CISA Exam Dumps | How would an IS auditor BEST determine the effectiveness of a security awareness program?

<< Prev Question Next Question >>

Question 650/742

How would an IS auditor BEST determine the effectiveness of a security awareness program?

A. Review the results of social engineering tests.

B. Evaluate management survey results.

C. Interview employees to assess their security awareness.

D. Review security awareness training quiz results.

Question List (742q): Question 1: Stress testing should ideally be carried out under a:...; Question 2: Which of the following is the BEST control to mitigate attac...; Question 3: An organization offers an e-commerce platform that allows co...; Question 4: Demonstrated support from which of the following roles in an...; Question 5: An IS auditor is reviewing documentation from a change that ...; Question 6: Which of the following should be of GREATEST concern to an I...; Question 7: What is the purpose of hashing a document?...; Question 8: Which of the following should be of MOST concern to an IS au...; Question 9: Which of the following BEST indicates that an incident manag...; Question 10: Which of the following is the GREATEST concern related to an...; Question 11: Which of the following is found in an audit charter?...; Question 12: Which of the following is the BEST testing approach to facil...; Question 13: Which of the following is the BEST indication to an IS audit...; Question 14: During a follow-up engagement, an IS auditor confirms eviden...; Question 15: Which of the following is the PRIMARY purpose of a rollback ...; Question 16: Which of the following is the BEST source of information for...; Question 17: What would be an IS auditor ' s BEST course of action when a...; Question 18: Which of the following is the MOST effective way to ensure a...; Question 19: In an annual audit cycle, the audit of an organization ' s I...; Question 20: An IS auditor finds a segregation of duties issue in an ente...; Question 21: An IS auditor is reviewing a machine learning (ML) model tha...; Question 22: Which of the following is the BEST control to minimize the r...; Question 23: Which of the following provides the BEST assurance of data i...; Question 24: What should an IS auditor ensure when a financial organizati...; Question 25: Which of the following should be an IS auditor ' s PRIMARY f...; Question 26: Which of the following should be of MOST concern to an IS au...; Question 27: An IS auditor is reviewing the installation of a new server....; Question 28: An IS auditor has been asked to provide support to the contr...; Question 29: Which of the following is the MOST important consideration w...; Question 30: An IS auditor noted a recent production incident in which a ...; Question 31: A small organization is experiencing rapid growth and plans ...; Question 32: Which of the following is the MOST important consideration f...; Question 33: To confirm integrity for a hashed message, the receiver shou...; Question 34: An IS auditor has been asked to assess the security of a rec...; Question 35: The PRIMARY reason for an IS auditor to perform a functional...; Question 36: During the review of a system disruption incident, an IS aud...; Question 37: Which of the following BEST enables an organization to measu...; Question 38: A system performance dashboard indicates several application...; Question 39: An IT balanced scorecard is PRIMARILY used for:...; Question 40: Which of the following is the GREATEST benefit of adopting a...; Question 41: An IS auditor is assigned to review the IS department s qual...; Question 42: Which of the following poses the GREATEST potential concern ...; Question 43: Which of the following occurs during the issues management p...; Question 44: Which of the following is the PRIMARY reason for an airline ...; Question 45: To ensure confidentiality through the use of asymmetric encr...; Question 46: Which of the following environments is BEST used for copying...; Question 47: Which of the following is the BEST compensating control when...; Question 48: Which type of security testing is MOST efficient for finding...; Question 49: When evaluating the design of controls related to network mo...; Question 50: Which of the following is MOST important for an IS auditor t...; Question 51: An organization has recently acquired and implemented intell...; Question 52: During a pre-deployment assessment, what is the BEST indicat...; Question 53: Which of the following is MOST important for an IS auditor t...; Question 54: An IS auditor is reviewing an organization ' s incident mana...; Question 55: Data centers that want to prevent unauthorized personnel fro...; Question 56: The record-locking option of a database management system (D...; Question 57: Which of the following is the PRIMARY reason for using a dig...; Question 58: During the discussion of a draft audit report IT management ...; Question 59: An IS auditor has been asked to advise on measures to improv...; Question 60: Which of the following is the PRIMARY benefit of effective i...; Question 61: Which of the following should be of GREATEST concern to an I...; Question 62: Which of the following is the BEST recommendation to prevent...; Question 63: When drafting a disaster recovery strategy, what should be t...; Question 64: Providing security certification for a new system should inc...; Question 65: An IS auditor has been asked to audit the proposed acquisiti...; Question 66: An IS auditor wants to gain a better understanding of an org...; Question 67: Which of the following is MOST critical for the effective im...; Question 68: Which of the following IT service monitoring tools is MOST e...; Question 69: Aligning IT strategy with business strategy PRIMARILY helps ...; Question 70: When an IS auditor needs to confirm that an organization is ...; Question 71: Which of the following backup methods is MOST appropriate wh...; Question 72: Which of the following is MOST important for the successful ...; Question 73: Which of the following findings would be of GREATEST concern...; Question 74: Which of the following staff should an IS auditor interview ...; Question 75: What is the MOST effective way to detect installation of una...; Question 76: Which of the following would be MOST important to include in...; Question 77: An internal audit department recently established a quality ...; Question 78: During the discussion of a draft audit report. IT management...; Question 79: An organization is planning to implement a work-from-home po...; Question 80: What is the PRIMARY purpose of documenting audit objectives ...; Question 81: An organization is ready to implement a new IT solution cons...; Question 82: Who is PRIMARILY responsible for the design of IT controls t...; Question 83: An organization conducted an exercise to test the security a...; Question 84: An IS auditor learns that an organization did not conduct an...; Question 85: Which of the following should be of GREATEST concern to an I...; Question 86: Which of the following is MOST critical to the success of an...; Question 87: IT disaster recovery time objectives (RTOs) should be based ...; Question 88: Which of the following is an example of shadow IT?...; Question 89: A disaster recovery plan (DRP) should include steps