CISA Practice Test 16 — 15 Questions

Question 1

Which of the following is the PRIMARY purpose of a business impact analysis (BIA) in business continuity planning?

Accepted Answer

To determine the criticality of business processes and their recovery requirements. The primary purpose of a BIA is to identify and prioritize business processes based on their criticality to the organization and to determine the recovery time objectives (RTOs) and recovery point objectives (RPOs) for each. This analysis forms the foundation for the business continuity plan by establishing what must be recovered and how quickly, before any recovery strategies or resource requirements are defined.

Answer

To create a list of emergency contacts

Answer

To identify the resources required for recovery

Answer

To document the technical recovery procedures

Question 2

During an agile software development project, which of the following events provides the best opportunity for the IS auditor to assess the effectiveness of controls implemented in the current sprint?

Accepted Answer

Sprint review. The sprint review is where the team demonstrates the completed increment to stakeholders, making it the best venue for the auditor to observe working software and evaluate whether controls built into the sprint were actually implemented and effective. It provides tangible evidence of the increment, unlike planning or standup meetings which discuss future or in-progress work.

Answer

Sprint planning meeting

Answer

Daily standup meeting

Answer

Sprint retrospective

Question 3

An organization is migrating sensitive customer data to a public cloud. Which of the following encryption strategies provides the STRONGEST protection against data exposure to the cloud provider?

Accepted Answer

Implement client-side encryption with keys managed on-premises. Client-side encryption with keys managed on-premises ensures that the cloud provider never has access to the encryption keys or the plaintext data. Even if the cloud provider's infrastructure is compromised or they have administrative access, the data remains encrypted and unreadable. This provides the strongest protection because the cloud provider is excluded from the cryptographic trust boundary.

Answer

Use transport layer security (TLS) for data in transit

Answer

Encrypt data at rest using server-side encryption with AES-256

Answer

Enable the cloud provider's key management service

Question 4

An organization's IT strategy is not aligned with business strategy due to lack of communication. Which of the following would BEST improve alignment?

Accepted Answer

Business-IT strategy mapping workshops. Business-IT strategy mapping workshops bring business and IT stakeholders together to explicitly map IT initiatives to business goals, which directly addresses the lack of communication and misalignment. This collaborative exercise creates shared understanding and a documented linkage between IT investments and business outcomes, which is the most effective way to improve alignment. It is a governance and communication mechanism, not just a reporting or budgeting action.

Answer

Weekly IT status reports

Answer

Outsourcing non-core IT functions

Answer

IT budget increase

Question 5

An organization has implemented a key management program. Which of the following is the MOST critical control for ensuring the security of cryptographic keys?

Accepted Answer

Secure key storage (e.g., HSM). Secure key storage, typically in a hardware security module (HSM), is the most critical control because it protects keys at rest from extraction, tampering, and unauthorized access throughout their lifecycle. If keys can be stolen from storage, every other control — generation, rotation, destruction — is undermined, since the attacker gains the key material itself. HSMs provide tamper resistance, cryptographic isolation, and access controls that software storage cannot match.

Answer

Key rotation policy

Answer

Key generation in a secure environment

Answer

Key destruction procedures

Question 6

An organization is developing a web application using an Agile methodology. The security team wants to integrate security testing early in the development lifecycle. Which of the following is the BEST approach to achieve this?

Accepted Answer

Implement static application security testing (SAST) in the continuous integration pipeline. Integrating SAST into the CI pipeline allows automated scanning of source code for vulnerabilities (e.g., SQL injection, XSS) as code is committed, aligning with Agile's iterative development. This shift-left approach catches flaws early, reducing remediation cost and effort compared to later stages.

Answer

Conduct a penetration test after each sprint

Answer

Schedule an annual vulnerability scan of the production environment

Answer

Perform dynamic application security testing (DAST) on deployed builds

Question 7

An organization uses a risk-based audit approach. For a high-risk area, the auditor decides to perform 100% testing instead of sampling. Which of the following is a valid reason for this decision?

Accepted Answer

The population size is small and errors are critical. When a high-risk area is identified and the population size is small, 100% testing is justified because the cost of missing a critical error outweighs the cost of testing every item. This approach eliminates sampling risk entirely, ensuring that all errors are detected. In audit, 100% testing is appropriate when the population is small enough to make full examination feasible and the consequences of error are severe.

Answer

The auditor has limited time

Answer

The tolerable error rate is high

Answer

The control is automated and always effective

Question 8

A security architect is designing a data classification schema for a multinational corporation. Which combination of factors is MOST critical for determining the classification level of a data asset?

Accepted Answer

Legal, regulatory, and business impact if disclosed.. The classification level of a data asset is primarily determined by the potential harm that could result from its unauthorized disclosure, modification, or loss. Legal, regulatory, and business impact factors—such as compliance with GDPR, HIPAA, or PCI DSS—directly dictate the required confidentiality, integrity, and availability controls. Without assessing these impacts, any classification scheme would be arbitrary and fail to align with organizational risk tolerance.

Answer

Data volume and storage location.

Answer

Data format and encryption status.

Answer

Data creation date and last access time.

