CISA Practice Test 2 — 25 Questions

Question 1

An IS auditor is reviewing the change management process for a financial application. Which of the following findings would be of MOST concern?

Accepted Answer

Emergency changes are not reviewed within 30 days. Emergency changes bypass normal controls; failure to review them within a reasonable time (e.g., 30 days) increases risk of undocumented changes. Logging in spreadsheet, pre-approved standard changes, and defined change windows are acceptable or even good practices.

Answer

Change requests are logged in a spreadsheet

Answer

Standard changes are pre-approved

Answer

Change windows are defined in the policy

Question 2

Which THREE of the following are characteristics of a SMART recommendation? (Select three.)

Accepted Answer

Measurable. A SMART recommendation must be Measurable (A), meaning it includes quantifiable criteria or metrics (e.g., a percentage, count, or threshold) so progress and success can be objectively verified. It must also be Time-bound (C), specifying a deadline or timeframe (e.g., "within 90 days") so the recommendation has a defined completion point. Finally, it must be Specific (D), clearly stating the exact action, system, or process to be changed rather than a vague aspiration. The unmarked options do not belong: General (B) contradicts the specificity requirement of SMART, and Subjective (E) is wrong because SMART criteria rely on objective, verifiable evidence rather than personal opinion.

Answer

General

Answer

Subjective

Question 3

Arrange the steps to perform a risk assessment in the correct order.

Accepted Answer

Asset identification, then Threat/vulnerability identification, then Risk analysis, then Prioritization, then Documentation of treatment. Risk assessment begins with asset identification, then threat/vulnerability identification, followed by risk analysis, prioritization, and documentation of treatment.

Answer

Threat/vulnerability identification, then Asset identification, then Risk analysis, then Prioritization, then Documentation of treatment

Answer

Asset identification, then Risk analysis, then Threat/vulnerability identification, then Prioritization, then Documentation of treatment

Answer

Documentation of treatment, then Asset identification, then Threat/vulnerability identification, then Risk analysis, then Prioritization

Question 4

During a firewall rule review, an IS auditor identifies several rules that allow any-to-any traffic. Which THREE of the following should the auditor recommend as the MOST appropriate actions?

Accepted Answer

Obtain business justification for each any-to-any rule. Option A is correct because an IS auditor must first obtain business justification for each any-to-any rule, since a rule may be required for a legitimate business or technical purpose and cannot be judged in isolation. Option B is correct because the fundamental remediation for overly permissive rules is to replace any-to-any rules with specific source, destination, port, and protocol rules that enforce least privilege and reduce the attack surface. Option E is correct because any any-to-any rule that lacks a valid business justification should be removed, as it represents unnecessary exposure with no documented need. Option C is not appropriate because immediately deleting all any-to-any rules without review could disrupt legitimate business traffic and cause outages, violating change management and availability requirements. Option D is not the most appropriate action because increasing logging only detects misuse after the fact; it does not remediate the excessive permissiveness that the auditor should recommend eliminating.

Answer

Immediately delete all any-to-any rules without review

Answer

Increase logging for any-to-any rules to detect misuse

Question 5

An IS auditor is reviewing change management procedures. Which of the following situations would be of GREATEST concern?

Accepted Answer

An emergency change was implemented and not reviewed after resolution. An emergency change bypasses the normal CAB review and testing gates, so the only compensating control is a mandatory post-implementation review (PIR) to confirm the change worked, assess side effects, and retroactively authorize it. If that review never happens, the change remains unauthorized and unverified, leaving a permanent gap in the change management audit trail. This is the greatest concern because it defeats the entire purpose of the emergency-change exception.

Answer

A standard change was implemented without CAB approval

Answer

The change request did not include an impact analysis

Answer

A normal change had a rollback plan that was not tested

Question 6

In a RACI matrix for an IT process, which role should be assigned to the person who ultimately approves the outcome and is held accountable for its success?

Accepted Answer

Accountable (A). In a RACI matrix, the Accountable (A) role is assigned to the person who ultimately approves the outcome and is held answerable for its success or failure. This is the single individual who owns the process or decision and has the authority to sign off. The Accountable person must be unique per activity to avoid ambiguity in ownership and decision-making.

Answer

Consulted (C)

Answer

Responsible (R)

Answer

Informed (I)

Question 7

A security review of the above Apache configuration identifies a critical vulnerability. Which of the following is the MOST significant issue?

