[Oct 12, 2025] Free Certified Information Systems Auditor CISA Official Cert Guide PDF Download [Q735-Q749]

4/5 - (1 vote)

[Oct 12, 2025] Free Certified Information Systems Auditor CISA Official Cert Guide PDF Download

ISACA CISA Official Cert Guide PDF

Q735. Which of the following would be the BEST Indicator of the effectiveness of an organization’s portfolio management program?

Experience of the portfolio management personnel

Stakeholders’ perception of IFs value

Percentage of investments achieving their forecasted value

Maturity levels of the value management processes

Q736. Which of the following is MOST important for an IS auditor to verify when reviewing the use of an outsourcer for disposal of storage media?

The vendor’s process appropriately sanitizes the media before disposal

The contract includes issuance of a certificate of destruction by the vendor

The vendor has not experienced security incidents in the past.

The disposal transportation vehicle is fully secure

Q737. Which of the following is MOST important with regard to an application development acceptance test?

The programming team is involved in the testing process.

All data files are tested for valid information before conversion.

User management approves the test design before the test is started.

The quality assurance (QA) team is in charge of the testing process.

Q738. Which of the following would be to MOST concern when determine if information assets are adequately safequately safeguarded during transport and disposal?

Lack of appropriate labelling

Lack of recent awareness training.

Lack of password protection

Lack of appropriate data classification

Q739. Which of the following would be MOST useful when analyzing computer performance?

Statistical metrics measuring capacity utilization

Operations report of user dissatisfaction with response time

Tuning of system software to optimize resource usage

Report of off-peak utilization and response time

Q740. Which of the following is the MOST important process to ensure planned IT system changes are completed in an efficient manner?

Incident management

Demand management

Release management

Configuration management

Q741. Which of the following controls would BEST detect intrusion?

User IDs and user privileges are granted through authorized procedures.

Automatic logoff is used when a workstation is inactive for a particular period of time.

Automatic logoff of the system occurs after a specified number of unsuccessful attempts.

Unsuccessful logon attempts are monitored by the security administrator.

Q742. An IS auditor is reviewing the results of a business process improvement project. Which of the following should be performed FIRST?

Evaluate control gaps between the old and the new processes.

Develop compensating controls.

Document the impact of control weaknesses in the process.

Ensure that lessons learned during the change process are documented.

Q743. During an emergency change management audit, an IS auditor notes that one of the changes sampled was a standard change, which follows a different process. What should the auditor do NEXT?

Obtain evidence that the change was approved.

Notify auditee management of the finding.

Perform supplemental sampling of standard changes.

Redefine population and sample changes accordingly.

Q744. Which of the following reports should an IS auditor use to check compliance with a service level agreements (SLA) requirement for uptime?

Utilization reports

Hardware error reports

System logs

Availability reports

Q745. Which of the following is BEST used for detailed testing of a business application’s data and configuration files?

Utility software

Audit hooks

Audit analytics tool

Version control software

Q746. Which of the following is a program evaluation review technique that considers different scenarios for
planning and control projects?

Function Point Analysis (FPA)

GANTT

Rapid Application Development (RAD)

PERT

Q747. Which of the following controls BEST ensures appropriate segregation of duties within an accounts payable department?

Ensuring that audit trails exist for transactions

Restricting access to update programs to accounts payable staff only

Restricting program functionality according to user security profiles

Including the creator’s user ID as a field in every transaction record created

Q748. The MOST important difference between hashing and encryption is that hashing:

is irreversible.

output is the same length as the original message.

is concerned with integrity and security.

is the same at the sending and receiving end.

Q749. An advantage of a continuous audit approach is that it can improve system security when used in time- sharing environments that process a large number of transactions. True or false?

True

False