CISA Practice Test 11 — 15 Questions

Question 1

Which THREE of the following are responsibilities of the board of directors regarding IT governance? (Choose three.)

Accepted Answer

Approving the IT strategy. Correct answers: B, C, E. The board is responsible for approving the IT strategy (B), reviewing and approving IT policies (C), and ensuring that IT risks are managed within acceptable levels (E). Implementing IT security controls (A) is a management duty, and monitoring daily IT operations (D) is an operational responsibility.

Answer

Implementing IT security controls

Answer

Monitoring daily IT operations

Question 2

Refer to the exhibit. The organization is planning to achieve the target level. What is the MOST appropriate action?

Accepted Answer

Implement process metrics and statistical controls. To move from Level 3 (Established) to Level 4 (Predictable), the process must be measured and controlled using statistical techniques. Implementing metrics and statistical controls directly addresses the gap. Documentation, ownership, and training are earlier-level activities.

Answer

Assign a process owner

Answer

Conduct awareness training

Answer

Increase process documentation

Question 3

Based on the exhibit, which control deficiency is most critical for the IS auditor to address?

Accepted Answer

The system lacks a policy to lock accounts after repeated failed login attempts. The most critical deficiency because without an account lockout policy, the system is vulnerable to brute-force password guessing attacks. Even if other controls like SSH key authentication are missing, a lockout policy is a fundamental defense that directly mitigates repeated login attempts, which is a primary attack vector for gaining unauthorized access.

Answer

SSH is configured to allow root login

Answer

The admin user logged in successfully with a password

Answer

Public key authentication is not being used

Question 4

Which physical security control is most effective for preventing unauthorized individuals from tailgating into a data center?

Accepted Answer

Mantrap (dual-door interlocking system).. A mantrap, or dual-door interlocking system, is the most effective physical security control against tailgating because it physically isolates individuals in a small vestibule where both doors cannot be opened simultaneously. This forces authentication and verification for each person before the second door unlocks, preventing an unauthorized person from following an authorized individual through a single entry point.

Answer

Security guards at the entrance.

Answer

Closed-circuit television (CCTV) surveillance.

Answer

Biometric fingerprint readers.

Question 5

Which TWO of the following are indicators of poor project governance that an IS auditor should identify?

Accepted Answer

Scope changes are frequently requested and approved verbally.. Verbal approval of scope changes bypasses formal change control processes, leading to undocumented scope creep, loss of audit trail, and increased risk of project failure. An IS auditor should identify this as a governance weakness because it violates the principle of documented authorization and traceability required for effective project oversight.

Answer

Project team uses an agile methodology.

Answer

Project status meetings are held weekly.

Answer

The project budget is reallocated across phases.

Question 6

Which TWO are primary criteria for classifying information assets within an organization? (Choose two.)

Accepted Answer

Business impact if the data is lost or disclosed. Business impact if the data is lost or disclosed (Option C) is a primary criterion because classification directly depends on the potential harm to the organization—confidentiality, integrity, and availability breaches drive the classification level (e.g., public, internal, confidential, restricted). Legal and regulatory requirements (Option E) are also primary because they mandate specific classification labels and handling controls (e.g., GDPR for PII, HIPAA for PHI, PCI DSS for cardholder data) that override internal business impact assessments. These two factors form the core of any information classification policy, as they dictate the protective measures required.

Answer

The format of the data (structured vs. unstructured)

Answer

The age of the data

Answer

Physical storage location of the data

Question 7

Refer to the exhibit. An application log shows an error. What is the MOST likely cause of this error?

Accepted Answer

A duplicate username was inserted into the USERS table. The error message 'Duplicate entry 'admin' for key 'PRIMARY'' indicates a violation of the PRIMARY KEY constraint on the USERS table. Since the username field is the primary key, inserting a second row with the same username (e.g., 'admin') causes MySQL to reject the INSERT operation with error code 1062. This is a unique constraint violation, not a connectivity or privilege issue.

Answer

The database server is offline

Answer

The user does not have insert privileges

Answer

The data type of the username field is incorrect

Question 8

A company decides to outsource the development of a customer portal. Which of the following is the MOST critical control to include in the contract?

