CISA Practice Test 12 — 15 Questions

Question 1

During the acquisition of a new software package, the procurement team evaluates two vendors. Vendor A offers a lower upfront cost but higher annual maintenance fees. Vendor B has a higher upfront cost but includes three years of maintenance. What is the MOST important factor for the IS auditor to consider?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The total cost of ownership over the expected life of the system.. Total cost of ownership (TCO) includes all direct and indirect costs over the system's expected life, providing a comprehensive comparison between Vendor A and Vendor B. Option A is incorrect because focusing solely on upfront cost ignores higher ongoing maintenance fees. Option B is incorrect because while vendor reputation is important, it is not the most critical factor in this cost-related decision. Option D is incorrect because budget constraints are a consideration but not the most important factor; the auditor should evaluate the total cost to ensure long-term financial viability.

Answer

The upfront cost of each vendor.

Answer

The vendor's market reputation.

Answer

The organization's budget constraints.

Question 2

An IT audit revealed that the organization's IT steering committee has not met in the past six months. Which of the following is the MOST likely consequence of this situation?

Accepted Answer

Delayed decision-making on IT investments.. The IT steering committee is responsible for approving and prioritizing IT investments; without meetings, decisions on investments are delayed. Option A is less direct, as turnover is influenced by many factors. Option B is incorrect because security incidents are typically addressed by operational security teams. Option C is incorrect because IT policies are usually set by separate governance processes, not solely by the steering committee.

Answer

Higher IT staff turnover.

Answer

Increased number of security incidents.

Answer

Inconsistent IT policies across departments.

Question 3

A company is implementing a new IT governance framework. Which of the following is the PRIMARY benefit of aligning IT strategy with business strategy?

Accepted Answer

Ensures IT investments support business objectives. Aligning IT strategy with business strategy ensures that IT investments support business objectives, delivering value and reducing waste. Reducing costs, improving morale, or simplifying architecture are secondary benefits.

Answer

Simplifies IT architecture

Answer

Improves IT staff morale

Answer

Reduces IT costs

Question 4

An organization is adopting COBIT 2019. Which TWO of the following are components of the governance system?

Accepted Answer

Processes. The correct answers are A (Processes) and D (Organizational structures). COBIT 2019 defines governance system components that include processes and organizational structures, among others. Processes describe the organized sets of practices, while organizational structures define roles and responsibilities. Option B (IT hardware inventory) is a resource or asset, not a component of the governance system. Option C (Information flows) is related to the Information component but is not a standalone component; information itself is a component, but flows are part of processes. Option E (Employee satisfaction surveys) is an HR activity, not a governance component.

Answer

IT hardware inventory

Answer

Information flows

Answer

Employee satisfaction surveys

Question 5

During an IT audit, the auditor discovers that the IT strategy is not formally documented. Which of the following is the MOST significant risk associated with this finding?

Accepted Answer

Lack of alignment between IT investments and business goals.. Without a formally documented IT strategy, IT investments may not be aligned with business goals, leading to misalignment and wasted resources. This is the most significant risk as it directly impacts the organization's ability to achieve its objectives. Option A is possible but less direct. Option B is a consequence but not the most significant. Option D is a potential outcome but not as critical as misalignment with business goals.

Answer

Difficulty in recruiting qualified IT staff.

Answer

Inability to measure the performance of IT systems.

Answer

Increased operational costs due to unplanned IT initiatives.

Question 6

A financial institution recently experienced a data breach where an attacker exfiltrated customer data through an SQL injection vulnerability in a web application. The IS auditor has been asked to review the application security controls. The web application is developed in-house and runs on an application server behind a web application firewall (WAF). The auditor reviews the WAF logs and finds that no SQL injection attacks were detected before the breach, but the logs show many blocked XSS attempts. The developer states that all input validation is performed on the client side using JavaScript. During the audit, the auditor also finds that the application uses a shared database account with DBA privileges for all connections. What is the MOST significant weakness that directly contributed to the breach?

Accepted Answer

Client-side input validation is insufficient and server-side validation is missing.. The most significant weakness that directly contributed to the SQL injection breach is that input validation is performed only on the client side, making it trivial for an attacker to bypass. Without server-side validation, malicious SQL payloads can be submitted directly to the server, allowing the attack to succeed. While the shared DBA account (option B) and WAF misconfiguration (option C) are security weaknesses, they are not as directly responsible for the breach; client-side-only validation is the immediate enabler. Option D is unsupported because no evidence of missing patches is mentioned.

Answer

The use of a shared DBA database account violates the principle of least privilege.

Answer

The WAF is misconfigured to detect only XSS attacks but not SQL injection.

Answer

The application server is not patched against known SQL injection vulnerabilities.

Question 7

An IS auditor is reviewing the business impact analysis (BIA) for a financial services company. Which THREE metrics are typically defined in a BIA?

Accepted Answer

Recovery point objective (RPO).. The Recovery Point Objective (RPO) is a key metric defined in a Business Impact Analysis (BIA) because it specifies the maximum acceptable amount of data loss measured in time, guiding the frequency of backups and replication. In a financial services company, RPO directly determines how much transactional data could be lost during a disruption, which is critical for regulatory compliance and data integrity.

Answer

Mean time to repair (MTTR).

Answer

Mean time between failures (MTBF).

Question 8

An organization is implementing a software asset management (SAM) program. Which of the following is the PRIMARY benefit of SAM?

Accepted Answer

Ensuring compliance with software licensing agreements. SAM helps ensure compliance with software licenses and avoid penalties.