for:...; Question 90: Which of the following tests is MOST likely to detect an err...; Question 91: An IS auditor should look for which of the following to ensu...; Question 92: Which type of threat can utilize a large group of automated ...; Question 93: A financial organization has learned that one of its busines...; Question 94: The due date of an audit project is approaching, and the aud...; Question 95: How does the emergence of quantum computing impact tradition...; Question 96: Secure code reviews as part of a continuous deployment progr...; Question 97: Which of the following is the MOST efficient solution for a ...; Question 98: Which of the following is the BEST way to verify the effecti...; Question 99: Which of the following is the MOST important control for vir...; Question 100: Which of the following is the MAIN purpose of an information...; Question 101: A firewall between internal network segments improves securi...; Question 102: An organizations audit charier PRIMARILY:...; Question 103: Which of the following findings would be of GREATEST concern...; Question 104: An organization is migrating its HR application to an Infras...; Question 105: A global organization ' s policy states that all workstation...; Question 106: Which of the following security measures is MOST important f...; Question 107: Which of the following is MOST important to consider when as...; Question 108: During the audit of an enterprise resource planning (ERP) sy...; Question 109: Which of the following is the BEST point in time to conduct ...; Question 110: Which of the following job scheduling schemes for operating ...; Question 111: Which of the following is the BEST reason for software devel...; Question 112: The PRIMARY reason to perform internal quality assurance (QA...; Question 113: Which of the following MOST effectively minimizes downtime d...; Question 114: Which of the following criteria is MOST important for the su...; Question 115: Which of the following is the PRIMARY objective of performin...; Question 116: Which of the following should an IS auditor recommend as a P...; Question 117: Which of the following is a PRIMARY benefit of an integrated...; Question 118: Which of the following observations should be of GREATEST co...; Question 119: What should be the PRIMARY focus during a review of a busine...; Question 120: When determining the quality of evidence collected during an...; Question 121: Which of the following is the GREATEST security risk associa...; Question 122: Management has decided to accept a risk in response to a dra...; Question 123: An organization produces control reports with a desktop appl...; Question 124: What would be the PRIMARY reason an IS auditor would recomme...; Question 125: Which of the following should be of MOST concern to an IS au...; Question 126: Which of the following is the BEST way to mitigate risk to a...; Question 127: Which of the following should be the PRIMARY purpose of cond...; Question 128: Which of the following provides the BEST evidence that all e...; Question 129: During a follow-up audit, an IS auditor finds that some crit...; Question 130: To develop meaningful recommendations ' or findings, which o...; Question 131: Which of the following is the MOST important action when pop...; Question 132: Data is being transferred from an application database to a ...; Question 133: Which of the following is MOST important to verify when dete...; Question 134: Which of the following observations would an IS auditor cons...; Question 135: An IS auditor who was instrumental in designing an applicati...; Question 136: The BEST way for an IS auditor to validate that separation o...; Question 137: A senior IS auditor suspects that a PC may have been used to...; Question 138: Which of the following BEST enables an organization to impro...; Question 139: Which of the following should be the FIRST consideration whe...; Question 140: Which of the following risks is BEST mitigated by implementi...; Question 141: An IS auditor finds that a recently deployed application has...; Question 142: Which of the following would BEST demonstrate that an effect...; Question 143: During the planning phase of a data loss prevention (DLP) au...; Question 144: Which of the following should be the PRIMARY objective of co...; Question 145: Which of the following is the MOST appropriate testing appro...; Question 146: Which of the following is the BEST recommendation by an IS a...; Question 147: Which of the following is the BEST indicator that a third-pa...; Question 148: The MOST important measure of the effectiveness of an organi...; Question 149: During a pre-implementation review, an IS auditor notes that...; Question 150: While executing follow-up activities, an IS auditor is conce...; Question 151: Which of the following is the MOST important reason for an I...; Question 152: What should an IS auditor recommend to management as the MOS...; Question 153: The management of a small e-commerce firm is concerned about...; Question 154: An IS auditor is reviewing the service management of an outs...; Question 155: Which of the following is MOST important for an IS auditor t...; Question 156: Which of the following provides an IS auditor assurance that...; Question 157: In the case of a disaster where the data center is no longer...; Question 158: The PRIMARY goal of capacity management is to:...; Question 159: During a review of system access, an IS auditor notes that a...; Question 160: Which of the following tasks would cause the GREATEST segreg...; Question 161: Which of the following should be of GREATEST concern to an I...; Question 162: Which of the following BEST describes an audit risk?...; Question 163: Which of the following will BEST ensure that a proper cutoff...; Question 164: An IS auditor discovers that backups of critical systems are...; Question 165: An IS auditor is assessing backup performance and observes t...; Question 166: An IS auditor is reviewing the system development practices ...; Question 167: The PRIMARY objective of a control self-assessment (CSA) is ...; Question 168: During an IT general controls audit of a high-risk area wher...; Question 169: Which of the following would be MOST effective in detecting ...; Question 170: The FIRST step in auditing a data communication system is to...; Question 171: An IS auditor decides to review a data inventory list captur...; Question 172: An IS auditor is reviewing a bank ' s service level agreemen...; Question 173: Which of the following is the MOST efficient way to identify...; Question 174: IT governance should be driven by:...; Question 175: The PRIMARY purpose of a configuration management system is ...; Question 176: When auditing the security architecture of an online applica...; Question 177: Which of the following should be the GREATEST concern for an...; Question 178: Which of the following is the GREATEST risk associated with ...; Question 179: An IS auditor extracts data from a travel and expenses syste...; Question 180: To help determine whether a controls-reliant approach to aud...; Question 181: Which of the following is a PRIMARY responsibility of a qual...; Question 182: Which of the following is the PRIMARY benefit of a tabletop ...; Question 183: Which of the following is the MOST effective accuracy contro...; Question 