CISA Practice Test 10 — 10 Questions

Question 1

An IS auditor is reviewing logical access controls for a critical application. Which of the following is the MOST important control to detect unauthorized access?

Accepted Answer

Audit logging of access attempts. Audit logs of successful and failed access attempts provide the evidence needed to detect unauthorized access. Other controls prevent or limit access but do not detect it after the fact.

Answer

Strong password policy

Answer

Monthly access recertification

Answer

Role-based access control (RBAC)

Question 2

Order the steps for conducting a business impact analysis (BIA) in the correct sequence.

Accepted Answer

Identify processes, then define recovery objectives, then assess impact, then prioritize, then document. BIA steps: identify processes, define recovery objectives, assess impact, prioritize, and document.

Answer

Assess impact, then prioritize, then identify processes, then define recovery objectives, then document

Answer

Identify processes, then assess impact, then define recovery objectives, then prioritize, then document

Answer

Define recovery objectives, then identify processes, then assess impact, then prioritize, then document

Question 3

Refer to the exhibit. Which perspective shows the greatest deviation from target?

Accepted Answer

Learning & Growth. Learning & Growth is 30 hours short of 150 (20% deficit), while Financial is 10% short, Internal Process is 4% short, and Customer exceeds target. Thus, Learning & Growth has the largest negative gap.

Answer

Customer

Answer

Financial

Answer

Internal Process

Question 4

An organization is acquiring a new financial system. The contract includes a clause that allows the organization to audit the vendor's controls. Which type of report would most efficiently provide assurance over the vendor's internal controls?

Accepted Answer

SOC 2 report. A SOC 2 report is specifically designed to provide assurance over a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy, which directly addresses the need to audit the vendor's internal controls for a financial system. It is more efficient than other options because it is a standardized, independent assessment that covers the control environment relevant to financial data processing.

Answer

Financial audit report

Answer

Penetration test report

Answer

ISO 27001 certificate

Question 5

According to ISACA IT Audit Standards, which of the following is the primary purpose of audit documentation (working papers)?

Accepted Answer

To provide a basis for the audit report and support the auditor's conclusions. Audit documentation supports the auditor's conclusions and provides evidence of the work performed. It is not primarily for future audit planning or legal protection.

Answer

To facilitate the planning of the next audit

Answer

To serve as a legal record for potential litigation

Answer

To demonstrate compliance with audit standards

Question 6

An IS auditor is assessing the vendor management process. Which TWO are key controls for managing third-party risk?

Accepted Answer

Including right-to-audit clauses in contracts.. Including right-to-audit clauses in contracts is a key control for managing third-party risk because it grants the IS auditor or the organization the contractual authority to independently verify the vendor's security controls, data handling practices, and compliance with policies. This clause ensures ongoing oversight beyond initial due diligence, allowing for on-site inspections or reviews of the vendor's systems and processes, which is critical for detecting control failures or unauthorized changes that could impact the organization's data.

Answer

Requiring vendors to disclose all subcontractors.

Answer

Developing an exit strategy for each vendor.

Answer

Performing vendor due diligence before contract signing.

Question 7

An organization is implementing a new financial system. Which of the following is the MOST important control to ensure data integrity during the data migration phase?

Accepted Answer

Implementing reconciliation controls between source and target. Reconciliation controls between source and target systems are the most critical control for ensuring data integrity during migration because they provide a systematic method to verify that every record has been accurately transferred without loss, duplication, or corruption. This typically involves comparing record counts, hash totals, or checksums (e.g., using MD5 or SHA-256) between the legacy and new databases, and flagging any discrepancies for correction before the system goes live.

Answer

Conducting a post-implementation review

Answer

Encrypting data in transit

Answer

Performing user acceptance testing

Question 8

During a spiral model SDLC project, an IS auditor is reviewing risk assessment documentation. Which of the following would be the GREATEST concern?

Accepted Answer

Key risks identified in the first iteration are not reassessed in later iterations. The spiral model is risk-driven; failure to identify critical risks undermines the methodology and could lead to project failure.

Answer

Risk mitigation plans are not documented

Answer

The project uses a combination of waterfall and prototyping

Answer

Risk analysis is performed by the project manager alone

Question 9

A security auditor discovers that a server has been compromised due to an unpatched vulnerability. Which of the following would have most effectively prevented this incident?

Accepted Answer

Implementing a vulnerability management program with regular patching.. A vulnerability management program with regular patching directly addresses the root cause of the compromise: the unpatched vulnerability. By systematically identifying, prioritizing, and applying security patches, the organization eliminates the known weakness that the attacker exploited. This proactive measure prevents the initial compromise, whereas other controls only detect or limit the attack after the vulnerability is exploited.

Answer

Enabling firewall rules to limit access.

Answer

Installing a host-based intrusion detection system (HIDS).

Answer

Using strong passwords on the server.

Question 10

Which of the following backup types copies only data that has changed since the last full backup?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of how many incremental backups have been performed. This means each differential backup contains all changes accumulated since the most recent full backup, making it larger than an incremental backup but faster to restore (requiring only the full backup plus the latest differential).

Answer

Mirror backup

Answer

Full backup

Answer

Incremental backup