CISA Practice Test 4 — 25 Questions

Question 1

An organization is planning to deploy a web application firewall (WAF) to protect a critical application. Which deployment mode should be used to ensure that the WAF can block malicious traffic without introducing a single point of failure?

Accepted Answer

Inline with high-availability clustering.. Inline with high-availability clustering ensures the WAF can actively inspect and block malicious traffic in real time while eliminating a single point of failure through automatic failover between clustered appliances. This mode maintains traffic flow even if one WAF node fails, meeting both security and availability requirements.

Answer

Out-of-band monitoring only.

Answer

Transparent inline without failover.

Answer

Reverse proxy with active-passive clustering.

Question 2

Refer to the exhibit. A security administrator is troubleshooting why external users cannot reach the web server at 203.0.113.10 from the internet. Based on the configuration, what is the MOST likely issue?

Accepted Answer

The 'no-proxy-arp' option prevents the ASA from responding to ARP requests for the public IP. The 'no-proxy-arp' command disables proxy ARP on the ASA interface for the public IP address 203.0.113.10. Without proxy ARP, the ASA will not respond to ARP requests from upstream routers for that IP, so traffic destined to the web server is never delivered to the ASA for NAT processing. This is the most likely cause because the NAT rule exists but the ASA cannot intercept the traffic at Layer 2.

Answer

No NAT rule is configured for the web server

Answer

The source address is not translated

Answer

The access list denies incoming web traffic

Question 3

A company is implementing a new customer relationship management (CRM) system. The project team is currently defining user roles and permissions. Which of the following is the PRIMARY reason to enforce segregation of duties (SoD) within the CRM?

Accepted Answer

To reduce the risk of fraud and errors. Segregation of duties (SoD) in a CRM system is primarily enforced to prevent a single user from having conflicting capabilities, such as creating a customer record and also approving credit limits or processing refunds. Without SoD, an employee could both initiate and approve a fraudulent transaction, directly increasing the risk of fraud and undetected errors. While SoD can indirectly support data accuracy and compliance, the primary control objective is risk reduction through separation of conflicting functions.

Answer

To ensure data accuracy and completeness

Answer

To comply with regulatory requirements

Answer

To improve system performance and efficiency

Question 4

An organization is implementing a business continuity plan (BCP). Which of the following is the PRIMARY purpose of conducting a business impact analysis (BIA)?

Accepted Answer

To identify critical business processes and their recovery time objectives (RTOs). The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the impact of their disruption, which directly drives the recovery time objectives (RTOs) and recovery point objectives (RPOs). These RTOs and RPOs form the foundation for selecting appropriate recovery strategies and technologies, such as synchronous replication for near-zero RPO or warm standby sites for specific RTO windows. Without a BIA, the BCP would lack the business-driven metrics needed to prioritize recovery efforts and allocate resources effectively.

Answer

To document the step-by-step recovery procedures for each system

Answer

To identify potential threats and vulnerabilities to the organization

Answer

To inventory all IT assets and their configurations

Question 5

A financial institution is evaluating its IT governance structure. Which of the following roles is BEST suited to ensure independent oversight of IT investments?

Accepted Answer

IT Audit Committee. The IT Audit Committee is the correct answer because it provides independent oversight of IT investments by operating outside of management's direct reporting structure. Unlike the CIO, PMO director, or CISO, who are all part of management and may have vested interests in project approvals or resource allocation, the IT Audit Committee reports to the board of directors and ensures that IT investments align with enterprise strategy, risk appetite, and regulatory requirements without bias.

Answer

Chief Information Officer (CIO)

Answer

Project Management Office (PMO) director

Answer

Chief Information Security Officer (CISO)

Question 6

An organization has implemented a new IT service management (ITSM) tool. The IT manager wants to measure the effectiveness of incident management. Which metric is MOST appropriate?

Accepted Answer

Mean time to resolve (MTTR) incidents. Mean time to resolve (MTTR) is the most appropriate metric for measuring the effectiveness of incident management because it directly reflects how quickly the IT team can restore normal service operation after an incident. In ITIL-based ITSM tools, MTTR tracks the elapsed time from incident logging to resolution, providing a clear indicator of process efficiency and team responsiveness.

Answer

Percentage of incidents resolved on first call

Answer

Number of incidents reported per month

Answer

Percentage of system uptime

Question 7

Which THREE of the following are components of a typical IT governance framework?

