CISA Practice Exam 4 — 20 Questions

Question 1

An organization is transitioning from a waterfall to an agile development methodology. Which of the following is a key risk that the IS auditor should highlight?

Accepted Answer

Scope creep may increase without proper controls.. In agile development, iterative cycles and continuous feedback can lead to scope creep if changes are not managed through a disciplined backlog prioritization process. Unlike waterfall, where scope is fixed early, agile's flexibility requires robust controls (e.g., sprint boundaries, product owner authority) to prevent uncontrolled expansion. An IS auditor should highlight this risk because without proper governance, the project may exceed budget and timeline despite agile's adaptive nature.

Answer

User requirements may be incomplete at the start.

Answer

Testing is deferred until the end of the project.

Answer

Stakeholder involvement may decrease.

Question 2

Which THREE of the following are essential components of a data classification program?

Accepted Answer

Data retention and disposal schedules. Data retention and disposal schedules are essential to a data classification program because they define how long each classification level of data must be retained and the secure methods for its disposal (e.g., degaussing, cryptographic erasure, or physical shredding). This ensures that data is not kept beyond its useful life, reducing the risk of unauthorized access or legal non-compliance. Without these schedules, the classification program lacks the lifecycle management component necessary for operational security.

Answer

Regular vulnerability scanning

Answer

Implementation of database encryption

Question 3

A software development company uses a cloud-based source code repository (e.g., GitHub) to store proprietary code. The company has two-factor authentication (2FA) enabled for all accounts. A developer's personal computer was infected with malware that stole the developer's session cookies and local credentials. The attacker used the stolen session to access the code repository and exfiltrated the entire codebase. The company's security team reviews the incident and notes that the repository has audit logging, but the logs were not monitored in real time. The team wants to implement additional controls to prevent a similar incident. Which control would have been most effective in preventing the exfiltration?

Accepted Answer

Require access to the code repository only from company-managed IP addresses. Restricting access to the code repository to only company-managed IP addresses (e.g., via a VPN or a corporate NAT gateway) would have prevented the attacker from using the stolen session cookies from an external, non-corporate IP. Even though the attacker had valid session tokens, the repository's access control list (ACL) would have blocked the connection at the network layer, stopping the exfiltration before it could begin. This control addresses the root cause—unauthorized network origin—rather than relying on detection or session management alone.

Answer

Use a SIEM to alert on unusual access patterns in real time

Answer

Enforce code signing for all commits

Answer

Implement a shorter session timeout for the code repository

Question 4

Which TWO of the following are primary objectives of a business continuity plan (BCP)?

Accepted Answer

Maintain regulatory compliance during disruptions. A primary objective of a BCP is to ensure that the organization can continue to meet legal and regulatory obligations during a disruption. This includes maintaining required data protection, reporting, and operational standards as mandated by regulations such as GDPR, HIPAA, or SOX, even when normal operations are impaired.

Answer

Replace the disaster recovery plan

Answer

Minimize financial loss

Answer

Guarantee 100% system uptime

Question 5

An organization is adopting an agile development methodology for a new financial application. During a sprint review, the product owner expresses concern that the system does not enforce segregation of duties (SoD). The development team argues that SoD will be addressed in a future sprint. As the IS auditor, what is the BEST recommendation?

Accepted Answer

Insist that SoD be implemented in the next sprint.. In agile development, security and compliance requirements like segregation of duties (SoD) must be addressed as early as possible, especially for a financial application where regulatory compliance is critical. Delaying SoD to a future sprint introduces significant risk and violates the principle of 'secure by design.' The IS auditor's best recommendation is to insist that SoD be implemented in the next sprint, ensuring that the control is prioritized and integrated into the development lifecycle without waiting for an indefinite future iteration.

Answer

Suggest that the product owner accept the residual risk.

Answer

Accept the team's plan and document the risk.

Answer

Require immediate implementation of SoD in this sprint.

Question 6

An IS auditor is reviewing the organization's incident management process. Which THREE of the following are essential components of an effective incident response plan?

Accepted Answer

Defined roles and responsibilities for the incident response team. An effective IR plan must include clear roles, communication procedures, and criteria for escalation and severity classification to ensure timely and coordinated response.

