CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CISA—Certified Information Systems Auditor - Part 241
1. Which of the following should be of PRIMARY concern to an IS auditor reviewing the management of external IT service providers?
A) Minimizing costs for the services provided
B) Prohibiting the provider from subcontracting services
C) Evaluating the process for transferring knowledge to the IT department
D) Determining if the services were provided as contracted
2. IT best practices for the availability and continuity of IT services should:
A) minimize costs associated with disaster-resilient components.
B) provide for sufficient capacity to meet the agreed upon demands of the business.
C) provide reasonable assurance that agreed upon obligations to customers can be met.
D) produce timely performance metric reports.
3. During a human resources (HR) audit, an IS auditor is informed that there is a verbal agreement between the IT and HR departments as to the level of IT services expected. In this situation, what should the IS auditor do FIRST?
A) Postpone the audit until the agreement is documented
B) Report the existence of the undocumented agreement to senior management
C) Confirm the content of the agreement with both departments
D) Draft a service level agreement (SLA) for the two departments
4. Which of the following procedures would MOST effectively detect the loading of illegal software packages onto a network?
A) The use of diskless workstations
B) Periodic checking of hard drives
C) The use of current antivirus software
D) policies that result in instant dismissal if violated
5. To determine which users can gain access to the privileged supervisory state, which of the following should an IS auditor review?
A) System access log files
B) Enabled access control software parameters
C) Logs of access control violations
D) System configuration files for control options used
A) Minimizing costs for the services provided
B) Prohibiting the provider from subcontracting services
C) Evaluating the process for transferring knowledge to the IT department
D) Determining if the services were provided as contracted
2. IT best practices for the availability and continuity of IT services should:
A) minimize costs associated with disaster-resilient components.
B) provide for sufficient capacity to meet the agreed upon demands of the business.
C) provide reasonable assurance that agreed upon obligations to customers can be met.
D) produce timely performance metric reports.
3. During a human resources (HR) audit, an IS auditor is informed that there is a verbal agreement between the IT and HR departments as to the level of IT services expected. In this situation, what should the IS auditor do FIRST?
A) Postpone the audit until the agreement is documented
B) Report the existence of the undocumented agreement to senior management
C) Confirm the content of the agreement with both departments
D) Draft a service level agreement (SLA) for the two departments
4. Which of the following procedures would MOST effectively detect the loading of illegal software packages onto a network?
A) The use of diskless workstations
B) Periodic checking of hard drives
C) The use of current antivirus software
D) policies that result in instant dismissal if violated
5. To determine which users can gain access to the privileged supervisory state, which of the following should an IS auditor review?
A) System access log files
B) Enabled access control software parameters
C) Logs of access control violations
D) System configuration files for control options used
1. Right Answer: D
Explanation: From an IS auditor's perspective, the primary objective of auditing the management of service providers should be to determine if the services that were requested were provided in a way that is acceptable, seamless and in line with contractual agreements. Minimizing costs, if applicable and achievable (depending on the customer's need) is traditionally not part of an IS auditor's job. This would normally be done by a line management function within the IT department.Furthermore, during an audit, it is too late to minimize the costs for existing provider arrangements. Subcontracting providers could be a concern, but it would not be the primary concern. Transferring knowledge to the internal IT department might be desirable under certain circumstances, but should not be the primary concern of an IS auditor when auditing IT service providers and the management thereof.
2. Right Answer: C
Explanation: It is important that negotiated and agreed commitments (i.e., service level agreements [SLAs]) can be fulfilled all the time. If this were not achievable, IT should not have agreed to these requirements, as entering into such a commitment would be misleading to the business. 'All the time' in this context directly relates to the'agreed obligations' and does not imply that a service has to be available 100 percent of the time. Costs are a result of availability and service continuity management and may only be partially controllable. These costs directly reflect the agreed upon obligations. Capacity management is a necessary, but not sufficient, condition of availability.Despite the possibility that a lack of capacity may result in an availability issue, providing the capacity necessary for seamless operations of services would be done within capacity management, and not within availability management. Generating reports might be a task of availability and service continuity management, but that is true for many other areas of interest as well (e.g., incident, problem, capacity and change management).
3. Right Answer: C
Explanation: An IS auditor should first confirm and understand the current practice before making any recommendations. The agreement can be documented after it has been established that there is an agreement in place. The fact that there is not a written agreement does not justify postponing the audit, and reporting to senior management is not necessary at this stage of the audit. Drafting a service level agreement (SLA) is not the IS auditor's responsibility.
4. Right Answer: B
Explanation: The periodic checking of hard drives would be the most effective method of identifying illegal software packages loaded to the network. Antivirus software will not necessarily identify illegal software, unless the software contains a virus. Diskless workstations act as a preventive control and are not effective, since users could still download software from other than diskless workstations. Policies lay out the rules about loading the software, but will not detect the actual occurrence.
5. Right Answer: D
Explanation: A review of system configuration files for control options used would show which users have access to the privileged supervisory state. Both systems access log files and logs of access violations are detective in nature. Access control software is run under the operating system.
Explanation: From an IS auditor's perspective, the primary objective of auditing the management of service providers should be to determine if the services that were requested were provided in a way that is acceptable, seamless and in line with contractual agreements. Minimizing costs, if applicable and achievable (depending on the customer's need) is traditionally not part of an IS auditor's job. This would normally be done by a line management function within the IT department.Furthermore, during an audit, it is too late to minimize the costs for existing provider arrangements. Subcontracting providers could be a concern, but it would not be the primary concern. Transferring knowledge to the internal IT department might be desirable under certain circumstances, but should not be the primary concern of an IS auditor when auditing IT service providers and the management thereof.
2. Right Answer: C
Explanation: It is important that negotiated and agreed commitments (i.e., service level agreements [SLAs]) can be fulfilled all the time. If this were not achievable, IT should not have agreed to these requirements, as entering into such a commitment would be misleading to the business. 'All the time' in this context directly relates to the'agreed obligations' and does not imply that a service has to be available 100 percent of the time. Costs are a result of availability and service continuity management and may only be partially controllable. These costs directly reflect the agreed upon obligations. Capacity management is a necessary, but not sufficient, condition of availability.Despite the possibility that a lack of capacity may result in an availability issue, providing the capacity necessary for seamless operations of services would be done within capacity management, and not within availability management. Generating reports might be a task of availability and service continuity management, but that is true for many other areas of interest as well (e.g., incident, problem, capacity and change management).
3. Right Answer: C
Explanation: An IS auditor should first confirm and understand the current practice before making any recommendations. The agreement can be documented after it has been established that there is an agreement in place. The fact that there is not a written agreement does not justify postponing the audit, and reporting to senior management is not necessary at this stage of the audit. Drafting a service level agreement (SLA) is not the IS auditor's responsibility.
4. Right Answer: B
Explanation: The periodic checking of hard drives would be the most effective method of identifying illegal software packages loaded to the network. Antivirus software will not necessarily identify illegal software, unless the software contains a virus. Diskless workstations act as a preventive control and are not effective, since users could still download software from other than diskless workstations. Policies lay out the rules about loading the software, but will not detect the actual occurrence.
5. Right Answer: D
Explanation: A review of system configuration files for control options used would show which users have access to the privileged supervisory state. Both systems access log files and logs of access violations are detective in nature. Access control software is run under the operating system.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment