existing practices.

Which of the following is the BEST performance criterion for evaluating the adequacy of an organization's security awareness training?. A. Senior management is aware of critical information assets and demonstrates an adequate concern for their protection. B. Job descriptions contain clear statements of accountability for information security. C. In accordance with the degree of risk and business impact, there is adequate funding for security efforts. D. No actual incidents have occurred that have caused a loss or a public embarrassment.

When a new system is to be implemented within a short time frame, it is MOST important to: A. finish writing user manuals. B. perform user acceptance testing. C. add last-minute enhancements to functionalities. D. ensure that the code has been documented and reviewed.

Which of the following statements BEST describes the process used by the sender of a message when creating a digital signature?. A. Use the sender's private key to encrypt the message. B. Use the recipient's public key to encrypt the message digest. C. Use the sender's private key to encrypt the message digest. D. Use the recipient's public key to encrypt the message.

The BEST overall quantitative measure of the performance of biometric control devices is: A. false-rejection rate (FRR). B. false-acceptance rate (FAR). C. equal-error rate (EER). D. estimated-error rate.

An IS auditor has been assigned to review an organization's information security policy. Which of the following issues represents the HIGHEST potential risk?. A. The policy has not been updated in more than one year. B. The policy includes no revision history. C. The policy is approved by the security administrator. D. The company does not have an information security policy committee.

Which of the following should be a concern for an IS auditor reviewing an organization's cloud computing strategy which is based on a Software as a Service (SaaS) model with an external provider?. A. Workstation upgrades must be performed. B. Long-term software acquisition costs are higher. C. Contract with the provider does not include onsite technical support. D. Incident handling procedures with the provider are not well defined.

Which of the following is the MOST effective when determining the correctness of individual account balances migrated from one database to another?. A. Compare the hash total before and after the migration. B. Verify that the number of records is the same for both databases. C. Perform sample testing of the migrated account balances. D. Compare the control totals of all of the transactions.

Which of the following should an incident response team address FIRST after a major incident in an information processing facility?. A. Restoration at the facility. B. Documentation of the facility. C. Containment at the facility. D. Monitoring of the facility.

Which of the following provides the MOST relevant information for proactively strengthening security settings?. A. Bastion host. B. Intrusion detection system (IDS). C. Honeypot. D. Intrusion prevention system.

An organization has outsourced its wide area network (WAN) to a third-party service provider. Under these circumstances, which of the following is the PRIMARY task the IS auditor should perform during an audit of business continuity (BCP) and disaster recovery planning (DRP)?. A. Review whether the service provider's BCP process is aligned with the organization's BCP and contractual obligations. B. Review whether the service level agreement (SLA) contains a penalty clause in case of failure to meet the level of service in case of a disaster. C. Review the methodology adopted by the organization in choosing the service provider. D. Review the accreditation of the third-party service provider's staff.

Which of the following is MOST critical for the successful implementation and maintenance of a security policy?. A. Assimilation of the framework and intent of a written security policy by all appropriate parties. B. Management support and approval for the implementation and maintenance of a security policy. C. Enforcement of security rules by providing punitive actions for any violation of security rules. D. Stringent implementation, monitoring and enforcing of rules by the security officer through access control software.

Which of the following is the BEST information source to obtain evidence when a server has been compromised by malware?. A. Volatile data held in computer resources. B. Operating system (OS) event log history. C. Firewall event log history. D. OS configuration files.

The PRIMARY reason for using digital signatures is to ensure data: A. confidentiality. B. integrity. C. availability. D. timeliness.

A new business application has been designed in a large, complex organization and the business owner has requested that the various reports be viewed on a “need to know” basis. Which of the following access control methods would be the BEST method to achieve this requirement?. A. Mandatory. B. Role-based. C. Discretionary. D. Single sign-on (SSO).

Which of the following security measures BEST ensures the integrity of information stored in a data warehouse?. A. Validated daily backups. B. Change management procedures. C. Data dictionary maintenance. D. A read-only restriction.

Which of the following should an IS auditor be MOST concerned about in a financial application?. A. Programmers have access to application source code. B. Secondary controls are documented for identified role conflicts. C. The information security officer does not authorize all application changes. D. Programmers have access to the production database.

Before implementing controls, management should PRIMARILY ensure that the controls: A. satisfy a requirement in addressing a risk. B. do not reduce productivity. C. are based on a cost-benefit analysis. D. are detective or corrective.

Report abuse