CISA Practice Test 10 — 10 Questions

Question 1

An IT manager is reviewing the service level agreements (SLAs) for a cloud-based email service. The SLA guarantees 99.9% uptime per month. The service experienced an outage of 45 minutes in a 30-day month. Did the service meet the SLA?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

No, because the allowed downtime for 99.9% uptime is approximately 43 minutes.. The SLA guarantees 99.9% uptime per month. For a 30-day month (43,200 minutes), 99.9% uptime allows only 0.1% downtime, which is 43.2 minutes. The actual outage of 45 minutes exceeds this threshold, so the SLA was not met. Option D correctly identifies the allowed downtime as approximately 43 minutes.

Answer

Yes, because 45 minutes is within 0.1% of the total time.

Answer

Yes, because the SLA is calculated per day, not per month.

Answer

No, because any downtime exceeding 30 minutes is a violation.

Question 2

A multinational manufacturing company with operations in 20 countries has historically allowed each regional division to manage its own IT systems independently. Recently, the company experienced a significant data breach originating from a region with weaker security controls, leading to financial losses and reputational damage. The board has mandated stronger IT governance to prevent future incidents. The CIO proposes implementing a global IT governance framework with centralized policy enforcement. However, regional directors argue that local regulations and business needs require autonomy. The governance committee must decide on a course of action that balances risk and business flexibility. Which of the following approaches is the MOST appropriate?

Accepted Answer

Adopt a federated governance model with global policies and local flexibility within defined tolerances.. A federated governance model with global policies and local flexibility within defined tolerances is the most appropriate because it balances the board's mandate for stronger, centralized governance with the regional directors' need for autonomy to meet local regulations and business requirements. It establishes global minimum standards while allowing regions to adapt within approved boundaries, directly addressing the risk of weak regional controls without eliminating necessary flexibility.

Answer

Allow each region to continue independently but require quarterly reporting to the committee.

Answer

Implement a fully centralized IT governance model with no regional deviations.

Answer

Maintain the status quo but enforce minimum security standards across all regions.

Question 3

According to ISACA IT Audit Standards, which of the following is the primary purpose of audit documentation (working papers)?

Accepted Answer

To provide a basis for the audit report and support the auditor's conclusions. Audit documentation supports the auditor's conclusions and provides evidence of the work performed. It is not primarily for future audit planning or legal protection.

Answer

To facilitate the planning of the next audit

Answer

To serve as a legal record for potential litigation

Answer

To demonstrate compliance with audit standards

Question 4

An IS auditor is reviewing the organization's data inventory process for privacy compliance. Which TWO of the following are the MOST important elements that should be included in the data inventory?

Accepted Answer

Data elements or fields containing personal data. Option A is correct because a data inventory must identify the specific data elements or fields that contain personal data, since this is the foundational step for determining what privacy obligations (e.g., GDPR, CCPA) apply and where protection controls are needed. Option C is correct because knowing the location of personal data storage and processing—whether on-premises, in the cloud, or across jurisdictions—is essential for assessing cross-border transfer restrictions, access controls, and regulatory applicability. Options B, D, and E, while useful attributes that may be recorded in a mature inventory, are not the most important core elements; classification labels, retention periods, and consent status are downstream details that depend on first knowing what personal data exists and where it resides.

Answer

Data classification labels

Answer

Data retention periods

Answer

Data subject consent status

Question 5

An organization has implemented role-based access control (RBAC). Which of the following is the PRIMARY benefit of RBAC?

Accepted Answer

Simplified user permission management. RBAC simplifies user permission management by assigning permissions to roles rather than individuals, allowing administrators to grant or revoke access by modifying role memberships. This reduces administrative overhead and the risk of permission errors, as changes propagate automatically to all users in a role. The primary benefit is operational efficiency in access control, not direct security features like encryption or malware protection.

