CISA Practice Test 2 — 25 Questions

Question 1

A company's endpoint protection solution alerts on a file that is digitally signed by a trusted software vendor but exhibits malicious behavior on execution. What type of threat does this scenario most likely depict?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Signed malware, indicating the certificate may have been compromised.. The scenario describes a file that is digitally signed by a trusted vendor yet exhibits malicious behavior. This is the classic definition of signed malware, where the digital certificate used to sign the file has likely been stolen, misused, or issued fraudulently. The trusted signature bypasses reputation-based and allowlist controls, making the threat particularly dangerous because the file appears legitimate to security tools that trust the vendor's certificate.

Answer

A Trojan horse disguised as legitimate software.

Answer

A zero-day exploit targeting an unpatched vulnerability.

Answer

A fileless attack that never writes to disk.

Question 2

During a review of firewall rule sets, an IS auditor finds a rule that allows any source IP to access any destination IP on TCP port 443. Which of the following should the auditor do FIRST?

Accepted Answer

Determine if the rule has a documented business justification.. The first step is to verify the business justification for the rule, as it may be necessary for a specific application.

Answer

Test whether the rule is actually being used.

Answer

Escalate the finding to senior management.

Answer

Recommend immediate removal of the rule.

Question 3

An IS auditor is reviewing the backup process for a critical database. Which TWO of the following are essential controls to ensure data recoverability?

Accepted Answer

Offsite storage of backup media.. Offsite storage of backup media (Option B) is essential because it protects against site-level disasters such as fire, flood, or physical theft. Without geographic separation, a single incident could destroy both the primary data and its backups, making recovery impossible. This control directly supports the recoverability objective by ensuring a usable copy exists outside the primary facility.

Answer

Automated job scheduling for backups.

Answer

Encryption of backup data.

Answer

Backup retention period of at least one year.

Question 4

An IS auditor is assessing the backup and recovery procedures for a critical database. Which TWO of the following are the MOST important controls to ensure recoverability?

Accepted Answer

Restore tests are conducted quarterly.. Regular restore tests (e.g., quarterly) are the only way to validate that backup data can actually be recovered and that the recovery procedures work as intended, which directly ensures recoverability. Option E is correct because storing backups offsite protects against site-level disasters (fire, flood, physical theft) that could destroy both primary data and on-site backups, ensuring data can be recovered from a separate location.

Answer

Backup media is encrypted.

Answer

Full backups are performed weekly.

Answer

Backup logs are reviewed daily.

Question 5

An IS auditor is reviewing the design phase of a new procurement system. Which TWO of the following controls are MOST critical to include in the system design to prevent unauthorized purchases?

Accepted Answer

Mandatory approval workflows for purchase orders above a threshold.. Mandatory approval workflows for purchase orders above a threshold are critical because they enforce a policy-based control that prevents unauthorized high-value purchases by requiring explicit authorization from a designated approver. This control is designed into the system to intercept transactions that exceed a predefined limit, ensuring that no single user can bypass financial authority limits.

Answer

Automated performance reports on purchase cycle times.

Answer

Real-time audit logging of all purchase transactions.

Answer

Encryption of purchase order data in transit.

Question 6

An IS auditor is reviewing an organization's data classification policy. Which of the following findings is MOST critical?

Accepted Answer

Data owners have not been identified for most data assets. Without identified data owners, no one is accountable for classifying, protecting, or granting access to data assets. This foundational gap undermines the entire data classification policy, making it impossible to enforce controls like encryption or access reviews. The CISA emphasizes that data owner assignment is the first step in any data governance framework.

Answer

Employees receive data classification training only once per year

Answer

Data classification is performed manually without automated tools

Answer

Sensitive data is not encrypted at rest

Question 7

Which THREE of the following are acceptable methods for gathering audit evidence? (Select THREE.)

Accepted Answer

Observation of processes being performed. Observation of processes being performed (Option B) is an acceptable audit evidence-gathering technique because the auditor directly witnesses the execution of controls or procedures, providing firsthand evidence of their operation. This method is particularly valuable for assessing the effectiveness of manual controls or physical security measures, as it allows the auditor to verify that the process is performed as documented and to identify any deviations in real-time.

Answer

Accepting management's assertions without corroboration

Answer

Obtaining hearsay from third parties

Question 8

Refer to the exhibit. An IS auditor is reviewing an IAM policy for a cloud data platform. The auditor notices that user jdoe has READ_ONLY access to all tables matching 'sales_', but asmith has READ_WRITE access to the same set of tables. Which of the following is the MOST critical control issue?

