CISA Practice Test 13 — 15 Questions

Question 1

You are the IT audit manager for a multinational corporation. The company recently implemented a new enterprise resource planning (ERP) system using a phased rollout approach. The first phase (finance module) was deployed to three regional offices six months ago. During a post-implementation review, you discovered that the user acceptance testing (UAT) for the finance module was completed in only two days instead of the planned two weeks. The UAT was performed by a small group of power users selected by the project manager, and they reported no critical issues. However, after go-live, several finance staff in one region found that the system does not support a statutory reporting requirement specific to that country, which was not tested. The project manager argues that the requirement was never documented in the business requirements specification. The system has been live for six months, and the missing functionality requires a significant customization that will take three months and cost $200,000. Management is reluctant to fund the customization because the budget is exhausted. As the IT auditor, what is the BEST course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Recommend that management implement a formal UAT process with representatives from all regions and include a checklist of statutory requirements for future rollouts. The root cause is a deficient UAT process, not just a missing requirement. A formal UAT process with representatives from all regions and a statutory requirements checklist would have caught the country-specific reporting need before go-live. As an IT auditor, recommending process improvements for future rollouts addresses the systemic control weakness, which is more effective than blaming individuals or accepting risk without remediation.

Answer

Report the project manager to senior management for failing to include the requirement

Answer

Recommend that the organization accept the risk and proceed without the customization

Answer

Advise the project manager to retroactively document the requirement and request a change order for the customization

Question 2

A mid-sized company is implementing a new IT service management (ITSM) tool to improve incident management. The IT manager wants to ensure that the tool aligns with ITIL best practices. The company has a dedicated service desk team that handles about 200 incidents per week. The IT manager is considering whether to implement a self-service portal for users to submit incidents and check status, or to continue using email-based incident reporting. The service desk team is concerned that a self-service portal might reduce their direct interaction with users and potentially lead to less personalized support. However, the IT manager believes that a portal could improve efficiency and tracking. The company's IT governance framework requires that any major IT investment be approved by the steering committee and that there be a clear business case. The IT manager has prepared a business case but the steering committee wants to ensure that the solution is aligned with ITIL and that it addresses key incident management processes. Which of the following is the most appropriate next step for the IT manager?

Accepted Answer

Conduct a process review with stakeholders to define requirements based on ITIL guidelines before selecting a tool.. ITIL best practices emphasize that process design should precede tool selection. Conducting a process review with stakeholders ensures the self-service portal aligns with defined incident management workflows, such as categorization, prioritization, and escalation, before committing to a specific tool. This step also satisfies the IT governance requirement for a clear business case by validating requirements against ITIL guidelines.

Answer

Implement the self-service portal immediately to improve efficiency, then present the business case later.

Answer

Proceed with the self-service portal without further review because it is clearly beneficial.

Answer

Abandon the self-service portal idea and continue with email-based reporting.

Question 3

A multinational corporation is replacing its legacy on-premises customer relationship management (CRM) system with a new cloud-based CRM solution. The project involves migrating data from the old system, customizing the new system to match business processes, and integrating with an existing enterprise resource planning (ERP) system. The project has a tight deadline of six months. During the planning phase, the project team decides to use a waterfall methodology because the requirements are well-defined. However, three months into the project, the business users request significant changes to the customer data fields, which were not originally specified. The project manager is concerned that accommodating these changes will delay the project. The integration with the ERP system is also proving more complex than anticipated, with data mapping errors causing delays. The go-live date is fixed due to the end-of-support for the legacy system. What is the BEST course of action for the project manager?

Accepted Answer

Conduct a formal change impact assessment and prioritize the changes; implement only critical ones for go-live. It follows the structured change management process required in a waterfall project with a fixed deadline. By conducting a formal change impact assessment, the project manager can objectively evaluate the cost, schedule, and resource implications of the requested changes. Prioritizing only critical changes for go-live ensures that the core CRM functionality is delivered on time, while non-critical enhancements can be deferred to a post-implementation phase. This approach balances the need to meet the legacy system's end-of-support deadline with accommodating essential business requirements.

Answer

Inform the business users that no changes can be made due to the fixed deadline

Answer

Delay the go-live date to accommodate all changes and integration issues

Answer

Switch to an agile methodology for the remaining three months

Question 4

Which control failure is MOST significant?

Accepted Answer

Insufficient incident notification procedures. Insufficient incident notification procedures are the most significant control failure because they directly undermine the entire incident response lifecycle. Without defined notification procedures, even if monitoring, alerting, and response are technically sound, the right stakeholders (e.g., CISO, legal, PR, regulators) may never be informed, leading to regulatory non-compliance, reputational damage, and failure to meet breach notification laws like GDPR Article 33 or SEC cyber rules. This procedural gap creates a systemic failure that cannot be compensated by technical speed alone.

Answer

Lack of timely incident response

Answer

Delayed alerting

Answer

Inadequate monitoring

Question 5

Which THREE of the following are key components of an effective information security awareness program? (Choose three.)

Accepted Answer

Phishing simulation exercises. Phishing simulation exercises are a key component of an effective information security awareness program because they provide hands-on, practical experience in identifying and responding to real-world phishing attempts. By simulating attacks, organizations can measure employee susceptibility, reinforce training, and reduce the risk of successful social engineering attacks. This proactive approach helps build a security-conscious culture and directly addresses the human factor in cybersecurity.

Answer

Reward program for reporting incidents

Answer

Annual one-time training for all employees

Question 6

During a review of the patch management process, the IS auditor finds that critical security patches are applied within 30 days, but the policy requires application within 7 days. The IT manager argues that the delay is due to testing requirements. What should the auditor recommend?

