CISA Certified Information Systems Auditor MCQ 3

Question 1

An IS auditor reviews a company's IT governance framework and finds no formal IT steering committee. The GREATEST risk of this gap is:

Accepted Answer

IT projects may not align with business objectives

Answer

Without an IT steering committee, there is no formal mechanism to align IT investments and projects with overall business strategy.

Question 2

A CAATs tool is BEST used by an IS auditor to:

Accepted Answer

Analyze large volumes of transaction data for anomalies

Answer

Computer-Assisted Audit Techniques (CAATs) are specifically designed to process large transaction datasets to identify exceptions, trends, and anomalies.

Question 3

During a review of a third-party vendor contract, an IS auditor notices the contract lacks a right-to-audit clause. This PRIMARILY means:

Accepted Answer

The organization cannot independently verify the vendor's control effectiveness

Answer

Without a right-to-audit clause, the organization has no contractual basis to independently assess whether the vendor's controls are operating effectively.

Question 4

Which of the following BEST describes the purpose of a control self-assessment (CSA)?

Accepted Answer

To allow management and staff to assess the effectiveness of internal controls

Answer

CSA is a process in which operational management and staff directly evaluate the effectiveness and efficiency of controls in their own areas.

Question 5

An IS auditor finds that application logs are stored on the same server as the application itself. The MAIN risk is:

Accepted Answer

An attacker who compromises the server could also alter or delete logs

Answer

Co-locating logs with the application means a successful attacker can cover their tracks by modifying or deleting the very logs that would record the attack.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Certified Information Systems Auditor MCQ 3