Answer

A list of all employees and their contact information

Answer

A detailed technical guide for each software application

Question 7

A company plans to implement a commercial off-the-shelf (COTS) application and requires significant customization to match its unique business processes. The vendor advises against extensive customization because it may complicate future upgrades. What is the BEST course of action?

Accepted Answer

Avoid customization and re-engineer business processes to match the COTS application. The best course of action is to avoid customization and re-engineer business processes to match the COTS application. This approach preserves the integrity of the vendor's standard codebase, ensuring that future upgrades and patches can be applied with minimal friction. Extensive customization creates a fork from the vendor's baseline, leading to costly regression testing, potential security gaps, and upgrade incompatibilities that undermine the long-term value of the COTS investment.

Answer

Use the vendor's customization module to minimize upgrade risks

Answer

Customize but maintain detailed documentation for upgrade impact analysis

Answer

Proceed with extensive customization to meet business needs

Question 8

Which TWO of the following are considered essential components of an information security policy framework? (Choose two.)

Accepted Answer

Data classification policy. A data classification policy is essential because it defines how information assets are categorized based on sensitivity and criticality (e.g., public, internal, confidential, restricted). This classification directly drives the selection and enforcement of appropriate security controls, such as encryption standards (e.g., AES-256 for confidential data) and access control mechanisms (e.g., role-based access control). Without it, security measures cannot be consistently applied across the organization, leading to gaps in protection.

Answer

Business continuity plan

Answer

Incident response plan

Answer

Network architecture diagram

Question 9

A financial institution is deploying a data loss prevention (DLP) solution. Which of the following is the MOST important prerequisite to ensure the DLP can effectively detect sensitive data?

Accepted Answer

Performing a data classification exercise. A DLP solution detects sensitive data by matching content against predefined patterns or rules. Without a data classification exercise, the organization cannot define what constitutes 'sensitive data' (e.g., PII, PCI, IP), making the DLP blind to what it should monitor. Classification provides the taxonomy and metadata (e.g., labels, tags) that the DLP engine uses to trigger alerts or blocks, ensuring detection is both accurate and aligned with policy.

Answer

Configuring incident response procedures

Answer

Installing endpoint agents on all devices

Answer

Implementing network segmentation

Question 10

An organization is implementing a data loss prevention (DLP) solution. Which of the following is the BEST approach to reduce false positives during initial deployment?

Accepted Answer

Deploy in monitor-only mode and analyze alerts for a period. Deploying a DLP solution in monitor-only mode allows the organization to observe what data is being transmitted and generate alerts without blocking any traffic. This enables security teams to analyze the alerts against actual business workflows, fine-tune policies, and eliminate false positives before moving to an active enforcement mode. It is a best practice for initial deployment to avoid disrupting legitimate business operations.

Answer

Use default policies without modification

Answer

Limit scope to one department to minimize noise

Answer

Block all sensitive data transmissions immediately

Question 11

An organization is implementing a change management process based on ITIL. Which THREE change types should be included in the policy?

Accepted Answer

Emergency change – requires immediate implementation to resolve a major incident.. ITIL defines an Emergency change as one that must be implemented as soon as possible—often to resolve a major incident or security vulnerability. This change type bypasses the normal CAB approval cycle and uses a dedicated Emergency CAB (ECAB) process to authorize and implement the fix rapidly while still maintaining control.

Answer

Planned change – scheduled during maintenance windows with no approval needed.

Answer

Major change – requires executive approval and a separate risk assessment.

Question 12

An organization is implementing a data classification policy and needs to assign ownership for sensitive data. Which of the following is the most appropriate role to assign as the data owner?

Accepted Answer

The head of the business unit that creates and uses the data. The data owner is the person or entity with ultimate accountability for a specific dataset, typically a senior business manager who understands the data's value, legal requirements, and usage context. In this scenario, the head of the business unit that creates and uses the data is best positioned to classify the data, authorize access, and ensure compliance with the data classification policy, as they have direct business responsibility for the data's lifecycle.

Answer

The chief information security officer (CISO)

Answer

The system administrator of the database

Answer

The legal counsel responsible for compliance

Question 13

An organization's backup strategy includes taking full backups weekly and transactional log backups every 15 minutes. The auditor wants to verify that backup encryption is implemented for offsite storage. Which control is most relevant?

