CISA Practice Test 20 — 15 Questions

Question 1

During an IT audit, the auditor finds that a system administrator has local administrator rights on multiple production servers and uses a shared service account for routine maintenance. What is the PRIMARY risk associated with this practice?

Accepted Answer

Audit trails cannot attribute actions to a specific individual. Option B is correct because a shared account obscures individual accountability, making it impossible to determine who performed specific actions. Option A is a general risk but less specific; Option C is not the primary risk; Option D is the opposite.

Answer

Password changes become more difficult to manage

Answer

The administrator may accidentally delete critical files

Answer

The shared account may be used by unauthorized personnel

Question 2

A company's IT service desk receives multiple reports of users being unable to access a cloud-based CRM system. The network team confirms that internet connectivity is working. Which of the following should be the FIRST step in troubleshooting the issue?

Accepted Answer

Check the vendor's service status page for any reported outages. Option A is correct because checking the status of the CRM service provider helps determine if it is a known outage. Option B is premature; Option C is device-specific; Option D is a later step.

Answer

Ask a user to try accessing from a different device

Answer

Restart the company's firewall and proxy servers

Answer

Review recent change requests for the CRM system

Question 3

An organization is evaluating its business continuity plan (BCP) for a critical application with a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour. The current backup strategy involves daily full backups and hourly transaction log backups. Which of the following is the MOST significant risk?

Accepted Answer

The backup media is stored in the same building as the primary system. Option D is correct because if the backups are stored at the same site, a disaster destroying the primary site would also destroy the backups, making recovery impossible. Options A, B, and C are less critical: A is a procedural issue, B is a minor gap, C is about recovery method but not as fundamental as off-site storage.

Answer

The recovery process requires manual intervention to apply logs

Answer

The backups are not tested regularly

Answer

The hourly logs cover only the last 24 hours

Question 4

Which of the following is the BEST indicator that an organization's incident management process is effective?

Accepted Answer

The percentage of recurring incidents is decreasing over time. Option C is correct because a decreasing number of recurring incidents indicates that root causes are being identified and resolved. Option A is about recovery time, not effectiveness; Option B is about volume, which could increase; Option D is reactive, not proactive effectiveness.

Answer

The average time to resolve incidents is under 1 hour

Answer

The number of incidents reported per month is increasing

Answer

All incidents are logged within 10 minutes of detection

Question 5

An IT auditor is reviewing the change management process for a financial application. The auditor finds that emergency changes are frequently implemented without post-implementation review. What is the MOST significant risk?

Accepted Answer

Security vulnerabilities may be introduced and remain undetected. Option A is correct because without review, emergency changes may introduce security vulnerabilities or instability that go unnoticed. Option B is a lesser risk; Option C is a consequence but not the most significant; Option D is operational risk but less critical than security.

Answer

The change may not be documented properly

Answer

The change may cause an outage during the next backup cycle

Answer

Users may not be notified of the change

Question 6

Which of the following is the PRIMARY purpose of a business impact analysis (BIA) in business continuity planning?

Accepted Answer

To determine the criticality of business processes and their recovery requirements. Option C is correct because BIA identifies critical processes and determines the maximum allowable downtime (RTO) and data loss (RPO). Options A, B, and D are subsequent steps after the BIA.

Answer

To create a list of emergency contacts

Answer

To identify the resources required for recovery

Answer

To document the technical recovery procedures

Question 7

A large enterprise is implementing a backup strategy for a critical database that requires an RTO of 2 hours and an RPO of 15 minutes. The database is 2 TB in size. Which backup method would BEST meet these requirements while minimizing storage costs?

Accepted Answer

Weekly full backups with transactional log backups every 15 minutes. Option B is correct because incremental backups after a full backup minimize data loss and allow frequent backups with low storage overhead, meeting the 15-minute RPO. Option A does not meet RPO; Option C uses too much storage; Option D is for file-level, not databases.

