CISA 無料問題集「ISACA Certified Information Systems Auditor」

（A）eliminated from the source code that reflects the version in production.

（B）reinstalled when replacing the version back into production.

（C）filed in production for future reference in researching the problem.

（D）applied to the source code that reflects the version in production.

（A）Conditions under which the system will operate are unclear.

（B）System requirements and expectations have not been clarified.

（C）Security requirements have not been defined.

（D）The business case does not include well-defined strategic benefits.

（A）Adequacy of physical and environmental controls

（B）Results of business continuity plan (BCP) tests

（C）Retention policy and period

（D）Shared facilities

（A）Process walk-through

（B）Statistical sampling

（C）Stratified sampling

（D）Computer-assisted audit technique (CAAT)

（A）Data classification

（B）Service level agreements (SLAs)

（C）Vendor cloud certification

（D）Data storage costs

（A）Ensure the validity of the recipient ID and use auto-numbered reports.

（B）Verify transactions are sequentially numbered in the header record.

（C）Perform edit checks to identify erroneous, unusual, or invalid transactions.

（D）Maintain a log of the number of messages sent and validate periodically.

（A）Impact assessment

（B）Risk classification

（C）Control self-assessment (CSA)

（D）Risk identification

（A）Exploitation

（B）Scanning

（C）Reconnaissance

（D）Exfiltration

（A）Give the programmer an emergency ID for temporary access and review the activity

（B）Give the programmer read-only access to investigate the problem

（C）Require that a change request be completed and approved

（D）Review activity logs the following day and investigate any suspicious activity

（A）Continuous monitoring plans

（B）Business project plan

（C）The cost of new controls

（D）Business impact

（A）Audit best practices

（B）Audit charter

（C）Information security policy

（D）IT steering committee

（A）All information assets will be assigned a clearly defined level to facilitate proper employee handling.

（B）Any information assets transmitted over a public network must be approved by executive management.

（C）Information assets should only be accessed by persons with a justified need.

（D）All information assets must be encrypted when stored on the organization's systems.

（A）Remediation dates included in management responses

（B）Complexity of business processes identified in the audit

（C）Peak activity periods for the business

（D）Availability of IS audit resources

（A）provided by the vendor of the application.

（B）simulated by production entities and customers.

（C）randomly selected by a test generator.

（D）randomly selected by the user.

（A）Ensuring that network components are not modified by the client

（B）Establishing a well-designed framework for network servirces.

（C）Reducing the number of entry points into the network

（D）Finding performance metrics that can be measured properly

（A）Assigning responsibilities for maintaining the tool to applicable data owners and stakeholders

（B）Defining and configuring policies and tool rule sets to monitor sensitive data movement

（C）Implementing the tool in monitor mode to avoid unnecessary blocking of communication

（D）Testing the tool in a test environment before moving to the production environment

（A）Review the internal audit sampling methodology.

（B）Review control self-assessment (CSA) results.

（C）Include the user termination process in all upcoming audits.

（D）Review user termination process changes.

（A）The source data is from the current year of operations so that irrelevant data from prior years is not included.

（B）The source data is modified in the data warehouse to remove confidential or sensitive information.

（C）The source data is pre-selected so that it already supports senior management's desired business decision outcome.

（D）The source data is standardized and cleansed before loading into the data warehouse.