CISA Practice Test 4 — 25 Questions

Question 1

Refer to the exhibit. The IS auditor reviews the router's version output during an audit. What is the MOST significant finding?

Accepted Answer

The IOS version is outdated and may contain security vulnerabilities.. The most significant finding is that the IOS version is outdated and may contain security vulnerabilities. An outdated IOS version can have known exploits that compromise the router's security, which is a critical risk for the organization. While other options describe operational states, they do not present the same level of immediate security threat as running unsupported or vulnerable firmware.

Answer

The router was returned to ROM by power-on.

Answer

The router has been running for over two years without a reboot.

Answer

The system image is stored in flash memory.

Question 2

An organization's backup strategy includes full backups every Sunday and incremental backups on other days. On Wednesday, a failure occurs. Which backups are needed to restore the data?

Accepted Answer

Sunday's full backup and Monday through Wednesday incremental backups. To restore from incremental backups, you need the last full backup (Sunday) and all incremental backups from Monday through Wednesday.

Answer

Sunday's full backup only

Answer

Sunday's full backup and Wednesday's incremental backup

Answer

Wednesday's incremental backup only

Question 3

A multinational corporation is evaluating its IT governance structure. The board wants to ensure that IT investments are prioritized based on risk and value. Which framework component is MOST critical?

Accepted Answer

Portfolio management process. A portfolio management process systematically evaluates and prioritizes investments based on risk and value, aligning with board objectives. Steering committee provides oversight, but portfolio management is the mechanism for prioritization.

Answer

Service level agreements

Answer

Balanced scorecard

Answer

IT steering committee

Question 4

Which TWO of the following are key benefits of using a system development life cycle (SDLC) methodology? (Select exactly two.)

Accepted Answer

It provides a structured approach to system development. SDLC provides a structured approach to system development (Option A), ensuring that phases are followed and projects are managed systematically. It also ensures that user requirements are captured and validated through continuous user involvement (Option B). Option C is incorrect because SDLC does not prevent scope changes; it helps manage and control them. Option D is incorrect because security testing is an integral part of SDLC, not eliminated. Option E is incorrect because SDLC may involve additional upfront costs, though it reduces long-term rework costs.

Answer

It prevents any scope changes during development

Answer

It eliminates the need for security testing

Answer

It reduces the overall cost of development

Question 5

An IS auditor is reviewing backup procedures for a critical database. Which THREE are key considerations for ensuring backup reliability and recoverability?

Accepted Answer

Ensuring backup retention periods meet the recovery point objective (RPO).. Backup reliability requires regular testing (restore verification), secure offsite storage to protect against site disasters, and retention aligned with business recovery objectives. Encryption is important but not directly for reliability; compression may affect performance but not reliability.

Answer

Encrypting backup data to prevent unauthorized access.

Answer

Compressing backup data to reduce storage costs.

Question 6

An IS auditor is reviewing the effectiveness of a control that requires dual approval for payments over $10,000. The auditor selects a sample of payments and independently verifies that two approvals were obtained. This audit procedure is:

Accepted Answer

Re-performance. Re-performance involves the auditor independently executing the control to verify its effectiveness.

Answer

Inquiry

Answer

Observation

Answer

Inspection

Question 7

An IS auditor is reviewing a waterfall SDLC project that has completed the requirements phase. Which of the following is the greatest risk to the project?

Accepted Answer

A key business stakeholder did not sign off on the requirements.. In waterfall, requirements are defined upfront and changes are difficult. If a key stakeholder did not sign off, there is a risk that later phases will be based on incomplete or incorrect requirements.

Answer

The project manager left the company.

Answer

The development team is unfamiliar with the technology.

Answer

The design phase is behind schedule.

Question 8

A government agency has an IT governance framework that includes an IT strategy committee, an IT steering committee, and a project management office. Despite this, there is a lack of transparency regarding IT spending and resource allocation. The agency's annual audit found that several IT initiatives were not approved by the steering committee and were funded out of operational budgets. The CFO is frustrated because IT costs are unpredictable. The agency's chief information officer (CIO) reports to the CFO but the IT steering committee is chaired by the CIO. The auditor's best recommendation to improve governance is to:

Accepted Answer

Change the steering committee chair to a senior business executive independent of IT. Having an independent steering committee chair (e.g., a senior business executive) eliminates the conflict of interest where the CIO chairs the committee and can bypass governance. Option A (chargeback) addresses cost allocation but not the root cause of unauthorized spending. Option B (business case) is a good practice but can still be ignored if the committee chair is the CIO. Option D (policy) can be overridden or ignored without structural change in governance.

Answer

Establish a chargeback system to allocate IT costs to business units

Answer

Require all IT projects to submit a business case to the steering committee for approval

Answer

Implement a policy that prohibits funding IT projects from operational budgets without steering committee approval

Question 9

An IS auditor is reviewing the change management process for a critical financial application. Which of the following findings would be of GREATEST concern?

Accepted Answer

Emergency changes are implemented without subsequent CAB approval. Emergency changes bypassing CAB approval pose high risk as they may not undergo proper testing and review.

Answer

Standard changes are documented but not tracked individually

Answer

Change requests are logged in a spreadsheet instead of a dedicated system

Answer

The CAB meets only once per month

Question 10

Which TWO of the following are key controls that an IS auditor should expect to find in a well-managed system development life cycle (SDLC)?

