CISA Practice Test 2 — 10 Questions

Question 1

An IT governance framework should include which TWO key components? (Select exactly two.)

Accepted Answer

Strategic alignment. Strategic alignment ensures IT supports business goals; performance measurement tracks achievement. Network firewall rules, user training, and vendor lock-in are operational or tactical, not core governance components.

Answer

User training

Answer

Vendor lock-in

Answer

Network firewall rules

Question 2

An organization's IT strategy is not aligned with business strategy due to lack of communication. Which of the following would BEST improve alignment?

Accepted Answer

Business-IT strategy mapping workshops. Business-IT strategy mapping workshops facilitate direct communication and collaboration, ensuring both sides understand and agree on priorities. Status reports, budget increases, or outsourcing do not address the communication gap.

Answer

Weekly IT status reports

Answer

Outsourcing non-core IT functions

Answer

IT budget increase

Question 3

An organization uses a risk-based audit approach. For a high-risk area, the auditor decides to perform 100% testing instead of sampling. Which of the following is a valid reason for this decision?

Accepted Answer

The population size is small and errors are critical. When a high-risk area is identified and the population size is small, 100% testing is justified because the cost of missing a critical error outweighs the cost of testing every item. This approach eliminates sampling risk entirely, ensuring that all errors are detected. In audit, 100% testing is appropriate when the population is small enough to make full examination feasible and the consequences of error are severe.

Answer

The auditor has limited time

Answer

The tolerable error rate is high

Answer

The control is automated and always effective

Question 4

An IT manager notices that the CPU utilization of a critical server consistently exceeds 90% during peak hours. Which is the BEST course of action?

Accepted Answer

Implement load balancing. Implementing load balancing distributes the workload across multiple servers, addressing the performance issue. Options B, C, and D are not the best; B is hasty, C helps but is not best, D does not fix the problem.

Answer

Immediately add more CPUs

Answer

Increase monitoring frequency

Answer

Schedule batch jobs during off-peak

Question 5

A company's backup policy requires that backup media be stored offsite. Which of the following is the PRIMARY reason for this requirement?

Accepted Answer

To ensure data is available in case of a site disaster. The primary reason for storing backup media offsite is to ensure data availability and recoverability in the event of a site-level disaster, such as a fire, flood, or physical destruction of the primary data center. This aligns with the core business continuity principle of geographic separation to avoid a single point of failure. Without offsite storage, a site disaster would destroy both primary and backup data, making recovery impossible.

Answer

To reduce backup storage costs

Answer

To comply with regulatory requirements

Answer

To protect against theft

Question 6

Refer to the exhibit. An IS auditor reviewing backup logs notices this error. Which of the following is the MOST likely root cause?

Accepted Answer

Storage array is offline. The error indicates failure to mount the backup target, implying a connectivity issue with the storage array. A syntax error would produce a script error; disk space would show a different error; authentication would show a credentials error.

Answer

Backup script has a syntax error

Answer

Incorrect database credentials

Answer

Insufficient disk space on backup target

Question 7

A small business lacks formal IT governance. What is the FIRST step to establish governance?

Accepted Answer

Conduct a risk assessment. Conducting a risk assessment identifies the most critical issues and guides the development of governance policies and structure. Defining policies or assigning roles without understanding risks may be premature.

Answer

Assign an IT manager

Answer

Define IT policies

Answer

Implement COBIT

Question 8

An organization implemented a business continuity plan (BCP) that includes manual workarounds. Which of the following is the PRIMARY risk of relying on manual processes during a disruption?

Accepted Answer

Higher probability of human error under stress. Human error is significantly higher under stress, which can cause delays and mistakes. Other options are not primary risks.

Answer

Longer recovery time for automated systems

Answer

Higher cost of implementation

Answer

Increased dependency on technology

Question 9

An IT department is struggling with project delays and budget overruns. Which governance practice would be MOST effective?

Accepted Answer

Establishing a project management office (PMO). Establishing a Project Management Office (PMO) provides standardized project management practices, oversight, and governance, addressing delays and overruns. Agile methodology alone may not provide governance; increasing staff or outsourcing may not solve underlying issues.

Answer

Outsourcing projects

Answer

Increasing IT staff

Answer

Adopting agile methodology

Question 10

An organization uses a cloud-based ERP system to manage financial transactions. The system is accessed by employees in finance, procurement, and sales departments. The IS auditor is reviewing the user access review process. The access review is performed quarterly by the IT manager using a report generated by the ERP system. The report lists all users and their roles. The IT manager manually checks off users who are still employed and approves the report. The auditor notes that the IT manager does not have detailed knowledge of job functions in each department. Additionally, the ERP system allows role combinations that may create segregation of duties conflicts, such as a user having both 'create purchase order' and 'approve purchase order' roles. The company's policy requires segregation of duties reviews to be performed by business process owners. Which of the following is the BEST recommendation?

Accepted Answer

Assign the access review to business process owners from each department. The core issue is that the IT manager lacks the business process knowledge to assess whether role combinations create segregation of duties (SoD) conflicts. Company policy explicitly requires SoD reviews to be performed by business process owners. Assigning the access review to business process owners from each department (Option C) directly aligns with policy and ensures that those with functional knowledge evaluate whether role assignments violate SoD rules, such as a user having both 'create purchase order' and 'approve purchase order' roles.

Answer

Increase the frequency of access reviews to monthly

Answer

Implement an automated tool to identify segregation of duties conflicts

Answer

Require the IT manager to obtain confirmation from each department head