CISA Practice Exam 3 — 20 Questions

Question 1

An organization is implementing a backup strategy for its critical database. The database is updated continuously during business hours, and the recovery point objective (RPO) is 15 minutes. Which backup method should be used to meet the RPO while minimizing backup storage and performance impact?

Accepted Answer

Perform incremental backups with transaction log backups every 15 minutes. Incremental backups with transaction log backups every 15 minutes meets the 15-minute RPO by capturing all changes since the last full or incremental backup, while transaction log backups record every individual database transaction. This method minimizes storage by only backing up changes and reduces performance impact compared to continuous replication, as log backups are lightweight and can be scheduled without constant I/O overhead.

Answer

Perform full backups every 24 hours

Answer

Implement synchronous replication to a standby server

Answer

Perform differential backups every 6 hours

Question 2

Based on the backup logs, the backup administrator notices that the incremental backup job failed due to insufficient storage. Which TWO actions should the administrator take to resolve the immediate issue and prevent recurrence?

Accepted Answer

Free up space on the backup storage device by removing old backup sets manually. Option A is correct because freeing up space on the backup storage device by removing old backup sets immediately resolves the insufficient storage issue that caused the incremental backup job to fail. This is a direct, short-term fix that reclaims capacity without altering backup schedules or configurations.

Answer

Check network bandwidth between the backup server and storage device

Answer

Increase the frequency of incremental backups to reduce data volume per job

Answer

Investigate and resolve the file-in-use warnings from the full backup job

Question 3

Refer to the exhibit. A security analyst notices that users on the INSIDE network (10.1.1.0/24) can browse HTTPS websites but cannot resolve domain names. What is the most likely cause?

Accepted Answer

The ACL only permits DNS traffic to host 10.2.2.10, but users need to query a different DNS server. The exhibit shows an ACL that permits DNS traffic (UDP port 53) only to host 10.2.2.10. Since users can browse HTTPS (TCP/443) but cannot resolve domain names, the ACL is blocking DNS queries to any other DNS server. Option B correctly identifies that the ACL restricts DNS to a single server, and if users are configured to query a different DNS server, resolution fails.

Answer

The ACL denies TCP traffic to port 443

Answer

The DNS server at 10.2.2.10 is unreachable

Answer

The OUTSIDE interface has no security-level configured correctly

Question 4

An IT manager is reviewing the service level agreements (SLAs) for a cloud-based email service. The SLA guarantees 99.9% uptime per month. The service experienced an outage of 45 minutes in a 30-day month. Did the service meet the SLA?

Accepted Answer

No, because the allowed downtime for 99.9% uptime is approximately 43 minutes.. The SLA guarantees 99.9% uptime per month. For a 30-day month (43,200 minutes), 99.9% uptime allows only 0.1% downtime, which is 43.2 minutes. The actual outage of 45 minutes exceeds this threshold, so the SLA was not met. Option D correctly identifies the allowed downtime as approximately 43 minutes.

Answer

Yes, because 45 minutes is within 0.1% of the total time.

Answer

Yes, because the SLA is calculated per day, not per month.

Answer

No, because any downtime exceeding 30 minutes is a violation.

Question 5

A company's security policy requires that all laptops have full disk encryption. During an audit, it is discovered that several laptops have encryption enabled but the recovery keys are stored on the local drive. What is the MOST significant risk?

Accepted Answer

Recovery keys can be used to bypass encryption.. Storing recovery keys on the local drive defeats the purpose of full disk encryption (FDE). If an attacker gains physical access to the laptop, they can simply boot an alternate OS or mount the drive and read the recovery key file, then use it to unlock the encrypted volume. This bypasses the encryption entirely, making the data vulnerable to unauthorized access despite encryption being enabled.

Answer

Performance degradation due to encryption overhead.

Answer

Unauthorized access to encrypted data.

Answer

Data corruption during encryption process.

Question 6

A company is migrating its on-premises data center to a public cloud provider. Which of the following is the MOST important control to implement before migration to ensure data security?

Accepted Answer

Implement data encryption at rest and in transit. Data encryption at rest and in transit is the most important control before migration because it protects sensitive data from exposure during the transfer process and after it is stored in the cloud. Without encryption, data could be intercepted over the network or accessed by unauthorized parties in the cloud provider's infrastructure. This control directly addresses the core risk of data leakage during and after migration, which is a fundamental security requirement.

Answer

Enable multi-factor authentication (MFA) for all cloud accounts

Answer

Deploy a cloud access security broker (CASB)

Answer

Establish a virtual private network (VPN) between on-premises and cloud

Question 7

An organization is planning to replace its legacy accounting system with a commercial off-the-shelf (COTS) software package. Which of the following is the PRIMARY risk of using a COTS solution?

