CISA Practice Test 15 — 15 Questions

Question 1

An organization is adopting agile development methodology. Which control is MOST critical to ensure security is integrated?

Accepted Answer

Including security stories in the product backlog. In agile development, security must be continuously integrated into each iteration. Including security stories in the product backlog ensures that security tasks are prioritized, estimated, and addressed during each sprint, making security an inherent part of the development lifecycle rather than an afterthought. This aligns with the principle of 'shifting left' on security, where controls are applied as early as possible.

Answer

Penetration testing before release

Answer

Code reviews after each sprint

Answer

Security requirements defined at project initiation

Question 2

Which of the following is an example of a compliance audit?

Accepted Answer

Evaluating whether IT controls meet SOX requirements. A compliance audit specifically evaluates whether an organization adheres to external laws, regulations, or standards. Option A is correct because SOX (Sarbanes-Oxley Act) is a mandatory regulatory requirement, and auditing IT controls for SOX compliance directly assesses conformity with those legal obligations. This is the essence of a compliance audit—verifying adherence to prescribed rules rather than evaluating performance or efficiency.

Answer

Assessing the performance of a new system

Answer

Reviewing the efficiency of a production line

Answer

Analyzing financial statement ratios

Question 3

An organization's backup strategy includes daily incremental backups and weekly full backups. During a disaster recovery test, the restoration of a critical server fails because a required incremental backup is corrupt. Which control should the organization implement to verify the integrity of backups?

Accepted Answer

Perform periodic restore verification tests. Periodic restore verification tests are the only control that actually validates that backup data is readable, complete, and restorable—directly detecting corruption like the failed incremental backup. Backup integrity cannot be assumed; it must be proven by performing test restores. This control aligns with the principle that a backup is only as good as its last successful restore.

Answer

Implement backup encryption

Answer

Use a different backup software

Answer

Increase the frequency of full backups

Question 4

Which of the following is the BEST control to ensure that system changes are authorized?

Accepted Answer

Change advisory board approval. The change advisory board (CAB) is the primary control for authorizing system changes because it provides a formal, documented approval process before any change is implemented. This ensures that changes are reviewed by stakeholders with appropriate authority, reducing the risk of unauthorized or poorly planned modifications. Without CAB approval, there is no definitive authorization step, making it the best control for ensuring authorization.

Answer

Audit trail of all changes

Answer

Segregation of duties between developers and operators

Answer

Version control system

Question 5

A financial services company is migrating its core banking system to a public cloud to improve scalability and reduce costs. The project is high-risk due to regulatory compliance requirements (e.g., data residency, audit trails). The IT governance committee has reviewed the project plan and finds that the risk assessment is incomplete – it does not address the potential impact of a cloud provider outage on critical transactions. The committee must approve the project or request changes. The project manager argues that the cloud provider's SLA guarantees 99.99% uptime and that additional controls would delay the project. What should the governance committee do?

Accepted Answer

Request a revised risk assessment that includes contingency plans for provider outages.. The governance committee's role is to ensure that risks are identified, assessed, and mitigated before approving a high-risk project. An incomplete risk assessment that ignores the impact of a cloud provider outage on critical banking transactions is a material gap. Requesting a revised risk assessment with contingency plans directly addresses this gap while allowing the project to proceed responsibly. This aligns with CISA's emphasis on risk-based decision-making and IT governance.

Answer

Reject the project and require the system to remain on-premises.

Answer

Approve the project based on the provider's strong SLA.

Answer

Approve a pilot migration for non-critical systems first.

Question 6

Based on the exhibit, which control is most likely missing to prevent this type of event?

Accepted Answer

Implementing account lockout after three failed attempts. The exhibit describes a brute-force attack against an SSH service, where an attacker repeatedly attempts to guess credentials. Implementing account lockout after three failed attempts is the most direct control to prevent this type of event, as it halts further login attempts after a threshold, stopping the attack in its tracks regardless of password strength or patching.

Answer

Applying the latest security patches to the SSH service

Answer

Disabling direct root login via SSH

Answer

Enforcing strong password complexity

Question 7

Based on the exhibit, what is the MOST likely security risk?

Accepted Answer

Unrestricted traffic is allowed after the specific deny. The 'permit ip any any' at the end allows all traffic, bypassing earlier specific denials. Option A is not correct because the deny line only blocks other traffic, but the permit any any overrides it. Option B is not directly indicated. Option D is a risk but less direct than the rule order issue.

Answer

The web server is fully protected

Answer

Traffic to port 80 is not encrypted

Answer

The host 192.168.1.100 is exposed to denial-of-service attacks

Question 8

During a change management audit, which TWO of the following are essential elements of a normal change request? (Select two.)

Accepted Answer

Justification for the change. Option B (Justification for the change) is correct because a normal change request must document the business or technical reason for the change so the Change Advisory Board (CAB) can assess whether the change is warranted and aligned with organizational objectives. Option D (Impact analysis) is correct because it identifies the potential effects of the change on services, configuration items, users, and risk levels, which is essential for the CAB to evaluate risk and approve, defer, or reject the change. Option A is not essential because the specific developer's name is an implementation detail typically captured in the change schedule or task assignment, not a required element of the change request itself. Option C is not essential because approval authority for normal changes rests with the Change Advisory Board or designated change manager, not necessarily the project manager. Option E is not essential because listing every affected user is impractical and unnecessary; impact analysis addresses affected user groups and services at an appropriate level of detail.

