CISA Certified Information Systems Auditor MCQ 2

Question 1

During an IS audit, an auditor discovers that change management procedures are not being followed for emergency fixes. What is the MOST significant risk?

Accepted Answer

Unauthorized or erroneous changes introduced to production

Answer

Bypassing change management for emergency fixes creates the highest risk of introducing unauthorized or erroneous changes that can compromise system integrity.

Question 2

An IS auditor is reviewing access controls and finds that terminated employees still have active accounts 30 days after separation. The PRIMARY concern is:

Accepted Answer

Potential unauthorized access to sensitive systems

Answer

Active accounts for terminated employees represent a direct threat of unauthorized access, which is the primary security risk to address.

Question 3

Which control type BEST describes a system that automatically locks a user account after five failed login attempts?

Accepted Answer

Preventive control

Answer

Account lockout after failed attempts is a preventive control because it stops further unauthorized access attempts before a breach occurs.

Question 4

An IS auditor is evaluating a company's disaster recovery plan. Which metric defines the maximum acceptable period of data loss following a disruption?

Accepted Answer

Recovery Point Objective (RPO)

Answer

Recovery Point Objective (RPO) defines the maximum age of data that must be recovered after a disaster to resume normal operations.

Question 5

When auditing an ERP system, an IS auditor should be MOST concerned with which of the following segregation of duties conflicts?

Accepted Answer

An accounts payable clerk who can also approve payments

Answer

An accounts payable clerk who can also approve payments creates a direct conflict that enables fraud without detection.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Certified Information Systems Auditor MCQ 2