ISACA Information System Auditing Process 5

Question 1

An IS auditor is reviewing a Software Development Life Cycle (SDLC). At which phase should security requirements FIRST be formally incorporated?

Accepted Answer

Requirements/design phase

Answer

Security requirements should be identified and documented during the requirements and design phase—'security by design'—to avoid costly remediation later.

Question 2

Which of the following BEST describes the purpose of a follow-up audit?

Accepted Answer

To verify that management has implemented agreed-upon corrective actions

Answer

A follow-up audit determines whether management has taken timely and effective corrective action to address findings from the original audit.

Question 3

An IS auditor is evaluating an organization's IT risk management framework. Which outcome BEST demonstrates effective risk management?

Accepted Answer

Residual risks are documented and formally accepted by risk owners

Answer

Effective risk management acknowledges that not all risk can be eliminated; residual risks should be documented and formally accepted by appropriate risk owners.

Question 4

When performing a review of physical access controls to a data center, an IS auditor would MOST appropriately:

Accepted Answer

Request the access control system logs and compare them against authorized access lists

Answer

Reviewing access logs against authorized access lists directly tests whether only authorized individuals accessed the data center and whether any unauthorized access occurred.

Question 5

Which of the following is the MOST important characteristic of audit evidence?

Accepted Answer

It must be sufficient and appropriate to support audit conclusions

Answer

Audit standards universally require evidence to be sufficient (adequate quantity) and appropriate (relevant quality and reliability) to support the auditor's conclusions.

(ISACA) Information Systems Audit and Control Association Certification Practice Test

(ISACA) Information Systems Audit and Control Association Certification Practice Test

ISACA Information System Auditing Process 5