Answer

Daily full backups

Answer

Continuous data protection (CDP) replicating to a remote site

Answer

A daily full backup and a differential backup every 4 hours

Question 8

Refer to the exhibit. An IT operator receives this error message from an automated backup job. What is the MOST likely cause of this failure?

Accepted Answer

The LUN presenting the virtual disk is not zoned or masked to the backup server. Option D is correct because the error indicates that the backup server cannot access the virtual disk, which is typically a LUN masking or zoning issue. Option A is plausible but the message specifically points to storage access; Option B is not indicated; Option C is possible but less direct.

Answer

The FinanceDB database is corrupted

Answer

The network link between servers is down

Answer

The backup server's disk is full

Question 9

An organization uses a hot site for disaster recovery. During a recent test, the hot site did not have the latest version of the application software. What is the MOST likely cause?

Accepted Answer

Inadequate change management procedures. Option D is correct because inadequate change management procedures fail to ensure that updates are replicated to the hot site. Options A, B, and C are less likely.

Answer

Failure to synchronize data

Answer

Lack of backup media

Answer

Insufficient bandwidth

Question 10

Which is the MOST likely cause?

Accepted Answer

Backup media is not connected. Option B is correct because 'The device is not ready' indicates the backup media is not available. Option A would give a different error; C typically shows license; D shows network.

Answer

Network connectivity lost

Answer

Backup software license expired

Answer

Backup media is full

Question 11

An IS auditor is evaluating the effectiveness of a backup strategy for a critical database. Which TWO of the following are essential controls to ensure data recoverability?

Accepted Answer

Storing backups offsite. Regular restoration tests verify that backups are recoverable, and offsite storage ensures availability after a site disaster. Encryption, labeling, and capacity are security or operational considerations but not essential for recoverability.

Answer

Encrypting backup tapes

Answer

Labeling tapes with dates

Answer

Using high-capacity media

Question 12

Which TWO of the following are key elements of an effective incident response plan? (Select exactly 2.)

Accepted Answer

A clear escalation path with contact information. Options B and D are correct. A clear escalation path ensures proper reporting and decision-making; predefined communication templates speed up notification. Option A is not essential; Option C is part of strategy but not directly incident response; Option E is after-action, not during.

Answer

A schedule for post-incident reviews

Answer

A detailed inventory of software licenses

Answer

A list of all hardware serial numbers

Question 13

Refer to the exhibit. An auditor reviews the security log of a sensitive server. Which of the following is the MOST suspicious event?

Accepted Answer

The remote interactive logon from IP 192.168.10.50 using NTLM. Option B is correct because a logon type 10 (Remote Interactive) from an unknown IP (192.168.10.50) using NTLM could indicate an unauthorized remote desktop session, especially if the employee is not on shift or the IP is unfamiliar. Option A is a normal network logon; Option C is not an event; Option D is not logged here.

Answer

The use of Negotiate authentication package

Answer

The logoff event at 23:45:12

Answer

The logon from workstation WS-FINANCE at 10.0.0.15

Question 14

Which TWO of the following are primary objectives of capacity management? (Select exactly 2.)

Accepted Answer

To ensure adequate IT resources to meet current and future business demands. Options B and E are correct. Capacity management aims to ensure that current and future business requirements are met cost-effectively. Option A is about financial management; Option C is performance monitoring but not the primary objective; Option D is procurement.

Answer

To monitor and report on system performance against SLAs

Answer

To minimize the total cost of ownership of IT resources

Answer

To procure hardware and software at the lowest possible cost

Question 15

An organization's backup strategy involves weekly full backups and daily incremental backups. After a system failure, the restoration takes longer than expected. What is the most likely cause?

Accepted Answer

Restoration process not tested. Option D is correct because without periodic testing, the recovery time may be underestimated. Option A is plausible but not the most likely cause given the time issue; B and C are incorrect because they are not directly related to the restoration time.

Answer

Incremental backups not stored offsite

Answer

Full backup frequency too low

Answer

Tape rotation failure