CISA Practice Test 2 — 10 Questions

Question 1

Order the steps for conducting an audit engagement from start to finish.

Accepted Answer

Step 1: Planning (scope, program), Step 2: Fieldwork, Step 3: Analysis, Step 4: Reporting with management review. Audit engagement follows: planning (scope, program), fieldwork, analysis, and reporting with management review.

Answer

Step 1: Planning, Step 2: Analysis, Step 3: Fieldwork, Step 4: Reporting

Answer

Step 1: Fieldwork, Step 2: Planning, Step 3: Analysis, Step 4: Reporting

Answer

Step 1: Planning, Step 2: Fieldwork, Step 3: Reporting, Step 4: Analysis

Question 2

Which THREE of the following are key considerations when selecting a software development methodology for a project?

Accepted Answer

Regulatory compliance requirements. Regulatory compliance requirements (Option B) are a key consideration because the chosen methodology must support necessary audit trails, documentation, and control frameworks (e.g., SOX, HIPAA, PCI DSS). A methodology like Waterfall provides rigid phase-gate documentation, while Agile may require adaptation (e.g., SAFe) to satisfy compliance evidence demands. Failure to align methodology with regulatory needs can lead to non-compliance findings during a CISA audit.

Answer

Availability of project management software

Answer

Programming language preferences

Question 3

Which of the following is a primary advantage of fixed-price contracts in systems acquisition?

Accepted Answer

Predictable cost for the buyer. The defining characteristic of a fixed-price contract is that the buyer pays a set amount regardless of the vendor's actual costs, giving the buyer cost predictability and transferring cost-overrun risk to the vendor. This predictability is the primary advantage for the acquiring organization's budgeting and financial planning.

Answer

Vendor has incentive to complete quickly

Answer

Greater flexibility to change requirements

Answer

Lower total cost compared to time-and-materials

Question 4

Which of the following is the MOST effective control to prevent unauthorized USB devices from connecting to corporate workstations?

Accepted Answer

Device control software that blocks non-approved USB devices.. Device control software (e.g., endpoint DLP or USB whitelisting tools) operates at the OS kernel or driver level to enforce a hardware ID or vendor ID allowlist, blocking any USB device not explicitly approved. This is the only option that provides a preventive, automated, and continuous control against unauthorized USB connections, regardless of user behavior or physical access.

Answer

User awareness training.

Answer

Physical security guards.

Answer

Encrypting all USB devices.

Question 5

Order the steps for performing a data backup in the correct sequence.

Accepted Answer

Identify data to be backed up, then choose backup method, then schedule the backup, then execute backup and verify integrity, then store backup offsite.. Backup process: identify data, choose method, schedule, execute/verify, and store offsite.

Answer

Identify data to be backed up, then schedule the backup, then choose backup method, then execute backup and verify integrity, then store backup offsite.

Answer

Choose backup method, then identify data to be backed up, then schedule the backup, then execute backup and verify integrity, then store backup offsite.

Answer

Identify data to be backed up, then choose backup method, then execute backup and verify integrity, then schedule the backup, then store backup offsite.

Question 6

An IS auditor is conducting a follow-up review of prior audit findings. Management has implemented a new automated control but has not yet updated the risk register to reflect the residual risk. Which of the following should the auditor do FIRST?

Accepted Answer

Verify that the new control is operating effectively through testing before concluding on residual risk.. The auditor's core duty during follow-up is to independently verify that management's remediation actually works. Testing the new control provides the evidence needed to determine whether residual risk is acceptable. Only after that verification is it appropriate to consider reporting or recommending documentation updates. Verification must precede conclusions about risk reduction.

Answer

Recommend that management update the risk register before any further audit work is performed.

Answer

Accept management's representation that the control is effective and close the finding.

Answer

Report to the audit committee that management has failed to maintain the risk register.

Question 7

An IS auditor is reviewing the backup strategy for a financial institution. The backup administrator states that full backups are taken every Sunday, and incremental backups are taken Monday through Saturday. On Thursday morning, a database server fails, and the administrator needs to restore the server to its state as of Wednesday night. Which backup sets must the administrator use to perform this restoration?

Accepted Answer

The most recent full backup and all incremental backups taken since that full backup.. In a full-plus-incremental backup strategy, a full backup captures all data, while each incremental backup captures only changes since the last backup of any type. To restore to a specific point, the administrator must restore the most recent full backup and then apply each subsequent incremental backup in the correct order. This ensures all changes are recovered. The other options incorrectly describe the restore process or assume a different backup scheme.

Answer

The most recent full backup, the differential backup, and the latest incremental backup.

Answer

The most recent full backup and the single most recent incremental backup.

Answer

Only the most recent full backup, as it contains all data up to the point of the backup.

Question 8

Which of the following is the BEST indicator of IT performance from the customer perspective in an IT balanced scorecard?

Accepted Answer

Help desk resolution time. The customer perspective in an IT balanced scorecard focuses on how users perceive IT services. Help desk resolution time directly measures service quality from the customer's viewpoint.

Answer

Number of security incidents

Answer

System availability percentage

Answer

IT budget as a percentage of revenue

Question 9

An organization uses a public key infrastructure (PKI) to issue digital certificates. The IS auditor is reviewing the certificate lifecycle management. Which of the following is the GREATEST risk if certificate revocation lists (CRLs) are not updated in a timely manner?

Accepted Answer

Compromised certificates could still be used to establish trust. If CRLs are not updated in a timely manner, a certificate that has been revoked due to compromise or misuse will still appear valid to relying parties, allowing it to be used to establish trust. This defeats the purpose of revocation and can enable man-in-the-middle or impersonation attacks. Timely CRL publication is essential for the integrity of the PKI trust model.

Answer

Certificate authorities may lose their root key

Answer

Certificates may expire without renewal

Answer

Users may not be able to verify certificate signatures

Question 10

An IS auditor is reviewing the backup strategy for a financial institution's core transaction processing system. The system processes high volumes of transactions continuously and requires a recovery point objective (RPO) of 5 minutes. The current strategy includes nightly full backups and hourly incremental backups. Which of the following should the auditor recommend as the MOST appropriate improvement?

Accepted Answer

Implement continuous data protection (CDP) with journaling to capture every transaction.. The core transaction system requires an RPO of 5 minutes, meaning no more than 5 minutes of data can be lost. Nightly full and hourly incremental backups leave up to 60 minutes of data at risk. Continuous data protection captures every change, enabling recovery to within seconds or minutes, thus meeting the RPO. Increasing incremental frequency to 15 minutes still exceeds the RPO, and other options are even less frequent. CDP is the only viable solution among the choices.

Answer

Perform full backups twice daily instead of nightly.

Answer

Increase the frequency of incremental backups to every 15 minutes.

Answer

Implement snapshot-based backups every 30 minutes.