CISA Practice Test 25 — 15 Questions

Question 1

An organization's business continuity plan (BCP) includes alternate facilities that can be operational within 24 hours. The maximum tolerable downtime (MTD) for a critical process is 12 hours. What is the most significant gap?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The alternate facility cannot be activated within the required MTD.. The alternate facility recovery time (24 hours) exceeds the MTD (12 hours), meaning the process would fail its recovery requirement.

Answer

The BCP does not include customer communication procedures.

Answer

The BCP does not address data backup procedures.

Answer

The recovery time objective (RTO) for the process is not defined.

Question 2

An organization is developing its IT strategy to align with the overall business strategy. The business strategy emphasizes rapid market expansion through digital products. Which of the following IT strategies would BEST support this business goal?

Accepted Answer

Adopt agile development methods and scalable cloud infrastructure.. A business strategy focused on rapid market expansion through digital products requires IT to deliver quickly and scale elastically. Agile development methods enable fast iteration and responsiveness to market feedback, while scalable cloud infrastructure provides the elasticity to handle growth without heavy upfront capital investment. Together they directly enable speed and scale, which are the core requirements of the stated strategy.

Answer

Standardize all IT systems to reduce complexity.

Answer

Outsource all IT operations to a low-cost provider.

Answer

Minimize IT investment to preserve capital for business growth.

Question 3

Which THREE of the following are components of the ITIL 4 service value system? (Select THREE)

Accepted Answer

Continual improvement. ITIL 4's service value system includes the service value chain, guiding principles, governance, practices, and continual improvement. The service value chain, guiding principles, and continual improvement are key components. Service level agreements are outputs, not components of the system. The four dimensions are part of the service value system but are not listed as components; they are dimensions. The question asks for three, and the correct ones are: service value chain, guiding principles, and continual improvement.

Answer

Four dimensions of service management

Answer

Service level agreements

Question 4

During a post-implementation review of a new accounting system, the IS auditor notes the following: the project was completed on time and within budget, but user satisfaction is low and there are several outstanding defect reports. Which THREE of the following are the MOST appropriate recommendations?

Accepted Answer

Compare actual benefits achieved against the business case. Option A is correct because a post-implementation review must measure realized benefits against the original business case to determine whether the system delivered the expected value, especially when satisfaction is low. Option B is correct because outstanding defect reports represent unresolved risks to data integrity and operational reliability in an accounting system, so a formal remediation plan with ownership, priorities, and target dates is the appropriate control response. Option E is correct because a lessons learned session captures root causes of the schedule/budget-versus-quality gap and feeds process improvements into future projects. Option C is not appropriate as a primary recommendation because additional budget is a funding request, not a control or governance action, and cost should follow an approved defect remediation plan. Option D is not appropriate because escalation to the sponsor may be a communication step, but it does not by itself resolve the defects or address the underlying process weaknesses.

Answer

Request additional budget to fix the defects

Answer

Immediately escalate the defect reports to the project sponsor

Question 5

An organization is developing a business continuity strategy. According to best practices, which THREE of the following should be included in the strategy?

Accepted Answer

Customer and partner communications plan.. A customer and partner communications plan (A) is a required element of a business continuity strategy because during a disruption the organization must be able to notify external stakeholders about service status, expected recovery times, and alternate contact channels, which protects reputation and contractual relationships. Procedures for staff to work remotely (C) belong in the strategy because personnel are the most critical resource; documented remote-work procedures ensure that essential functions can continue when the primary site is unavailable. Details of alternate processing facilities (E) are essential because the strategy must identify where and how critical systems and operations will be resumed, including recovery site type (hot, warm, or cold), location, and activation criteria. Vendor contract renewal dates (B) are administrative procurement data rather than continuity planning content, and an IT asset inventory list (D) is an operational input used during business impact analysis and recovery planning, not a strategic continuity element itself.

Answer

Vendor contract renewal dates.

Answer

IT asset inventory list.

Question 6

Which TWO of the following are benefits of an iterative SDLC approach compared to waterfall? (Select two.)

Accepted Answer

Early and frequent feedback from stakeholders. Option A is correct because iterative SDLC delivers working increments at the end of each short iteration, letting stakeholders review and provide feedback early and frequently rather than waiting until the end of the project as in waterfall. Option D is correct because iterative development welcomes and accommodates changing requirements between iterations, whereas waterfall typically freezes requirements after the initial phase and makes late changes costly. Option B is not inherently true, since iterative methods still require documentation and may even produce more artifacts across iterations. Option C is wrong because iterative projects are generally less predictable in overall timeline due to evolving scope, unlike waterfall's fixed sequential plan. Option E is incorrect because iterative approaches actually increase, not reduce, the need for ongoing user involvement through regular reviews and feedback.

