CISA Practice Exam 3 — 20 Questions

Question 1

Refer to the exhibit. Which of the following statements is TRUE regarding this S3 bucket policy?

Accepted Answer

Anonymous read access is allowed only over HTTPS. The S3 bucket policy includes a condition `aws:SecureTransport` set to `true`, which explicitly denies any request that is not made over HTTPS. The `Effect: Allow` on the `Principal: "*"` grants anonymous read access, but the `Condition` block ensures that only HTTPS requests are permitted, making anonymous read access allowed only over HTTPS.

Answer

The bucket is fully public for all actions

Answer

Write access is allowed over HTTP

Answer

Only authenticated users can access objects

Question 2

During an IT audit, the auditor observes that mandatory vacation policies are not enforced for IT staff with access to financial systems. What is the PRIMARY risk associated with this finding?

Accepted Answer

Increased risk of undetected fraud. Mandatory vacation policies force the periodic removal of an employee's access, which allows detection of irregularities or fraudulent activities that require the employee's continued presence to conceal. Without enforcement, a malicious insider could perpetrate fraud (e.g., creating ghost vendors, altering payment records) and cover it up by maintaining daily control over transactions. This directly increases the risk that fraudulent actions will go undetected over extended periods.

Answer

Increased likelihood of system downtime

Answer

Inadequate segregation of duties

Answer

Non-compliance with licensing agreements

Question 3

An IS auditor is evaluating the effectiveness of an organization's change management process. Which of the following is the most important control to verify during the audit?

Accepted Answer

A segregation of duties exists between development and production.. Segregation of duties between development and production environments ensures that code cannot be directly moved from development to production without independent review and testing. This control prevents unauthorized or untested code from affecting live systems, which is a fundamental principle of change management. Without this separation, a developer could introduce malicious or defective code directly into production, bypassing all quality and security checks.

Answer

All changes are approved by the IT manager.

Answer

Emergency changes are documented after implementation.

Answer

Change requests are prioritized by business impact.

Question 4

During an audit, the IS auditor discovers that the audit log for a critical server is overwritten every 24 hours. The auditor wants to ensure logs are preserved for a longer period. Which of the following recommendations is most appropriate?

Accepted Answer

Configure the server to archive logs to a centralized log management system. The most appropriate recommendation is to configure the server to archive logs to a centralized log management system. This ensures logs are preserved beyond the 24-hour overwrite window by sending them to a separate, persistent storage location, which also supports security monitoring, forensics, and compliance requirements. Centralized logging (e.g., using syslog, SIEM, or a dedicated log collector) provides redundancy, integrity checks, and long-term retention without relying on the local server's limited storage.

Answer

Implement a manual backup of logs daily

Answer

Reduce the logging level to minimize data

Answer

Increase the log size to retain more data

Question 5

A multinational corporation is deploying a data loss prevention (DLP) solution across its network. The DLP system must be configured to prevent the exfiltration of personally identifiable information (PII) while minimizing false positives. Which approach is most effective?

Accepted Answer

Use regex patterns for PII combined with context-aware policies (e.g., user role, destination domain). Using regex patterns for PII combined with context-aware policies (e.g., user role, destination domain) allows the DLP system to accurately detect sensitive data while minimizing false positives. Option A is too simplistic; keyword-based blocking can cause high false positives. Option B relies on user training and self-reporting, which is not a technical DLP control and is ineffective. Option C (encryption) protects data at rest and in transit but does not prevent exfiltration; it is not a DLP method.

Answer

Block all outbound email containing keywords such as 'SSN' or 'credit card'

Answer

Require all users to complete annual data handling training and rely on self-reporting

Answer

Implement full disk encryption on all endpoints and encrypt all outbound traffic

Question 6

An IS auditor is reviewing the logical access controls of a financial application. Which of the following is the BEST way to verify that user access rights are appropriate?

Accepted Answer

Compare the user access rights with the job descriptions and responsibilities.. Comparing user access rights directly against job descriptions and responsibilities is the most effective method to verify that access is appropriate based on the principle of least privilege. This approach ensures that each user's permissions align with their actual job functions, which is the core objective of a logical access control review. Interviewing or reviewing lists alone does not validate the appropriateness of access against business roles.

Answer

Interview the IT security manager about the access control process.

