CISA Certified Information Systems Auditor MCQ 2

Question 1

During an IS audit, an auditor discovers that change management procedures are not being followed for emergency fixes. What is the MOST significant risk?

Accepted Answer

Unauthorized or erroneous changes introduced to production

Answer

Increased project costs

Answer

Slower deployment of fixes

Answer

Lack of developer accountability

Question 2

An IS auditor is reviewing access controls and finds that terminated employees still have active accounts 30 days after separation. The PRIMARY concern is:

Accepted Answer

Potential unauthorized access to sensitive systems

Answer

Wasted software licenses

Answer

Non-compliance with HR procedures

Answer

Increased IT support workload

Question 3

Which control type BEST describes a system that automatically locks a user account after five failed login attempts?

Accepted Answer

Preventive control

Answer

Detective control

Answer

Corrective control

Answer

Compensating control

Question 4

An IS auditor is evaluating a company's disaster recovery plan. Which metric defines the maximum acceptable period of data loss following a disruption?

Accepted Answer

Recovery Point Objective (RPO)

Answer

Recovery Time Objective (RTO)

Answer

Mean Time to Repair (MTTR)

Answer

Maximum Tolerable Downtime (MTD)

Question 5

When auditing an ERP system, an IS auditor should be MOST concerned with which of the following segregation of duties conflicts?

Accepted Answer

An accounts payable clerk who can also approve payments

Answer

A developer who also writes system documentation

Answer

A DBA who can also read application logs

Answer

A security officer who also reviews audit logs

Question 6

During a penetration test scoping meeting, the client insists the auditor must not test the payroll system. The IS auditor should:

Accepted Answer

Proceed without testing payroll and note the scope limitation in the report

Answer

Refuse to conduct the engagement without full access

Answer

Test payroll anyway because it is the highest-risk system

Answer

Escalate to regulators about the client's non-cooperation

Question 7

Which sampling technique is MOST appropriate when an IS auditor wants to give every transaction an equal chance of being selected for testing?

Accepted Answer

Random sampling

Answer

Judgmental sampling

Answer

Stratified sampling

Answer

Cluster sampling