CISA Practice Test 4 — 10 Questions

Question 1

An organization is implementing a new ERP system. The project sponsor requests a change that will significantly increase project scope without additional budget. Which of the following is the BEST action for the project manager?

Accepted Answer

Initiate the formal change control process and escalate to the steering committee.. The project manager must follow the formal change control process to evaluate the impact of a scope change that lacks additional budget. Escalating to the steering committee is appropriate because they have the authority to approve or reject changes that affect project constraints, ensuring alignment with organizational governance and IT strategy.

Answer

Accept the change and adjust the project timeline accordingly.

Answer

Implement the change and inform the steering committee later.

Answer

Reject the change because it is outside the original scope.

Question 2

Match each disaster recovery site type to its description.

Question 3

Match each COBIT 5 domain to its description.

Question 4

Match each type of access control to its definition.

Question 5

Match each encryption key type to its usage.

Question 6

Match each log type to its typical content.

Question 7

Match each testing technique to its description.

Question 8

Which TWO of the following are key responsibilities of an IT steering committee?

Accepted Answer

Approving the annual IT budget and major capital expenditures. The IT steering committee is a senior-level governance body responsible for aligning IT strategy with business objectives. Approving the annual IT budget and major capital expenditures (A) is a core fiduciary duty, ensuring resources are allocated to approved projects and initiatives. Defining IT policies and standards (C) establishes the governance framework for security, compliance, and operational consistency across the enterprise.

Answer

Performing daily system monitoring and incident response

Answer

Writing application code for new software features

Answer

Configuring firewall rules and network access controls

Question 9

During user acceptance testing (UAT) of a new financial system, users report that the system fails to enforce a segregation of duties rule where the same user should not be able to create a purchase order and approve it. The requirement was documented in the functional specifications. Which of the following is the MOST likely cause of this issue?

Accepted Answer

The system was not configured to enforce the control.. Option D is correct because the segregation of duties (SoD) rule is a functional control that must be explicitly configured in the system's authorization or workflow engine. Since the requirement was documented in the functional specifications, the most likely cause is that the system was not configured to enforce the control, meaning the access control list (ACL) or role-based access control (RBAC) settings did not prevent the same user from both creating and approving a purchase order.

Answer

Performance testing was prioritized over functional testing.

Answer

The functional requirements were incomplete.

Answer

The requirements were ambiguous and misinterpreted by developers.

Question 10

An IS auditor is reviewing the system development life cycle (SDLC) for a custom application. The project manager has decided to skip the design phase and proceed directly from requirements to coding. Which of the following risks are MOST likely to increase as a result? (Choose two.)

Accepted Answer

Inadequate security controls.. Skipping the design phase means that security requirements are never formally defined or integrated into the system architecture. Without a security design, controls such as authentication, authorization, encryption, and input validation are likely to be omitted or implemented ad hoc, leading to inadequate security controls. This directly increases the risk of vulnerabilities that could be exploited in production.

Answer

Delays in project schedule.

Answer

Increased cost due to rework.

Answer

Increased number of defects during unit testing.