Answer

Review the access control list for each user.

Answer

Re-perform a sample of transactions to detect unauthorized access.

Question 7

An IS auditor is preparing the audit report. According to ISACA standards, which of the following should be included in the final audit report?

Accepted Answer

Findings, recommendations, and management action plans. The final audit report should include findings, recommendations, and management's action plans to provide a complete picture and enable follow-up.

Answer

Only the audit findings

Answer

Only the recommendations

Answer

The audit program and procedures

Question 8

An IS auditor is reviewing a change management process. Which TWO elements should be documented in a normal change request to ensure adequate governance? (Select TWO)

Accepted Answer

Test plan. A change request should include a test plan to verify the change works as intended and a rollback plan to revert if the change fails. These are critical for risk management and governance.

Answer

Vendor contact information

Answer

Change requester's name

Answer

Project budget remaining

Question 9

An IS auditor is reviewing a vulnerability scan report and finds that a critical vulnerability on a web server has been open for 90 days beyond the remediation SLA. The system owner states that the vulnerability cannot be patched because it would break a legacy application. What should the auditor recommend?

Accepted Answer

Require the system owner to sign a risk acceptance form. The appropriate action is to formally accept the risk through a documented risk acceptance process, with sign-off from management. This ensures accountability and awareness. The other options are either premature or inappropriate.

Answer

Escalate the issue to the board of directors

Answer

Implement compensating controls and close the finding

Answer

Recommend decommissioning the web server

Question 10

An IS auditor is evaluating the change management process. Which of the following is the BEST indicator that emergency changes are being properly controlled?

Accepted Answer

Emergency changes are documented with a justification and promptly reviewed after implementation. Emergency changes require a documented rationale and timely post-implementation review to ensure proper authorization and minimal risk.

Answer

Emergency changes are approved by the change manager within 24 hours

Answer

Emergency changes are tested in a production-like environment before implementation

Answer

Emergency changes require approval from the CAB before implementation

Question 11

Refer to the exhibit. The IAM policy is intended to allow only requests originating from account 123456789012 to perform any S3 actions. Why does the policy NOT achieve this objective?

Accepted Answer

The condition key 'aws:SourceAccount' only applies when the request is made from another account; it does not restrict access to resources owned by the same account.. The 'aws:SourceAccount' condition key is designed for use in resource-based policies (like S3 bucket policies) to prevent cross-account confusion of resources. It does not restrict access within the same account; it only validates the source account when the request originates from a different account. Since the policy is an IAM identity-based policy (attached to a user/role), the 'aws:SourceAccount' condition is not evaluated for same-account requests, so any principal in account 123456789012 can still perform S3 actions without being restricted by this condition.

Answer

The Resource element is set to "*", which allows all actions on all resources regardless of the condition.

Answer

The policy should include a Deny statement for all other accounts to be effective.

Answer

The Version element is incorrect and should be updated to the latest version.

Question 12

An organization has experienced several security incidents due to unauthorized changes to production systems. Which governance mechanism should be strengthened?

Accepted Answer

Change management process. A change management process ensures that all changes are authorized, tested, and approved, directly addressing unauthorized changes. Asset management, CMDB, and incident response are supportive but not the primary control.

Answer

IT asset management

Answer

Configuration management database

Answer

Incident response plan

Question 13

Refer to the exhibit. An auditor reviews the ACL and notes that it allows traffic from a specific host while blocking other IPs in the same subnet. What is the most likely security issue?

Accepted Answer

The ACL is misconfigured because the permit any at the end bypasses the deny.. The ACL has a 'permit any' statement at the end, which overrides the preceding 'deny' statements. In Cisco ACLs, packets are processed sequentially from top to bottom; once a match is found, no further rules are evaluated. Therefore, the 'deny' for the subnet is never reached, and all traffic (including from the blocked subnet) is permitted, defeating the intended restriction.

Answer

The ACL blocks all traffic from the subnet except the host, which is desired.

Answer

The ACL allows all traffic from the specific host, which is a risk.

Answer

The ACL should be reversed to deny first.

Question 14

A company is implementing a cloud-based identity and access management (IAM) system. Which of the following best describes the principle of least privilege in this context?

