CISA Practice Test 12 — 15 Questions

Question 1

An organization is acquiring a new financial system. The contract includes a clause that allows the organization to audit the vendor's controls. Which type of report would most efficiently provide assurance over the vendor's internal controls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SOC 2 report. A SOC 2 report is specifically designed to provide assurance over a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy, which directly addresses the need to audit the vendor's internal controls for a financial system. It is more efficient than other options because it is a standardized, independent assessment that covers the control environment relevant to financial data processing.

Answer

Financial audit report

Answer

Penetration test report

Answer

ISO 27001 certificate

Question 2

During an audit of the incident response process, the IS auditor finds that the organization relies on shared accounts for system administration. Which TWO of the following are the MOST significant risks associated with shared accounts?

Accepted Answer

Lack of individual accountability for actions performed. Option B is correct because shared accounts eliminate the one-to-one mapping between a user identity and an account, so when multiple administrators use the same credentials there is no way to attribute a specific action to a specific individual, destroying individual accountability. Option D is correct because the audit logs generated under a shared account record only the account name, not the actual person, so the resulting audit trail cannot reliably support forensic investigations or non-repudiation. Options A and C are operational inconveniences rather than the most significant risks, and option E describes a possible consequence of poor password hygiene rather than the core accountability and forensic integrity risks that an IS auditor would emphasize.

Answer

Increased complexity in password management

Answer

Increased overhead for account provisioning

Answer

Higher likelihood of password sharing outside the authorized group

Question 3

An IS auditor is reviewing the release management process for a critical application. The release strategy includes a phased rollout to 10% of users initially, then 50%, then 100%. The first phase revealed a data integrity issue that affected a subset of transactions. The release manager decided to continue with the next phase while a patch was being developed. What should the auditor most recommend?

Accepted Answer

Halt the rollout until the data integrity issue is resolved.. Continuing the rollout while a data integrity issue exists could affect more users. Best practice is to halt the rollout until the issue is resolved and patched, to prevent further impact and ensure the fix is effective.

Answer

Document the issue as a known error and proceed.

Answer

Accelerate the rollout to quickly identify all issues.

Answer

Increase testing in the next phase to catch issues earlier.

Question 4

During an audit of privacy controls, the IS auditor discovers that the organization processes personal data of EU residents but has not appointed a Data Protection Officer (DPO). Which regulation is MOST likely being violated?

Accepted Answer

GDPR. The GDPR (EU Regulation 2016/679) governs the processing of personal data of EU residents and mandates the appointment of a Data Protection Officer (DPO) in specific circumstances—such as large-scale systematic monitoring or large-scale processing of special categories of data by public authorities or core-activity organizations. Processing EU residents' personal data without a required DPO is a direct GDPR Article 37 violation. The other regulations listed address payment card data, financial reporting integrity, and US healthcare information, none of which impose a DPO requirement for EU personal data.

Answer

PCI DSS

Answer

SOX

Answer

HIPAA

Question 5

A company is designing a public cloud-based application that processes highly sensitive personal data. Which of the following data protection strategies provides the STRONGEST assurance that data remains confidential even if the cloud provider's infrastructure is compromised?

Accepted Answer

Implement client-side encryption with customer managed keys. Client-side encryption with customer managed keys ensures that data is encrypted before it leaves the client environment, and the cloud provider never has access to the plaintext data or the encryption keys. Even if the cloud provider's infrastructure is fully compromised, the attacker cannot decrypt the data because the keys are never stored or processed by the provider. This provides the strongest assurance of confidentiality because the data remains encrypted end-to-end, independent of the provider's security controls.

Answer

Use server-side encryption with cloud provider managed keys

Answer

Enable encryption in transit using TLS 1.3

Answer

Apply data masking at the application layer

Question 6

Which TWO of the following are indicators that an IS auditor may need to adjust the audit approach during fieldwork? (Select TWO.)

Accepted Answer

Inability to obtain sufficient appropriate audit evidence. Option A is correct because when an IS auditor cannot obtain sufficient appropriate audit evidence, the planned procedures are not yielding a reliable basis for conclusions, so the audit approach (for example, additional or alternative substantive testing, or revised reliance on controls) must be adjusted. Option E is correct because higher-than-expected error rates in sample testing indicate that the assessed level of control risk or the tolerable deviation/error rate may be wrong, requiring the auditor to expand testing, increase sample sizes, or reconsider the nature, timing, and extent of procedures. Option B is not correct because completing the initial risk assessment is a normal, planned phase of the audit that informs the approach rather than a fieldwork indicator that it must change. Option C is not correct because being behind schedule is a project-management or resource issue, not audit evidence or risk information that by itself dictates a change in the audit approach. Option D is not correct because a management-requested scope change is a governance/engagement matter to be evaluated and approved, not an indicator arising from fieldwork evidence that the audit approach needs adjustment.

Answer

Completion of the initial risk assessment

Answer

Audit team members are behind schedule

Answer

Management requests a change in audit scope

Question 7

During an IS audit, the auditor finds that a control deficiency could result in a material misstatement. According to ISACA standards, this should be classified as:

Accepted Answer

A material weakness. A material weakness is a deficiency or combination of deficiencies that results in a reasonable possibility that a material misstatement will not be prevented or detected.