Answer

Reducing hardware costs

Answer

Automating patch management

Answer

Improving network performance

Question 9

A company is migrating its applications to a public IaaS cloud. What is the primary concern for protecting data in this environment?

Accepted Answer

Properly configuring security groups and access control lists (ACLs) to limit network access.. In an IaaS public cloud, the customer retains responsibility for securing the network layer, including virtual firewalls. Security groups (stateful) and ACLs (stateless) are the primary mechanisms to enforce least-privilege network access, which directly protects data from unauthorized exposure over the network. This aligns with the shared responsibility model where the provider secures the physical infrastructure, but the customer must control traffic to their instances.

Answer

Regularly patching the operating system and applications.

Answer

Using only hardened virtual machine images from the provider.

Answer

Ensuring encryption keys are stored in the cloud provider's key management service.

Question 10

According to COBIT 2019, which design factor is MOST critical for tailoring a governance system?

Accepted Answer

Enterprise strategy. Enterprise strategy determines the governance objectives and risk appetite, making it the most critical design factor. Options A, B, and C are all important but secondary; they influence the system but are driven by strategy.

Answer

Regulatory environment

Answer

Technology complexity

Answer

Organizational size

Question 11

An organization is planning to implement a data loss prevention (DLP) solution to protect sensitive data. Which THREE of the following are essential steps to ensure the effectiveness of the DLP program?

Accepted Answer

Classifying data based on sensitivity. Classifying data based on sensitivity (B) is foundational to know what to protect. Defining DLP policies and rules (E) dictates the rules to enforce. Monitoring and tuning DLP rules regularly (C) ensures policies remain effective. Encrypting all data at rest and in transit (A) is not always feasible or appropriate and is not an essential step. Training all employees on data handling procedures (D) is important but not an essential step for the effectiveness of the DLP program.

Answer

Encrypting all data at rest and in transit

Answer

Training all employees on data handling procedures

Question 12

A large enterprise is implementing a backup strategy for a critical database that requires an RTO of 2 hours and an RPO of 15 minutes. The database is 2 TB in size. Which backup method would BEST meet these requirements while minimizing storage costs?

Accepted Answer

Weekly full backups with transactional log backups every 15 minutes. The best choice because weekly full backups with transactional log backups every 15 minutes meet the 15-minute RPO while minimizing storage costs compared to more frequent full backups. Transactional log backups are small and frequent, allowing point-in-time recovery within the RPO. The weekly full backup ensures that the RTO of 2 hours can be met by restoring the full backup and applying the log backups. Option A (daily full) would require more storage and may not meet the RPO if the last backup is older than 15 minutes. Option B (CDP) is expensive and may exceed the RTO due to complexity. Option D (daily full + differential every 4 hours) does not achieve the 15-minute RPO.

Answer

Daily full backups

Answer

Continuous data protection (CDP) replicating to a remote site

Answer

A daily full backup and a differential backup every 4 hours

Question 13

A multinational organization operates a critical ERP system on a virtualized infrastructure across two data centers (primary and DR). The primary data center is located in Region A, and the DR site in Region B, 500 km away. The ERP database is 2 TB and changes at an average rate of 10 MB per second. The organization uses synchronous replication between the two sites over a dedicated 10 Gbps WAN link. During a recent disaster simulation, the IT team observed that the replication link experienced 15 ms latency, causing the primary database to slow down significantly under peak load, ultimately missing the defined RTO of 4 hours for full failover. The business has an RPO of 15 minutes. The CISO asks the IS auditor to recommend a solution that balances cost and performance while meeting both RTO and RPO. Which of the following is the BEST course of action?

Accepted Answer

Change replication to asynchronous mode and implement continuous data protection (CDP) to meet the 15-minute RPO.. Synchronous replication over long distance introduces latency that degrades primary performance. Changing to asynchronous replication with continuous data protection (CDP) can meet the 15-minute RPO without impacting the primary site. Upgrading bandwidth does not reduce latency; backup-to-disk with hourly logs may not meet RPO due to potential data loss; reducing RPO changes the business requirement unacceptably.

Answer

Reduce the RPO to 30 minutes and perform snapshots every 30 minutes on the primary site.

Answer

Upgrade the WAN link to 40 Gbps to reduce latency and improve replication throughput.

Answer

Implement a backup-to-disk solution with daily full backups and hourly transaction log backups to the DR site.

Question 14

A medium-sized financial services firm recently suffered a ransomware attack that encrypted critical servers and backups. The recovery process took three weeks because the backup tapes were stored in the same building (which was also infected) and the backup software had a vulnerability that allowed the ransomware to delete old backups. The firm's BCP did not account for simultaneous loss of primary and secondary data. As the IS auditor, you are asked to recommend the most effective improvement to the backup strategy to prevent recurrence and improve resilience. Which of the following actions should the firm implement?

Accepted Answer

Implement immutable backups and store them offsite or in a separate air-gapped environment. Immutable backups prevent modification or deletion by ransomware, even if the backup software or administrative credentials are compromised. Storing them offsite or in an air-gapped environment ensures that a simultaneous physical or logical attack cannot destroy both primary and secondary data, directly addressing the root cause of the three-week recovery delay.

Answer

Increase the frequency of full backups to daily

Answer

Conduct quarterly tabletop exercises to test recovery procedures

Answer

Move all backups to a cloud storage provider with default settings

Question 15

An organization uses a hot site as its disaster recovery alternative. Which of the following is the MOST critical consideration when selecting a hot site?

Accepted Answer

Compatibility of hardware and software with the production environment. The hot site must be compatible with the production environment to enable quick recovery.

Answer

Distance from the primary site

Answer

Cost of the hot site contract

Answer

Availability of staff at the hot site