CISA Practice Test 17 — 15 Questions

Question 1

Which THREE of the following are key components of an effective information security awareness program? (Choose three.)

Accepted Answer

Phishing simulation exercises. Phishing simulation exercises are a key component of an effective information security awareness program because they provide hands-on, practical experience in identifying and responding to real-world phishing attempts. By simulating attacks, organizations can measure employee susceptibility, reinforce training, and reduce the risk of successful social engineering attacks. This proactive approach helps build a security-conscious culture and directly addresses the human factor in cybersecurity.

Answer

Reward program for reporting incidents

Answer

Annual one-time training for all employees

Question 2

An IT steering committee is reviewing a proposed project to implement a new customer relationship management (CRM) system. The project has strong support from the sales department but is opposed by the finance department due to cost concerns. What is the primary role of the IT steering committee in this situation?

Accepted Answer

Evaluate the project's alignment with strategic goals and make a decision. The IT steering committee ensures that IT investments align with business strategy and provide value, balancing stakeholder needs.

Answer

Approve the project because sales is a revenue-generating department

Answer

Delegate the decision to the IT manager

Answer

Reject the project due to finance department opposition

Question 3

An organization is adopting a DevOps approach for system development. Which THREE controls should an IS auditor expect to see in place to maintain security and compliance?

Accepted Answer

Automated security scanning integrated into the CI/CD pipeline. Option B is correct because automated security scanning (e.g., SAST, DAST, or SCA tools) integrated into the CI/CD pipeline provides continuous, shift-left detection of vulnerabilities before code reaches production, which is essential for maintaining security in a fast-paced DevOps environment. Option C is correct because version control and change tracking for infrastructure as code (e.g., Git repositories with commit history and pull-request approvals) ensure that infrastructure modifications are auditable, traceable, and reversible, directly supporting compliance and change-management requirements. Option E is correct because real-time monitoring and logging of production systems (e.g., via SIEM, centralized log aggregation, and alerting) enable timely detection of security incidents and provide the evidence trail needed for compliance and forensic review. Option A does not belong because annual penetration testing only after release is periodic and post-deployment, which is too infrequent and too late for a DevOps model that requires continuous assurance. Option D does not belong because mandating manual code review for every change creates a bottleneck that undermines DevOps velocity and is not a scalable control; automated reviews and peer approvals within the pipeline are more appropriate.

Answer

Annual penetration testing after the release

Answer

Manual code review for every change before deployment

Question 4

A financial services company is developing a new customer-facing web application for account management. The project is using a waterfall methodology. The initial requirements were gathered six months ago, and the coding phase is nearly complete. The business sponsor now requests a new feature that allows customers to view transaction receipts online. The project manager is concerned that this change will delay the project by two months and exceed the budget. The sponsor insists that the feature is critical for customer satisfaction and that the project must adapt. The development team estimates it will take 200 hours to implement. The steering committee is divided. As an IS auditor, what would be the BEST recommendation to resolve this?

Accepted Answer

Formally submit a change request, assess the impact on cost and schedule, and obtain approval from the change control board before proceeding.. In a waterfall methodology, changes after the coding phase require a formal change control process to assess impact on cost, schedule, and scope. The correct answer is A because submitting a change request to the change control board (CCB) ensures that the 200-hour effort, two-month delay, and budget overrun are evaluated against business priorities, maintaining project governance and auditability. This aligns with ISACA’s guidance on managing scope creep in systems development.

Answer

Terminate the current project and launch a new project incorporating the new feature.

Answer

Advise the sponsor to postpone the feature until the next release and continue as planned.

Answer

Instruct the development team to implement the feature immediately to satisfy the sponsor.

Question 5

Refer to the exhibit. An auditor finds that the file 'sensitive.txt' has world-writable permissions. Which of the following is the most appropriate remediation action?

Accepted Answer

Remove world-writable permissions using chmod 644.. The file 'sensitive.txt' has world-writable permissions, meaning any user on the system can modify or delete it. The most direct and appropriate remediation is to remove the world-writable permission using `chmod 644`, which sets the file to owner read-write, group read, and others read. This eliminates the security risk while preserving necessary access for the owner and group.

Answer

Encrypt the file using GnuPG to protect its contents.