Accepted Answer

Backup encryption at rest. Backup encryption at rest ensures that data stored offsite is protected from unauthorized access, which is a key control for offsite backups.

Answer

Backup compression

Answer

Offsite transport log

Answer

Backup verification logs

Question 14

A large financial institution is evaluating the effectiveness of its IT governance framework. The board has requested a review to ensure alignment with business objectives and regulatory requirements. Which of the following is the MOST important factor for the board to consider when assessing the IT governance framework?

Accepted Answer

The framework is integrated with enterprise governance and supports strategic objectives.. An effective IT governance framework must be integrated with enterprise governance to ensure alignment with business objectives and regulatory requirements. Option B is incorrect because incident response is an operational process, not a primary board-level governance consideration. Option C is incorrect because technical efficiency is a management concern, not a governance-level factor. Option D is incorrect because minimizing IT costs is a tactical objective that may conflict with strategic priorities.

Answer

The framework includes a detailed incident response plan.

Answer

The framework focuses on achieving high technical efficiency.

Answer

The framework minimizes overall IT costs.

Question 15

A company's availability monitoring shows that a critical application has an average MTBF of 720 hours and an average MTTR of 4 hours. What is the availability percentage?

Accepted Answer

99.45%. Availability = MTBF / (MTBF + MTTR) = 720 / (720 + 4) = 720 / 724 ≈ 0.994475, or 99.45%.

Answer

99.72%

Answer

99.17%

Answer

99.95%

Question 16

Refer to the exhibit. The IS auditor reviews the router's version output during an audit. What is the MOST significant finding?

Accepted Answer

The IOS version is outdated and may contain security vulnerabilities.. The most significant finding is that the IOS version is outdated and may contain security vulnerabilities. An outdated IOS version can have known exploits that compromise the router's security, which is a critical risk for the organization. While other options describe operational states, they do not present the same level of immediate security threat as running unsupported or vulnerable firmware.

Answer

The router was returned to ROM by power-on.

Answer

The router has been running for over two years without a reboot.

Answer

The system image is stored in flash memory.

Question 17

An organization's backup strategy includes full backups every Sunday and incremental backups on other days. On Wednesday, a failure occurs. Which backups are needed to restore the data?

Accepted Answer

Sunday's full backup and Monday through Wednesday incremental backups. To restore from incremental backups, you need the last full backup (Sunday) and all incremental backups from Monday through Wednesday.

Answer

Sunday's full backup only

Answer

Sunday's full backup and Wednesday's incremental backup

Answer

Wednesday's incremental backup only

Question 18

A multinational corporation is evaluating its IT governance structure. The board wants to ensure that IT investments are prioritized based on risk and value. Which framework component is MOST critical?

Accepted Answer

Portfolio management process. A portfolio management process systematically evaluates and prioritizes investments based on risk and value, aligning with board objectives. Steering committee provides oversight, but portfolio management is the mechanism for prioritization.

Answer

Service level agreements

Answer

Balanced scorecard

Answer

IT steering committee

Question 19

Which TWO of the following are key benefits of using a system development life cycle (SDLC) methodology? (Select exactly two.)

Accepted Answer

It provides a structured approach to system development. SDLC provides a structured approach to system development (Option A), ensuring that phases are followed and projects are managed systematically. It also ensures that user requirements are captured and validated through continuous user involvement (Option B). Option C is incorrect because SDLC does not prevent scope changes; it helps manage and control them. Option D is incorrect because security testing is an integral part of SDLC, not eliminated. Option E is incorrect because SDLC may involve additional upfront costs, though it reduces long-term rework costs.

Answer

It prevents any scope changes during development

Answer

It eliminates the need for security testing

Answer

It reduces the overall cost of development

Question 20

An IS auditor is reviewing backup procedures for a critical database. Which THREE are key considerations for ensuring backup reliability and recoverability?

Accepted Answer

Ensuring backup retention periods meet the recovery point objective (RPO).. Backup reliability requires regular testing (restore verification), secure offsite storage to protect against site disasters, and retention aligned with business recovery objectives. Encryption is important but not directly for reliability; compression may affect performance but not reliability.

Answer

Encrypting backup data to prevent unauthorized access.

Answer

Compressing backup data to reduce storage costs.