Accepted Answer

The software may not fully align with the organization's business processes. The primary risk of a COTS solution is that it is designed for a broad market and may not fully align with the organization's specific business processes. This misalignment can force the organization to change its workflows or perform costly customizations, which can negate the benefits of a packaged solution and introduce project delays or failures.

Answer

The total cost of ownership is likely to be higher than custom development

Answer

The software may have inherent security vulnerabilities

Answer

Vendor support may be discontinued after a few years

Question 8

An organization is developing a web application using an Agile methodology. The security team wants to integrate security testing early in the development lifecycle. Which of the following is the BEST approach to achieve this?

Accepted Answer

Implement static application security testing (SAST) in the continuous integration pipeline. Integrating SAST into the CI pipeline allows automated scanning of source code for vulnerabilities (e.g., SQL injection, XSS) as code is committed, aligning with Agile's iterative development. This shift-left approach catches flaws early, reducing remediation cost and effort compared to later stages.

Answer

Conduct a penetration test after each sprint

Answer

Schedule an annual vulnerability scan of the production environment

Answer

Perform dynamic application security testing (DAST) on deployed builds

Question 9

Which THREE of the following are common challenges when integrating a software package with existing legacy systems? (Select exactly three.)

Accepted Answer

Lack of documented application programming interfaces (APIs). Legacy systems often lack well-documented or standardized APIs, making it difficult to establish reliable interfaces for integration. Without clear API documentation, developers must reverse-engineer communication protocols or rely on outdated methods like screen scraping, which increases integration risk and effort.

Answer

Availability of modern integration middleware

Answer

Need for custom development to bridge the gap

Question 10

An IS auditor is reviewing a change management process. A developer made an emergency change directly to production without following the standard change approval process. The change was later documented as a normal change. Which control weakness is MOST indicated by this scenario?

Accepted Answer

Inadequate segregation of duties between development and production environments. The developer bypassed the standard change approval process by making an emergency change directly to production, then retroactively documenting it as a normal change. This directly violates the principle of segregation of duties (SoD), as the same individual who implemented the change also controlled the documentation and approval trail, eliminating independent oversight. In a properly segregated environment, developers should not have direct write access to production systems without a separate change authorization and deployment step.

Answer

Absence of a rollback plan for emergency changes

Answer

Insufficient testing of emergency changes before deployment

Answer

Lack of a formal change documentation policy

Question 11

An IS auditor is evaluating the effectiveness of an organization's business continuity plan (BCP). Which of the following findings would be of GREATEST concern?

Accepted Answer

The BCP has not been tested in over two years. The BCP has not been tested in over two years is the greatest concern because testing is the only way to validate that the plan works under real-world conditions. Without recent testing, the organization cannot be confident that recovery time objectives (RTOs) and recovery point objectives (RPOs) are achievable, and any gaps or assumptions in the plan remain undiscovered. ISACA standards recommend testing at least annually, and a two-year gap significantly increases the risk of plan failure during an actual disaster.

Answer

The backup tapes are stored in a locked cabinet in the server room

Answer

The BCP contact list has not been updated in six months

Answer

The BCP relies on manual workarounds for critical systems

Question 12

The exhibit shows a log entry from a domain controller. The IS auditor is investigating account lockout issues. What is the MOST likely cause of this event?

Accepted Answer

Multiple failed authentication attempts from the backup server. The log entry shows a failed authentication attempt from the backup server's IP address (10.0.0.15) using the service account 'svc_backup'. The event ID 4625 indicates an account logon failure, and the 'Failure Reason' field explicitly states 'Unknown user name or bad password'. Since the account name is correct, the most likely cause is multiple failed authentication attempts (e.g., due to a stale or incorrect password cached in the backup software) leading to account lockout, not a single event.

Answer

The service account password has expired

Answer

The service account does not exist

Answer

The service account has been disabled by an administrator

Question 13

During a system development project, the project manager notices that the actual cost is significantly higher than the planned cost at the 50% completion point. The earned value (EV) is $500,000, the actual cost (AC) is $600,000, and the planned value (PV) is $550,000. Which of the following is the MOST appropriate action?

Accepted Answer

Conduct a root cause analysis to identify the reasons for cost overrun. Option C is correct because the project is over budget (EV $500K vs AC $600K) and behind schedule (EV $500K vs PV $550K). Before taking corrective action, the project manager must first perform a root cause analysis to understand why costs are exceeding planned values. This aligns with the CISA’s emphasis on identifying the underlying cause of variances before implementing changes to scope, budget, or schedule.

Answer

Request additional budget from senior management

Answer

Reduce the project scope to align with the budget

Answer

Crash the project schedule to make up for lost time

Question 14

Refer to the exhibit. An application log shows an error. What is the MOST likely cause of this error?