Accepted Answer

Service level agreements. Service level agreements (SLAs) are the most critical control because they define measurable performance targets (e.g., uptime, response time, throughput) for the outsourced customer portal. Without enforceable SLAs, the company has no contractual mechanism to ensure the portal meets availability and responsiveness requirements, directly impacting customer experience and business operations.

Answer

Fixed price clause

Answer

Non-disclosure agreement

Answer

Termination for convenience clause

Question 9

An organization has the storage bucket policy shown. Which of the following is the MOST likely intent of this policy?

Accepted Answer

Prevent deletion of objects from the bucket over unencrypted connections.. The policy denies object deletion when the request is not over HTTPS (i.e., encrypted connection false), thereby blocking deletion over unencrypted connections but allowing deletion over HTTPS. Option B is incorrect because deletion over HTTPS is still allowed. Option C is incorrect because other actions like read are not restricted. Option D is incorrect because it does not specifically allow deletion only over HTTPS; it denies over unencrypted connections, so deletion over HTTPS is allowed implicitly.

Answer

Prevent all deletion of objects from the bucket.

Answer

Prevent access to the bucket over HTTP.

Answer

Allow deletion only over HTTPS.

Question 10

What is the FIRST step in implementing an identity and access management (IAM) program?

Accepted Answer

Performing a user access review.. Performing a user access review is the first step because it establishes a baseline of current access rights, identifies segregation of duties conflicts, and uncovers orphaned accounts or excessive privileges. Without this foundational assessment, subsequent IAM controls like SSO or MFA would be deployed on an insecure or non-compliant access framework, violating the principle of 'least privilege' and potentially failing audit requirements.

Answer

Selecting an IAM vendor.

Answer

Implementing multi-factor authentication.

Answer

Deploying single sign-on (SSO).

Question 11

During an audit, the auditor uses a sampling method where the population is divided into subgroups, and samples are selected from each subgroup. This method is known as:

Accepted Answer

Stratified sampling. Stratified sampling divides the population into subgroups (strata) and samples from each.

Answer

Systematic sampling

Answer

Judgmental sampling

Answer

Random sampling

Question 12

Which TWO of the following are types of analytical procedures used in an IS audit? (Select two.)

Accepted Answer

Ratio analysis. Ratio analysis and trend analysis are common analytical procedures.

Answer

Observation

Answer

Re-performance

Answer

Inquiry

Question 13

An organization is implementing a new ERP system. The project sponsor requests a change that will significantly increase project scope without additional budget. Which of the following is the BEST action for the project manager?

Accepted Answer

Initiate the formal change control process and escalate to the steering committee.. The project manager must follow the formal change control process to evaluate the impact of a scope change that lacks additional budget. Escalating to the steering committee is appropriate because they have the authority to approve or reject changes that affect project constraints, ensuring alignment with organizational governance and IT strategy.

Answer

Accept the change and adjust the project timeline accordingly.

Answer

Implement the change and inform the steering committee later.

Answer

Reject the change because it is outside the original scope.

Question 14

Which of the following is the PRIMARY benefit of using a prototype during system development?

Accepted Answer

Clarifying user requirements. Prototyping is primarily used to clarify and validate user requirements by providing a tangible model for users to interact with. This early feedback reduces the risk of misinterpretation and costly rework later. While prototyping may also accelerate development indirectly, its primary benefit is requirement clarification. Reducing development cost is not a primary benefit; in fact, prototyping can increase initial costs. Accelerating coding and minimizing documentation are secondary or not direct objectives.

Answer

Accelerating coding

Answer

Minimizing documentation

Answer

Reducing development cost

Question 15

An organization is implementing a new IT policy. What is the MOST important step to ensure compliance?

Accepted Answer

Conducting training and awareness sessions. Compliance depends on employees understanding the policy and knowing what is expected. Training and communication are critical to raise awareness and ensure adherence.

Answer

Publishing the policy on the intranet

Answer

Establishing penalties for non-compliance

Answer

Assigning a policy owner