184: The use of control totals reduces the risk of:...; Question 185: Which of the following is an IS auditor's BEST approach when...; Question 186: Which of the following is a detective control?...; Question 187: Which of the following BEST minimizes performance degradatio...; Question 188: Which of the following is the BEST method to delete sensitiv...; Question 189: Which of the following controls BEST ensures appropriate seg...; Question 190: An organization that processes credit card information emplo...; Question 191: An organization has introduced a capability maturity model t...; Question 192: Which of the following should be the FIRST step to successfu...; Question 193: Which of the following BEST supports an organization ' s obj...; Question 194: A bank has a combination of corporate customer accounts (hig...; Question 195: Which of the following is MOST important to ensure successfu...; Question 196: An IS auditor requests direct access to data required to per...; Question 197: Which of the following should be the PRIMARY objective of a ...; Question 198: An IS auditor is reviewing security controls related to coll...; Question 199: Which of the following would MOST effectively help to reduce...; Question 200: An IS auditor is reviewing a decision to consolidate process...; Question 201: Which of the following is the PRIMARY purpose of obtaining a...; Question 202: An IS auditor concludes that an organization has a quality s...; Question 203: Which of the following is a PRIMARY benefit of using risk as...; Question 204: Controls related to authorized modifications to production p...; Question 205: A white box testing method is applicable with which of the f...; Question 206: When auditing the closing stages of a system development pro...; Question 207: Which of the following is the MOST effective method for ensu...; Question 208: An IS auditor found that operations personnel failed to run ...; Question 209: When reviewing a data classification scheme, it is MOST impo...; Question 210: During an exit interview, senior management disagrees with s...; Question 211: An organization outsourced its IS functions to meet its resp...; Question 212: An IS auditor reviewing incident response management process...; Question 213: When conducting an audit of an organization ' s use of AI in...; Question 214: A CFO has requested an audit of IT capacity management due t...; Question 215: Which of the following should an IS auditor be MOST concerne...; Question 216: Which of the following is the BEST source of information for...; Question 217: Which of the following controls helps to ensure that data ex...; Question 218: Which of the following BEST indicates an effective internal ...; Question 219: An organization has engaged a third party to implement an ap...; Question 220: Which of the following is the MOST important determining fac...; Question 221: An organization used robotic process automation (RPA) techno...; Question 222: Which of the following provides the BE ST method for maintai...; Question 223: Which of the following is the GREATEST risk associated with ...; Question 224: An organization has recently implemented a Voice-over IP (Vo...; Question 225: Which of the following provides IS audit professionals with ...; Question 226: Which of the following should be of GREATEST concern to an |...; Question 227: Afire alarm system has been installed in the computer room T...; Question 228: Which of the following is a challenge in developing a servic...; Question 229: Which of the following is the PRIMARY benefit of monitoring ...; Question 230: Which of the following technology trends can lead to more ro...; Question 231: Which of the following is an IS auditor ' s BEST recommendat...; Question 232: Which of the following findings should be of GREATEST concer...; Question 233: Which of the following is an analytical review procedure for...; Question 234: An organization wants to use virtual desktops to deliver cor...; Question 235: Which of the following would the IS auditor MOST likely revi...; Question 236: The use of which of the following would BEST enhance a proce...; Question 237: An IS auditor notes that not all security tests were complet...; Question 238: Which of the following is the BEST approach for determining ...; Question 239: A hearth care organization utilizes Internet of Things (loT)...; Question 240: Which of the following is the PRIMARY reason to follow a con...; Question 241: An organization has assigned two new IS auditors to audit a ...; Question 242: An organization establishes capacity utilization thresholds ...; Question 243: During a follow-up audit, an IS auditor finds that senior ma...; Question 244: A checksum is classified as which type of control?...; Question 245: Which of the following is the MOST important factor when an ...; Question 246: An organization is disposing of a system containing sensitiv...; Question 247: Which of the following should be the FIRST step when plannin...; Question 248: Data from a system of sensors located outside of a network i...; Question 249: Which of the following findings should be of GREATEST concer...; Question 250: Using swipe cards to limit employee access to restricted are...; Question 251: Which of the following MUST be performed by senior audit lea...; Question 252: A review of IT interface controls finds an organization does...; Question 253: Management has requested a post-implementation review of a n...; Question 254: The operations team of an organization has reported an IS se...; Question 255: An IS audit manager is reviewing workpapers for a recently c...; Question 256: One advantage of managing an entire collection of projects a...; Question 257: Which of the following BEST indicates the effectiveness of a...; Question 258: After delivering an audit report, the audit manager discover...; Question 259: Which of the following would BEST assist an IS auditor in un...; Question 260: An IS auditor is reviewing the security of a web-based custo...; Question 261: In a data center audit, an IS auditor finds that the humidit...; Question 262: An IS auditor has learned that access privileges are not per...; Question 263: An IS auditor finds that one employee has unauthorized acces...; Question 264: The PRIMARY reason for an IS auditor to use data analytics t...; Question 265: When processing speed is the highest priority, which cryptog...; Question 266: Which of the following should be the PRIMARY focus when comm...; Question 267: Which of the following is the PRIMARY objective of a control...; Question 268: An organization is implementing a new system that supports a...; Question 269: An IS auditor finds a user account where privileged access i...; Question 270: An IS auditor is reviewing an organization ' s business cont...; Question 271: An IS auditor notes the transaction processing times in an o...; Question 272: When an organization conducts business process improvements,...; Question 273: An organization has made a strategic decision to split into ...; Question 274: Which type of device sits on the perimeter of a corporate of...; Question 275: The use of control totals satisfies which of the following c...; Question 276: During the walk-through procedures for an upcoming audit, an...; Question 277: Which of the following BEST