CISA Practice Test 14 — 15 Questions

Question 1

An IS auditor is reviewing a system development project to assess whether it is on schedule. Which of the following would provide the BEST evidence of project progress against the planned timeline?

Accepted Answer

Updated project schedule with actual completion dates for milestones. The updated project schedule with actual completion dates for milestones (Option D) provides direct, objective evidence of progress against the planned timeline. It shows the baseline plan, the actual dates work was completed, and the variance, allowing the IS auditor to quantitatively assess schedule adherence. This is the primary artifact for schedule tracking in system development projects.

Answer

Minutes from status review meetings

Answer

Approved requirements document

Answer

Successful unit test results

Question 2

An organization is negotiating a contract with a cloud service provider. Which clause is most important for the IS auditor to ensure is included?

Accepted Answer

Right-to-audit clause.. A right-to-audit clause allows the organization to verify the provider's controls and compliance, which is critical for third-party risk management.

Answer

Data localization requirements.

Answer

Automatic renewal terms.

Answer

Service level agreement (SLA) with penalties.

Question 3

Refer to the exhibit. An auditor notices this log entry during a review. The user john.doe does not have a legitimate business need to access executive salaries. Which of the following is the MOST likely control failure?

Accepted Answer

Inadequate access controls or role-based permissions. The log entry shows user john.doe successfully accessed executive salary data via a SELECT query. Since the user has no legitimate business need for this data, the most likely control failure is inadequate access controls or role-based permissions (RBAC). Proper RBAC would restrict access to sensitive columns or tables based on job function, preventing unauthorized queries regardless of other controls.

Answer

Database firewall misconfiguration

Answer

Audit logging is not enabled

Answer

Lack of encryption at rest

Question 4

A company's IT governance policy requires that all critical systems have a documented business continuity plan (BCP). During an audit, an IT auditor finds that the BCP for a critical financial system has not been updated in three years. Which of the following is the BEST recommendation?

Accepted Answer

Update the BCP to reflect current processes and conduct a test.. IT governance policies require that BCPs remain current to reflect actual operational processes. An outdated BCP (three years stale) may contain obsolete recovery procedures, contact information, or dependencies, rendering it ineffective during a real incident. Updating the BCP and then testing it validates that the documented steps align with the current system architecture and can be executed successfully, which is a core requirement of the BCP lifecycle per ISACA guidelines.

Answer

Archive the outdated BCP and develop a new one from scratch.

Answer

Accept the risk because the system has been stable.

Answer

Implement a new system with built-in redundancy.

Question 5

Which TWO of the following are key components of an IT governance framework?

Accepted Answer

IT strategy committee. Options A and C are correct. An IT governance framework includes structures like an IT strategy committee (A) and processes like IT risk management (C). B (IT asset inventory) is an operational practice, D (IT project portfolio management) is a management practice, and E (IT help desk ticketing system) is operational. None of these are core governance components.

Answer

IT asset inventory

Answer

IT project portfolio management

Answer

IT help desk ticketing system

Question 6

A healthcare organization is required to comply with HIPAA regulations for protecting electronic protected health information (ePHI). The organization uses a cloud-based electronic health record (EHR) system. During a compliance audit, it is discovered that some employees are accessing patient records without a legitimate business need. The EHR system logs all access, but there is no automated process to review logs or detect anomalous behavior. The organization has implemented role-based access control (RBAC) and requires strong passwords, but unauthorized access continues. The IT manager proposes implementing a security information and event management (SIEM) system to collect and correlate logs. However, the budget is limited. Which additional control would be most cost-effective to reduce unauthorized access to patient records?

Accepted Answer

Implementing user behavior analytics (UBA) on the EHR access logs. User behavior analytics (UBA) is the most cost-effective control because it directly addresses the core issue: unauthorized access by insiders. UBA applies machine learning to EHR access logs to establish baselines of normal user behavior and detect anomalous patterns (e.g., accessing records outside work hours or from unusual locations) without requiring manual log review. This provides automated, real-time detection of the specific unauthorized access incidents that are occurring, which the current logging system alone cannot provide.

