Certified Information Systems Auditor v1.0

In a controlled application development environment, the MOST important segregation of duties should be between the person who implements changes into the production environment and the:

A small startup organization does not have the resources to implement segregation of duties. Which of the following is the MOST effective compensating control?

When planning an audit to assess application controls of a cloud-based system, it is MOST important for the IS auditor to understand the:

Which of the following data would be used when performing a business impact analysis (BIA)?

Which of the following is the BEST indicator of the effectiveness of an organization's incident response program?

An organization recently implemented a cloud document storage solution and removed the ability for end users to save data to their local workstation hard drives.
Which of the following findings should be the IS auditor's GREATEST concern?

Which of the following security measures will reduce the risk of propagation when a cyberattack occurs?

An IS auditor notes that the previous year's disaster recovery test was not completed within the scheduled time frame due to insufficient hardware allocated by a third-party vendor. Which of the following provides the BEST evidence that adequate resources are now allocated to successfully recover the systems?

When implementing Internet Protocol security (IPsec) architecture, the servers involved in application delivery:

During audit fieldwork, an IS auditor learns that employees are allowed to connect their personal devices to company-owned computers. How can the auditor
BEST validate that appropriate security controls are in place to prevent data loss?

Management has requested a post-implementation review of a newly implemented purchasing package to determine to what extent business requirements are being met. Which of the following is MOST likely to be assessed?

Which of the following is an advantage of using agile software development methodology over the waterfall methodology?

In an online application, which of the following would provide the MOST information about the transaction audit trail?

On a public-key cryptosystem when there is no previous knowledge between parties, which of the following will BEST help to prevent one person from using a fictitious key to impersonate someone else?