CISA Practice Test 4 — 25 Questions

Question 1

An organization has experienced several security incidents due to unauthorized changes to production systems. Which governance mechanism should be strengthened?

Accepted Answer

Change management process. Unauthorized changes to production systems indicate a failure in the change management process, which is designed to control and authorize modifications. Strengthening change management ensures that all changes are reviewed, approved, and documented, reducing the risk of unauthorized alterations. The other mechanisms address asset inventory, configuration data, or incident response, but do not directly prevent unauthorized changes.

Answer

IT asset management

Answer

Configuration management database

Answer

Incident response plan

Question 2

Which TWO of the following are examples of analytical procedures used as audit evidence? (Select two.)

Accepted Answer

Ratio analysis. Ratio analysis (A) is a classic analytical procedure because it evaluates financial information by comparing relationships among accounts (e.g., current ratio, gross margin percentage) to identify unusual fluctuations or inconsistencies that may indicate misstatement. Trend analysis (D) is likewise analytical, as it compares financial data across periods (e.g., year-over-year revenue growth) to spot significant variances requiring further audit attention. Both fall under the analytical procedures defined in auditing standards (e.g., AU-C 520), which involve evaluations of financial information through analysis of plausible relationships among financial and nonfinancial data. By contrast, inquiry of management (B) is a form of audit evidence obtained through questioning, not analysis; inspection of documents (C) is a substantive test of details involving examination of records; and observation of process (E) is a procedure of watching a process or procedure being performed, none of which constitute analytical procedures.

Answer

Inquiry of management

Answer

Inspection of documents

Answer

Observation of process

Question 3

An IS auditor is assessing the security of an organization's virtualized environment. The organization uses a type 1 hypervisor and has multiple virtual machines (VMs) running on a single physical host. The auditor is concerned about the risk of VM escape, where an attacker compromises the hypervisor from within a VM. Which of the following controls are MOST effective in mitigating this risk? (Choose two.)

Accepted Answer

Ensuring the hypervisor is kept up to date with the latest security patches.. The most effective controls to mitigate VM escape are patching the hypervisor and hardening VM configurations by disabling unnecessary virtual hardware and shared folders. Patching addresses known vulnerabilities that could be exploited for escape, while reducing the attack surface limits the vectors an attacker can use. Together, these preventive measures significantly reduce the risk of a VM compromising the hypervisor.

Answer

Using a host-based intrusion detection system (HIDS) on each VM.

Answer

Regularly backing up VM images to a separate storage system.

Answer

Enabling promiscuous mode on the virtual switch to monitor all traffic.

Question 4

An organization is evaluating a cloud-based identity as a service (IDaaS) for single sign-on (SSO). Which of the following security concerns is MOST critical to address?

Accepted Answer

Compromise of the identity provider's credentials. The compromise of the identity provider's (IdP) credentials is the most critical security concern because the IdP acts as the central trust anchor for all SSO transactions. If an attacker gains control of the IdP's signing key or administrative credentials, they can forge SAML assertions for any user, bypassing all downstream authentication and gaining unauthorized access to every connected service provider (SP). This represents a single point of failure that undermines the entire SSO trust model.

Answer

Lack of encryption for SAML assertions

Answer

Incompatibility with legacy applications

Answer

Downtime of the IDaaS provider

Question 5

A company plans to implement a commercial off-the-shelf (COTS) application and requires significant customization to match its unique business processes. The vendor advises against extensive customization because it may complicate future upgrades. What is the BEST course of action?

Accepted Answer

Avoid customization and re-engineer business processes to match the COTS application. The best course of action is to avoid customization and re-engineer business processes to match the COTS application. This approach preserves the integrity of the vendor's standard codebase, ensuring that future upgrades and patches can be applied with minimal friction. Extensive customization creates a fork from the vendor's baseline, leading to costly regression testing, potential security gaps, and upgrade incompatibilities that undermine the long-term value of the COTS investment.

Answer

Use the vendor's customization module to minimize upgrade risks

Answer

Customize but maintain detailed documentation for upgrade impact analysis

Answer

Proceed with extensive customization to meet business needs

Question 6

During an audit of a public key infrastructure (PKI), the IS auditor finds that certificate revocation lists (CRLs) are only updated weekly. Which of the following is the MOST significant risk?

Accepted Answer

Revoked certificates may be accepted as valid. If CRLs are only updated weekly, revoked certificates may still be accepted as valid during the interval between revocation and CRL publication, allowing compromised or misused certificates to be trusted. This is the most significant risk because it undermines the revocation mechanism and can enable impersonation or man-in-the-middle attacks. Timely revocation is critical to PKI trust.

Answer

Certificate authorities may become unavailable

Answer

Increased network traffic due to large CRLs

Answer

Users may experience delays in certificate validation

Question 7

An IS auditor is reviewing the physical access controls at a data center. Which of the following is the MOST effective control to prevent tailgating?

Accepted Answer

Mantrap. A mantrap is a physical security control consisting of a small vestibule with two interlocking doors, where the first door must close and the person must be authenticated before the second door opens. This design physically prevents tailgating because only one person can occupy the space at a time, and unauthorized individuals cannot slip through behind an authorized person. It is the most effective preventive control specifically engineered to defeat tailgating.