Accepted Answer

Directory listing is enabled (Indexes option). The Indexes option in Apache enables directory listing, which exposes the entire contents of a directory when no index file (e.g., index.html) is present. This can reveal sensitive files, configuration backups, or source code, making it a critical information disclosure vulnerability. Unlike other options, Indexes directly leads to unauthorized data exposure without requiring any additional conditions.

Answer

Default DocumentRoot path is used

Answer

AllowOverride All allows .htaccess overrides

Answer

Require all granted permits all access

Question 8

An organization uses a COTS (commercial off-the-shelf) ERP system with significant customizations. The IS auditor is reviewing the system's configuration management. Which of the following findings would MOST indicate a weakness?

Accepted Answer

The system administrator has the ability to modify both configuration and production data.. In a COTS ERP system with significant customizations, allowing the system administrator to modify both configuration and production data violates the principle of segregation of duties (SoD). This creates a risk of unauthorized or undetected changes, as the same individual can alter system configurations and then manipulate production data to conceal the impact, bypassing audit trails and controls.

Answer

The vendor releases quarterly patches but the organization only applies critical security patches.

Answer

Customizations are not tracked in a separate change management system.

Answer

The organization does not have a formal testing environment for customizations.

Question 9

Match each security control to its category.

Accepted Answer

Firewall: Prevents unauthorized network access by filtering traffic.. Firewalls are preventive controls that block unauthorized access, IDS are detective controls that monitor and alert, and data backups are corrective controls that restore data after loss. The distractors swap these definitions.

Answer

Firewall: Monitors network traffic for suspicious activity and alerts.

Answer

Intrusion Detection System (IDS): Restores lost or corrupted data from copies.

Answer

Data Backup: Prevents unauthorized network access by filtering traffic.

Question 10

An organization's IT security policy requires background checks for all IT staff handling sensitive data. Which of the following is the PRIMARY reason for this requirement?

Accepted Answer

To reduce the risk of insider threats by verifying the trustworthiness of personnel. Background checks verify the integrity, identity, and criminal history of personnel before granting access to sensitive data, directly mitigating the risk that a trusted insider will misuse their privileges. Insider threats — whether malicious, negligent, or coerced — are among the hardest to detect because insiders already possess legitimate access. Pre-employment screening is a preventive control that reduces the likelihood of hiring individuals who pose an elevated trust risk.

Answer

To ensure employees have the necessary technical skills

Answer

To reduce employee turnover

Answer

To comply with industry regulations

Question 11

Which THREE of the following are essential components of a change management process?

Accepted Answer

Impact analysis. Impact analysis (B) is essential because it identifies the potential effects, risks, and dependencies of a proposed change on systems, services, and users before implementation, allowing informed decision-making. A rollback plan (C) is essential because it defines the documented procedure and criteria for reverting a change if it fails or causes unintended consequences, minimizing downtime and restoring the prior known-good state. Change request approval (E) is essential because it provides formal authorization from the Change Advisory Board (CAB) or designated authority, ensuring changes are reviewed, prioritized, scheduled, and aligned with business and IT governance. Options A and D do not belong: immediate implementation without review (A) bypasses the required assessment and authorization steps, and bypassing testing for urgent changes (D) skips validation that the change works as intended and does not introduce regressions, both of which violate core change management controls even under emergency change procedures.

Answer

Immediate implementation without review

Answer

Bypassing testing for urgent changes

Question 12

What is the primary purpose of a chargeback model for IT services?

Accepted Answer

To provide transparency and encourage efficient use of IT resources. Chargeback models allocate IT costs to business units based on usage, promoting accountability and cost awareness.

Answer

To increase the IT budget

Answer

To simplify IT financial management

Answer

To centralize IT decision-making

Question 13

During which phase of the audit process does the auditor perform procedures such as inquiry, observation, and inspection?

Accepted Answer

Fieldwork. Fieldwork is the phase where the auditor executes the planned audit procedures, including inquiry, observation, inspection, reperformance, and data analysis, to gather evidence and evaluate controls. Planning is about understanding the process and designing procedures; reporting is about communicating results; follow-up addresses remediation. Therefore, the procedures listed are performed during fieldwork.

Answer

Follow-up

Answer

Reporting

Answer

Planning

Question 14

An organization is considering whether to build a custom application or purchase a commercial off-the-shelf (COTS) product. Which of the following factors would most strongly support a build decision?

Accepted Answer

The required functionality is unique to the organization's competitive advantage.. When the required functionality is unique to the organization's competitive advantage, building a custom application is justified because COTS products cannot provide differentiated capabilities that create strategic value. Custom development allows the organization to tailor features, integrate proprietary processes, and maintain exclusive control over the intellectual property. This factor most strongly supports a build decision because it directly ties the software to business differentiation.

