ISACA Information Systems Operations and Business Resilience 5

Question 1

Which of the following BEST describes a tabletop exercise in the context of business continuity?

Accepted Answer

A discussion-based walkthrough of a disaster scenario without activating recovery systems

Answer

A tabletop exercise engages key personnel in a scenario discussion to identify gaps and clarify roles without the cost and disruption of a full operational test.

Question 2

An IS auditor finds that system administrators have the ability to modify audit logs. This PRIMARILY represents a failure of:

Accepted Answer

Segregation of duties and audit trail integrity controls

Answer

Allowing those being monitored to modify the records of their activity undermines the integrity of the audit trail and violates segregation of duties.

Question 3

When auditing an outsourced data center, an IS auditor should rely PRIMARILY on:

Accepted Answer

SSAE 18 SOC 2 Type II reports and contractual audit rights clauses

Answer

SOC 2 Type II reports provide an independent, structured assessment of controls over a period of time, and audit rights clauses allow the organization to verify controls directly.

Question 4

Which metric is MOST useful for evaluating the effectiveness of an incident response program?

Accepted Answer

Mean time to detect (MTTD) and mean time to respond (MTTR) to security incidents

Answer

MTTD and MTTR directly measure how quickly threats are identified and contained, reflecting the operational performance of the incident response process.

Question 5

An organization's IT operations team performs all system administration, change management, and security monitoring. The GREATEST risk from this arrangement is:

Accepted Answer

Lack of segregation of duties allows unauthorized changes to go undetected

Answer

When the same team administers systems, approves changes, and monitors security, there is no independent check on their activities, enabling concealment of unauthorized actions.

(ISACA) Information Systems Audit and Control Association Certification Practice Test

(ISACA) Information Systems Audit and Control Association Certification Practice Test

ISACA Information Systems Operations and Business Resilience 5