CISA Practice Test 19 — 15 Questions

Question 1

An IS auditor reviews the exhibit. Which of the following is the most likely cause of the denied traffic?

Accepted Answer

Missing firewall rule allowing RDP traffic. The log shows an RDP connection (port 3389) being denied by the access-group 'outside_in', indicating that no rule permits this traffic.

Answer

Misconfigured VPN tunnel

Answer

Intrusion prevention system blocking

Answer

Incorrect NAT configuration

Question 2

An IS auditor is reviewing the incident management process. The organization has a policy that all security incidents must be reported within one hour. However, the average reporting time is four hours. Which is the BEST corrective action?

Accepted Answer

Provide additional training to staff. Option A is correct because additional training addresses the human factors causing delays. Option B lowers the standard; C is punitive; D might help but is not the best first step.

Answer

Reduce the reporting time requirement

Answer

Increase penalties for non-compliance

Answer

Implement automated incident detection

Question 3

Given this configuration, which is the PRIMARY concern?

Accepted Answer

Bandwidth may be insufficient to meet RPO. Option A is correct because the data change rate of 50 GB per hour (~112 Mbps sustained) exceeds the 100 Mbps bandwidth, causing replication lag that may exceed the RPO. Option B is less direct; C is a concern but not primary; D is the same as A.

Answer

Data change rate exceeds bandwidth

Answer

RTO may not be achievable

Answer

Synchronous replication may impact application performance

Question 4

A company is updating its business continuity plan (BCP). Which THREE of the following should be included as key components?

Accepted Answer

List of critical staff and contact information. A BCP must define who is responsible, how to activate the plan, and the risks it addresses. Network diagrams and vendor contracts are supporting documents but not key components of the plan itself.

Answer

Detailed network topology diagrams

Answer

Vendor contracts for equipment replacement

Question 5

A multinational corporation is implementing a disaster recovery plan for its critical financial systems. The plan includes off-site backups and redundant hardware. During a recent test, the recovery time objective (RTO) was met, but the recovery point objective (RPO) was exceeded by 30 minutes due to delayed data replication. Which of the following is the BEST action to address this issue?

Accepted Answer

Implement synchronous replication to the secondary site.. Option B is correct because synchronous replication ensures data is written to both sites simultaneously, minimizing RPO. Option A is wrong because increasing full backups to every 4 hours still leaves up to 4 hours of potential data loss. Option C is wrong because reducing bandwidth for replication would likely increase the delay further. Option D is wrong because extending the RTO does not address the RPO issue.

Answer

Extend the RPO to accommodate the delay.

Answer

Reduce the bandwidth for replication to avoid congestion.

Answer

Increase the frequency of full backups to every 4 hours.

Question 6

An organization's online transaction processing system experienced a sudden performance degradation. The database administrator checked system resources and found excessive I/O wait time on the storage subsystem. Which of the following is the MOST likely root cause?

Accepted Answer

Inadequate disk spindles or a storage area network (SAN) bottleneck. Option C is correct because excessive I/O wait time typically indicates that the storage system cannot keep up with the demand, often due to insufficient disk spindles or a storage bottleneck. Option A is wrong because insufficient memory usually causes high CPU usage or swapping, not directly I/O wait. Option B is wrong because network latency affects network I/O, not disk I/O. Option D is wrong because application code bugs might cause logical errors but not necessarily storage I/O issues.

Answer

An inefficient SQL query causing table scans

Answer

Insufficient memory allocated to the database server

Answer

Network latency between the application and database servers

Question 7

Which of the following is the PRIMARY objective of an operational audit?

Accepted Answer

To assess the efficiency and effectiveness of operations. Option A is correct because operational audit focuses on efficiency and effectiveness. Options B, C, and D are objectives of other types of audits.

Answer

To identify security vulnerabilities

Answer

To evaluate financial reporting

Answer

To verify compliance with laws

Question 8

Which control failure is MOST significant?

Accepted Answer

Insufficient incident notification procedures. Option D is correct because the delay in notifying the incident response team (from 14:25 to 16:00) is the most significant failure, as it allowed unauthorized access to continue. Option A is not a failure (alert timely); B is a factor but not the primary; C is secondary.