enables an organization to impro...; Question 278: Which of the following BEST describes the role of a document...; Question 279: When an IS audit reveals that a firewall was unable to recog...; Question 280: Which of the following would BEST indicate the effectiveness...; Question 281: Which of the following is MOST likely to be a project delive...; Question 282: An organization has replaced its call center with Al chatbot...; Question 283: An IS auditor learns that a business owner violated the orga...; Question 284: Which of the following should be done FIRST when creating a ...; Question 285: An external audit firm was engaged to perform a validation a...; Question 286: What should an IS auditor do FIRST when management responses...; Question 287: Which of the following is the PRIMARY role of the release pl...; Question 288: Which of the following should be the FIRST step in a data mi...; Question 289: Which of the following cloud capabilities BEST enables an or...; Question 290: Which of the following is the BEST way for an organization t...; Question 291: Effective separation of duties in an online environment can ...; Question 292: An IS auditor is reviewing an organization ' s primary route...; Question 293: Which of the following should an IS auditor review when eval...; Question 294: Which of the following should be the FIRST step when conduct...; Question 295: Which of the following would be a result of utilizing a top-...; Question 296: The IS quality assurance (OA) group is responsible for:...; Question 297: During the evaluation of controls over a major application d...; Question 298: Which of the following testing methods is MOST appropriate f...; Question 299: During the implementation of a new system, an IS auditor mus...; Question 300: Which of the following is MOST appropriate to prevent unauth...; Question 301: Which of the following is MOST important to consider when de...; Question 302: Which of the following would be of MOST concern to an IS aud...; Question 303: An IT balanced scorecard is the MOST effective means of moni...; Question 304: An IS auditor is reviewing a medical device that is attached...; Question 305: A new regulation requires organizations to report significan...; Question 306: Which of the following be of GREATEST concern to an IS audit...; Question 307: The MOST effective way to reduce sampling risk is to increas...; Question 308: A PRIMARY objective of risk management is to keep the total ...; Question 309: Which of the following is MOST important to ensure when plan...; Question 310: Which of the following is the BEST method to safeguard data ...; Question 311: While reviewing the effectiveness of an incident response pr...; Question 312: Which of the following would minimize the risk of losing tra...; Question 313: Which of the following should be the GREATEST concern to an ...; Question 314: As part of an audit response, an auditee has concerns with t...; Question 315: Which of the following would a digital signature MOST likely...; Question 316: During an audit, an IT finding is agreed upon by all IT team...; Question 317: Which of the following is the MOST important responsibility ...; Question 318: An organization recently migrated Us data warehouse from a l...; Question 319: When auditing IT organizational structure, which of the foll...; Question 320: A month after a company purchased and implemented system and...; Question 321: An IS auditor finds that a number of key patches have not be...; Question 322: When planning an audit, it is acceptable for an IS auditor t...; Question 323: When reviewing the disaster recovery strategy, IT management...; Question 324: An IS auditor is reviewing a data conversion project Which o...; Question 325: A programmer has made unauthorized changes lo key fields in ...; Question 326: Which of the following applications has the MOST inherent ri...; Question 327: An organization is enhancing the security of a client-facing...; Question 328: An organization ' s senior management thinks current securit...; Question 329: Which type of control is being implemented when a biometric ...; Question 330: An organization using a cloud provider for its online billin...; Question 331: A system administrator recently informed the IS auditor abou...; Question 332: Which of the following is the MOST important area of focus f...; Question 333: An organization ' s enterprise architecture (EA) department ...; Question 334: What should an IS auditor do FIRST upon discovering that a s...; Question 335: If enabled within firewall rules, which of the following ser...; Question 336: An IS audit reveals that an organization operating in busine...; Question 337: A review of an organization's IT portfolio revealed several ...; Question 338: To protect the organization from malware transmitted by phys...; Question 339: An organization is implementing a new data loss prevention (...; Question 340: Which of the following physical controls provides the GREATE...; Question 341: Which of the following is the BEST way to help ensure new IT...; Question 342: Which of the following is the PRIMARY function of a data los...; Question 343: Which of the following BEST enables alignment of IT with bus...; Question 344: Which of the following BEST enables an IS auditor to combine...; Question 345: An IS auditor is reviewing job scheduling software and notes...; Question 346: An organization ' s networking team wants to route data betw...; Question 347: During an external review, an IS auditor observes an inconsi...; Question 348: An organization is planning to implement a control self-asse...; Question 349: Which of the following is MOST important to review during th...; Question 350: Which of the following will MOST likely compromise the contr...; Question 351: The decision to accept an IT control risk related to data qu...; Question 352: An IS auditor learns the organization has experienced severa...; Question 353: Which of the following is the BEST performance indicator for...; Question 354: An organization is shifting to a remote workforce In prepara...; Question 355: During which IT project phase is it MOST appropriate to cond...; Question 356: An IS auditor reviewing security incident processes realizes...; Question 357: Which of the following is an IS auditor ' s BEST recommendat...; Question 358: Which of the following MOST effectively reduces the risk of ...; Question 359: Which of the following is MOST important to consider when sc...; Question 360: Who is responsible for defining data access permissions?...; Question 361: Which of the following approaches will ensure recovery time ...; Question 362: An IS auditor is assessing an organization ' s DevSecOps app...; Question 363: Which of the following should an IS auditor be MOST concerne...; Question 364: Which of the following is the MOST important consideration f...; Question 365: What is the MAIN reason to use incremental backups?...; Question 366: An IS auditor is preparing a plan for audits to be carried o...; Question 367: Which of the following is the PRIMARY purpose of batch proce...; Question 368: When reviewing an organization's enterprise architecture (EA...; Question 369: Which of the following is the PRIMARY benefit of operational...; Question 370: Which of the following is MOST important for an IS