CISA Practice Test 25 — 15 Questions

Question 1

Which of the following is the PRIMARY purpose of conducting a privacy impact assessment (PIA)?

Accepted Answer

To identify privacy risks and recommend mitigations. A PIA identifies and mitigates privacy risks associated with the processing of personal data.

Answer

To document the data processing activities

Answer

To obtain consent from data subjects

Answer

To ensure compliance with data protection laws

Question 2

An organization uses shared accounts for system administration. Which of the following is the MOST significant audit concern?

Accepted Answer

Lack of individual accountability and audit trail. Shared accounts make it impossible to attribute actions to specific individuals, leading to loss of audit trail and non-repudiation. This is critical for forensic investigations and accountability.

Answer

Increased complexity of password management

Answer

Violation of segregation of duties

Answer

Higher risk of password sharing outside the team

Question 3

An IT auditor is reviewing the business continuity plan (BCP) testing schedule. The organization conducts a test where participants discuss their roles and responses to a scenario without any actual system activation. Which type of test is this?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based test where participants walk through a scenario without executing procedures or activating systems.

Answer

Parallel test

Answer

Walkthrough

Answer

Simulation

Question 4

An organization is implementing a change management process. A change that requires approval from the Change Advisory Board (CAB) but is scheduled to be implemented during the next maintenance window is classified as which type of change?

Accepted Answer

Normal change. Standard changes are pre-approved and low risk; emergency changes require urgent approval. Normal changes require CAB approval.

Answer

Emergency change

Answer

Standard change

Answer

Minor change

Question 5

During a change advisory board (CAB) meeting, a proposed change to the database server is discussed. The change involves implementing a security patch that requires a reboot. The change is categorized as 'normal' and has been risk-assessed as low impact. What is the most likely role of the CAB in this scenario?

Accepted Answer

Review and approve the change. The CAB reviews and approves changes based on risk and impact. For a low-risk normal change, the CAB typically authorizes the change, possibly with standard procedures.

Answer

Implement the change directly

Answer

Reject the change as unnecessary

Answer

Defer the change to the next release cycle

Question 6

An IS auditor is assessing network security controls. Which TWO of the following are key elements of a firewall rule review?

Accepted Answer

Verifying that each rule has a business justification. A firewall rule review should compare documented rules with actual configured rules and verify business justifications for each rule.

Answer

Checking for default passwords on firewall

Answer

Testing firewall failover capabilities

Answer

Reviewing firewall performance metrics

Question 7

In business continuity planning, a company identifies a critical business process with a maximum tolerable downtime (MTD) of 4 hours. What is the primary purpose of this metric?

Accepted Answer

To determine the recovery time objective (RTO). MTD defines the maximum time a process can be unavailable without causing severe business impact. It sets the recovery time objective (RTO) target.

Answer

To define the backup frequency

Answer

To calculate the mean time between failures (MTBF)

Answer

To establish service level agreements (SLAs)

Question 8

During an audit of network security controls, the IS auditor reviews firewall rule sets and identifies a rule that allows any-to-any traffic from the internal network to the Internet. The rule has a business justification. What is the auditor's BEST recommendation?

Accepted Answer

Implement a more restrictive rule set based on specific IP addresses and ports. Overly permissive rules should be tightened to reduce risk; the auditor should recommend implementing more specific rules based on actual needs.

Answer

Add an intrusion prevention system (IPS) to monitor the traffic

Answer

Require all traffic to go through a proxy server

Answer

Accept the risk because there is a business justification

Question 9

An organization is developing a business continuity strategy. According to best practices, which THREE of the following should be included in the strategy?

Accepted Answer

Customer and partner communications plan.. A comprehensive BCP includes procedures for people, alternate facilities, and communications.

Answer

Vendor contract renewal dates.

Answer

IT asset inventory list.

Question 10

An IS auditor is reviewing the process for granting access to a critical financial system. The auditor finds that access requests are approved by the system owner but there is no segregation between the request and approval functions for emergency access. Which of the following is the BEST control to mitigate this risk?

Accepted Answer

Implement a break-glass procedure with post-event review. For emergency access, a break-glass procedure with post-event review ensures that urgent access is granted quickly but is later reviewed for appropriateness and accountability.

Answer

Require two-factor authentication for emergency access

Answer

Disable emergency access and require standard approval

Answer

Log all emergency access activities without review

Question 11

An organization uses shared accounts for system administration. Which of the following is the BEST control to mitigate the risk of non-repudiation?

Accepted Answer

Implementing a privileged access management (PAM) solution with session recording.. To ensure accountability, individual user authentication must be implemented before granting privileged access.

Answer

Changing the shared account password after each use.

Answer

Logging all commands executed by the shared account.

Answer

Requiring two-factor authentication for the shared account.

Question 12

An IS auditor is reviewing the logical access controls for a critical financial application. Which of the following is the MOST important control to ensure that user access rights remain appropriate over time?

Accepted Answer

Conducting periodic access recertification. Periodic access recertification ensures that users' access rights are reviewed and confirmed by managers, reducing the risk of excessive or inappropriate access.

Answer

Implementing single sign-on (SSO)

Answer

Enforcing password complexity rules

Answer

Using role-based access control (RBAC)

Question 13

An organization uses a public key infrastructure (PKI) to issue digital certificates. The IS auditor is reviewing the certificate lifecycle management. Which of the following is the GREATEST risk if certificate revocation lists (CRLs) are not updated in a timely manner?

Accepted Answer

Compromised certificates could still be used to establish trust. If CRLs are stale, revoked certificates may still be trusted, allowing unauthorized parties to impersonate legitimate entities or access encrypted data.

Answer

Certificate authorities may lose their root key

Answer

Certificates may expire without renewal

Answer

Users may not be able to verify certificate signatures

Question 14

An organization is implementing a key management program to protect encryption keys. Which of the following is the MOST important control to ensure the security of cryptographic keys?

Accepted Answer

Storing keys in a hardware security module (HSM). Using a hardware security module (HSM) provides tamper-resistant storage and management of keys, which is the most important control for key security. Other controls are important but secondary.

Answer

Separating key management duties

Answer

Regular key rotation

Answer

Encrypting keys with a master key

Question 15

During an audit of a public key infrastructure (PKI), the IS auditor finds that certificate revocation lists (CRLs) are only updated weekly. Which of the following is the MOST significant risk?

Accepted Answer

Revoked certificates may be accepted as valid. Delays in CRL updates increase the window during which a revoked certificate may be accepted, potentially allowing unauthorized access.

Answer

Certificate authorities may become unavailable

Answer

Increased network traffic due to large CRLs

Answer

Users may experience delays in certificate validation