40. Which of the following is MOST important to consider when selecting an automated fire suppression system for an unmanned data center?
A.       Onsite support by the vendor
B.       Maintenance costs
C.       Likelihood of fires at the data center
D.      Potential damage to equipment
 
 
Answer: D
 
41. Which of the following is the MOST efficient method for an organization with strong configuration and release management to prepare a new system?
A.       A fresh configuration based on the manufacturer default configuration
B.       An existing system configuration consisting of recorded baselines
C.       A new configuration built from the ground up according to approved standards
D.      A configuration imported from a successfully implemented production system
 
Answer: B
 
 
42. An IS auditor is reviewing the security of a banking system that uses hardware-based encryption. Which of the following is the PRIMARY objective for the adoption of this type of encryption?
A.       To simplify the key management process
B.       To improve encryption algorithm efficiency
C.       To increase encryption key length
D.      To provide secure key management
 
 
Answer: D
 
 
43. Which of the following should be of GREATEST concern to an IS auditor when reviewing public key infrastructure (PKI)?
A.       There is more than one certificate authority (CA).
B.       The organization’s private key is backed up at the certificate authority (CA).
C.       The certificate authority (CA) delegates the verification process to the registration authority.
D.      The organization’s public key has been shared without authorization by business partners.
 
Answer: B
 
 
44. An IS auditor is reviewing a bank’s service level agreement (SLA) with a third-party provider that hosts the bank’s secondary data center. Which of the following findings should be of GREATEST concern to the auditor?
A.       The recovery point objective (RPO) has a shorter duration than documented in the disaster recovery plan (DRP).
B.       Backup data is hosted online only.
C.       The SLA has not been in reviewed in more than a year.
D.      The recovery time objective (RTO) has a longer duration than documented in the disaster recovery plan (DRP).
 
Answer: D
 
 
45. Which of the following should be of MOST concern to an IS auditor reviewing an organization’s IT policies?
A.       The policies are not mapped to industry best practices.
B.       The policies are primarily targeted toward IT staff.
C.       The policies are reviewed and approved by an organizational IT committee.
D.      The policies are not regularly reviewed and updated.
 
Answer: D
 
 
46. Which of the following methods would MOST effectively provide positive authentication for physical access?
A.       Retina scan
B.       Numeric keypads and surveillance camera
C.       A smart card and a security guard
D.      Proximity card
 
Answer: A
 
 
47. Which of the following would be the MOST likely basis for determining a data retention period for audit trail purposes?
A.       Regulatory requirements
B.       Generally accepted audit standards
C.       Computer forensic principles
D.      Control risks
 
Answer: A

 
48 An IS auditor finds that some employees are using public cloud-based Al tools. Which of the following presents the GREATEST concern?
A.       Data reliability
B.       Data leakage
C.       Copyright infringements
D.      Cost overruns
 
Answer: B
 
49. An IS auditor is reviewing an organization’s continuous integration development logs over a period of 12 months. Which of the following sampling methods is BEST suited for compliance testing?
A.       Judgmental sampling
B.       Variable sampling
C.       Attribute sampling
D.      Random sampling
 
Answer: C
 
 
50. In the context of audit algorithms, which of the following is a characteristic of a supervised learning model?
A.       The audit algorithm learns by itself without any monitoring by an auditor.
B.       The audit algorithm needs to be constantly monitored by an auditor.
C.       The audit algorithm learns from labeled data where the outcome is known.
D.      The audit algorithm does not require any data to make predictions.
 
Answer: C