Isaca CISA Quiz 269 Topic 5 Questions 1341-1345

Question: 1

In the course of performing a risk analysis, an IS auditor has identified threats and

potential impacts. Next, the IS auditor should:

Aidentify and assess the risk assessment process used by management.

Bidentify information assets and the underlying systems.

Cdisclose the threats and impacts to management.

Didentify and evaluate the existing controls.

Show Answer

Question: 2

Which of the following should be of MOST concern to an IS auditor?

ALack of reporting of a successful attack on the network

BFailure to notify police of an attempted intrusion

CLack of periodic examination of access rights

DLack of notification to the public of an intrusion

Show Answer

Question: 3

Which of the following would normally be the MOST reliable evidence for an auditor?

AA confirmation letter received from a third party verifying an account balance

BAssurance from line management that an application is working as designed

CTrend data obtained from World Wide Web (Internet) sources

DRatio analysts developed by the IS auditor from reports supplied by line management

Show Answer

Question: 4

When evaluating the collective effect of preventive, detective or corrective controls within a process, an IS auditor should be aware of which of the following?

AThe point at which controls are exercised as data flow through the system

BOnly preventive and detective controls are relevant

CCorrective controls can only be regarded as compensating

DClassification allows an IS auditor to determine which controls are missing

Show Answer

Question: 5

Which audit technique provides the BEST evidence of the segregation of duties in an IS department?

ADiscussion with management

BReview of the organization chart

CObservation and interviews

DTesting of user access rights

Show Answer

Isaca CISA Quiz:269 Topic:5 Questions:1341-1345