auditor t...; Question 371: A new regulation in one country of a global organization has...; Question 372: What Is the BEST method to determine if IT resource spending...; Question 373: Which of the following is the MOST effective way for an orga...; Question 374: An IS auditor is reviewing documentation of application syst...; Question 375: Which of the following security measures will reduce the ris...; Question 376: Which of the following would BEST detect that a distributed ...; Question 377: A web application is developed in-house by an organization. ...; Question 378: An IS auditor observes that a business-critical application ...; Question 379: Which of the following is the BEST reason for an organizatio...; Question 380: Which of the following demonstrates the use of data analytic...; Question 381: How is nonrepudiation supported within a public key infrastr...; Question 382: An IS auditor determines elevated administrator accounts for...; Question 383: Before the release of a new application into an organization...; Question 384: An IS auditor finds a high-risk vulnerability in a public-fa...; Question 385: An IS auditor discovers that an IT organization serving seve...; Question 386: Which of the following is MOST useful to an IS auditor perfo...; Question 387: Which of the following metrics is the BEST indicator of the ...; Question 388: Which of the following is the PRIMARY advantage of using vir...; Question 389: Which of the following would be the BEST criteria for monito...; Question 390: A startup organization wants to develop a data loss preventi...; Question 391: An organization has recently become aware of a pervasive chi...; Question 392: Which of the following is a method to prevent disclosure of ...; Question 393: Coding standards provide which of the following?...; Question 394: An IS auditor reviewing a job scheduling tool notices perfor...; Question 395: An organization that operates an e-commerce website wants to...; Question 396: Which of the following is MOST helpful for understanding an ...; Question 397: When physical destruction IS not practical, which of the fol...; Question 398: Which of the following BEST ensures the quality and integrit...; Question 399: An IS auditor discovers a box of hard drives in a secured lo...; Question 400: An organization ' s security team created a simulated produc...; Question 401: Which of the following BEST Indicates that an incident manag...; Question 402: Which of the following is the GREATEST concern associated wi...; Question 403: Which of the following is the MOST effective way to evaluate...; Question 404: Users are complaining that a newly released enterprise resou...; Question 405: Which of the following concerns is MOST effectively addresse...; Question 406: Which of the following should be the FIRST step m managing t...; Question 407: Due to limited storage capacity, an organization has decided...; Question 408: Which of the following is the MOST important reason to class...; Question 409: An IS auditor finds that application servers had inconsisten...; Question 410: Retention periods and conditions for the destruction of pers...; Question 411: Which of the following is the STRONGEST indication of a matu...; Question 412: Which of the following findings from a database security aud...; Question 413: A contract for outsourcing IS functions should always includ...; Question 414: The process of applying a hash function to a message and obt...; Question 415: An IS auditor follows up on a recent security incident and f...; Question 416: An organization has decided to purchase a web-based email se...; Question 417: Which of the following is the GREATEST concern associated wi...; Question 418: A vendor requires privileged access to a key business applic...; Question 419: Which of the following MUST be completed as part of the annu...; Question 420: Which of the following is the BEST reason to implement a con...; Question 421: An IS auditor finds that some employees are using public clo...; Question 422: An IS auditor finds that the cost of developing an applicati...; Question 423: A computer forensic audit is MOST relevant in which of the f...; Question 424: Which of the following would be an appropriate rote of inter...; Question 425: During audit planning, the IS audit manager is considering w...; Question 426: During an exit meeting, an IS auditor highlights that backup...; Question 427: Which of the following would BEST help to ensure that an inc...; Question 428: Which of the following provides the MOST useful information ...; Question 429: Which of the following is the BEST way to identify key areas...; Question 430: An IS auditor found that a company executive is encouraging ...; Question 431: Which of the following is an audit reviewer ' s PRIMARY role...; Question 432: Which of the following weaknesses would have the GREATEST im...; Question 433: Which of the following is the MOST important prerequisite fo...; Question 434: Which of the following provides the MOST reliable audit evid...; Question 435: An IS auditor concludes that logging and monitoring mechanis...; Question 436: Which of the following recommendations would BEST prevent th...; Question 437: In a RAO model, which of the following roles must be assigne...; Question 438: The PRIMARY objective of the disaster recovery planning proc...; Question 439: Which of the following provides re BEST evidence that outsou...; Question 440: During a follow-up audit, it was found that a complex securi...; Question 441: Compared to developing a system in-house, acquiring a softwa...; Question 442: An organization is concerned about duplicate vendor payments...; Question 443: During an audit of an organization ' s risk management pract...; Question 444: Which of the following is a concern associated with virtuali...; Question 445: Which of the following is the PRIMARY reason an IS auditor s...; Question 446: An IS audit reveals an IT application is experiencing poor p...; Question 447: Which of the following provides the BEST evidence that IT po...; Question 448: Which type of attack targets security vulnerabilities in web...; Question 449: A now regulation requires organizations to report significan...; Question 450: Which of the following should be an IS auditor ' s GREATEST ...; Question 451: An IS auditor is reviewing the perimeter security design of ...; Question 452: What is BEST for an IS auditor to review when assessing the ...; Question 453: During the planning stage of a compliance audit, an IS audit...; Question 454: Which of the following is an IS auditor ' s BEST recommendat...; Question 455: Which of the following responsibilities associated with a di...; Question 456: Which of the following is an IS auditor's BEST recommendatio...; Question 457: Which of the following is the MOST important consideration w...; Question 458: The following findings are the result of an IS auditor's pos...; Question 459: An IS auditor determines that the vendor ' s deliverables do...; Question 460: A project team has decided to switch to an agile approach to...; Question 461: Which of the following would an IS auditor find to be the GR...; Question 462: Which of the following should be the FRST step when developi...; Question 463: With regard to resilience, which of the following is the GRE...; Question 