Accepted Answer

A duplicate username was inserted into the USERS table. The error message 'Duplicate entry 'admin' for key 'PRIMARY'' indicates a violation of the PRIMARY KEY constraint on the USERS table. Since the username field is the primary key, inserting a second row with the same username (e.g., 'admin') causes MySQL to reject the INSERT operation with error code 1062. This is a unique constraint violation, not a connectivity or privilege issue.

Answer

The database server is offline

Answer

The user does not have insert privileges

Answer

The data type of the username field is incorrect

Question 15

Which TWO are primary objectives of an identity and access management (IAM) program? (Select exactly 2.)

Accepted Answer

Ensuring appropriate access to resources.. Option A is correct because the primary objective of an IAM program is to ensure that the right individuals have access to the appropriate resources at the right time for the right reasons. This is achieved through authentication, authorization, and access control mechanisms such as Role-Based Access Control (RBAC) or Attribute-Based Access Control (ABAC). Without this, the organization cannot enforce security policies or maintain audit trails.

Answer

Encrypting data at rest and in transit.

Answer

Patching software vulnerabilities.

Answer

Monitoring network traffic for anomalies.

Question 16

An organization experiences a critical system failure during non-business hours. The IT team discovers that the last full backup was 48 hours ago, and the incremental backups for the past 24 hours are corrupted. The recovery time objective (RTO) for this system is 4 hours, and the recovery point objective (RPO) is 1 hour. Which of the following is the MOST immediate concern?

Accepted Answer

The data loss may exceed the recovery point objective (RPO). The RPO of 1 hour means the organization can tolerate losing at most 1 hour of data. With the last full backup 48 hours old and incremental backups for the past 24 hours corrupted, the usable recovery point is at least 24 hours old, resulting in data loss far exceeding the 1-hour RPO. This gap between actual and acceptable data loss is the most immediate concern because it directly violates the business continuity requirement.

Answer

The backup schedule should be changed to daily full backups

Answer

The root cause of the failure must be determined before recovery

Answer

The recovery time objective (RTO) of 4 hours will be exceeded

Question 17

An organization is implementing a data loss prevention (DLP) solution. Which of the following is the BEST approach to minimize false positives while ensuring sensitive data is protected?

Accepted Answer

Use contextual analysis including user roles and data classification.. Contextual analysis (Option C) is the best approach because it reduces false positives by considering user roles, data classification, and behavioral patterns, ensuring that only genuinely risky data transfers are flagged. Unlike static methods, this dynamic analysis adapts to the organization's data governance policies, allowing legitimate business communications to proceed while still protecting sensitive information.

Answer

Encrypt all outbound emails containing any attachment.

Answer

Deploy exact file matching against a database of known sensitive documents.

Answer

Apply keyword matching to all outbound emails.

Question 18

A security architect is designing a data classification schema for a multinational corporation. Which combination of factors is MOST critical for determining the classification level of a data asset?

Accepted Answer

Legal, regulatory, and business impact if disclosed.. The classification level of a data asset is primarily determined by the potential harm that could result from its unauthorized disclosure, modification, or loss. Legal, regulatory, and business impact factors—such as compliance with GDPR, HIPAA, or PCI DSS—directly dictate the required confidentiality, integrity, and availability controls. Without assessing these impacts, any classification scheme would be arbitrary and fail to align with organizational risk tolerance.

Answer

Data volume and storage location.

Answer

Data format and encryption status.

Answer

Data creation date and last access time.

Question 19

An organization is implementing a new IT governance framework. Which of the following is the PRIMARY benefit of using a framework like COBIT?

Accepted Answer

Aligning IT strategy with business goals.. COBIT is designed to bridge the gap between business objectives and IT operations by providing a framework that maps IT processes to business goals. The primary benefit is ensuring that IT strategy directly supports and enables business strategy, rather than focusing on cost reduction or risk elimination.

Answer

Reducing IT operational costs.

Answer

Eliminating all IT-related risks.

Answer

Ensuring compliance with all regulatory requirements.

Question 20

Based on the exhibit, what should the IS auditor MOST likely recommend?

Accepted Answer

Review the criteria for emergency changes and enforce proper classification. The exhibit shows changes classified as 'emergency' bypassing the standard approval process. The IS auditor's primary concern is that emergency changes may be misclassified to avoid proper review, increasing risk. Option D is correct because it addresses the root cause: reviewing the criteria for emergency changes and enforcing proper classification ensures that only truly urgent changes bypass standard controls, while all others follow the required approval path.

Answer

Investigate whether any changes are missing from the log

Answer

Immediately block all direct production access for developers

Answer

Require all changes to go through the standard approval process