Answer

Security guards at the entrance

Answer

CCTV cameras at the entrance

Answer

Biometric readers at all entrances

Question 8

An IS auditor is reviewing the vulnerability management program. The auditor notes that a critical vulnerability was identified in a production system six months ago and has not been patched due to a business impact assessment. Which of the following should the auditor examine NEXT?

Accepted Answer

Whether a formal risk acceptance and compensating controls are in place. When a critical vulnerability remains unpatched due to a business impact assessment, the auditor's next step is to verify whether a formal risk acceptance and compensating controls are in place, because unpatched critical vulnerabilities require documented management approval and mitigating measures. This ensures the organization has consciously accepted the risk with proper governance rather than leaving it unaddressed. The auditor must confirm that the decision was authorized, documented, and supported by controls that reduce the residual risk to an acceptable level.

Answer

The technical details of the vulnerability

Answer

The patch deployment schedule for the next quarter

Answer

The vendor's patch release notes

Question 9

Which THREE of the following are key metrics to include in a disaster recovery test report? (Select exactly 3.)

Accepted Answer

Amount of data lost (actual vs. RPO). Option A is correct because a DR test report must quantify actual data loss against the Recovery Point Objective (RPO), showing whether the achieved recovery point met the agreed tolerable data-loss threshold. Option C is correct because measuring the time taken to recover each critical system validates performance against the Recovery Time Objective (RTO) and identifies systems that exceeded acceptable downtime. Option E is correct because the percentage of successful restores demonstrates the reliability and integrity of backups and recovery procedures, exposing failed or partial restores that need remediation. Option B is not a standard DR test metric; cost per incident belongs to financial or business-impact analysis rather than recovery validation. Option D is also not a key DR metric, since headcount alone does not measure recovery effectiveness, speed, or data integrity.

Answer

Cost per incident

Answer

Number of personnel involved

Question 10

Which TWO of the following are key components of an IT governance framework? (Choose two.)

Accepted Answer

IT strategy. Option D (IT strategy) is correct because an IT governance framework must define how IT is aligned with and supports the organization's business objectives, and the IT strategy is the core document that establishes this direction, priorities, and value delivery. Option E (IT steering committee) is correct because governance requires a decision-making body with assigned authority and accountability; the IT steering committee provides oversight, prioritization, and resource-allocation decisions across IT initiatives. The remaining options do not belong: a network topology diagram (A) and a hardware inventory (C) are operational/technical artifacts describing infrastructure, not governance mechanisms, and help desk procedures (B) are tactical service-management documentation rather than a governance component.

Answer

Network topology diagram

Answer

Help desk procedures

Answer

Hardware inventory

Question 11

An IT steering committee is reviewing a proposed project to migrate critical applications to the cloud. Which of the following is the PRIMARY role of the IT steering committee in this decision?

Accepted Answer

To ensure the project aligns with business strategy. The IT steering committee ensures that IT investments align with business strategy. They are responsible for strategic alignment and approving major projects based on business value.

Answer

To perform the technical feasibility study

Answer

To select the cloud service provider

Answer

To manage the project budget and schedule

Question 12

During a build vs. buy analysis, the IS auditor observes that the organization decided to build a custom application because no vendor solution met all requirements. Which of the following risks should the auditor emphasize?

Accepted Answer

Increased time-to-market and development costs. When an organization chooses to build a custom application instead of buying a vendor solution, the primary risks shift from external dependencies to internal development challenges. Building custom software typically requires significant upfront investment in time, skilled personnel, and financial resources, and it often takes longer to deliver than implementing an existing product. Therefore, the auditor should emphasize increased time-to-market and development costs as the key risk in this scenario.

Answer

Lack of customization

Answer

Dependence on external support

Answer

Vendor lock-in

Question 13

An IT auditor is reviewing the policy hierarchy of an organization. Which of the following correctly describes the relationship between a policy and a procedure?

Accepted Answer

A policy defines the 'what' and 'why', while a procedure defines the 'how'.. A policy is a high-level statement of management intent that defines what must be done and why, establishing mandatory requirements and direction. A procedure is the detailed, step-by-step operational instruction that defines how to accomplish the policy's requirements. This 'what/why vs. how' distinction is the foundational relationship in any IT governance documentation hierarchy.

Answer

A policy is reviewed annually, while a procedure is reviewed every five years.

Answer

A policy is a detailed step-by-step instruction, while a procedure is a high-level statement.

Answer

A policy is a mandatory requirement, while a procedure is optional.

Question 14

An organization is considering acquiring a commercial off-the-shelf (COTS) ERP system. Which of the following risks is most effectively mitigated by including a contractual clause for audit rights?

Accepted Answer

Inadequate vendor security controls. A contractual clause for audit rights allows the organization to assess the vendor's security controls, ensuring they meet the organization's requirements and mitigating the risk of inadequate vendor security. This is critical because the organization relies on the vendor to protect its data, and without audit rights, it cannot verify the effectiveness of the vendor's controls. The other risks are not directly addressed by audit rights: incompatibility is a technical integration issue, vendor lock-in relates to data portability, and cost overruns stem from project management.

