CISA Exam Questions and Answers

Implement a privileged access management (PAM) solution to control and monitor elevated access.

Privileged access management directly addresses insider misuse by vaulting, brokering and session-recording elevated accounts, enforcing least privilege and just-in-time elevation. This targets the root cause — uncontrolled privileged credentials — rather than merely detecting activity after the breach has already occurred.

COBIT 2019

COBIT 2019 provides a governance and management framework explicitly linking IT objectives to business goals, with defined processes and control practices for regulatory compliance. This satisfies the board's need for enterprise-wide governance across hybrid cloud rather than technology-specific operational guidance.

Increased value of IT investments to business objectives

Aligning IT strategy with business strategy directs IT spending and initiatives toward organisational goals, maximising the business value delivered by IT investments. That outcome is the primary benefit, rather than cost reduction, technology standardisation or faster project delivery.

IT Audit Committee

An independent audit committee provides objective oversight.

Initiate the formal change control process and escalate to the steering committee.

A scope increase without matching budget requires the formal change control process, since the change board and steering committee hold authority to approve, reject, or re-baseline scope, schedule, and funding. This satisfies the stem's constraint by preventing unilateral scope creep and preserving the approved baseline.

Average server CPU utilization

Average server CPU utilisation directly quantifies how much processing capacity is consumed versus available, giving a concrete efficiency measure of IT resource usage. It satisfies the manager's need to measure utilisation, unlike metrics such as incident counts or uptime that reflect availability rather than efficiency.

Review and approve the change

Normal changes require CAB review and authorisation before implementation. Even though the patch is low impact, the reboot and database scope mean the CAB must review and approve it, satisfying the stem's normal-category constraint rather than auto-approving it as standard.

Perform periodic restore verification tests

Periodic restore verification tests directly satisfy the stem's need to detect corruption before a disaster, since only an actual restore proves every incremental in the chain is readable. Checksums or media scans may pass while a corrupt incremental still breaks recovery, so rehearsed restoration is the control that validates end-to-end recoverability.

To determine the recovery time objective (RTO)

MTD defines the maximum time a process can be unavailable, and the RTO must be set at or below it to keep downtime tolerable. Deriving the RTO from the 4-hour MTD ensures recovery capabilities align with business tolerance.

Increase in unauthorized changes

Bypassing CAB review removes independent oversight, so the change manager alone authorises emergency changes. That concentrates approval authority in one person, enabling changes to be implemented without detection or challenge — directly increasing the risk of unauthorised changes, the specific risk the stem's missing segregation of duties creates.

Issue a non-compliance notice and require a remediation plan

The vendor's 3-hour average breaches the SLA's 2-hour P1 resolution target, so the auditor should raise non-compliance and require a remediation plan. This addresses the contractual gap directly rather than accepting or renegotiating the agreed service level.

Recovery time objective (RTO) and recovery point objective (RPO)

The 8-hour disruption tolerance defines the recovery time objective, the maximum acceptable downtime before the process must be restored. The 15-minute data loss limit defines the recovery point objective, the maximum tolerable data loss measured backwards from the incident.

Internal audit

Internal audit is performed by the organisation's own employees, who report to management or the audit committee. This contrasts with external audit, delivered by independent third parties, directly satisfying the stem's requirement for work conducted by staff within the organisation.

Fieldwork

Fieldwork is the phase where the auditor gathers evidence by performing inquiry, observation, inspection and reperformance against the audit programme. Planning establishes scope and risk, while reporting communicates findings, so these procedures occur during fieldwork.

Detection risk

Detection risk is the component the auditor directly controls through the nature, timing and extent of substantive testing. With inherent risk high and control risk low, the auditor adjusts testing to keep detection risk at a level that holds overall audit risk within acceptable bounds.

Re-performance

Re-performance requires the auditor to independently execute the control procedure, such as recalculating a total or re-running an authorisation check, and compare the result with the organisation's output. This directly tests operating effectiveness rather than relying on documentation or inquiry.