Answer

An observation

Answer

A deficiency

Answer

A finding

Question 8

An IS auditor is reviewing the privileged access management (PAM) process. Which TWO of the following are the MOST effective controls to prevent misuse of privileged accounts?

Accepted Answer

Session recording and monitoring of privileged activities. Option A is correct because session recording and monitoring of privileged activities creates a tamper-evident audit trail and real-time oversight, which deters misuse and enables detection and accountability for every privileged action. Option B is correct because just-in-time (JIT) privileged access grants elevated rights only for a limited, approved window and revokes them automatically, drastically shrinking the standing attack surface and the opportunity for misuse. Option C is not the most effective preventive control because a quarterly review is a detective, after-the-fact activity that can leave misuse undetected for up to three months. Option D is wrong because generic administrative accounts shared by multiple users destroy individual accountability and make attribution of actions impossible. Option E is wrong because shared passwords for emergency access eliminate non-repudiation and cannot be traced to a specific individual, increasing the risk of undetected misuse.

Answer

Quarterly review of privileged account access

Answer

Assignment of generic administrative accounts to multiple users

Answer

Use of shared passwords for emergency access

Question 9

An IS auditor is reviewing an agile project that uses Scrum. Which event provides the best opportunity for the auditor to assess whether completed user stories meet the defined acceptance criteria?

Accepted Answer

Sprint review. The sprint review is the Scrum event where the team demonstrates completed work to stakeholders and gathers feedback, making it the best opportunity for an IS auditor to assess whether completed user stories meet the defined acceptance criteria. During the sprint review, the product owner and stakeholders review the increment and verify that it meets the acceptance criteria, providing a clear checkpoint for audit evidence. This event directly addresses the completion and acceptance of user stories.

Answer

Daily standup

Answer

Retrospective

Answer

Sprint planning

Question 10

An organization's IT department is considering a shift from insourcing to co-sourcing for application development. What is a PRIMARY advantage of co-sourcing?

Accepted Answer

Provides access to specialized expertise while maintaining internal control. Co-sourcing combines internal and external resources, allowing access to specialized skills while retaining control.

Answer

Eliminates the cost of employee benefits

Answer

Simplifies performance management

Answer

Reduces the need for IT governance

Question 11

During a review of the patch management process, the IS auditor finds that critical security patches are applied within 30 days, but the policy requires application within 7 days. The IT manager argues that the delay is due to testing requirements. What should the auditor recommend?

Accepted Answer

Require risk acceptance documentation for each patch that misses the SLA. The policy requires 7-day patching but actual practice is 30 days, creating a documented control gap. Rather than silently accepting the deviation or weakening the standard, the auditor should recommend that each missed SLA be formally documented as a risk acceptance so management owns the residual risk. This preserves the control baseline while providing an auditable trail of conscious risk decisions.

Answer

Escalate to senior management immediately

Answer

Update the policy to allow 30 days for critical patches

Answer

Accept the delay as necessary for stability

Question 12

Which COBIT 2019 governance objective describes the board's responsibility for overseeing IT?

Accepted Answer

Evaluate, Direct, and Monitor (EDM). COBIT 2019 defines the governance objective as Evaluate, Direct, and Monitor (EDM), which is the board's responsibility.

Answer

Deliver, Service, and Support (DSS)

Answer

Align, Plan, and Organize (APO)

Answer

Build, Acquire, and Implement (BAI)

Question 13

Which of the following is a principle of ISO/IEC 38500 for corporate governance of IT?

Accepted Answer

Strategy. ISO/IEC 38500 outlines six principles: responsibility, strategy, acquisition, performance, conformance, and human behavior.

Answer

Start where you are

Answer

Optimise and automate

Answer

Focus on value

Question 14

What is the PRIMARY purpose of conducting a feasibility study before acquiring a new information system?

Accepted Answer

To assess the technical, operational, and economic viability. The primary purpose of a feasibility study is to evaluate whether a proposed information system is technically achievable, operationally compatible with existing processes, and economically justified before committing resources. This upfront assessment prevents investment in systems that cannot be successfully implemented or sustained, directly addressing risk management in the acquisition lifecycle.

Answer

To define detailed system requirements

Answer

To select a vendor through a bidding process

Answer

To determine the total cost of ownership

Question 15

A bank is converting data from its legacy core banking system to a new platform. Which control is MOST critical to ensure the completeness and accuracy of data conversion?

Accepted Answer

Reconciliation of converted data totals to source system totals. Reconciliation of converted data totals to source system totals is the most critical control because it directly verifies that every record from the legacy system has been accurately migrated without loss or duplication. This control compares aggregate values (e.g., account balances, transaction counts) between the source and target databases, providing a definitive check for completeness and accuracy that other controls cannot guarantee.

Answer

Parallel running of both systems

Answer

Data validation rules programmed in the conversion tool

Answer

User acceptance testing of the new system