CISA Practice Test 23 — 15 Questions

Question 1

An organization is implementing a new ERP system. The project sponsor requests a change that will significantly increase project scope without additional budget. Which of the following is the BEST action for the project manager?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Initiate the formal change control process and escalate to the steering committee.. The project manager must follow the formal change control process to evaluate the impact of a scope change that lacks additional budget. Escalating to the steering committee is appropriate because they have the authority to approve or reject changes that affect project constraints, ensuring alignment with organizational governance and IT strategy.

Answer

Accept the change and adjust the project timeline accordingly.

Answer

Implement the change and inform the steering committee later.

Answer

Reject the change because it is outside the original scope.

Question 2

An IS auditor is reviewing an agile software development project. Which of the following practices would BEST help ensure that security controls are adequately addressed?

Accepted Answer

Including security acceptance criteria in user stories. Embedding security acceptance criteria directly into user stories makes security requirements explicit, testable, and part of the definition of done for every increment, ensuring controls are addressed continuously throughout agile development. This shifts security left and integrates it into the team's normal workflow rather than treating it as a separate phase.

Answer

Requiring sign-off from the project sponsor before each sprint review

Answer

Performing a single comprehensive security test after all sprints are complete

Answer

Conducting a formal design review at the end of each sprint

Question 3

Arrange the steps to implement a password policy in the correct order.

Accepted Answer

Define password requirements, then set password expiration, then configure account lockout, then communicate policy to users, then enforce policy.. Password policy implementation: define requirements, set expiration, lockout, communicate, and enforce.

Answer

Communicate policy to users, then define password requirements, then set password expiration, then configure account lockout, then enforce policy.

Answer

Define password requirements, then communicate policy to users, then set password expiration, then configure account lockout, then enforce policy.

Answer

Define password requirements, then set password expiration, then communicate policy to users, then configure account lockout, then enforce policy.

Question 4

A company is implementing a new procurement system. The project team is considering using a rapid application development (RAD) methodology. Which of the following is a potential risk of using RAD?

Accepted Answer

Inadequate documentation. RAD prioritizes speed and iterative prototyping over formal documentation. Because the focus is on quickly delivering working software through user feedback and short development cycles, comprehensive documentation is often neglected or produced after the fact, leading to inadequate records for maintenance, auditing, and compliance.

Answer

Reduced stakeholder involvement

Answer

Longer development time

Answer

Difficulty in prototyping

Question 5

An IT department is struggling with project delays and budget overruns. Which governance practice would be MOST effective?

Accepted Answer

Establishing a project management office (PMO). A PMO provides centralized governance, standardizes project management processes, and enforces oversight across all projects. This directly addresses the root causes of delays and overruns—lack of consistent methodology, resource coordination, and performance monitoring. By establishing a PMO, the IT department gains the structure needed to plan, execute, and control projects effectively, making it the most comprehensive governance practice.

Answer

Outsourcing projects

Answer

Increasing IT staff

Answer

Adopting agile methodology

Question 6

An IS auditor is reviewing the termination procedure for IT employees. Which of the following is the most critical control to ensure immediate effectiveness?

Accepted Answer

Revoking physical and logical access immediately. Immediate revocation of access rights upon termination is the most critical control to prevent unauthorized access.

Answer

Collecting company property

Answer

Notifying the IT department within 24 hours

Answer

Conducting an exit interview

Question 7

An organization is implementing a data loss prevention (DLP) solution. Which TWO of the following are key considerations for effective DLP deployment?

Accepted Answer

Implementing DLP in monitoring mode initially to baseline traffic. Option A is correct because deploying DLP in monitoring (discovery/audit) mode first lets the organization baseline normal data flows, identify false positives, and tune policies before enforcing blocking actions, which minimizes business disruption. Option D is correct because effective DLP fundamentally depends on data classification—labeling data by sensitivity and criticality (e.g., PII, PHI, IP) so policies can accurately identify what to protect and how. Option B is wrong because policies and classification must be defined before agent rollout; deploying agents first without policies provides no meaningful protection and creates management overhead. Option C is wrong because encryption at rest and in transit is a complementary data-protection control, not a prerequisite for DLP deployment. Option E is wrong because DLP augments, not replaces, user security awareness training, which remains essential for reducing human-driven data loss.

Answer

Deploying DLP agents on all endpoints before defining policies

Answer

Encrypting all data at rest and in transit as a prerequisite

Answer

Replacing user security awareness training with automated DLP

Question 8

According to ISACA IT Audit Standards, which phase of the audit process includes the development of an audit programme?

Accepted Answer

Planning. According to ISACA IT Audit Standards, the audit programme — the detailed plan of audit procedures to be performed — is developed during the Planning phase. Planning encompasses scoping, risk assessment, resource allocation, and designing the procedures that will be executed during fieldwork. Reporting, fieldwork, and follow-up occur after the programme has been established.

Answer

Reporting

Answer

Fieldwork

Answer

Follow-up

Question 9

An IT auditor is evaluating the capacity management process. Which of the following findings would be of MOST concern?