Accepted Answer

Require risk acceptance documentation for each patch that misses the SLA. The best course is to document the risk acceptance for each delayed patch, ensuring management is aware and accepts the risk. This formalizes the deviation and maintains accountability.

Answer

Escalate to senior management immediately

Answer

Update the policy to allow 30 days for critical patches

Answer

Accept the delay as necessary for stability

Question 7

An IS auditor is evaluating the release management process for a software application. Which TWO are essential components of a successful release plan?

Accepted Answer

A testing strategy that includes unit, integration, and user acceptance testing.. A release plan should include a rollback plan (to revert if issues arise) and a testing strategy (to validate the release). Deployment automation is beneficial but not always essential; communication plan is important but secondary to technical components; post-implementation review is after the release.

Answer

Automated deployment scripts to minimize manual errors.

Answer

A post-implementation review scheduled for 30 days after release.

Answer

A communication plan to notify all stakeholders of the release schedule.

Question 8

During which phase of the SDLC should security requirements be formally documented and approved?

Accepted Answer

Requirements phase. Security requirements must be formally documented and approved during the Requirements phase of the SDLC because this is when functional and non-functional needs, including security controls, are defined before any design or coding begins. Integrating security at this stage ensures that confidentiality, integrity, and availability requirements are captured in the system specification, preventing costly rework later. The Requirements phase is the earliest point where stakeholders can review and approve security constraints, such as encryption standards or access control policies, aligning them with business objectives.

Answer

Design phase

Answer

Development phase

Answer

Testing phase

Question 9

Which TWO of the following are key controls in the system development life cycle?

Accepted Answer

Post-implementation review. A post-implementation review is a key control in the SDLC because it systematically evaluates whether the delivered system meets the defined business requirements, security objectives, and performance criteria after deployment. It identifies gaps, operational issues, and lessons learned that feed back into future development cycles, ensuring continuous improvement and compliance with governance frameworks like COBIT.

Answer

Use of agile methodology

Answer

Formal approval of business requirements

Answer

Automated deployment tools

Question 10

An organization uses a third-party cloud service for data storage. Which of the following is the BEST way to ensure data confidentiality in the event of a cloud provider breach?

Accepted Answer

Implement client-side encryption before uploading data. Client-side encryption ensures that data is encrypted before it leaves the organization's control, so the cloud provider never has access to the plaintext or the encryption keys. In the event of a provider breach, the encrypted data remains confidential because only the organization holds the keys to decrypt it. This is the only option that guarantees confidentiality regardless of the cloud provider's security posture.

Answer

Rely on the cloud provider's encryption at rest

Answer

Use TLS for data in transit

Answer

Deploy a cloud access security broker (CASB) with DLP

Question 11

A multinational corporation is implementing a bring your own device (BYOD) policy. Which of the following is the most important security control to ensure corporate data is protected on employee devices?

Accepted Answer

Implement mobile device management (MDM) with containerization.. Mobile Device Management (MDM) with containerization creates a separate, encrypted workspace on the employee's device that isolates corporate data from personal data. This ensures that the organization can enforce security policies (e.g., remote wipe, access controls) on the corporate container without affecting the user's personal information, which is critical for BYOD environments where full-device control is not feasible.

Answer

Require employees to install antivirus software.

Answer

Prohibit the use of personal devices for work.

Answer

Mandate full-device encryption.

Question 12

An organization is considering outsourcing its IT infrastructure management. Which of the following is the MOST important factor to include in the service level agreement (SLA)?

Accepted Answer

Definition of key performance indicators (KPIs) and reporting frequency.. Key performance indicators (KPIs) and reporting frequency are essential to define measurable performance standards and enable ongoing monitoring of vendor compliance. Without clear KPIs and regular reporting, the organization cannot effectively assess whether the vendor is meeting service levels. While B (list of hardware/software) is a necessary operational detail, C (staffing) and D (penalty clauses) are secondary; the SLA must first establish how performance will be measured and reported.

Answer

List of hardware and software to be managed.

Answer

Staffing levels and qualifications of vendor personnel.

Answer

Price reduction clauses for non-compliance.

Question 13

An organization is implementing a new IT governance framework. Which of the following is the PRIMARY benefit of using a framework like COBIT?

Accepted Answer

Aligning IT strategy with business goals.. COBIT is designed to bridge the gap between business objectives and IT operations by providing a framework that maps IT processes to business goals. The primary benefit is ensuring that IT strategy directly supports and enables business strategy, rather than focusing on cost reduction or risk elimination.

Answer

Reducing IT operational costs.

Answer

Eliminating all IT-related risks.

Answer

Ensuring compliance with all regulatory requirements.

Question 14

Which of the following audit types is MOST likely to be performed by an organization's own employees?

Accepted Answer

Internal audit. Internal audits are conducted by employees of the organization, providing deep knowledge but raising independence concerns.

Answer

External audit

Answer

IS audit

Answer

Compliance audit

Question 15

A bank is converting data from its legacy core banking system to a new platform. Which control is MOST critical to ensure the completeness and accuracy of data conversion?

Accepted Answer

Reconciliation of converted data totals to source system totals. Reconciliation of converted data totals to source system totals is the most critical control because it directly verifies that every record from the legacy system has been accurately migrated without loss or duplication. This control compares aggregate values (e.g., account balances, transaction counts) between the source and target databases, providing a definitive check for completeness and accuracy that other controls cannot guarantee.

Answer

Parallel running of both systems

Answer

Data validation rules programmed in the conversion tool

Answer

User acceptance testing of the new system