Question 9

Which TWO of the following are types of statistical sampling methods? (Select TWO.)

Accepted Answer

Stratified sampling. Stratified sampling (B) is a statistical sampling method in which the population is divided into homogeneous subgroups (strata) and random samples are drawn from each stratum, ensuring representation across defined characteristics. Systematic sampling (C) is also statistical: it selects every nth item from a population after a random starting point, applying a measurable, probability-based selection interval. Both are probability-based techniques because each item has a known, non-zero chance of selection, which supports statistical inference. By contrast, block sampling (A) is a non-statistical approach that selects contiguous groups or clusters of items, haphazard sampling (D) relies on convenience with no defined selection probability, and judgmental sampling (E) depends on the auditor's subjective judgment, so none of these are statistical sampling methods.

Answer

Block sampling

Answer

Haphazard sampling

Answer

Judgmental sampling

Question 10

During a recent audit, the IT auditor found that the problem management process does not include a known error database (KEDB). Which of the following is the MOST significant risk associated with this finding?

Accepted Answer

Increased time to resolve incidents. Without a known error database (KEDB), incident resolution relies on ad-hoc troubleshooting rather than leveraging documented root causes and workarounds. This directly increases the mean time to resolve (MTTR) incidents because support teams cannot quickly identify and apply previously identified fixes, leading to longer outages and reduced operational efficiency.

Answer

Higher likelihood of unauthorized changes

Answer

Increased backup failure rates

Answer

Inaccurate SLA reporting

Question 11

An organization is evaluating its business continuity plan (BCP) for a critical application with a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour. The current backup strategy involves daily full backups and hourly transaction log backups. Which of the following is the MOST significant risk?

Accepted Answer

The backup media is stored in the same building as the primary system. Storing backup media in the same building as the primary system means a single physical disaster (fire, flood, building loss) can destroy both the production system and its backups, making recovery impossible regardless of RTO/RPO design. This is the most significant risk because it defeats the purpose of the BCP entirely. The other issues are operational weaknesses but do not eliminate the ability to recover.

Answer

The recovery process requires manual intervention to apply logs

Answer

The backups are not tested regularly

Answer

The hourly logs cover only the last 24 hours

Question 12

Which THREE of the following are characteristics of SMART recommendations in an audit report? (Select three.)

Accepted Answer

Measurable. Option A (Measurable) is correct because SMART recommendations must include quantifiable criteria or metrics so that auditors and management can objectively verify whether the recommendation has been implemented and its effect assessed. Option C (Specific) is correct because a SMART recommendation must clearly state the exact action, system, process, or control to be addressed, leaving no ambiguity about what is required. Option E (Time-bound) is correct because SMART recommendations must specify a deadline or target timeframe by which the action should be completed, enabling follow-up and accountability. Option B (Vague) is incorrect because vagueness directly contradicts the Specific and Measurable criteria of SMART, making recommendations unverifiable. Option D (Rigid) is incorrect because SMART recommendations should be achievable and adaptable to the organization's context, not inflexible; rigidity is not one of the SMART attributes (Specific, Measurable, Achievable, Relevant, Time-bound).

Answer

Vague

Answer

Rigid

Question 13

In the context of ITIL change management, which change type requires approval from the Change Advisory Board (CAB)?

Accepted Answer

Normal change. In ITIL change management, a 'Normal change' is any change that is not a standard (pre-approved) change and is not urgent enough to be an emergency change. Normal changes must be assessed, evaluated, and authorized by the Change Advisory Board (CAB) before implementation. The CAB reviews the change's risk, impact, and resource requirements to decide whether to approve, reject, or defer it.

Answer

Emergency change

Answer

Minor change

Answer

Standard change

Question 14

An organization has a disaster recovery plan that includes a hot site. During a full interruption test, the recovery team discovers that the hot site's network configuration is incompatible with the production environment. What is the most likely root cause?

Accepted Answer

The DR plan was not updated to reflect production changes.. The incompatibility suggests that the hot site was not properly configured to mirror production, possibly due to lack of change synchronization or testing.

Answer

The backup data was not encrypted.

Answer

The test was not conducted during business hours.

Answer

The hot site is too far from the primary site.

Question 15

Which TWO of the following are typically included in the fieldwork phase of an IS audit? (Select two.)

Accepted Answer

Testing controls. Option B (Testing controls) is correct because the fieldwork phase is where the auditor executes the audit program by gathering evidence and evaluating whether controls are designed and operating effectively, which is the core of substantive and compliance testing. Option E (Performing walkthroughs) is correct because walkthroughs are an evidence-gathering technique performed during fieldwork to trace transactions or processes through the system and confirm the auditor's understanding of controls in operation. Option A (Defining audit scope) is incorrect because scope definition occurs during the planning phase, before fieldwork begins. Option C (Developing the audit program) is incorrect because the audit program is designed in the planning phase to guide the subsequent fieldwork. Option D (Issuing the draft report) is incorrect because reporting occurs after fieldwork is completed, during the reporting phase.

Answer

Defining audit scope

Answer

Developing the audit program

Answer

Issuing the draft report