464: Which of the following is the BEST indication of effective g...; Question 465: An IS auditor reviewing an organization's IT systems finds t...; Question 466: Which of the following practices associated with capacity pl...; Question 467: An organization has implemented a distributed security admin...; Question 468: Who is PRIMARILY responsible for the design of IT controls t...; Question 469: An IS auditor has discovered that a software system still in...; Question 470: Who should be the FIRST to evaluate an audit report prior to...; Question 471: Which of the following should be the PRIMARY role of an inte...; Question 472: An IS auditor reviewing the throat assessment for a data can...; Question 473: The PRIMARY objective of a follow-up audit is to:...; Question 474: Which of the following provides the BEST evidence of effecti...; Question 475: In order to be useful, a key performance indicator (KPI) MUS...; Question 476: What is the FIRST step when creating a data classification p...; Question 477: Which of the following activities should be separated in an ...; Question 478: Which of the following should an IS auditor review FIRST whe...; Question 479: Which of the following findings from an IT governance review...; Question 480: An organization has alternative links in its wide area netwo...; Question 481: Which of the following is MOST important to include when dev...; Question 482: Which of the following is a social engineering attack method...; Question 483: Transaction records from a business database were inadverten...; Question 484: Which of the following is the MOST appropriate and effective...; Question 485: Which of the following is MOST useful for determining whethe...; Question 486: Users are complaining that a newly released enterprise resou...; Question 487: An IS auditor is reviewing processes for importing market pr...; Question 488: An employee loses a mobile device resulting in loss of sensi...; Question 489: What is the GREATEST concern for an IS auditor reviewing con...; Question 490: What should an IS auditor do FIRST when a follow-up audit re...; Question 491: Which of the following security risks can be reduced by a pr...; Question 492: Which of the following BEST indicates that the effectiveness...; Question 493: Which of the following BEST enables a governing body to moni...; Question 494: Which of the following would BEST reduce the risk of applica...; Question 495: Which of the following is the GREATEST benefit of an effecti...; Question 496: Which of the following is an IS auditor ' s BEST recommendat...; Question 497: An IS auditor has been tasked with auditing the inventory co...; Question 498: Which of the following is an effective way to ensure the int...; Question 499: Which of the following would BEST ensure that a backup copy ...; Question 500: Which of the following is MOST important for an IS auditor t...; Question 501: The use of access control lists (ACLs) is the MOST effective...; Question 502: Which of the following establishes the PRIMARY difference be...; Question 503: Which of the following should an IS auditor consider the MOS...; Question 504: Which of the following controls is the BEST recommendation t...; Question 505: Which of the following is the PRIMARY role of key performanc...; Question 506: Which of the following is the BEST way to determine the adeq...; Question 507: During a follow-up audit, an IS auditor finds that some crit...; Question 508: If a recent release of a program has to be backed out of pro...; Question 509: Which of the following techniques BEST mitigates the risk of...; Question 510: An IS auditor is reviewing desktop software profiles and not...; Question 511: Which of the following is the BEST reason for an IS auditor ...; Question 512: What is the Most critical finding when reviewing an organiza...; Question 513: Which of the following findings should be of GREATEST concer...; Question 514: A manager Identifies active privileged accounts belonging to...; Question 515: When an intrusion into an organization ' s network is detect...; Question 516: An IS auditor wants to inspect recent events in a system to ...; Question 517: When testing the accuracy of transaction data, which of the ...; Question 518: Which of the following is MOST important to include in secur...; Question 519: Management receives information indicating a high level of r...; Question 520: Which of the following is the PRIMARY benefit of introducing...; Question 521: Which of the following is the MOST important consideration w...; Question 522: An IS auditor is assessing the adequacy of management ' s re...; Question 523: Which of the following is a social engineering attack method...; Question 524: During which phase of the software development life cycle sh...; Question 525: An IS auditor finds that an organization ' s data loss preve...; Question 526: Which of the following provides the BEST evidence that a thi...; Question 527: Which of the following is MOST helpful to an IS auditor when...; Question 528: When reviewing a business case for a proposed implementation...; Question 529: Which of the following applications should an IS auditor con...; Question 530: Which of the following will provide the GREATEST assurance t...; Question 531: An IS auditor is analyzing a sample of accounts payable tran...; Question 532: The following findings are the result of an IS auditor ' s p...; Question 533: In which of the following sampling methods is the entire sam...; Question 534: Which of the following observations should be of GREATEST co...; Question 535: During an audit of a reciprocal disaster recovery agreement ...; Question 536: Due to limited storage capacity, an organization has decided...; Question 537: When selecting a new data loss prevention (DLP) solution, th...; Question 538: An organization ' s strategy to source certain IT functions ...; Question 539: Attribute sampling is BEST suited to estimate:...; Question 540: Which of the following BEST enables a benefits realization p...; Question 541: Which of the following would be an appropriate role of inter...; Question 542: Which of the following is the BEST evidence that an organiza...; Question 543: What is the BEST control to address SQL injection vulnerabil...; Question 544: Which of the following should be the IS auditor ' s PRIMARY ...; Question 545: Some control activities have been found to be only partially...; Question 546: Which of the following can BEST reduce the impact of a long-...; Question 547: When a data center is attempting to restore computing facili...; Question 548: A secure server room has a badge reader system that records ...; Question 549: Management has agreed to move the organization ' s data cent...; Question 550: An IS auditor is reviewing an organization ' s system develo...; Question 551: Which task should an IS auditor complete FIRST during the pr...; Question 552: Which of the following BEST facilitates the successful imple...; Question 553: Which of the following is MOST important for an IS auditor t...; Question 554: Which of the following is the BEST way to address segregatio...; Question 555: An IS auditor notes that several employees are spending an e...; Question 556: A characteristic of a digital signature is that it...; Question 557: Which of the following would