Allocate more audit resources to areas with higher risk and lower control effectiveness

Risk-based auditing directs limited resources toward exposures with the greatest likelihood and impact, weighted by how weakly existing controls mitigate them. Prioritising high-risk, low-control-effectiveness areas satisfies the stem's requirement, since coverage then targets residual risk rather than spreading effort uniformly.

Random sampling

Random sampling gives every transaction in the 1,000-item population an equal, non-zero chance of selection, which the random number generator enforces. This satisfies the stem's requirement for a statistically valid, unbiased sample, unlike haphazard or judgmental methods, and supports extrapolating the 50-transaction results to the full population.

Unauthorized access to sensitive data due to excessive privileges

Annual owner reviews without manager confirmation mean access is never validated against current job need, so transferred or terminated staff retain entitlements. Accumulated excessive privileges let users reach sensitive financial data beyond their remit, the specific risk the undocumented confirmation step leaves unmitigated.

To communicate management's commitment and direction for information security

The policy exists to articulate management's commitment and strategic direction for information security, authorising the programme and setting expectations. This satisfies the stem's constraint by establishing the mandate from which standards, procedures and controls derive their authority.

Implement individual accounts with privilege escalation for administrative tasks

Individual accounts with privilege escalation tie each administrative action to a named user, so logs attribute activity to a person rather than an anonymous shared login. This preserves accountability and satisfies the audit trail requirement that shared credentials destroy.

Reduction in the number of successful phishing attacks

Awareness programmes aim to change behaviour, so fewer successful phishing attacks demonstrates that staff actually recognise and resist real threats. This outcome metric reflects genuine risk reduction, unlike completion rates or quiz scores, which measure attendance rather than effectiveness.

Compromised certificates could still be used to establish trust

CRLs are the mechanism relying parties use to learn that a certificate is revoked. If they are stale, a compromised certificate's serial number is absent, so systems continue trusting it and attackers can still authenticate or decrypt traffic until the CRL is refreshed.

Mantrap

A mantrap permits only one person through an interlocking door sequence at a time, physically preventing an unauthorised individual from following an authenticated person. This directly satisfies the stem's constraint by eliminating the single-entry tailgating vector that badge readers alone cannot address.

The system may not fully meet business requirements, leading to user workarounds

Passing only 60% of UAT cases means 40% of tested business scenarios failed, so the system may not satisfy requirements and users will adopt manual workarounds that undermine controls and reporting integrity. This is the most significant risk.

Incomplete or inaccurate data may be loaded into the new system

Skipping full reconciliation removes the control that detects records lost, duplicated or corrupted during migration. Without it, incomplete or inaccurate data enters the ERP and may drive incorrect transactions and reporting, making data integrity the auditor's primary concern.

Requirements phase

Requirements are baselined and formally approved by the business owner before design begins, since later phases build directly on that frozen scope. Sign-off here authorises the project to proceed, whereas design and testing approvals occur within their own phases.

Each sprint concludes with a sprint review attended by stakeholders

Sprint reviews provide evidence that stakeholders inspect the increment each sprint, satisfying the need for continuous user acceptance in agile delivery. Unlike a single end-of-project sign-off, this recurring stakeholder validation demonstrates acceptance controls operate throughout development, directly addressing the stem's requirement for adequate user acceptance evidence.

Evaluate compensating controls or seek an alternative vendor

An adverse SOC 2 opinion means the vendor's controls failed to meet trust services criteria, so the auditor should recommend evaluating compensating controls or selecting an alternative vendor. This directly addresses the assurance gap the adverse opinion creates for a critical system.

Each spiral iteration includes a risk analysis document

The spiral model's defining feature is iteration-level risk analysis, so a risk analysis document produced within each spiral iteration provides direct, repeatable evidence that risk assessment occurs at every cycle, not merely at project initiation.