Accepted Answer

The resource pattern '.*' in the regex could grant access to unintended tables. The regex pattern '.*' in the resource block is overly permissive and could match unintended tables beyond the intended 'sales_' prefix. In AWS IAM policies, the resource element uses regex-like patterns, and '.*' after 'sales_' would match any characters, including tables like 'sales_archive_private' or 'sales_2024_sensitive', potentially exposing sensitive data. This violates the principle of least privilege and is a critical control issue.

Answer

Users should not be directly assigned roles; use groups

Answer

The roles data_analyst and data_scientist have overlapping permissions

Answer

User jdoe should not have access to the sales_ tables

Question 9

An IT manager needs to ensure that the organization's IT resources are used efficiently. Which of the following is the BEST metric to measure IT resource utilization?

Accepted Answer

Average server CPU utilization. Average server CPU utilization directly measures how much of the computing capacity is being consumed over time, making it the most relevant metric for assessing whether IT resources are being used efficiently. High or low CPU utilization can indicate over-provisioning, under-utilization, or potential performance bottlenecks, enabling the IT manager to optimize resource allocation.

Answer

System uptime percentage

Answer

Number of help desk tickets resolved per day

Answer

Percentage of projects completed on time

Question 10

An organization is developing a critical application using an agile methodology. The project sponsor demands frequent deliveries but the development team is concerned about insufficient testing. Which of the following BEST mitigates this risk?

Accepted Answer

Implement continuous integration and automated testing. Continuous integration (CI) and automated testing enable frequent, reliable code integration and immediate feedback on defects, directly addressing the tension between rapid delivery and insufficient testing. Automated tests run on every commit, catching regressions early without manual overhead, which is essential for agile sprints where manual testing alone cannot scale to match delivery velocity.

Answer

Deploy with known defects and fix them in the next sprint

Answer

Increase manual testing effort at the end of each sprint

Answer

Extend the release cycle to allow more time for testing

Question 11

Order the steps for conducting an audit engagement from start to finish.

Accepted Answer

Step 1: Planning (scope, program), Step 2: Fieldwork, Step 3: Analysis, Step 4: Reporting with management review. Audit engagement follows: planning (scope, program), fieldwork, analysis, and reporting with management review.

Answer

Step 1: Planning, Step 2: Analysis, Step 3: Fieldwork, Step 4: Reporting

Answer

Step 1: Fieldwork, Step 2: Planning, Step 3: Analysis, Step 4: Reporting

Answer

Step 1: Planning, Step 2: Fieldwork, Step 3: Reporting, Step 4: Analysis

Question 12

Which TWO of the following are primary objectives of a data loss prevention (DLP) strategy?

Accepted Answer

Identify and classify sensitive data. Identifying and classifying sensitive data is the foundational step in a DLP strategy. Without knowing where sensitive data resides (e.g., PII, PCI, IP), DLP policies cannot accurately detect or prevent unauthorized transfers. Classification enables the DLP system to apply context-aware rules, such as blocking credit card numbers in email attachments or flagging confidential documents uploaded to cloud storage.

Answer

Encrypt all data in transit

Answer

Replace all existing security controls

Answer

Ensure compliance with all regulations

Question 13

An IS auditor is reviewing the incident management process. Incidents are categorized as P1 (critical) through P4 (low). The SLA for P1 incidents requires initial response within 15 minutes and resolution within 4 hours. The auditor notes that the average time to respond to P1 incidents is 12 minutes, but the average resolution time is 6 hours. The root cause analysis shows that many P1 incidents are due to known errors documented in the known error database (KEDB). What is the most significant finding?

Accepted Answer

Problem management is not effectively utilizing the KEDB to prevent recurring incidents.. If known errors are causing P1 incidents, problem management should have identified workarounds or permanent fixes. The fact that these incidents recur indicates a weakness in the problem management process, which should reduce incidents from known errors.

Answer

The average resolution time for P1 incidents exceeds SLA.

Answer

The average response time for P1 incidents is within SLA.

Answer

Incident management is not escalating P1 incidents properly.

Question 14

During an agile software development project, a sprint review meeting is conducted. What is the PRIMARY purpose of this meeting from an IS audit perspective?

Accepted Answer

To demonstrate the working product increment to stakeholders and gather feedback. The sprint review is a key control in agile to demonstrate completed work to stakeholders and obtain feedback. It serves as a form of user acceptance testing and helps ensure the product meets stakeholder needs.