Answer

Apply an ACL to restrict access only to specific users.

Answer

Change the file owner to a different user using chown.

Question 6

During a disaster recovery planning audit, the IS auditor notes that the organization's plan includes a hot standby site. However, the plan has not been updated in two years, and the last test was a tabletop exercise 18 months ago. The organization has recently implemented a new ERP system. Which THREE findings should the auditor report as most significant?

Accepted Answer

The DR plan has not been tested in over a year.. Option A is correct because the plan's last test was a tabletop exercise 18 months ago, exceeding the commonly expected annual DR testing cadence; tabletop exercises alone also do not validate technical recovery of systems, so the lack of recent, more substantive testing is a significant finding. Option B is correct because the plan has not been updated in two years, meaning it likely no longer reflects the current infrastructure, dependencies, and recovery procedures, which undermines its reliability during an actual disaster. Option E is correct because the recently implemented ERP system is a critical business application whose recovery time objective (RTO) and recovery point objective (RPO), backup integration, and dependencies must be documented in the DR plan; failing to update the plan for it creates a major gap in recoverability. Option C is not marked correct because distance between sites is a design consideration that depends on the organization's risk assessment and is not inherently a deficiency. Option D is not marked correct because the scenario provides no evidence about management review or approval status, so it cannot be reported as a finding.

Answer

The hot standby site is located too far from the primary site.

Answer

The DR plan has not been reviewed and approved by senior management in the last year.

Question 7

An IS auditor is evaluating an organization's SDLC controls for a new system. Which TWO of the following are key controls that should be in place during the design phase? (Select TWO.)

Accepted Answer

Architecture review by a senior architect. Option A (Architecture review by a senior architect) is correct because the design phase is exactly when the proposed system architecture, integration points, and technology choices must be validated against enterprise standards, scalability, and security requirements before costly build work begins. Option E (Threat modeling to identify security threats) is correct because threat modeling is a design-phase activity that systematically identifies threats, attack surfaces, and required mitigations (e.g., using STRIDE or DREAD) so that security controls are built into the design rather than retrofitted. Option B (SAST) is not a design-phase control; static application security testing analyzes source code or binaries during coding/build, so it belongs to development and testing phases. Option C (UAT) is a testing-phase control performed by end users to confirm the system meets business requirements before go-live. Option D (Regression testing) is also a testing-phase control executed after changes to verify that existing functionality has not been broken.

Answer

Static application security testing (SAST)

Answer

User acceptance testing (UAT)

Answer

Regression testing

Question 8

During an audit of the information security program, the IS auditor reviews the organization's information security policy. Which of the following is the PRIMARY purpose of an information security policy?

Accepted Answer

To communicate management's commitment and direction for information security. The primary purpose of an information security policy is to communicate management's commitment, intent, and direction for information security across the organization. It is a high-level governance document that establishes the mandate from which standards, procedures, and guidelines flow. It is not intended to be technically prescriptive or operational.

Answer

To provide detailed step-by-step instructions for implementing security controls

Answer

To specify the technical configurations for security devices

Answer

To define the roles and responsibilities for information security

Question 9

During a disaster recovery test, the team discovers that the backup server is unable to restore data because of incompatible software versions. Which TWO controls should have been implemented to prevent this?

Accepted Answer

Maintaining a configuration management database. Option A (Maintaining a configuration management database) is correct because a CMDB records the versions and configurations of backup software and dependent components, so version incompatibilities between the backup server and restore targets can be identified and reconciled before a disaster recovery test. Option E (Performing regular patch management) is correct because keeping backup software and related systems patched and at compatible version levels directly prevents the version mismatch that blocked restoration. Option B (Using cloud-based backup solutions) does not inherently prevent software version incompatibility, since cloud backups still require compatible client/agent and restore software. Option C (Implementing intrusion detection systems) addresses security monitoring, not version compatibility. Option D (Increasing the frequency of full backups) improves recovery point objectives but does nothing to resolve incompatible software versions.

Answer

Using cloud-based backup solutions

Answer

Implementing intrusion detection systems

Answer

Increasing the frequency of full backups

Question 10

An IS auditor is reviewing the logical access controls of a financial application. Which of the following is the BEST way to verify that user access rights are appropriate?