Accepted Answer

Resource utilization trends are not monitored. The core purpose of capacity management is to ensure that IT resources are sized and timed to meet current and future demand in a cost-effective manner. This is impossible without monitoring resource utilization trends, because trends are the predictive input that drives forecasting, threshold tuning, and procurement decisions. If trends are not monitored, the organization is reactive rather than proactive and will suffer either performance degradation or wasteful over-provisioning. Therefore, the absence of trend monitoring is the most significant control gap among the findings.

Answer

Alert thresholds are set at 80% utilization

Answer

Capacity thresholds are reviewed annually

Answer

Capacity reports are generated monthly

Question 10

A multinational corporation is implementing a new enterprise resource planning (ERP) system across multiple regions. The project uses a phased roll-out. After the first phase in Asia, the system experiences intermittent synchronization errors between the central database and regional servers. The IT team suspects network latency but cannot reproduce the issue consistently. The project sponsor wants to proceed with the next phase in Europe to avoid further delays. The IS auditor is performing a post-implementation review. What is the MOST appropriate recommendation?

Accepted Answer

Conduct a thorough root cause analysis of the synchronization issue before any further roll-out.. The intermittent synchronization errors indicate a potential data integrity or consistency issue that must be fully understood before expanding the system's footprint. Proceeding without root cause analysis risks propagating the defect to the European phase, which could lead to widespread data corruption, increased remediation costs, and regulatory non-compliance. A thorough root cause analysis (e.g., examining network latency, transaction log replication, or database conflict resolution) is essential to ensure the ERP's distributed architecture is reliable.

Answer

Proceed with the European roll-out and monitor for similar issues.

Answer

Switch to a different ERP vendor that offers better cloud capabilities.

Answer

Document the synchronization error as a known issue and accept the operational risk.

Question 11

An IS auditor is evaluating the effectiveness of an organization's change management process. Which of the following is the most important control to verify during the audit?

Accepted Answer

A segregation of duties exists between development and production.. Segregation of duties between development and production environments ensures that code cannot be directly moved from development to production without independent review and testing. This control prevents unauthorized or untested code from affecting live systems, which is a fundamental principle of change management. Without this separation, a developer could introduce malicious or defective code directly into production, bypassing all quality and security checks.

Answer

All changes are approved by the IT manager.

Answer

Emergency changes are documented after implementation.

Answer

Change requests are prioritized by business impact.

Question 12

Which THREE of the following are indicators of mature IT governance?

Accepted Answer

IT risks are formally assessed and managed.. Option B is correct because mature IT governance requires a formal, repeatable risk management process — risks are identified, assessed, prioritized, and mitigated with defined ownership and reporting, typically aligned to frameworks such as COBIT or ISO/IEC 27005. Option D is correct because governance maturity means IT strategy and investment decisions are driven by and traceable to business objectives, not by technology for its own sake. Option E is correct because board-level oversight through regular IT performance reporting (KPIs, dashboards, risk and compliance updates) demonstrates accountability and direction-setting at the highest level of the organization. Option A does not belong because high staff retention is an HR outcome that may reflect pay or market conditions rather than governance maturity. Option C does not belong because on-time, on-budget delivery is a project management performance metric, not an indicator of governance maturity — projects can be delivered efficiently under poor governance and vice versa.

Answer

The IT department has high staff retention.

Answer

IT projects are completed on time and within budget.

Question 13

Which of the following is a key component of an IT balanced scorecard from the 'internal process' perspective?

Accepted Answer

System availability percentage. The internal process perspective focuses on operational efficiency and effectiveness, such as system availability.

Answer

Customer satisfaction score

Answer

Employee satisfaction

Answer

IT budget variance

Question 14

During which phase of the IS audit process does the auditor perform walkthroughs and test controls?

Accepted Answer

Fieldwork. Walkthroughs and control testing are performed during fieldwork, where the auditor executes planned audit procedures.

Answer

Reporting

Answer

Planning

Answer

Follow-up

Question 15

An IS auditor is assessing the effectiveness of an organization's IT governance framework. Which THREE of the following are key indicators of a mature governance process?

Accepted Answer

Defined roles and responsibilities for IT decisions. Option A is correct because a mature IT governance framework requires clearly defined roles and responsibilities (e.g., RACI matrices) that specify who is accountable for IT decision-making, ensuring ownership and reducing ambiguity. Option C is correct because an IT steering committee provides the formal governance structure through which senior business and IT leaders prioritize investments, align IT with business strategy, and oversee risk—a hallmark of mature governance such as that described in COBIT's EDM and APO domains. Option E is correct because regular measurement of IT performance against defined metrics (e.g., KPIs/KGIs, balanced scorecard) enables continuous monitoring, accountability, and improvement, which is essential for governance maturity. Option B is not a key indicator because an annual budget approval is a routine financial control and does not by itself demonstrate mature governance processes such as decision rights, oversight structures, or performance measurement. Option D is not a key indicator because outsourcing all IT operations is a sourcing decision, not evidence of governance maturity, and could even weaken governance if oversight is not retained.

Answer

Annual IT budget approval by senior management

Answer

Outsourcing of all IT operations