CISA Certified Information Systems Auditor 4

Question 1

An IS auditor discovers that a system administrator has both the ability to create user accounts and approve access requests. This BEST represents a violation of:

Accepted Answer

Separation of duties

Answer

Separation of duties requires that no single individual control all aspects of a critical transaction or process to reduce fraud risk.

Question 2

During a business continuity audit, which of the following is the MOST important indicator that a BCP is effective?

Accepted Answer

The plan has been successfully tested and updated

Answer

A BCP that has been tested and kept current demonstrates actual operational effectiveness, not just paper compliance.

Question 3

Which IS audit approach BEST supports continuous auditing of high-volume transaction systems?

Accepted Answer

Embedded audit modules that monitor transactions in real time

Answer

Embedded audit modules allow auditors to continuously monitor transactions as they occur, enabling timely detection of anomalies.

Question 4

An auditor is evaluating a software development lifecycle (SDLC). Which phase is MOST critical for ensuring security requirements are addressed early?

Accepted Answer

Requirements and design

Answer

Incorporating security requirements during requirements and design (shift-left) is far less costly than retrofitting security after development.

Question 5

In IT risk management, a threat is BEST described as:

Accepted Answer

A potential cause of an unwanted incident

Answer

A threat is any potential event or action that could exploit a vulnerability and cause harm to an asset.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Certified Information Systems Auditor 4