CISA Practice Test 1 — 10 Questions

Question 1

Order the steps for performing a data backup in the correct sequence.

Accepted Answer

Identify data to be backed up, then choose backup method, then schedule the backup, then execute backup and verify integrity, then store backup offsite.. Backup process: identify data, choose method, schedule, execute/verify, and store offsite.

Answer

Identify data to be backed up, then schedule the backup, then choose backup method, then execute backup and verify integrity, then store backup offsite.

Answer

Choose backup method, then identify data to be backed up, then schedule the backup, then execute backup and verify integrity, then store backup offsite.

Answer

Identify data to be backed up, then choose backup method, then execute backup and verify integrity, then schedule the backup, then store backup offsite.

Question 2

A company requires employees to use smart cards for facility access. Which additional control would BEST prevent tailgating?

Accepted Answer

Install mantraps at entry points. Mantraps prevent tailgating by allowing only one person per authentication. Biometrics address identity, not tailgating. Random audits are detective. Keypad locks are simple and do not prevent tailgating.

Answer

Require biometric authentication

Answer

Use keypad locks on doors

Answer

Conduct random audits of access logs

Question 3

During a build vs. buy analysis, the IS auditor observes that the organization decided to build a custom application because no vendor solution met all requirements. Which of the following risks should the auditor emphasize?

Accepted Answer

Increased time-to-market and development costs. Custom development carries risk of longer time-to-market and higher cost due to unforeseen complexities.

Answer

Lack of customization

Answer

Dependence on external support

Answer

Vendor lock-in

Question 4

An IS auditor is evaluating the security of the architecture. Which of the following is the MOST critical finding?

Accepted Answer

No encryption for SQL traffic between web and database servers. The most critical finding because unencrypted SQL traffic between the web and database servers exposes sensitive data to interception via man-in-the-middle attacks. Even if the traffic is confined to an internal network, an attacker who compromises the web server can sniff credentials or query results in plaintext. Encrypting SQL traffic with TLS or IPSec is a fundamental security control to protect data in transit.

Answer

The web server has a public IP address

Answer

SQL traffic from the web server to the database server is allowed

Answer

The database server is not placed in the DMZ

Question 5

A mid-sized company is upgrading its legacy financial system to a new cloud-based ERP. The project manager has decided to use a big-bang cutover approach to minimize costs and time. During the first week post-go-live, users report that several critical reports are generating incorrect totals. An initial investigation reveals that the data mapping from the old system to the new system was not fully validated. Which of the following should the IS auditor recommend as the most appropriate corrective action?

Accepted Answer

Perform a data mapping review and remediation, then run parallel operations until accuracy is confirmed. A big-bang cutover with unvalidated data mapping introduces a high risk of data integrity issues, as seen with the incorrect report totals. Running parallel operations after a data mapping review and remediation allows the IS auditor to validate that the new ERP processes data correctly by comparing outputs with the legacy system, ensuring accuracy before full reliance. This aligns with ISACA's guidance on post-implementation verification and control testing for data conversion in cloud-based ERP migrations.

Answer

Implement additional manual controls and have users double-check all reports

Answer

Increase the project budget and hire more consultants to fix the issues

Answer

Immediately revert to the legacy system and restart the project with a phased approach

Question 6

An organization has configured HSRP as shown. During a failover test, the primary router (G0/1) is shut down, but the DR site router does not become active. What is the MOST likely reason?

Accepted Answer

The HSRP group numbers on the two interfaces do not match. HSRP requires that both routers participating in the same virtual IP address use the same group number to form a single HSRP group. If the group numbers on the two interfaces do not match, each router will form its own separate HSRP group, and neither will recognize the other as a peer. Consequently, when the primary router fails, the DR router does not assume the active role because it is not part of the same HSRP group.

Answer

The default route on the primary router points to the wrong next-hop

Answer

The preempt command is missing on the DR router

Answer

The OSPF routing protocol is not redistributing the default route

Question 7

An organization has a policy requiring strong passwords. Which additional control is most effective at preventing credential stuffing attacks?

Accepted Answer

Requiring multi-factor authentication (MFA) for all logins.. Multi-factor authentication (MFA) stops attackers who have stolen passwords because they cannot provide the second factor.

Answer

Increasing password length and complexity requirements.

Answer

Implementing account lockout after 3 failed attempts.

Answer

Conducting annual security awareness training.

Question 8

Refer to the exhibit. Based on the governance status report, which component should be addressed as a priority?

Accepted Answer

Resource Optimization. Resource Optimization has a Red status, indicating critical risk or non-compliance, requiring immediate attention. Green and Yellow components are less urgent.

Answer

Strategy Alignment

Answer

Performance Measurement

Answer

Risk Management

Question 9

A multinational corporation has implemented a hot site disaster recovery solution for its critical financial applications. Which of the following is the MOST important consideration to ensure the effectiveness of the hot site?

Accepted Answer

Regular, documented testing of the failover process is performed. Without regular testing, the hot site may not function as expected. Options A, B, and C are important but secondary: A is part of planning, B is operational, C is compliance but not the most critical for effectiveness.

Answer

Data replication latency is less than 15 minutes

Answer

The hot site is located in a different seismic zone

Answer

The hot site complies with regional data privacy regulations

Question 10

Refer to the exhibit. During a penetration test, a security analyst captures this SAML response. Which of the following security weaknesses is most evident?

Accepted Answer

The assertion is not encrypted. The SAML response shows the assertion is sent in plaintext (no xenc:EncryptedData element), meaning the authentication assertion is not encrypted. This allows an attacker who intercepts the SAML response to extract the assertion and reuse it in a replay or impersonation attack, violating the confidentiality requirement for sensitive authentication tokens.

Answer

The name identifier format is inappropriate

Answer

The session is too short

Answer

The authentication context is weak