Isaca CISA Quiz 358 Topic 3 Questions 1786-1790

Question: 1

Which of the following BEST describes the relationship between vulnerability scanning and penetration testing?

AFor entities with regulatory drivers, the two tests must be the same

BBoth are labor-intensive in preparation, planning and execution.

CBoth utilize a risk-based analysis that considers threat scenarios.

DThe scope of both is determined primarily by the likelihood of exploitation

Show Answer

Question: 2

An IS auditor is evaluating the log management system for an organization with devices and systems in multiple geographic locations. Which of the following is MOST important for e auditor to verify?

ALog files w concurrently updated

BLog files are encrypted and digitally signed.

CLog files are reviewed in multiple locations.

DLog files of the servers are synchronized.

Show Answer

Question: 3

An IS auditor is a member of an application development team that is selecting software. Which of the following would impair the auditor's independence?

AApproving the vendor selection methodology

Bverifying the weighting of each selection criteria

CReviewing the request for proposal (RFP)

DWitnessing the vendor selection process

Show Answer

Question: 4

Loss-site scripting (XSS) attacks are BEST prevented through:

Aa three-tier web architecture.

BSecure coding practices

Capplication firewall policy settings

Duse of common industry frameworks.

Show Answer

Question: 5

Which of the following projects would be MOST important to review in an audit of an organizations financial statements?

AAutomation of operational risk management processes

BResource optimization of the enterprise resource planning (ERP) system

CSecurity enhancements to the customer relationship database

DOutsourcing of the payroll system to an external service provider

Show Answer

Isaca CISA Quiz:358 Topic:3 Questions:1786-1790