Answer

To identify and document lessons learned for process improvement

Answer

To assign tasks to team members for the current sprint

Answer

To plan the tasks for the next sprint

Question 15

An organization's backup strategy involves weekly full backups and daily incremental backups. After a system failure, the restoration takes longer than expected. What is the most likely cause?

Accepted Answer

Restoration process not tested. If the restoration process is not tested, unexpected issues (e.g., missing dependencies, corruption, or procedural errors) can cause delays, leading to longer restoration times. Option A (incremental backups not stored offsite) affects availability but not directly the restoration duration. Option B (full backup frequency too low) could increase restore time due to more increments, but testing is a more likely root cause for a specific delay. Option D (tape rotation failure) could cause missing backups, but the question states backup strategy worked; the issue is restore time, not backup failure.

Answer

Incremental backups not stored offsite

Answer

Full backup frequency too low

Answer

Tape rotation failure

Question 16

Refer to the exhibit. Which of the following statements is TRUE regarding this S3 bucket policy?

Accepted Answer

Anonymous read access is allowed only over HTTPS. The S3 bucket policy includes a condition `aws:SecureTransport` set to `true`, which explicitly denies any request that is not made over HTTPS. The `Effect: Allow` on the `Principal: "*"` grants anonymous read access, but the `Condition` block ensures that only HTTPS requests are permitted, making anonymous read access allowed only over HTTPS.

Answer

The bucket is fully public for all actions

Answer

Write access is allowed over HTTP

Answer

Only authenticated users can access objects

Question 17

During an IT audit, the auditor observes that mandatory vacation policies are not enforced for IT staff with access to financial systems. What is the PRIMARY risk associated with this finding?

Accepted Answer

Increased risk of undetected fraud. Mandatory vacation policies force the periodic removal of an employee's access, which allows detection of irregularities or fraudulent activities that require the employee's continued presence to conceal. Without enforcement, a malicious insider could perpetrate fraud (e.g., creating ghost vendors, altering payment records) and cover it up by maintaining daily control over transactions. This directly increases the risk that fraudulent actions will go undetected over extended periods.

Answer

Increased likelihood of system downtime

Answer

Inadequate segregation of duties

Answer

Non-compliance with licensing agreements

Question 18

An IS auditor is evaluating the effectiveness of an organization's change management process. Which of the following is the most important control to verify during the audit?

Accepted Answer

A segregation of duties exists between development and production.. Segregation of duties between development and production environments ensures that code cannot be directly moved from development to production without independent review and testing. This control prevents unauthorized or untested code from affecting live systems, which is a fundamental principle of change management. Without this separation, a developer could introduce malicious or defective code directly into production, bypassing all quality and security checks.

Answer

All changes are approved by the IT manager.

Answer

Emergency changes are documented after implementation.

Answer

Change requests are prioritized by business impact.

Question 19

During an audit, the IS auditor discovers that the audit log for a critical server is overwritten every 24 hours. The auditor wants to ensure logs are preserved for a longer period. Which of the following recommendations is most appropriate?

Accepted Answer

Configure the server to archive logs to a centralized log management system. The most appropriate recommendation is to configure the server to archive logs to a centralized log management system. This ensures logs are preserved beyond the 24-hour overwrite window by sending them to a separate, persistent storage location, which also supports security monitoring, forensics, and compliance requirements. Centralized logging (e.g., using syslog, SIEM, or a dedicated log collector) provides redundancy, integrity checks, and long-term retention without relying on the local server's limited storage.

Answer

Implement a manual backup of logs daily

Answer

Reduce the logging level to minimize data

Answer

Increase the log size to retain more data

Question 20

A multinational corporation is deploying a data loss prevention (DLP) solution across its network. The DLP system must be configured to prevent the exfiltration of personally identifiable information (PII) while minimizing false positives. Which approach is most effective?

Accepted Answer

Use regex patterns for PII combined with context-aware policies (e.g., user role, destination domain). Using regex patterns for PII combined with context-aware policies (e.g., user role, destination domain) allows the DLP system to accurately detect sensitive data while minimizing false positives. Option A is too simplistic; keyword-based blocking can cause high false positives. Option B relies on user training and self-reporting, which is not a technical DLP control and is ineffective. Option C (encryption) protects data at rest and in transit but does not prevent exfiltration; it is not a DLP method.

Answer

Block all outbound email containing keywords such as 'SSN' or 'credit card'

Answer

Require all users to complete annual data handling training and rely on self-reporting

Answer

Implement full disk encryption on all endpoints and encrypt all outbound traffic