Free CISA Exam Braindumps
Certified Information Systems Auditor Questions 746–750 (page: 151)

Updated On: 10-Feb-2026

What should an IS auditor do FIRST upon discovering that a service provider did not notify its customers of a security breach?

  1. Notify law enforcement of the finding.
  2. Require the third party to notify customers.
  3. Issue the audit report with a significant finding.
  4. Notify audit management of the finding.

Answer(s): D



An IS auditor is reviewing an organization's primary router access control list. Which of the following should result in a finding?

  1. There are conflicting permit and deny rules for the IT group.
  2. There is only one rule per group with access privileges.
  3. Individual permissions are overriding group permissions.
  4. The network security group can change network address translation (NAT).

Answer(s): A



Which of the following is the GREATEST risk of using a reciprocal site for disaster recovery?

  1. Inability to utilize the site when required
  2. Inability to test the recovery plans onsite
  3. Mismatched organizational security policies
  4. Equipment compatibility issues at the site

Answer(s): A



Which of the following BEST enables the timely identification of risk exposure?

  1. Control self-assessment (CSA)
  2. Internal audit review
  3. Stress testing
  4. External audit review

Answer(s): A



An IT balanced scorecard is the MOST effective means of monitoring:

  1. change management effectiveness.
  2. return on investment (ROI).
  3. governance of enterprise IT.
  4. control effectiveness.

Answer(s): C



Viewing page 151 of 366
Viewing questions 751 - 755 out of 1823 questions


Post your Comments and Discuss ISACA CISA exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!