Answer

The name of the developer who will implement the change

Answer

The project manager's approval

Answer

A list of all users affected

Question 9

A company uses role-based access control (RBAC). An employee moves from one department to another but retains some previous access due to overlapping role permissions. This condition is known as:

Accepted Answer

Privilege creep. Privilege creep occurs when an employee accumulates access rights over time, often due to role changes or lateral moves, without corresponding removal of previous permissions. In RBAC, overlapping role permissions can cause this condition when old role memberships are not revoked, leading to excessive entitlements that violate the principle of least privilege.

Answer

Access aggregation

Answer

Segregation of duties conflict

Answer

Entitlement explosion

Question 10

A hospital is implementing a new electronic health record (EHR) system. The project team includes clinicians and IT staff. During integration testing, the system fails to exchange lab results with the existing legacy system due to format mismatches. The IT team suggests developing a custom interface. The clinical team is concerned that any custom solution may not comply with health data privacy regulations. The project sponsor pressures the team to quickly fix the issue to avoid delays. The IS auditor is reviewing this situation. What is the MOST appropriate action for the auditor to recommend?

Accepted Answer

Conduct a privacy impact assessment on the custom interface and ensure controls are in place before deployment.. The custom interface introduces a new data exchange path between the EHR and legacy system. Without a privacy impact assessment (PIA), the auditor cannot verify that the interface will enforce encryption, access controls, and audit logging required by HIPAA or similar regulations. A PIA identifies risks like unauthorized disclosure of protected health information (PHI) during format translation, ensuring controls are implemented before deployment. This aligns with the IS auditor's role to safeguard data privacy, not just meet deadlines.

Answer

Proceed with the custom interface to meet the project deadline.

Answer

Reject the custom interface and delay the project until a standard solution is found.

Answer

Replace the legacy system with a new one that is compatible.

Question 11

Which TWO of the following are essential components of a business case for a new system?

Accepted Answer

Alignment with business strategy.. Option C (Alignment with business strategy) is correct because a business case must demonstrate that the proposed system directly supports the organization's strategic goals and objectives, justifying why the investment is worthwhile from a business perspective. Option E (Cost-benefit analysis) is correct because a business case must quantify and compare the expected costs against the anticipated benefits (financial and non-financial) to show the investment delivers value and to support go/no-go decision-making. Option A (Implementation schedule) is not essential to the business case itself; scheduling belongs to the project plan and is derived after approval. Option B (Detailed system architecture) is a technical design artifact, not a business justification component. Option D (Risk assessment for all identified risks) is too absolute and belongs to risk management planning; while some risk consideration may appear in a business case, assessing every identified risk is not an essential component.

Answer

Implementation schedule.

Answer

Detailed system architecture.

Answer

Risk assessment for all identified risks.

Question 12

A company's security policy requires that all laptops have full-disk encryption. During an audit, 10% of laptops are found without encryption. Which of the following is the MOST effective corrective action?

Accepted Answer

Deploy centralized endpoint management to enforce encryption. Centralized endpoint management (e.g., Microsoft Intune, SCCM, or a third-party MDM) allows administrators to enforce full-disk encryption (such as BitLocker or FileVault) via policy, automatically encrypting non-compliant laptops and preventing users from disabling encryption. This is the most effective corrective action because it addresses the root cause—lack of enforcement—rather than relying on user action or manual processes.

Answer

Require users to manually enable encryption

Answer

Distribute encryption keys to users

Answer

Conduct security awareness training on encryption

Question 13

Which TWO of the following are primary objectives of a data loss prevention (DLP) strategy?

Accepted Answer

Identify and classify sensitive data. Option B is correct because a core objective of any DLP strategy is to discover, identify, and classify sensitive data (e.g., PII, PHI, PCI, intellectual property) so that policies can be applied based on data sensitivity and regulatory category. Option D is correct because DLP's defining function is to monitor and control data movement across endpoints, networks, and cloud channels — inspecting content in use, in motion, and at rest and enforcing actions such as block, quarantine, encrypt, or alert when policy violations occur. Option A is not a primary DLP objective; encryption in transit is typically handled by TLS/IPsec and is a separate control, though DLP may trigger encryption as an enforcement action. Option C is incorrect because DLP augments, rather than replaces, existing security controls like firewalls, IAM, and endpoint protection. Option E is too broad — DLP supports compliance with specific data-handling regulations but does not by itself ensure compliance with all regulations.

Answer

Encrypt all data in transit

Answer

Replace all existing security controls

Answer

Ensure compliance with all regulations

Question 14

During a business impact analysis (BIA), the auditor identifies a critical process with a maximum tolerable downtime (MTD) of 4 hours. The IT department proposes a recovery time objective (RTO) of 2 hours and a recovery point objective (RPO) of 1 hour. Which statement is correct?

Accepted Answer

The RTO is acceptable as it is less than the MTD. The RTO must be less than or equal to the MTD. Here, RTO (2 hours) is less than MTD (4 hours), so the recovery target is acceptable.

Answer

The MTD should be reduced to match the RTO

Answer

The RPO is too high because it exceeds the MTD

Answer

The RTO should be equal to the MTD

Question 15

Which of the following is the PRIMARY purpose of performing a walkthrough during the audit planning phase?

Accepted Answer

To gain an understanding of the process and identify control points. A walkthrough is performed during audit planning to trace a transaction or process from start to finish, allowing the auditor to understand how the process actually operates and to pinpoint where controls exist. This understanding is the foundation for scoping the audit, designing test procedures, and identifying risks. It is not a test of control effectiveness — that comes later during fieldwork.

Answer

To test the operating effectiveness of controls

Answer

To collect evidence of control failures

Answer

To identify process owners and key personnel