Answer

Short time to market is critical.

Answer

The vendor offers a robust service-level agreement (SLA).

Answer

The organization has limited in-house development resources.

Question 15

According to ITIL 4, which guiding principle emphasizes understanding the current state before making improvements?

Accepted Answer

Start where you are. ITIL 4's guiding principle 'Start where you are' advises assessing the current state before embarking on improvements.

Answer

Progress iteratively

Answer

Focus on value

Answer

Keep it simple and practical

Question 16

A company is implementing a new customer relationship management (CRM) system. The project team is currently defining user roles and permissions. Which of the following is the PRIMARY reason to enforce segregation of duties (SoD) within the CRM?

Accepted Answer

To reduce the risk of fraud and errors. Segregation of duties (SoD) in a CRM system is primarily enforced to prevent a single user from having conflicting capabilities, such as creating a customer record and also approving credit limits or processing refunds. Without SoD, an employee could both initiate and approve a fraudulent transaction, directly increasing the risk of fraud and undetected errors. While SoD can indirectly support data accuracy and compliance, the primary control objective is risk reduction through separation of conflicting functions.

Answer

To ensure data accuracy and completeness

Answer

To comply with regulatory requirements

Answer

To improve system performance and efficiency

Question 17

An organization has outsourced its IT help desk to a third-party provider. Which of the following is the MOST critical control to ensure service quality?

Accepted Answer

Service level agreement (SLA) with key performance indicators. A Service Level Agreement (SLA) with key performance indicators (KPIs) is the most critical control because it defines measurable targets (e.g., average speed to answer, first-call resolution rate, ticket closure time) and establishes contractual remedies for non-compliance. Without an SLA, the organization has no enforceable mechanism to hold the provider accountable for service quality, making it the foundational control for outsourced IT help desk governance.

Answer

Regular background checks on provider employees

Answer

Access to provider's incident management system

Answer

Monthly meetings with provider management

Question 18

During an incident response, the IT team isolates a compromised system from the network. Which of the following is the primary purpose of this action?

Accepted Answer

To prevent further damage and contain the incident.. Isolating a compromised system from the network (e.g., by disconnecting the Ethernet cable, disabling the switch port, or applying a host-based firewall rule to drop all traffic) immediately stops the system from communicating with other hosts. This containment action prevents the attacker from moving laterally, exfiltrating data, or deploying additional malware, thereby limiting the blast radius and stopping ongoing damage.

Answer

To preserve evidence for forensic analysis.

Answer

To allow the system to be patched offline.

Answer

To comply with regulatory requirements.

Question 19

During a post-implementation review of a new customer relationship management (CRM) system, the IS auditor finds that the system is processing transactions slower than anticipated. What is the BEST initial course of action for the auditor?

Accepted Answer

Compare actual performance to the performance criteria in the business case. The auditor's best initial action is to compare actual system performance against the performance criteria defined in the business case. This establishes whether the slowdown represents a genuine deviation from expected outcomes and provides an objective basis for further investigation. Without this comparison, any recommendation or escalation would lack context and could be premature.

Answer

Recommend immediate performance tuning to resolve the issue

Answer

Report the issue to senior management immediately

Answer

Conduct a load test to identify bottlenecks

Question 20

A university is implementing a new student information system. The project team uses an iterative development approach. During user acceptance testing, students report that the online course registration portal crashes when more than 100 users register simultaneously. The development team identifies a database connection pooling issue and estimates a fix will take three weeks. The project deadline is in two weeks. The project manager suggests deploying the system as is and fixing the issue after go-live, as the crash is rare. The IS auditor is consulted. What should the auditor recommend?

Accepted Answer

Delay the go-live until the defect is fixed and user acceptance testing is passed.. Deploying a system with a known critical defect that fails under expected load conditions violates the principle of delivering a reliable and secure system. The database connection pooling issue causes the portal to crash under concurrent user load, which is a functional failure that directly impacts business operations. Delaying go-live ensures the defect is fixed and user acceptance testing (UAT) is fully passed, aligning with the IS auditor's responsibility to recommend risk mitigation over acceptance of a preventable failure.

Answer

Document the risk and proceed with the go-live, planning to fix later.

Answer

Deploy on time but restrict registration to fewer than 100 students per session.

Answer

Implement a temporary increase in server capacity to handle the load.