Accepted Answer

Strategic alignment of IT with business. Strategic alignment of IT with business is a core component of an IT governance framework because it ensures that IT initiatives directly support and enable the organization's business objectives and strategies. This alignment is achieved through mechanisms like balanced scorecards and IT steering committees, which prioritize IT investments based on business value. Without this component, IT may operate in a silo, leading to wasted resources and missed opportunities.

Answer

Network troubleshooting procedures

Answer

Vendor contract management

Question 8

An administrator sees the above error after a failed backup job. What is the MOST likely cause?

Accepted Answer

The network share \BACKUPSRV\DBBackups\DB01\ is offline or unreachable. The error message indicates that the backup destination path \BACKUPSRV\DBBackups\DB01\ is inaccessible. This is most commonly caused by the network share being offline, unreachable due to network issues, or the target server being down. Without connectivity to the UNC path, the backup job cannot proceed, even if permissions and disk space are adequate.

Answer

The backup service account does not have write permissions to the destination

Answer

The SQL Server backup client is not installed

Answer

The backup destination disk is full

Question 9

A company's backup policy requires that backup tapes be stored offsite for at least one year. During an audit, the auditor finds that the offsite storage facility is not access-controlled and backup tapes are not encrypted. Which of the following is the auditor's BEST recommendation?

Accepted Answer

Encrypt all backup tapes before sending them offsite. The core issue is that backup tapes contain sensitive data and are stored in an uncontrolled environment. Encrypting the tapes before transport ensures that even if the physical security of the offsite facility is compromised, the data remains confidential. This directly addresses the risk of unauthorized access to the data, which is the primary concern, and is a cost-effective, immediate control that does not disrupt operations.

Answer

Negotiate a new contract with a different offsite storage provider

Answer

Move the tapes back to the primary site until the offsite facility is secured

Answer

Implement a check-in/check-out log for the offsite facility

Question 10

Which type of disaster recovery test involves actually switching over to the alternate site and processing live transactions, but does not require the primary site to be shut down?

Accepted Answer

Parallel test. Parallel testing is the correct answer because it involves processing live transactions at the alternate site while the primary site remains fully operational. This allows validation of the disaster recovery (DR) systems without risking a service outage, as both sites run concurrently and results are compared for consistency. Unlike a full interruption test, the primary site is not shut down, ensuring business continuity during the test.

Answer

Simulation test

Answer

Full interruption test

Answer

Tabletop test

Question 11

Based on the exhibit, what is the MOST likely compliance issue requiring immediate remediation?

Accepted Answer

Backup media lacks encryption.. The exhibit shows backup tapes stored in an unsecured cabinet without any indication of encryption. Since backup media often contains sensitive data, the lack of encryption exposes the organization to data breaches if the media is lost or stolen. This is a direct violation of data protection requirements and requires immediate remediation.

Answer

Access is not properly restricted.

Answer

Compliance checks are not being performed.

Answer

Retention period is too short.

Question 12

A large enterprise recently experienced a data breach due to an insider threat. The IT governance committee is reviewing the incident and considering measures to prevent recurrence. Which of the following is the BEST course of action to address the root cause?

Accepted Answer

Implement a privileged access management (PAM) solution to control and monitor elevated access.. A privileged access management (PAM) solution directly addresses the root cause of an insider threat by controlling, monitoring, and auditing elevated access rights. Since the breach was caused by an insider, limiting and tracking privileged accounts prevents unauthorized or excessive use of administrative credentials, which is the most effective preventive measure against recurrence.

Answer

Increase logging and auditing of all user activities.

Answer

Deploy a security information and event management (SIEM) tool.

Answer

Terminate the employment of the insider who caused the breach.

Question 13

A company's IT governance policy requires that all critical systems have a documented business continuity plan (BCP). During an audit, an IT auditor finds that the BCP for a critical financial system has not been updated in three years. Which of the following is the BEST recommendation?

Accepted Answer

Update the BCP to reflect current processes and conduct a test.. Option B is correct because IT governance policies require that BCPs remain current to reflect actual operational processes. An outdated BCP (three years stale) may contain obsolete recovery procedures, contact information, or dependencies, rendering it ineffective during a real incident. Updating the BCP and then testing it validates that the documented steps align with the current system architecture and can be executed successfully, which is a core requirement of the BCP lifecycle per ISACA guidelines.

Answer

Archive the outdated BCP and develop a new one from scratch.

Answer

Accept the risk because the system has been stable.

Answer

Implement a new system with built-in redundancy.

Question 14

Which TWO of the following are benefits of implementing an IT governance framework?

