CISA Practice Test 20 — 15 Questions

Question 1

An organization is implementing a new IT governance framework to align IT with business objectives. Which framework focuses on the principles of evaluate-direct-monitor?

Accepted Answer

COBIT 2019. COBIT 2019 uses the evaluate-direct-monitor (EDM) governance objective for governance of enterprise IT.

Answer

PMBOK

Answer

ITIL 4

Answer

ISO/IEC 38500

Question 2

An organization is implementing a new IT service management system based on ITIL 4. Which TWO of the following are guiding principles of ITIL 4?

Accepted Answer

Focus on value. ITIL 4 has seven guiding principles, including 'Focus on value' and 'Start where you are'.

Answer

Responsibility, strategy, acquisition

Answer

Evaluate, direct, monitor

Answer

Align, plan, organize

Question 3

What is the PRIMARY purpose of conducting a static application security testing (SAST) during the development phase?

Accepted Answer

To identify security vulnerabilities in the source code. SAST analyzes source code for vulnerabilities early in the SDLC, allowing remediation before deployment.

Answer

To ensure the application is free of logic errors

Answer

To test the application's functionality

Answer

To validate that security requirements are met

Question 4

An organization wants to implement an exception management process for IT policies. Which of the following is the most important step to ensure effective control?

Accepted Answer

Require a formal request with approval from an appropriate authority and a defined expiration date. Exceptions must be approved by appropriate management and documented with a defined expiration date to prevent permanent deviations.

Answer

Automatically renew exceptions every year unless revoked

Answer

Allow any exception to be granted by the IT manager

Answer

Log all exceptions but do not set expiration dates

Question 5

An IS auditor is reviewing an agile software development project. Which of the following practices would BEST help ensure that security controls are adequately addressed?

Accepted Answer

Including security acceptance criteria in user stories. In agile, security requirements should be included in user stories and tested during the sprint. Accepting a user story only after successful testing ensures security is validated.

Answer

Requiring sign-off from the project sponsor before each sprint review

Answer

Performing a single comprehensive security test after all sprints are complete

Answer

Conducting a formal design review at the end of each sprint

Question 6

Which of the following is a requirement for effective segregation of duties in IT?

Accepted Answer

Different individuals should be responsible for authorizing, executing, and reconciling transactions.. Segregation of duties ensures that no single individual has control over conflicting tasks, reducing fraud risk.

Answer

All IT staff should have access to production data for troubleshooting.

Answer

System administrators should also perform internal audits to maintain expertise.

Answer

The same person should develop, test, and deploy code to ensure consistency.

Question 7

A company is deciding whether to centralize or decentralize its IT function. Which of the following is an advantage of a centralized IT structure?

Accepted Answer

Standardized technology and processes across the enterprise. Centralized IT allows for greater control, standardization, and economies of scale.

Answer

Faster decision-making at the business unit level

Answer

Better alignment with individual department goals

Answer

Increased responsiveness to local business needs

Question 8

An organization is implementing an agile methodology for a new software project. Which of the following is the MOST effective control to ensure that security requirements are addressed?

Accepted Answer

Including security requirements in the product backlog. In agile, including security requirements in the product backlog ensures they are prioritized and addressed in each sprint.

Answer

Conducting a single security requirements review at the start of the project

Answer

Requiring a separate security sprint after development

Answer

Performing a security audit only at the end of the project

Question 9

An organization is adopting a decentralized IT structure to better meet the needs of its business units. Which of the following is a potential risk of this approach?

Accepted Answer

Increased duplication of IT resources and inconsistent standards. Decentralized IT can lead to duplication of efforts and inconsistent standards across units, increasing complexity and cost.

Answer

Slower response to business unit needs

Answer

Higher initial setup costs for central services

Answer

Reduced alignment with corporate strategy

Question 10

Which of the following is a key performance indicator (KPI) for IT service management?

Accepted Answer

Help desk first-call resolution rate. Help desk first-call resolution rate is a common KPI measuring efficiency and effectiveness of support services.

Answer

Revenue growth

Answer

Percentage of employees trained

Answer

Number of security incidents

Question 11

An IS auditor is reviewing a post-implementation review report for a new financial system. Which finding would most indicate that the project did not meet its objectives?

Accepted Answer

The system processed transactions 20% slower than projected. The post-implementation review should compare actual performance against projections. Significant performance degradation indicates the system is not meeting its intended performance objectives, which is a key project goal.

Answer

Three minor change requests were submitted in the first month

Answer

Users required additional training after go-live

Answer

The project budget was exceeded by 5%

Question 12

During an ERP implementation, the project team decides to disable segregation of duties (SoD) controls in the system to accelerate go-live. After go-live, the IS auditor identifies that a single user can perform incompatible functions. What is the BEST course of action?

Accepted Answer

Implement compensating controls such as enhanced monitoring and audit logs. SoD conflicts are a high-risk issue. The auditor should recommend immediate implementation of compensating controls (e.g., enhanced monitoring, dual approval) to mitigate risk until the system is reconfigured.

Answer

Require reconfiguration of SoD controls before the next audit

Answer

Document the issue and accept the risk

Answer

Advise management to terminate the project manager

Question 13

In a spiral SDLC model, what is the primary purpose of risk analysis in each iteration?

Accepted Answer

To identify and resolve potential project risks early. The spiral model is risk-driven; each iteration includes a risk analysis to identify and mitigate project risks before proceeding to the next phase.

Answer

To assess user satisfaction with the prototype

Answer

To plan the next iteration's tasks

Answer

To define detailed functional requirements

Question 14

An organization is migrating from a legacy system to a new ERP. Which TWO of the following are the HIGHEST risks during data migration?

Accepted Answer

Incorrect data mapping between old and new systems. Data quality issues (incomplete/inaccurate data) and mapping errors are common risks that can lead to system failures.

Answer

Insufficient network bandwidth during cutover

Answer

Lack of user training on the new system

Answer

Lack of segregation of duties in the new system

Question 15

An IS auditor is reviewing change management procedures. Which of the following situations would be of GREATEST concern?

Accepted Answer

An emergency change was implemented and not reviewed after resolution. Emergency changes bypass normal controls; without post-change review, unauthorized or flawed changes may persist unnoticed.

Answer

A standard change was implemented without CAB approval

Answer

The change request did not include an impact analysis

Answer

A normal change had a rollback plan that was not tested