Answer

Incompatibility with existing infrastructure

Answer

Vendor lock-in due to proprietary data formats

Answer

Cost overruns from customization

Question 15

An information systems auditor is evaluating user accounts in an organization's Linux environment. The accounts have the following properties:
- The 'root' account has its password field set to '!!' (disabled).
- The 'admin' account has its password field set to '!' (locked) and UID 0.
- The 'test' account is a regular user with UID 1000.
Based on this information, which user account poses the HIGHEST security risk?

Accepted Answer

admin. The 'admin' account poses the highest security risk because, despite its password being locked (indicated by '!' in the shadow file), it has UID 0 (root privileges). A locked password prevents password-based login, but the account may still be accessible via SSH keys or other authentication methods, and its privileged status makes it a valuable target for privilege escalation attacks. In contrast, the 'root' account may be fully disabled, and the 'test' account is a standard user without elevated privileges.

Answer

root

Answer

test

Answer

None of the accounts are risky

Question 16

An IT manager is reviewing the service level agreements (SLAs) for a cloud-based email service. The SLA guarantees 99.9% uptime per month. The service experienced an outage of 45 minutes in a 30-day month. Did the service meet the SLA?

Accepted Answer

No, because the allowed downtime for 99.9% uptime is approximately 43 minutes.. The SLA guarantees 99.9% uptime per month. For a 30-day month (43,200 minutes), 99.9% uptime allows only 0.1% downtime, which is 43.2 minutes. The actual outage of 45 minutes exceeds this threshold, so the SLA was not met. Option D correctly identifies the allowed downtime as approximately 43 minutes.

Answer

Yes, because 45 minutes is within 0.1% of the total time.

Answer

Yes, because the SLA is calculated per day, not per month.

Answer

No, because any downtime exceeding 30 minutes is a violation.

Question 17

A multinational manufacturing company with operations in 20 countries has historically allowed each regional division to manage its own IT systems independently. Recently, the company experienced a significant data breach originating from a region with weaker security controls, leading to financial losses and reputational damage. The board has mandated stronger IT governance to prevent future incidents. The CIO proposes implementing a global IT governance framework with centralized policy enforcement. However, regional directors argue that local regulations and business needs require autonomy. The governance committee must decide on a course of action that balances risk and business flexibility. Which of the following approaches is the MOST appropriate?

Accepted Answer

Adopt a federated governance model with global policies and local flexibility within defined tolerances.. A federated governance model with global policies and local flexibility within defined tolerances is the most appropriate because it balances the board's mandate for stronger, centralized governance with the regional directors' need for autonomy to meet local regulations and business requirements. It establishes global minimum standards while allowing regions to adapt within approved boundaries, directly addressing the risk of weak regional controls without eliminating necessary flexibility.

Answer

Allow each region to continue independently but require quarterly reporting to the committee.

Answer

Implement a fully centralized IT governance model with no regional deviations.

Answer

Maintain the status quo but enforce minimum security standards across all regions.

Question 18

According to ISACA IT Audit Standards, which of the following is the primary purpose of audit documentation (working papers)?

Accepted Answer

To provide a basis for the audit report and support the auditor's conclusions. Audit documentation supports the auditor's conclusions and provides evidence of the work performed. It is not primarily for future audit planning or legal protection.

Answer

To facilitate the planning of the next audit

Answer

To serve as a legal record for potential litigation

Answer

To demonstrate compliance with audit standards

Question 19

An IS auditor is reviewing the organization's data inventory process for privacy compliance. Which TWO of the following are the MOST important elements that should be included in the data inventory?

Accepted Answer

Data elements or fields containing personal data. Option A is correct because a data inventory must identify the specific data elements or fields that contain personal data, since this is the foundational step for determining what privacy obligations (e.g., GDPR, CCPA) apply and where protection controls are needed. Option C is correct because knowing the location of personal data storage and processing—whether on-premises, in the cloud, or across jurisdictions—is essential for assessing cross-border transfer restrictions, access controls, and regulatory applicability. Options B, D, and E, while useful attributes that may be recorded in a mature inventory, are not the most important core elements; classification labels, retention periods, and consent status are downstream details that depend on first knowing what personal data exists and where it resides.

Answer

Data classification labels

Answer

Data retention periods

Answer

Data subject consent status

Question 20

An organization has implemented role-based access control (RBAC). Which of the following is the PRIMARY benefit of RBAC?

Accepted Answer

Simplified user permission management. RBAC simplifies user permission management by assigning permissions to roles rather than individuals, allowing administrators to grant or revoke access by modifying role memberships. This reduces administrative overhead and the risk of permission errors, as changes propagate automatically to all users in a role. The primary benefit is operational efficiency in access control, not direct security features like encryption or malware protection.

Answer

Encryption of sensitive data at rest

Answer

Elimination of compliance requirements

Answer

Improved protection against malware