Answer

Lack of timely incident response

Answer

Delayed alerting

Answer

Inadequate monitoring

Question 9

During a disaster recovery test, the team discovers that the backup server is unable to restore data because of incompatible software versions. Which TWO controls should have been implemented to prevent this?

Accepted Answer

Maintaining a configuration management database. A configuration management database (CMDB) tracks software versions, and a patch management process ensures compatibility. Cloud backups, backup frequency, and IDS do not address version compatibility.

Answer

Using cloud-based backup solutions

Answer

Implementing intrusion detection systems

Answer

Increasing the frequency of full backups

Question 10

During an audit, the IS auditor finds that the business continuity plan (BCP) was last updated two years ago and does not include new cloud-based applications. The organization has not conducted a BCP test in 18 months. What should the auditor recommend FIRST?

Accepted Answer

Perform a risk assessment to prioritize changes. Option B is correct because a risk assessment is needed to prioritize which updates are critical. Option A is premature without understanding current risks; C is part of the update process but should follow risk assessment; D is later in the process.

Answer

Obtain management approval for BCP updates

Answer

Immediately schedule a full-scale test

Answer

Update the BCP to include cloud applications

Question 11

A database administrator accidentally deleted a critical table. The last full backup was taken 24 hours ago, and transaction logs are archived every 15 minutes. Which recovery method will minimize data loss?

Accepted Answer

Restore from full backup and apply transaction logs up to the time of deletion. Option C is correct because restoring the full backup and applying transaction logs up to the deletion point recovers all data except the very last transactions. Option A is incomplete; B loses 24 hours; D is not applicable.

Answer

Use a standby database

Answer

Point-in-time recovery using transaction logs

Answer

Restore from full backup only

Question 12

A company's backup policy requires that backup media be stored offsite. Which of the following is the PRIMARY reason for this requirement?

Accepted Answer

To ensure data is available in case of a site disaster. Option C is correct because offsite storage ensures data availability in case of a site disaster. Options A, B, and D are secondary or incorrect.

Answer

To reduce backup storage costs

Answer

To comply with regulatory requirements

Answer

To protect against theft

Question 13

An organization's business continuity plan includes a reciprocal agreement with another company. What is the PRIMARY risk of this arrangement?

Accepted Answer

Both companies may be affected by the same disaster. Option D is correct because both companies may be affected by the same regional disaster. Options A, B, and C are valid concerns but secondary.

Answer

The other company may be a competitor

Answer

The agreement may not be legally enforceable

Answer

The other company may not have adequate security

Question 14

Refer to the exhibit. During a security audit, an IS analyst identifies that a critical business application hosted on 192.168.1.100:443 is unreachable from the 10.0.1.0/24 subnet. Which of the following is the MOST likely cause?

Accepted Answer

The first rule blocks all traffic from 10.0.1.0/24. The first rule denies all IP traffic from 10.0.1.0/24 to any destination; this rule takes precedence. The second rule blocks only HTTPS from any source, but the first rule already blocks all traffic from that subnet. The permit rule is for a different subnet.

Answer

The second rule blocks HTTPS traffic from any source to the host

Answer

The third rule permits all traffic from the 10.0.0.0/16 subnet

Answer

The firewall is misconfigured for TCP traffic

Question 15

A multinational corporation has implemented a hot site disaster recovery solution for its critical financial applications. Which of the following is the MOST important consideration to ensure the effectiveness of the hot site?

Accepted Answer

Regular, documented testing of the failover process is performed. Option D is correct because without regular testing, the hot site may not function as expected. Options A, B, and C are important but secondary: A is part of planning, B is operational, C is compliance but not the most critical for effectiveness.

Answer

Data replication latency is less than 15 minutes

Answer

The hot site is located in a different seismic zone

Answer

The hot site complies with regional data privacy regulations

CISA Practice Test 19 — 15 Questions

Exhibit

CISA Practice Test 19 — 15 Questions

Exhibit