Accepted Answer

Permissions should be granted based on the user's role and need-to-know.. The principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions, based on their role and need-to-know. In a cloud-based IAM system, this is typically implemented through role-based access control (RBAC) or attribute-based access control (ABAC), ensuring minimal exposure to sensitive resources and reducing the attack surface.

Answer

Users should have administrative rights for troubleshooting.

Answer

Permissions should be revoked only when an employee leaves the company.

Answer

All users should have the same level of access for consistency.

Question 15

An IT steering committee is reviewing a proposal for a new customer relationship management (CRM) system. Which of the following BEST demonstrates that the proposal aligns with the organization's strategic goals?

Accepted Answer

The business case includes a clear link to the organization's five-year strategic plan.. A clear link to the organization's five-year strategic plan demonstrates that the proposal aligns with strategic goals. Option B is about the project manager's experience, which does not indicate strategic alignment. Option C describes a feature that may be beneficial but is not inherently tied to strategic goals. Option D is a cost-saving tactic, not evidence of strategic alignment.

Answer

The project manager has extensive experience with CRM implementations.

Answer

The proposed system includes advanced analytics capabilities.

Answer

The vendor offers discounted licensing for the first year.

Question 16

Which of the following is the MOST important objective of system testing?

Accepted Answer

Verify that the system meets specified requirements. System testing is a formal, structured process that validates the entire integrated system against its specified requirements. The primary goal is to confirm that the system behaves as defined in the functional and technical specifications, ensuring that all requirements are correctly implemented before user acceptance testing. While user satisfaction and defect removal are important, they are secondary to verifying requirement compliance, which is the core objective of system testing.

Answer

Confirm that end users are satisfied

Answer

Ensure the code is free of defects

Answer

Validate system performance under load

Question 17

Which TWO of the following are key elements of an effective incident response plan? (Select exactly 2.)

Accepted Answer

A clear escalation path with contact information. A clear escalation path (C) ensures incidents are reported to the right stakeholders for timely decision-making, while predefined communication templates (E) enable rapid and consistent notifications to internal and external parties. These are directly used during incident response. Post-incident reviews (A) are important but not a key element of the plan itself; software licenses (B) and hardware serial numbers (D) are asset management details, not incident response essentials.

Answer

A schedule for post-incident reviews

Answer

A detailed inventory of software licenses

Answer

A list of all hardware serial numbers

Question 18

An IS auditor is reviewing the process for granting privileged access in a large organization. Which of the following findings should be of MOST concern?

Accepted Answer

Privileged access is granted without approval from the system owner. Privileged access requests must be properly authorized to prevent unauthorized elevation of privileges.

Answer

Privileged accounts are not monitored in real-time

Answer

Privileged access is reviewed quarterly

Answer

There is no segregation of duties for privileged users

Question 19

An IT auditor is reviewing the business continuity plan (BCP) for a financial services firm. The plan includes a hot site that is shared with another organization under a reciprocal agreement. Which of the following findings should be of MOST concern to the auditor?

Accepted Answer

The reciprocal agreement does not guarantee exclusive use of the hot site during a disaster. A reciprocal agreement for a shared hot site does not guarantee exclusive access during a disaster. If both organizations declare a disaster simultaneously, the site may become oversubscribed, leading to resource contention and potential failure of the BCP. This directly undermines the recovery capability, making it the most critical finding.

Answer

The hot site uses a different internet service provider than the primary site

Answer

The hot site has not been tested in the past 12 months

Answer

The hot site is located in the same seismic zone as the primary site

Question 20

During a system development project, the project manager notices that the actual cost is significantly higher than the planned cost at the 50% completion point. The earned value (EV) is $500,000, the actual cost (AC) is $600,000, and the planned value (PV) is $550,000. Which of the following is the MOST appropriate action?

Accepted Answer

Conduct a root cause analysis to identify the reasons for cost overrun. The project is over budget (EV $500K vs AC $600K) and behind schedule (EV $500K vs PV $550K). Before taking corrective action, the project manager must first perform a root cause analysis to understand why costs are exceeding planned values. This aligns with the CISA’s emphasis on identifying the underlying cause of variances before implementing changes to scope, budget, or schedule.

Answer

Request additional budget from senior management

Answer

Reduce the project scope to align with the budget

Answer

Crash the project schedule to make up for lost time