CISA Practice Test 23 — 15 Questions

Question 1

During a vendor evaluation for a critical system, the IS auditor notes that the vendor's SOC 2 report includes an adverse opinion. What should be the auditor's PRIMARY recommendation?

Accepted Answer

Evaluate compensating controls or seek an alternative vendor. An adverse SOC 2 opinion indicates material weaknesses in controls; the organization should seek compensating controls or consider alternative vendors.

Answer

Negotiate a lower price to offset the risk

Answer

Accept the risk because the vendor is well-known

Answer

Request a customized SOC 2 report

Question 2

An organization is implementing a new payroll system using an agile methodology. Which TWO of the following are the MOST important controls for the IS auditor to assess?

Accepted Answer

The product backlog is prioritized and includes security requirements. In agile, the product backlog is the primary control for requirements, and sprint reviews provide stakeholder validation.

Answer

Comprehensive documentation of all design decisions

Answer

A formal change control board to approve all changes

Answer

A detailed project plan with all tasks upfront

Question 3

An organization is developing a business continuity strategy. Which THREE of the following are essential components of a comprehensive BC strategy?

Accepted Answer

Alternate facilities. People procedures, alternate facilities, and data/technology recovery are core to BC.

Answer

Software licensing compliance

Answer

Vendor audit reports

Question 4

Which of the following is a primary advantage of fixed-price contracts in systems acquisition?

Accepted Answer

Predictable cost for the buyer. Fixed-price contracts provide cost certainty for the buyer, as the vendor bears the risk of cost overruns.

Answer

Vendor has incentive to complete quickly

Answer

Greater flexibility to change requirements

Answer

Lower total cost compared to time-and-materials

Question 5

An organization is implementing a new financial system using the waterfall SDLC model. Which of the following is the MOST critical control to ensure that business requirements are met?

Accepted Answer

Formal user acceptance testing (UAT) sign-off. In the waterfall model, requirements are defined upfront and formal sign-off at each phase is critical. Formal user acceptance testing (UAT) is the key control to ensure the system meets business needs before deployment.

Answer

Automated unit testing results

Answer

Code reviews by the development team

Answer

Detailed technical design documents

Question 6

Which of the following BEST describes the role of threat modeling in the design phase of the SDLC?

Accepted Answer

To analyze the system architecture for potential security threats. Threat modeling proactively identifies potential security threats and vulnerabilities in the system architecture to design appropriate controls.

Answer

To define functional requirements for the system

Answer

To test the application's resilience to attacks

Answer

To identify and mitigate security vulnerabilities in the code

Question 7

An organization is deploying a major system upgrade. The change request has been approved by CAB, but the deployment plan does not include a rollback procedure. As an IS auditor, what should you recommend?

Accepted Answer

Delay the deployment until a rollback plan is created and tested. Without a rollback plan, if the deployment fails, the system may be unavailable for an extended period, impacting business operations.

Answer

Perform the deployment during off-peak hours to minimize impact

Answer

Document the decision to skip rollback in the change record

Answer

Proceed with deployment as CAB approval is sufficient

Question 8

Which of the following is a key objective of the design phase in the SDLC?

Accepted Answer

To define system architecture and integrate security controls. The design phase defines the system architecture and ensures security controls are incorporated rather than added later.

Answer

To conduct user acceptance testing

Answer

To develop code

Answer

To gather business requirements

Question 9

During a change management audit, the IS auditor notes that an emergency change was implemented to fix a critical security vulnerability. Which of the following should the auditor expect to find in the change documentation?

Accepted Answer

A rollback plan. Emergency changes require a rollback plan to ensure the system can be restored if the change fails. A full test plan may be abbreviated.

Answer

A post-implementation review scheduled six months later

Answer

A formal change request approved by the Change Advisory Board (CAB) before implementation

Answer

A complete test plan executed before deployment

Question 10

An organization is considering replacing its legacy financial system with a new ERP solution. Which of the following is the PRIMARY advantage of purchasing a commercial off-the-shelf (COTS) ERP package over building a custom system?

Accepted Answer

Faster implementation. COTS packages typically have a faster implementation timeline because the core functionality already exists, reducing development time.

Answer

Greater control over customization

Answer

Lower total cost of ownership

Answer

Complete alignment with business processes

Question 11

An IS auditor is reviewing a software development project that follows the waterfall model. Which of the following is the MAIN advantage of this methodology?

Accepted Answer

Clear milestones and documentation at each phase. Waterfall's sequential phases and formal sign-offs provide clear milestones and documentation.

Answer

Reduced risk of requirements misinterpretation

Answer

Early delivery of working software increments

Answer

Ability to accommodate changing requirements easily

Question 12

An IS auditor is reviewing the system design phase of a project. Which of the following activities is most important to ensure that security is adequately addressed?

Accepted Answer

Conducting a threat modeling exercise. Threat modeling identifies potential security threats and informs the design of controls, ensuring security is built in.

Answer

Creating a data flow diagram

Answer

Developing a detailed project schedule

Answer

Reviewing the budget for security tools

Question 13

During which phase of the waterfall SDLC should security requirements be formally documented and approved by the business owner?

Accepted Answer

Requirements phase. In the waterfall model, security requirements must be defined during the requirements phase to ensure they are integrated into the design. Formal sign-off by the business owner ensures accountability.

Answer

Development phase

Answer

Design phase

Answer

Testing phase

Question 14

Which of the following is the primary purpose of conducting a static application security test (SAST) during the development phase of the SDLC?

Accepted Answer

To identify security vulnerabilities in the source code. SAST analyzes source code for vulnerabilities early in development, allowing fixes before deployment.

Answer

To ensure the application is free of runtime errors

Answer

To validate that the application meets business requirements

Answer

To test the application's performance under load

Question 15

An IS auditor is reviewing change management procedures and finds that standard changes are approved by the change manager without CAB review. What is the auditor's BEST conclusion?

Accepted Answer

This is acceptable provided that standard changes are clearly defined and low-risk. Standard changes are pre-approved, low-risk changes that do not require CAB review. This is acceptable if the criteria for standard changes are properly defined.

Answer

The change manager should be a member of the CAB

Answer

The auditor should recommend that all changes go through CAB

Answer

This is a control weakness because all changes should be reviewed by the CAB