Accepted Answer

Compare the user access rights with the job descriptions and responsibilities.. Comparing user access rights directly against job descriptions and responsibilities is the most effective method to verify that access is appropriate based on the principle of least privilege. This approach ensures that each user's permissions align with their actual job functions, which is the core objective of a logical access control review. Interviewing or reviewing lists alone does not validate the appropriateness of access against business roles.

Answer

Interview the IT security manager about the access control process.

Answer

Review the access control list for each user.

Answer

Re-perform a sample of transactions to detect unauthorized access.

Question 11

Which TWO of the following are key activities in the system design phase of the SDLC?

Accepted Answer

Defining system architecture. Defining system architecture is a key activity in the system design phase because it establishes the high-level structure of the system, including hardware, software, network components, and their interactions. This blueprint guides subsequent detailed design and implementation, ensuring alignment with functional and non-functional requirements. Without a defined architecture, the system risks integration failures and scalability issues.

Answer

Writing unit tests

Answer

Performing user acceptance testing

Answer

Gathering business requirements

Question 12

An IT auditor is reviewing the business continuity plan (BCP) for a financial services firm. The plan includes a hot site that is shared with another organization under a reciprocal agreement. Which of the following findings should be of MOST concern to the auditor?

Accepted Answer

The reciprocal agreement does not guarantee exclusive use of the hot site during a disaster. A reciprocal agreement for a shared hot site does not guarantee exclusive access during a disaster. If both organizations declare a disaster simultaneously, the site may become oversubscribed, leading to resource contention and potential failure of the BCP. This directly undermines the recovery capability, making it the most critical finding.

Answer

The hot site uses a different internet service provider than the primary site

Answer

The hot site has not been tested in the past 12 months

Answer

The hot site is located in the same seismic zone as the primary site

Question 13

An IS auditor is evaluating the patch management process. The auditor notes that critical security patches are applied within 30 days, but the policy requires 7 days. The IT manager states that the delay is due to testing requirements. What should the auditor recommend?

Accepted Answer

Implement a risk-based patching process that allows faster deployment for critical patches. A risk-based patching process prioritizes critical patches for immediate deployment while allowing less critical patches to undergo standard testing. This balances security needs with operational stability, addressing the policy violation without sacrificing testing entirely. The auditor should recommend this approach because it aligns with industry best practices (e.g., NIST, ISO 27001) and enables faster remediation of high-risk vulnerabilities.

Answer

Require automated patching without testing

Answer

Accept the current practice as a compensating control

Answer

Modify the policy to align with the actual patching timeline

Question 14

A company's IT service desk receives multiple reports of users being unable to access a cloud-based CRM system. The network team confirms that internet connectivity is working. Which of the following should be the FIRST step in troubleshooting the issue?

Accepted Answer

Check the vendor's service status page for any reported outages. When multiple users report the same cloud service outage and internet connectivity is confirmed working, the fastest way to determine whether the issue is internal or vendor-side is to check the vendor's service status page. This is a low-cost, non-disruptive first step that can immediately confirm a known outage and avoid unnecessary internal troubleshooting.

Answer

Ask a user to try accessing from a different device

Answer

Restart the company's firewall and proxy servers

Answer

Review recent change requests for the CRM system

Question 15

Which TWO of the following are key benefits of using a system development life cycle (SDLC) methodology? (Select exactly two.)

Accepted Answer

It provides a structured approach to system development. Option A is correct because an SDLC methodology provides a structured, phased approach (such as requirements, design, development, testing, and deployment) that organizes and governs how a system is built, giving repeatability and control over the process. Option B is correct because SDLC methodologies explicitly include requirements-gathering and validation phases, ensuring user and stakeholder requirements are captured, documented, and confirmed before and during development. Option C is incorrect because SDLC methodologies do not prevent scope changes; they provide change-control mechanisms to manage scope changes, which can and do still occur. Option D is incorrect because security testing remains necessary and is typically integrated into SDLC phases (e.g., during testing or via secure development practices), not eliminated. Option E is incorrect because while an SDLC can improve efficiency and reduce rework costs, it does not guarantee a reduction in overall development cost, so this is not a key guaranteed benefit.

Answer

It prevents any scope changes during development

Answer

It eliminates the need for security testing

Answer

It reduces the overall cost of development