Accepted Answer

Segregation of duties between development and testing.. Segregation of duties between development and testing is a key control because it ensures that code is independently verified before release, preventing developers from approving their own changes and reducing the risk of undetected defects or malicious code. In a well-managed SDLC, this separation enforces an independent testing phase, which is critical for maintaining code integrity and security.

Answer

Vendor due diligence reports.

Answer

Automated unit testing scripts.

Answer

Gantt chart for project scheduling.

Question 11

During an operational audit, the auditor wants to evaluate the efficiency of a data entry process. Which of the following audit procedures would be most appropriate?

Accepted Answer

Performing trend analysis on the number of transactions processed per hour. Analytical procedures, such as comparing processing times to benchmarks, can identify inefficiencies. Observation may show procedures but not efficiency quantitatively.

Answer

Inspecting system logs to verify user access

Answer

Observing data entry operators to identify procedural bottlenecks

Answer

Interviewing the data entry supervisor about error rates

Question 12

An IS auditor is reviewing the physical access controls at a data center. Which of the following is the MOST effective control to prevent tailgating?

Accepted Answer

Mantrap with two interlocking doors. A mantrap allows only one person to pass at a time, preventing unauthorized individuals from following an authorized person.

Answer

Biometric access controls

Answer

CCTV cameras at entrances

Answer

Security guards at the entrance

Question 13

An organization is developing a policy on acceptable use of company IT resources. Which of the following should be included to support effective governance?

Accepted Answer

Consequences of non-compliance. An acceptable use policy should clearly define what constitutes acceptable and unacceptable use, including consequences for violations. This supports governance by establishing rules and accountability.

Answer

Detailed technical configuration standards

Answer

Service level targets for IT support

Answer

Procedures for incident response

Question 14

A multinational corporation is implementing a global HR system. The project team decides to use a pilot implementation in one region before rolling out to others. What is the PRIMARY risk if the pilot region is not representative of the entire organization?

Accepted Answer

Issues relevant to other regions may remain undetected.. The primary risk of a non-representative pilot is that region-specific variations in regulatory, cultural, or technical infrastructure (e.g., data privacy laws like GDPR, local labor regulations, or network latency) will not be exercised. This means defects or integration failures that are unique to other regions remain hidden until full rollout, undermining the pilot's purpose as a risk-reduction mechanism. Option C directly captures this core risk of undetected issues.

Answer

The pilot team may become overly confident.

Answer

The pilot may run over budget due to unexpected challenges.

Answer

The implementation schedule will be delayed.

Question 15

Based on the exhibit, which of the following is the MOST likely result of the current firewall configuration?

Accepted Answer

Remote SSH connections are permitted from any IP address. The exhibit shows an access control list (ACL) that permits TCP traffic on port 22 (SSH) from any source IP address (0.0.0.0/0) to the destination IP address of the firewall's external interface. Since there is no source restriction, remote SSH connections are allowed from any IP address on the internet. This is a significant security risk because it exposes the firewall's management interface to brute-force attacks from the entire internet.

Answer

SSH access is restricted to the internal network

Answer

HTTPS traffic from the internal network is blocked

Answer

HTTPS traffic from the internet is allowed

Question 16

An IS auditor is reviewing logical access controls for a critical application. Which of the following is the MOST important control to detect unauthorized access?

Accepted Answer

Audit logging of access attempts. Audit logs of successful and failed access attempts provide the evidence needed to detect unauthorized access. Other controls prevent or limit access but do not detect it after the fact.

Answer

Strong password policy

Answer

Monthly access recertification

Answer

Role-based access control (RBAC)

Question 17

Order the steps for conducting a business impact analysis (BIA) in the correct sequence.

Accepted Answer

Identify processes, then define recovery objectives, then assess impact, then prioritize, then document. BIA steps: identify processes, define recovery objectives, assess impact, prioritize, and document.

Answer

Assess impact, then prioritize, then identify processes, then define recovery objectives, then document

Answer

Identify processes, then assess impact, then define recovery objectives, then prioritize, then document

Answer

Define recovery objectives, then identify processes, then assess impact, then prioritize, then document

Question 18

Refer to the exhibit. Which perspective shows the greatest deviation from target?

Accepted Answer

Learning & Growth. Learning & Growth is 30 hours short of 150 (20% deficit), while Financial is 10% short, Internal Process is 4% short, and Customer exceeds target. Thus, Learning & Growth has the largest negative gap.

Answer

Customer

Answer

Financial

Answer

Internal Process

Question 19

An organization is acquiring a new financial system. The contract includes a clause that allows the organization to audit the vendor's controls. Which type of report would most efficiently provide assurance over the vendor's internal controls?

Accepted Answer

SOC 2 report. A SOC 2 report is specifically designed to provide assurance over a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy, which directly addresses the need to audit the vendor's internal controls for a financial system. It is more efficient than other options because it is a standardized, independent assessment that covers the control environment relevant to financial data processing.

Answer

Financial audit report

Answer

Penetration test report

Answer

ISO 27001 certificate

Question 20

According to ISACA IT Audit Standards, which of the following is the primary purpose of audit documentation (working papers)?

Accepted Answer

To provide a basis for the audit report and support the auditor's conclusions. Audit documentation supports the auditor's conclusions and provides evidence of the work performed. It is not primarily for future audit planning or legal protection.

Answer

To facilitate the planning of the next audit

Answer

To serve as a legal record for potential litigation

Answer

To demonstrate compliance with audit standards