CISA Questions Bank

Certified Information Systems Auditor Questions and Answers

Question 109

An organization's information security policies should be developed PRIMARILY on the basis of:

enterprise architecture (EA).

industry best practices.

a risk management process.

past information security incidents.

Question 110

Which of the following should an IS auditor be MOST concerned with when a system uses RFID?

Scalability

Maintainability

Nonrepudiation

Privacy

Question 111

In order for a firewall to effectively protect a network against external attacks, what fundamental practice must be followed?

The firewall must be placed in the demilitarized zone (DMZ).

Only essential external services should be permitted.

Filters for external information must be defined.

All external communication must be via the firewall.

Question 112

Which of the following is the PRIMARY reason to involve IS auditors in the software acquisition process?

To help ensure hardware and operating system requirements are considered

To help ensure proposed contracts and service level agreements (SLAs) address key elements

To help ensure the project management process complies with policies and procedures

To help ensure adequate controls to address common threats and risks are considered