Free ISACA CISA Exam Dumps Questions & Answers

Which of the following should be of GREATEST concern to an IS auditor assessing an organization's patch management program?

• A.  There is no process in place to quarantine servers that have not been patched.
• B.  There is no process in place to scan the network to identify missing patches.
• C.  Patches for medium- and low-risk vulnerabilities are omitted.
• D.  Patches are deployed from multiple deployment servers.

Which of the following be of GREATEST concern to an IS auditor reviewing on-site preventive maintenance for an organization's business-critical server hardware?

• A.  Preventive maintenance has not been approved by the information system
• B.  Preventive maintenance is outsourced to multiple vendors without requiring nondisclosure agreements (NDAs)
• C.  The preventive maintenance schedule is based on mean time between failures (MTBF) parameters.
• D.  Preventive maintenance costs exceed the business allocated budget.

An IS auditor is reviewing the system development practices of an organization that is about to move from a Waterfall to an Agile approach. Which of the following is MOST important for the auditor to focus on as a result of this move?

• A.  Release management
• B.  Capacity planning
• C.  Code documentation
• D.  Secure code review

An IS auditor is reviewing an organization's system development life cycle (SDLC) Which of the following MUST be included in the review?

• A.  Definition of quality attributes to be associated with the system
• B.  Ownership of the system quality management plan
• C.  Utilization of standards in the system development processes and procedures
• D.  Validation that system development processes adhere to quality standards

Which of the following should be the PRIMARY focus when communicating an IS audit issue to management?

• A.  How the issue was found and who bears responsibility
• B.  A detailed solution for resolving the issue
• C.  The nature, extent, and timing of subsequent audit follow-up
• D.  The risk to which the organization is exposed due to the issue