CISA Practice Test 19 — 15 Questions

Question 1

Which TWO of the following are effective controls to prevent fraud in IT? (Select TWO)

Accepted Answer

Mandatory vacation policies. Separation of duties prevents fraud by ensuring no single person has control over all aspects of a transaction. Mandatory vacation allows detection of fraud when employees are away. Background checks are preventive but not as directly effective as separation of duties and mandatory vacation for ongoing fraud prevention.

Answer

Background checks on new hires

Answer

Password complexity requirements

Answer

Single sign-on (SSO) systems

Question 2

An IT steering committee is evaluating a major system upgrade. Which of the following is the PRIMARY benefit of using an IT balanced scorecard in this evaluation?

Accepted Answer

It provides a framework to align IT investments with business strategy across financial, customer, internal process, and learning/growth perspectives.. The IT balanced scorecard translates IT performance into business terms, ensuring alignment with strategic goals from multiple perspectives.

Answer

It replaces the need for a detailed business case.

Answer

It ensures the project is completed within budget and on time.

Answer

It focuses solely on the financial returns of IT investments.

Question 3

Which TWO of the following are components of the ITIL 4 four dimensions of service management? (Select TWO.)

Accepted Answer

Organizations and people. ITIL 4 defines four dimensions: Organizations and People, Information and Technology, Partners and Suppliers, and Value Streams and Processes.

Answer

Finance and accounting

Answer

Risk and compliance

Answer

Marketing and sales

Question 4

An organization's IT policy review cycle is set to every two years. However, a new regulation requires immediate changes to data retention policies. What is the best course of action?

Accepted Answer

Update the policy immediately through an exception process. Policy review cycles should be flexible to accommodate urgent regulatory changes; an immediate update is necessary.

Answer

Reduce the review cycle to annually

Answer

Wait until the next scheduled review to make changes

Answer

Ignore the regulation until the review

Question 5

When implementing a data classification policy, which of the following roles is PRIMARILY responsible for assigning classification labels to data?

Accepted Answer

Data owner.. The data owner is the senior manager or business process owner who has the authority to determine the sensitivity and criticality of the data. They are primarily responsible for assigning classification labels because they understand the business impact if the data is compromised. This role defines the classification level (e.g., Public, Internal, Confidential, Restricted) based on the data's value and legal or regulatory requirements.

Answer

Data custodian.

Answer

Data user.

Answer

Data steward.

Question 6

Which TWO of the following are HR controls that help mitigate the risk of insider fraud in IT? (Select TWO.)

Accepted Answer

Job rotation. Mandatory vacation and job rotation are detective and preventive controls against fraud.

Answer

Flexible work hours

Answer

Employee recognition programs

Answer

Annual performance reviews

Question 7

In a RACI matrix for an IT process, which role should be assigned to the person who ultimately approves the outcome and is held accountable for its success?

Accepted Answer

Accountable (A). Accountable (A) is the person who is ultimately answerable for the correct and thorough completion of the deliverable or task, and who must approve the work.

Answer

Consulted (C)

Answer

Responsible (R)

Answer

Informed (I)

Question 8

In a waterfall SDLC, when should user acceptance testing (UAT) typically occur?

Accepted Answer

After system testing and before deployment. UAT is performed after system testing is complete and before deployment to ensure the system meets user requirements.

Answer

After deployment

Answer

After coding but before unit testing

Answer

During the requirements phase

Question 9

An auditor is evaluating the IT governance framework of a large bank. Which TWO of the following are components of COBIT 2019's governance system? (Select TWO.)

Accepted Answer

Organizational Structures. COBIT 2019 includes governance components such as principles, policies, frameworks, processes, organizational structures, culture, ethics, behavior, information, services, infrastructure, and applications.

Answer

Key Performance Indicators

Answer

Change Management Process

Answer

Service Level Agreements

Question 10

An organization's IT security policy requires background checks for all IT staff handling sensitive data. Which of the following is the PRIMARY reason for this requirement?

Accepted Answer

To reduce the risk of insider threats by verifying the trustworthiness of personnel. Background checks help verify the trustworthiness of employees who have access to sensitive information, reducing the risk of insider threats.

Answer

To ensure employees have the necessary technical skills

Answer

To reduce employee turnover

Answer

To comply with industry regulations

Question 11

The IT governance objective 'Evaluate-Direct-Monitor' in COBIT 2019 is primarily associated with which role?

Accepted Answer

Board of directors. The Evaluate-Direct-Monitor (EDM) domain in COBIT 2019 is focused on governance responsibilities typically performed by the board of directors and executive management.

Answer

Internal audit

Answer

IT management

Answer

IT steering committee

Question 12

An auditor is reviewing IT policy compliance and finds that a critical policy was last updated three years ago. The organization has undergone significant changes. What is the auditor's PRIMARY concern?

Accepted Answer

The policy may not be aligned with current business objectives. Policies should be reviewed and updated regularly to remain current and effective. The primary concern is that the policy may no longer be relevant or effective due to changes in the organization, technology, or regulatory environment.

Answer

Employees may not be aware of the policy

Answer

The policy may not have been approved by management

Answer

The policy may not be enforced

Question 13

An organization outsources its help desk to a third-party vendor. The contract includes a service level agreement (SLA) with response times. The auditor wants to ensure that the organization can monitor vendor performance. Which clause is most important?

Accepted Answer

Right-to-audit clause. The right-to-audit clause allows the organization to audit the vendor's processes and performance, ensuring SLA compliance.

Answer

Exit strategy clause

Answer

Indemnification clause

Answer

Confidentiality clause

Question 14

Which of the following is a key objective of the COBIT 2019 management objective 'Align, Plan, and Organize' (APO)?

Accepted Answer

Manage the IT management framework. APO focuses on strategic planning and alignment of IT with business objectives.

Answer

Manage changes

Answer

Manage security

Answer

Manage IT operations

Question 15

An organization is adopting ISO/IEC 38500 to govern IT. Which of the following best illustrates the application of the 'Human Behaviour' principle?

Accepted Answer

Providing security awareness training to all employees. The Human Behaviour principle requires that IT policies respect human behavior and include training and awareness to ensure compliance.

Answer

Aligning IT strategy with business strategy

Answer

Ensuring IT investments deliver value and manage risk

Answer

Assigning clear responsibility for IT decisions