protect the confidentiality of ...; Question 558: An IS auditor Is renewing the deployment of a new automated ...; Question 559: An accounting department uses a spreadsheet to calculate sen...; Question 560: Which of the following would be MOST effective to protect in...; Question 561: During a database security audit, an IS auditor is reviewing...; Question 562: An IS auditor is following up on prior period items and find...; Question 563: Following a security breach in which a hacker exploited a we...; Question 564: Which of the following is the PRIMARY advantage of a decentr...; Question 565: In continuous delivery, the critical connector between devel...; Question 566: What is the MOST effective way to manage contractors ' acces...; Question 567: Which of the following BEST enables an organization to deter...; Question 568: An externally facing system containing sensitive data is con...; Question 569: A national tax administration agency with a distributed netw...; Question 570: A small IT department has embraced DevOps, which allows memb...; Question 571: During an audit, the IS auditor finds that in many cases exc...; Question 572: When planning an internal penetration test, which of the fol...; Question 573: Which of the following are BEST suited for continuous auditi...; Question 574: In which phase of penetration testing would host detection a...; Question 575: An outsourced recruitment vendor processes personally identi...; Question 576: Which of the following would be MOST helpful to an IS audito...; Question 577: Which of the following should be of MOST concern to an IS au...; Question 578: Which of the following is the BEST way to strengthen the sec...; Question 579: Which of the following should an IS auditor recommend be don...; Question 580: Which of the following represents the GREATEST risk to virtu...; Question 581: A security review focused on data loss prevention (DLP) reve...; Question 582: From a risk management perspective, which of the following i...; Question 583: Which of the following attack techniques will succeed becaus...; Question 584: Which of the following responses to risk associated with sep...; Question 585: The performance, risks, and capabilities of an IT infrastruc...; Question 586: Which of the following presents the GREATEST risk associated...; Question 587: During a review of an organization ' s IT capacity managemen...; Question 588: In an organization ' s feasibility study to acquire hardware...; Question 589: Which of the following is the MOST important Issue for an IS...; Question 590: Management has requested a post-implementation review of a n...; Question 591: A transaction processing system interfaces with the general ...; Question 592: An IS auditor is reviewing a machine learning algorithm-base...; Question 593: Which of the following findings from a network security revi...; Question 594: Which of the following is the PRIMARY reason to perform a ri...; Question 595: When designing metrics for information security, the MOST im...; Question 596: An IS auditor has been tasked to review the processes that p...; Question 597: Which of the following is the MOST significant risk to an or...; Question 598: A job is scheduled to transfer data from a transactional sys...; Question 599: Which of the following would be the GREATEST concern to an I...; Question 600: Which of the following metrics is MOST helpful for evaluatin...; Question 601: Which of the following is the BEST approach to validate whet...; Question 602: The PRIMARY role of a control self-assessment (CSA) facilita...; Question 603: An IS auditor is reviewing a client ' s outsourced payroll s...; Question 604: Which of the following is the MOST important consideration w...; Question 605: When auditing the adequacy of a cooling system for a data ce...; Question 606: An IS auditor is reviewing a machine learning model that pre...; Question 607: An organization relies on an external vendor that uses a clo...; Question 608: While evaluating the data classification process of an organ...; Question 609: An IS auditor discovers from patch logs that some in-scope s...; Question 610: An IS auditor has found that a vendor has gone out of busine...; Question 611: An IS auditor is performing a follow-up audit and notes that...; Question 612: An IS auditor is reviewing database fields updated in real-t...; Question 613: When planning an audit to assess application controls of a c...; Question 614: During a database management evaluation an IS auditor discov...; Question 615: Which of the following is MOST important when implementing a...; Question 616: An organization has outsourced its data processing function ...; Question 617: Which of the following should be of GREATEST concern to an I...; Question 618: Which of the following activities is MOST likely to increase...; Question 619: Which of the following provides the BEST assurance that a ne...; Question 620: Which of the following is MOST important for an IS auditor t...; Question 621: Which type of testing is used to identify security vulnerabi...; Question 622: What is the BEST way to reduce the risk of inaccurate or mis...; Question 623: Which of the following indicates that an internal audit orga...; Question 624: An IS auditor discovers that a developer has used the same k...; Question 625: Which of the following should be an IS auditor ' s PRIMARY f...; Question 626: An IS auditor is assigned to perform a post-implementation r...; Question 627: An IS auditor reviewing an organization's online payment sys...; Question 628: Which of the following is the MOST important benefit of invo...; Question 629: Which of the following BEST helps data loss prevention (DLP)...; Question 630: Which of the following should be an IS auditor ' s GREATEST ...; Question 631: An IS auditor is providing input to an RFP to acquire a fina...; Question 632: An organization ' s business continuity plan (BCP) should be...; Question 633: Which of the following is a PRIMARY responsibility of an IT ...; Question 634: An IS auditor has discovered that a software system still in...; Question 635: The charging method that effectively encourages the MOST eff...; Question 636: A core system fails a week after a scheduled update, causing...; Question 637: When assessing the overall effectiveness of an organization ...; Question 638: Which of the following key performance indicators (KPIs) pro...; Question 639: Which of the following provides the MOST assurance of the in...; Question 640: Which of the following groups is PRIMARILY accountable for e...; Question 641: Which of the following provides the BEST evidence that syste...; Question 642: Which of the following is the MOST effective control to miti...; Question 643: Which of the following is MOST important for an IS auditor t...; Question 644: When auditing the feasibility study of a system development ...; Question 645: Which of the following should an IS auditor perform FIRST wh...; Question 646: When designing a data analytics process, which of the follow...; Question 647: Audit observations should be FIRST communicated with the aud...; Question 648: Which of the following provides the BEST audit evidence that...; Question 649: An IS auditor has been asked to advise on measures to improv...; Question 650: How would an IS auditor BEST