Answer

Encryption of sensitive data at rest

Answer

Elimination of compliance requirements

Answer

Improved protection against malware

Question 6

A hospital is implementing a new electronic health records (EHR) system. The system will be used by doctors, nurses, and administrative staff. During the user acceptance testing (UAT) phase, the nursing staff reports that the interface for entering patient vitals is too slow and requires many clicks, which slows down their workflow. The project team has already completed system testing and is preparing for go-live in two weeks. The development team can make a quick fix to streamline the vital signs entry by adding a shortcut, but this change has not been tested. The IT director is concerned about patient safety and wants to ensure the system is usable. What is the BEST course of action?

Accepted Answer

Assess the risk, develop the fix, fast-track testing, and if successful, include it in the go-live. It balances patient safety with project timelines by formally assessing the risk of the untested fix, developing it, and then fast-tracking a targeted regression test. This approach ensures the usability issue is resolved without bypassing necessary quality controls, which is critical for a clinical system where data entry errors could directly impact patient care. The IT director's concern about patient safety is addressed by the risk assessment and focused testing, while the go-live date is preserved if the fix passes.

Answer

Implement the quick fix immediately and go live as scheduled

Answer

Proceed with go-live as planned and address usability issues in a future release

Answer

Delay go-live by one month to fully test the fix

Question 7

When an organization uses an external provider to manage its IT help desk, this is an example of which sourcing model?

Accepted Answer

Outsourcing. Outsourcing is the sourcing model where an external provider manages a specific IT function, such as the help desk, under a contract. This transfers operational responsibility to the third party while the organization retains oversight. It is distinct from cloud services, insourcing, and co-sourcing.

Answer

Cloud services

Answer

Insourcing

Answer

Co-sourcing

Question 8

An organization is considering outsourcing its IT help desk. Which of the following is a key risk that should be addressed in the outsourcing contract?

Accepted Answer

Inadequate data privacy and security measures. Data privacy and security are critical when outsourcing services that handle sensitive information.

Answer

Reduced flexibility in service hours

Answer

Lack of technical expertise in the outsourcing provider

Answer

Higher cost compared to in-house operations

Question 9

An organization is migrating from a legacy system to a new ERP. Which TWO of the following are the HIGHEST risks during data migration?

Accepted Answer

Incorrect data mapping between old and new systems. Option A is correct because incorrect data mapping between the legacy and new ERP schemas directly causes fields to be transformed, truncated, or populated into the wrong target columns, producing corrupt or unusable records in the new system — a core data migration risk. Option E is correct because incomplete or inaccurate source data (missing values, duplicates, inconsistent formats) propagates defects into the ERP and undermines the integrity of the migrated dataset, regardless of how well the mapping is designed. These two are the highest risks because they directly threaten the accuracy and completeness of the migrated data itself, which is the primary objective of the migration. Option B is not a top migration risk since bandwidth affects cutover performance/throughput rather than data correctness and is typically mitigated by scheduling and sizing. Option C concerns post-migration adoption and user competence, not the integrity of the migrated data. Option D is an access-control/governance risk in the new system's design, not a data migration risk.

Answer

Insufficient network bandwidth during cutover

Answer

Lack of user training on the new system

Answer

Lack of segregation of duties in the new system

Question 10

An IS auditor is assessing the data inventory of a financial institution to ensure compliance with privacy regulations. Which TWO of the following are essential elements that should be included in the data inventory?

Accepted Answer

The location (systems and physical) where PII is stored. Option B is correct because a data inventory must record where PII resides—both the systems (applications, databases, cloud services) and physical locations—so the organization can apply appropriate safeguards and respond to access, breach, or deletion requests under privacy regulations. Option D is correct because documenting the retention period for each type of PII ensures data is kept only as long as legally or operationally necessary and is securely disposed of when that period ends, which is a core privacy compliance requirement. Option A is not essential to the inventory itself; encryption algorithms are security controls recorded in system documentation, not identifying attributes of a data inventory. Option C is irrelevant to privacy compliance, as storage cost is a financial metric rather than a data-governance attribute. Option E is unnecessary and impractical, since the inventory should identify processing activities and roles, not list every individual employee who handles the data.

Answer

The encryption algorithm used to protect the data

Answer

The cost of storing the data

Answer

The names of all employees who process the data