Answer

Simpler documentation requirements

Answer

Predictable project timeline

Answer

Reduced need for user involvement

Question 7

During a vendor audit, an IS auditor discovers that a cloud service provider uses subcontractors to manage data storage. The contract does not mention subcontracting. Which THREE risks should the auditor highlight to management?

Accepted Answer

Vendor concentration risk from subcontractor dependency. Option A is correct because undisclosed subcontracting creates vendor concentration risk: the organization becomes dependent not only on the primary provider but also on subcontractors it did not evaluate or approve, so a subcontractor failure or change can disrupt critical data storage services. Option B is correct because the absence of subcontracting clauses complicates the exit strategy — the organization may lack contractual rights to require transition assistance, data return, or cooperation from subcontractors during termination or migration. Option E is correct because unmanaged subcontractors are fourth parties, and without contractual flow-down requirements (e.g., security, privacy, audit rights, SLAs), the provider's oversight of them is unverified, exposing the organization to compliance and data protection failures. Option C is not a risk but a potential benefit, and it is not guaranteed by subcontracting. Option D is not a relevant risk here, since the scenario concerns undisclosed data storage subcontracting, not licensing cost increases.

Answer

Improved service level performance

Answer

Increased licensing costs

Question 8

A company is developing a new financial application. Which THREE of the following are valid reasons to involve internal audit during the development phase?

Accepted Answer

To ensure compliance with regulatory requirements. Option A is correct because internal audit involvement during development helps verify that the financial application meets applicable regulatory requirements (e.g., SOX, PCI DSS, GDPR, or financial-industry regulations), since audit's independence lets it assess compliance obligations before the system goes live. Option C is correct because internal audit can validate that security controls are designed and built into the application from the start, rather than retrofitted later, which is far more effective and less costly. Option E is correct because internal audit provides guidance on internal controls, advising on control design and risk mitigation without taking ownership of the controls themselves. Option B is not correct because designing the application architecture is the responsibility of the development and architecture teams, not internal audit, whose role must remain independent of design decisions. Option D is not correct because approving all user requirements is a business/user responsibility, and audit should not approve requirements it may later have to independently review.

Answer

To design the application architecture

Answer

To approve all user requirements

Question 9

An organization is implementing a large ERP system. The project manager is concerned about segregation of duties conflicts. Which THREE controls should the IS auditor recommend to mitigate segregation of duties risks during implementation? (Select THREE)

Accepted Answer

Use automated segregation of duties monitoring tools. Option A is correct because automated segregation of duties (SoD) monitoring tools continuously analyze user role assignments and transaction authorizations against a ruleset of conflicting access combinations, enabling early detection and remediation of toxic combinations during ERP implementation. Option C is correct because role-based access controls (RBAC) map permissions to defined job functions rather than to individuals, which prevents the accumulation of conflicting duties and provides a maintainable, auditable authorization structure in the ERP. Option E is correct because requiring dual approval (two-person integrity) for sensitive transactions such as vendor master changes or payment runs compensates for residual SoD conflicts by ensuring no single user can complete a high-risk action alone. Option B is not appropriate because halting deployment until every conflict is resolved is impractical and ignores the use of compensating controls and risk acceptance. Option D is not appropriate because a single end-of-project UAT would not provide the continuous, iterative control testing needed to detect SoD conflicts throughout implementation.

Answer

Delay deployment until all segregation conflicts are resolved

Answer

Conduct a single user acceptance test (UAT) at the end of the project

Question 10

Which THREE of the following are phases of the audit process as defined by ISACA? (Select THREE.)

Accepted Answer

Fieldwork. ISACA's audit process is commonly structured around three core phases: Planning (option D), Fieldwork (option A), and Reporting (option C). Planning (D) is correct because it is the initial phase where the audit scope, objectives, risk assessment, criteria, and resource requirements are defined before any testing begins. Fieldwork (A) is correct because it is the phase in which auditors gather evidence, perform tests of controls and substantive procedures, and document findings to support conclusions. Reporting (C) is correct because it is the phase where the auditor communicates results, including findings, conclusions, and recommendations, to management and the audit committee. Remediation (B) is not a phase of the audit process itself but rather a post-audit management activity of correcting identified issues, and Execution (E) is not an ISACA-defined phase name — it is essentially synonymous with fieldwork and is not used as a distinct phase in ISACA's model.