determine the effectiveness of ...; Question 651: Which of the following would lead an IS auditor to conclude ...; Question 652: How does a continuous integration/continuous development (CI...; Question 653: Which of the following application input controls would MOST...; Question 654: Which of the following BEST demonstrates alignment of the IT...; Question 655: The PRIMARY advantage of using open-source-based solutions i...; Question 656: Which of the following is MOST critical to the success of an...; Question 657: An organization is establishing a steering committee for the...; Question 658: During a closing meeting, the IT manager disagrees with a va...; Question 659: Which of the following would BEST help lo support an auditor...; Question 660: An IS auditor is asked to provide feedback on the systems op...; Question 661: Cross-site scripting (XSS) attacks are BEST prevented throug...; Question 662: Which of the following risk scenarios is BEST mitigated thro...; Question 663: Which of the following provides the MOST protection against ...; Question 664: A mission-critical application utilizes a one-node database ...; Question 665: Which of the following backup schemes is the BEST option whe...; Question 666: Which of the following is the PRIMARY reason an IS auditor s...; Question 667: Which of the following is the BEST way for management to ens...; Question 668: The PRIMARY role of an IS auditor in the remediation of prob...; Question 669: Which of the following procedures for testing a disaster rec...; Question 670: Which of the following conditions would be of MOST concern t...; Question 671: Which of the following should be of MOST concern to an IS au...; Question 672: An external attacker spoofing an internal Internet Protocol ...; Question 673: During a new system implementation, an IS auditor has been a...; Question 674: An organization ' s IT risk assessment should include the id...; Question 675: Which of the following presents the GREATEST challenge to th...; Question 676: An IS auditor is evaluating the progress of a web-based cust...; Question 677: The PRIMARY objective of a privacy protection policy is to i...; Question 678: Which of the following is a PRIMARY purpose of a privacy not...; Question 679: When planning an audit to assess controls for an application...; Question 680: When implementing Internet Protocol security (IPsec) archite...; Question 681: Which of the following should be restricted from a network a...; Question 682: Which of the following is a threat to IS auditor independenc...; Question 683: During the forensic investigation of a cyberattack involving...; Question 684: Which audit approach is MOST helpful in optimizing the use o...; Question 685: Which of the following is the MOST important consideration o...; Question 686: An IS auditor assessing the controls within a newly implemen...; Question 687: Email required for business purposes is being stored on empl...; Question 688: An online retailer is receiving customer complaints about re...; Question 689: In a small IT web development company where developers must ...; Question 690: Which of the following is MOST helpful for an IS auditor to ...; Question 691: Which of the following is the PRIMARY benefit of implementin...; Question 692: An IS auditor is reviewing an IT project and finds that an e...; Question 693: In an environment where data virtualization is used, which o...; Question 694: During a project audit, an IS auditor notes that project rep...; Question 695: Which of the following is the BEST control to mitigate the r...; Question 696: Which of the following is the GREATEST impact as a result of...; Question 697: When assessing a proposed project for the two-way replicatio...; Question 698: Which of the following is the MAJOR advantage of automating ...; Question 699: Which of the following is BEST supported by enforcing data d...; Question 700: Which of the following is an advantage of using agile softwa...; Question 701: Which of the following should an IS auditor consider FIRST w...; Question 702: Which of the following is MOST important to define within a ...; Question 703: An organization has moved all of its infrastructure to the c...; Question 704: Which of the following would be of GREATEST concern to an IS...; Question 705: When is it MOST important for an IS auditor to apply the con...; Question 706: Which of the following should an IS auditor do FIRST when au...; Question 707: An IS auditor has been asked to review the quality of data i...; Question 708: An IS auditor finds an IT manager recently changed a Softwar...; Question 709: What is the PRIMARY purpose of performing a parallel run of ...; Question 710: Which of the following controls helps to reduce fraud risk a...; Question 711: A review of Internet security disclosed that users have indi...; Question 712: Which of the following is the BEST control to help ensure th...; Question 713: When an IS audit reveals that a firewall was unable to recog...; Question 714: Which of the following is the PRIMARY objective of data loss...; Question 715: Which of the following documents would be MOST useful in det...; Question 716: In data warehouse (DW) management, what is the BEST way to p...; Question 717: An IS auditor is supporting a forensic investigation. An ima...; Question 718: Which of the following is the BEST way to ensure that busine...; Question 719: An organization with many desktop PCs is considering moving ...; Question 720: Which of the following network communication protocols is us...; Question 721: Which of the following is an example of a passive attack met...; Question 722: How does public key infrastructure (PKI) help to verify that...; Question 723: Which of the following is the BEST way to minimize sampling ...; Question 724: Which of the following BEST protects an organization ' s pro...; Question 725: Which of the following is the GREATEST risk of project dashb...; Question 726: In a large organization, IT deadlines on important projects ...; Question 727: Which of the following would be the MOST significant finding...; Question 728: Which of the following will invalidate the authenticity of d...; Question 729: Which of the following BEST ensures that effective change ma...; Question 730: From an IS auditor ' s perspective, which of the following w...; Question 731: Which of the following is the MOST likely root cause of shad...; Question 732: An IS auditor has been asked to review the integrity of data...; Question 733: Which of the following would provide the BEST evidence that ...; Question 734: Which of the following is the BEST indicator of the effectiv...; Question 735: Which of the following is the MOST important advantage of pa...; Question 736: Which of the following should be given GREATEST consideratio...; Question 737: Which of the following is the MOST appropriate responsibilit...; Question 738: Which of the following should be an IS auditor ' s PRIMARY f...; Question 739: Which of the following would be of GREATEST concern to an IS...; Question 740: Due to advancements in technology and electronic records, an...; Question 741: An IS audit reveals that an organization is not proactively ...; Question 742: Which of the following is the PRIMARY advantage of parallel ...

Question 650/742

LEAVE A REPLY

Download PDF File