Answer

Conducting a quarterly review of user access rights and removing unnecessary privileges

Answer

Encrypting all ePHI at rest and in transit

Answer

Increasing the logging level to capture every keystroke

Question 7

During a change management process review, an IS auditor finds that the change advisory board (CAB) approved a change that subsequently caused a major service outage. The change was classified as 'normal' with no emergency. What is the auditor's primary concern?

Accepted Answer

The CAB did not adequately assess the potential impact of the change.. The primary concern is that the CAB approved a 'normal' change without adequately assessing its potential impact, leading to a major service outage. In ITIL-based change management, the CAB is responsible for evaluating the risk, impact, and resource requirements of a change before approval. A failure in this assessment indicates a breakdown in the change management process, which is the core issue an IS auditor must address.

Answer

The service desk was not notified of the change.

Answer

The change should have been classified as emergency.

Answer

The change was not tested in a pre-production environment.

Question 8

Which TWO of the following are components of an IT balanced scorecard? (Select TWO)

Accepted Answer

Customer perspective. The IT balanced scorecard typically includes four perspectives: financial, customer, internal process, and learning & growth. Financial and customer are two of these. Security and vendor management are not standard perspectives.

Answer

Competitor perspective

Answer

Security perspective

Answer

Vendor perspective

Question 9

In a RACI matrix for an IT change management process, who is responsible for performing the change?

Accepted Answer

The system administrator. The 'R' in RACI stands for Responsible, which is the person who does the work.

Answer

The business process owner

Answer

The IT director

Answer

The change manager

Question 10

An IS auditor is evaluating the effectiveness of a control. The auditor observes the control being performed and then independently performs the same control to confirm the result. Which combination of evidence types is being used?

Accepted Answer

Observation and re-performance. Observation (watching) and re-performance (doing) are both used to test control effectiveness.

Answer

Inquiry and inspection

Answer

Inspection and observation

Answer

Analytical procedures and inquiry

Question 11

According to ISACA IT Audit Standards, which phase of the audit process includes the development of an audit programme?

Accepted Answer

Planning. The planning phase includes defining scope, risk assessment, and developing the audit programme.

Answer

Reporting

Answer

Fieldwork

Answer

Follow-up

Question 12

A compliance audit is primarily concerned with:

Accepted Answer

Determining whether the organization is following applicable laws and regulations. Compliance audits specifically assess adherence to laws, regulations, and policies. Efficiency and effectiveness are the focus of operational audits.

Answer

Evaluating the effectiveness of internal controls

Answer

Assessing the efficiency of IT operations

Answer

Ensuring the organization is meeting its strategic objectives

Question 13

An IS auditor is performing a compliance audit of a company's data privacy practices. Which type of evidence would be most appropriate to verify that employees have completed mandatory privacy training?

Accepted Answer

Inspection of training completion records. Inspection of training records provides documentary evidence of completion, which is more reliable than inquiry or observation for verifying compliance.

Answer

Observation of a training session

Answer

Inquiry with the HR manager

Answer

Analytical procedures comparing training completion rates

Question 14

An IS auditor is assessing the risk of fraud in a financial system. Which combination of audit risk components is most directly relevant?

Accepted Answer

Inherent risk, control risk, and detection risk. Audit risk = inherent risk × control risk × detection risk; all three combine to determine overall risk.

Answer

Control risk and detection risk only

Answer

Inherent risk and detection risk only

Answer

Inherent risk and control risk only

Question 15

According to ISACA IT Audit Standards, which of the following is a key requirement for audit documentation?

Accepted Answer

Documentation must support the audit findings and conclusions.. Audit documentation must be sufficient to enable an experienced auditor, with no prior connection to the audit, to understand the work performed and conclusions reached.

Answer

Documentation must be retained for at least 10 years.

Answer

Documentation must be reviewed by the audit committee.

Answer

Documentation must be prepared in the local language of the auditee.