Answer

Remediation

Answer

Execution

Question 11

An IS auditor finds that a project failed to meet its objectives because key stakeholders were not involved in the requirements definition phase. Which phase of the SDLC was most neglected?

Accepted Answer

Requirements analysis. The requirements analysis phase is where stakeholder needs are formally captured and documented. Without key stakeholder involvement, the project lacks a validated baseline of what must be built, leading to misaligned objectives and scope creep. The IS auditor’s finding directly points to a failure in this phase, as it is the only SDLC phase that defines the project’s success criteria from the user’s perspective.

Answer

Development

Answer

Design

Answer

Testing

Question 12

Which TWO of the following are examples of IT governance frameworks? (Select TWO.)

Accepted Answer

COBIT 2019. COBIT 2019 (A) is correct because it is ISACA's dedicated IT governance framework, providing governance and management objectives across the five domains (EDM, APO, BAI, DSS, MEA) to align IT with enterprise goals. ISO/IEC 38500 (D) is correct because it is the international standard for corporate governance of IT, defining principles (responsibility, strategy, acquisition, performance, conformance, human behaviour) and a governance model for directing and controlling IT. PMBOK (B) is a project management body of knowledge, ITIL 4 (C) is an IT service management framework, and Six Sigma (E) is a process-improvement methodology — none of these are IT governance frameworks.

Answer

PMBOK

Answer

ITIL 4

Answer

Six Sigma

Question 13

A large enterprise is assessing its IT governance maturity. Which THREE of the following are indicators of a mature governance process? (Select exactly three.)

Accepted Answer

There is a formal IT governance committee. Option C is correct because a formal IT governance committee establishes clear accountability, decision rights, and oversight structures, which are hallmarks of a mature governance process rather than ad hoc or siloed decision-making. Option D is correct because linking IT performance metrics to business outcomes demonstrates that governance is aligned with enterprise strategy and value delivery, a key maturity indicator in frameworks such as COBIT. Option E is correct because regular board-level review of IT strategy, such as quarterly, shows sustained executive engagement, strategic alignment, and proactive oversight rather than reactive or infrequent attention. Options A and B do not belong because siloed IT decision-making and budget allocation based solely on historical spending reflect immature, reactive governance practices that lack integration, strategic alignment, and value-based prioritization.

Answer

IT decisions are made in silos

Answer

IT budget is allocated based on historical spending

Question 14

Which THREE are core components of a comprehensive identity and access management (IAM) system? (Choose three.)

Accepted Answer

Single sign-on (SSO) for simplified authentication.. Single sign-on (SSO) is a core IAM component because it centralizes authentication so users log in once and gain access to multiple applications via federated protocols such as SAML 2.0 or OIDC, directly addressing authentication and access convenience. Privileged access management (PAM) is core IAM because it secures, vaults, and audits administrative and high-risk accounts (e.g., root, domain admin) with session recording, credential rotation, and just-in-time elevation. Role-based access control (RBAC) is core IAM because it is the authorization model that assigns permissions based on job roles, enforcing least privilege through role-to-permission mappings. A VPN is a network access/transport control, not an identity or access management function, and DLP is a data-centric security control for preventing exfiltration, so neither belongs to the core IAM component set.

Answer

Virtual private network (VPN) for remote network access.

Answer

Data loss prevention (DLP) to prevent data exfiltration.

Question 15

Which THREE of the following are typical controls in the design phase of the SDLC?

Accepted Answer

Designing security controls. Option A (Designing security controls) is correct because the design phase is exactly where security requirements are translated into concrete controls such as encryption schemes, authentication mechanisms, and access control models before any code is written. Option B (Architecture review) is correct because reviewing the proposed system architecture during design ensures that structural weaknesses, trust boundaries, and integration points are evaluated and corrected early, when changes are cheapest. Option D (Threat modeling) is correct because threat modeling is a design-phase activity that systematically identifies threats, attack vectors, and mitigations against the planned architecture and data flows. Option C (Code review) does not belong because it occurs during the implementation or development phase, after code exists to inspect. Option E (User acceptance testing) does not belong because UAT is a testing/validation activity performed late in the SDLC, after the system is built, to confirm it meets business requirements.

Answer

Code review

Answer

User acceptance testing