1. During a review of the IT strategic plan, an IS auditor finds several IT initiatives focused on delivering new systems and technology are not aligned with the organization's strategy. Witch of the following would be the IS auditor's BEST recommendation?

A) Reassess the return on investment for the IT initiatives
B) Modify IT initiatives that do not map to business strategies
C) Utilize a balanced scorecard to align IT initiatives to business strategies
D) Reassess IT initiatives that do not map business strategies



2. An organization has outsourced some of its subprocesses to a service provider. When scoping the audit of the provider, the organization's internal auditor shouldFIRST:

A) evaluate operational controls of the provider
B) discuss audit objectives with the provider
C) review internal audit reports of the provider
D) review the contract with the provider



3. An organization was severely impacted after an advanced persistent threat (APT) attack. Afterwards, it was found that the initial breach happened a month prior to the attack. Management's GREATEST concern should be:

A) results of the past internal penetration test
B) the effectiveness of monitoring processes
C) the installation of critical security patches
D) external firewall policies



4. Software quality assurance (QA) reviews are planned as part of system development. At which stage in the development process should the first review be initiated?

A) At pre-implementation planning
B) As a part of the user requirements definition
C) Immediately prior to user acceptance testing
D) During the feasibility study



5. An organization has made a strategic decision to split into separate operating entities to improve profitability. However, the IT infrastructure remains shared between the entities. Which of the following would BEST help to ensure that IS audit still covers key risk areas within the IT environment as part of its annual plan?

A) Increasing the frequency of risk-based IS audits for each business entity
B) Revising IS audit plans to focus on IT changes introduced after the split
C) Conducting an audit of newly introduced IT policies and procedures
D) Developing a risk-based plan considering each entity's business processes