Accepted Answer

Improved risk management and mitigation. Implementing an IT governance framework, such as COBIT or ISO/IEC 38500, establishes structured policies, procedures, and controls that directly improve risk management and mitigation. By defining clear roles, accountability, and risk appetite, the framework ensures that risks are systematically identified, assessed, and treated, rather than being managed ad hoc. This aligns IT strategy with business objectives and embeds risk management into daily operations.

Answer

Reduction in IT staff headcount

Answer

Reduced IT operational costs

Answer

Elimination of all IT project failures

Question 15

Which of the following is the PRIMARY purpose of an IT governance framework?

Accepted Answer

To ensure IT aligns with and supports business strategy. The primary purpose of an IT governance framework is to ensure that IT investments, strategies, and operations are aligned with and support the overall business strategy, enabling the organization to achieve its goals. This alignment is achieved through mechanisms such as strategic planning, portfolio management, and performance measurement, which are core to frameworks like COBIT 2019. Without this alignment, IT may operate in isolation, leading to wasted resources and missed business opportunities.

Answer

To ensure compliance with laws and regulations

Answer

To protect IT assets from cyber threats

Answer

To reduce IT operational costs

Question 16

Which TWO of the following are key responsibilities of an IT steering committee?

Accepted Answer

Monitoring IT performance and value delivery. The IT steering committee is a senior-level governance body responsible for aligning IT strategy with business objectives. Monitoring IT performance and value delivery (A) is a key responsibility because the committee must ensure that IT investments generate the expected business benefits and that service levels meet agreed targets. Prioritizing IT projects and allocating resources (D) is also a core duty, as the committee decides which initiatives receive funding and staffing based on strategic importance and risk, rather than operational urgency.

Answer

Managing day-to-day IT operations

Answer

Writing and testing application code

Answer

Conducting IT audit engagements

Question 17

A multinational corporation is adopting a hybrid cloud strategy. The IT governance board must decide on a framework to ensure alignment with business objectives and regulatory compliance. Which framework is MOST appropriate?

Accepted Answer

COBIT 2019. COBIT 2019 is the most appropriate framework because it is specifically designed for IT governance, providing a comprehensive set of controls and processes to align IT with business objectives and ensure regulatory compliance. In a hybrid cloud strategy, COBIT 2019's focus on governance objectives, stakeholder needs, and risk management directly addresses the board's need for oversight across on-premises and cloud environments, unlike frameworks that target service management, security, or project management.

Answer

ITIL 4 Service Value System

Answer

ISO/IEC 27001 Information Security Management

Answer

PMBOK Guide

Question 18

An organization's IT strategy must be aligned with business strategy. Which of the following is the PRIMARY benefit of this alignment?

Accepted Answer

Increased value of IT investments to business objectives. When IT strategy is aligned with business strategy, every IT investment is directly tied to achieving specific business objectives, such as increasing revenue, improving customer experience, or enabling new business models. This alignment ensures that resources are allocated to projects that deliver measurable business value, rather than being spent on technology for its own sake. The primary benefit is therefore the increased value of IT investments to business objectives, as misalignment often leads to wasted expenditure on systems that do not support core business goals.

Answer

Faster adoption of new technologies

Answer

Enhanced security posture

Answer

Reduced IT operational costs

Question 19

A company is implementing a new procurement system. The project team is considering using a rapid application development (RAD) methodology. Which of the following is a potential risk of using RAD?

Accepted Answer

Inadequate documentation. RAD prioritizes speed and iterative prototyping over formal documentation. Because the focus is on quickly delivering working software through user feedback and short development cycles, comprehensive documentation is often neglected or produced after the fact, leading to inadequate records for maintenance, auditing, and compliance.

Answer

Reduced stakeholder involvement

Answer

Longer development time

Answer

Difficulty in prototyping

Question 20

During a business impact analysis (BIA), the IS auditor identifies that the maximum tolerable downtime (MTD) for an online payment system is 2 hours, and the recovery point objective (RPO) is 15 minutes. The current disaster recovery solution uses nightly backups (12-hour RPO) and can restore the system in 4 hours. Which risk is most critical?

Accepted Answer

Data loss exceeds the RPO.. The current solution has a 12-hour RPO (nightly backups), but the business requires an RPO of 15 minutes. This means up to 11 hours and 45 minutes of transaction data could be lost, far exceeding the acceptable data loss threshold. While the recovery time of 4 hours also exceeds the MTD of 2 hours, the most critical risk is data loss because the gap between the actual RPO and the required RPO is proportionally larger and directly impacts transaction integrity and financial reconciliation.

Answer

The backup frequency is not aligned with the RPO.

Answer

The disaster recovery plan has not been tested.

Answer

Recovery time exceeds the MTD.