CISA Practice Test 5 — 25 Questions

Question 1

An IS auditor is reviewing the software asset management (SAM) process. The organization uses a mix of commercial off-the-shelf (COTS) and open-source software. The auditor finds that several servers are running end-of-life (EOL) operating systems that are no longer patched. Which TWO risks are most directly associated with this finding?

Accepted Answer

Increased risk of security breaches due to unpatched vulnerabilities.. End-of-life (EOL) operating systems no longer receive security patches from the vendor, leaving known vulnerabilities unmitigated. This directly increases the risk of security breaches because attackers can exploit these unpatched flaws. Additionally, many regulatory frameworks (e.g., PCI DSS, SOX) require timely patching of critical systems, so running EOL software constitutes non-compliance with those requirements.

Answer

Difficulty in integrating with newer systems.

Answer

Reduced performance due to outdated software.

Answer

Higher software licensing costs.

Question 2

Which THREE of the following are key considerations when selecting a software development methodology for a project?

Accepted Answer

Regulatory compliance requirements. Regulatory compliance requirements (Option B) are a key consideration because the chosen methodology must support necessary audit trails, documentation, and control frameworks (e.g., SOX, HIPAA, PCI DSS). A methodology like Waterfall provides rigid phase-gate documentation, while Agile may require adaptation (e.g., SAFe) to satisfy compliance evidence demands. Failure to align methodology with regulatory needs can lead to non-compliance findings during a CISA audit.

Answer

Availability of project management software

Answer

Programming language preferences

Question 3

Which THREE of the following are common risks associated with outsourcing software development?

Accepted Answer

Quality issues due to lack of oversight. Option A is correct because outsourcing software development often results in quality issues due to the client's limited visibility into the vendor's development processes, testing rigor, and adherence to coding standards. Without direct oversight, defects may go undetected until later stages, increasing rework costs and project delays.

Answer

Faster time to market

Answer

Increased internal control

Question 4

During a problem management meeting, the team identifies a recurring issue causing multiple incidents. The root cause is known, but a permanent fix is not yet available. Which of the following is the BEST approach to manage this situation until a permanent fix is implemented?

Accepted Answer

Document the known error and implement a workaround. Option C is correct because in ITIL-based problem management, when a root cause is known but a permanent fix is unavailable, the known error should be documented in the Known Error Database (KEDB) and a workaround should be implemented to reduce incident impact and restore service. This aligns with the problem management process of controlling the error until a permanent solution (e.g., a patch or change) is deployed, ensuring operational continuity and minimizing recurrence of incidents.

Answer

Escalate the problem to senior management

Answer

Reclassify the problem as an incident

Answer

Close the problem record and wait for the fix

Question 5

During an audit, an IS auditor finds that the organization uses a cloud-based identity provider (IdP) for single sign-on (SSO) but does not enforce multi-factor authentication (MFA) for all users. Which of the following is the BEST recommendation to reduce risk?

Accepted Answer

Enforce MFA for all users accessing any application. Enforcing MFA for all users accessing any application is the best recommendation because it directly addresses the lack of a second authentication factor, which is the primary control to mitigate credential theft and unauthorized access. In a cloud-based IdP SSO environment, a single compromised password grants access to all integrated applications, so MFA must be applied universally to protect the entire trust boundary, not just external-facing apps. This aligns with NIST SP 800-63B and zero-trust principles, ensuring that every authentication request is verified with something the user knows and something they have.

Answer

Require MFA only for external-facing applications

Answer

Disable SSO and require separate passwords for each application

Answer

Reduce session timeout to 15 minutes

Question 6

Which of the following disaster recovery test types involves a full switch-over to the alternate site, resulting in actual disruption to normal operations?

Accepted Answer

Full interruption test. The full interruption test (also known as a cold-start test) involves an actual shutdown of primary systems and a complete switch-over to the alternate site, causing real disruption to normal operations. This validates the entire recovery capability under realistic conditions, including failover, data synchronization, and user reconnection, but carries the highest risk of data loss or extended downtime.

Answer

Simulation test

Answer

Parallel test

Answer

Tabletop test

Question 7

A system has a Mean Time Between Failures (MTBF) of 500 hours and a Mean Time To Repair (MTTR) of 20 hours. What is the availability of the system?

Accepted Answer

96.15%. Availability is calculated as MTBF / (MTBF + MTTR). With MTBF = 500 hours and MTTR = 20 hours, availability = 500 / (500 + 20) = 500 / 520 ≈ 0.9615, or 96.15%. This formula measures the proportion of time the system is operational, directly reflecting its resilience and recoverability.

Answer

97.50%

Answer

92.00%

Answer

95.00%

Question 8

An organization is developing a mobile app that will handle personal health information (PHI). The security team mandates that data must be encrypted both in transit and at rest. Which of the following implementation strategies BEST ensures compliance?

Accepted Answer

Implement TLS for data in transit and AES-256 encryption for data at rest. Option D is correct because it uses TLS (the modern, secure successor to SSL) to encrypt data in transit, ensuring confidentiality and integrity during network communication, and AES-256, a strong symmetric encryption standard, to encrypt data at rest. This combination directly satisfies the mandate for encryption both in transit and at rest, as TLS protects against eavesdropping and tampering on the wire, while AES-256 protects stored PHI from unauthorized access if the device is lost or compromised.

Answer

Use HTTPS for all network communication and store data in plaintext

Answer

Use SSL and encrypt all data with a simple XOR cipher

Answer

Rely on platform-level encryption provided by the mobile OS

Question 9

An organization has implemented role-based access control (RBAC). Which of the following is the PRIMARY benefit of RBAC?

Accepted Answer

Simplified user permission management. RBAC simplifies user permission management by assigning permissions to roles rather than individuals, allowing administrators to grant or revoke access by modifying role memberships. This reduces administrative overhead and the risk of permission errors, as changes propagate automatically to all users in a role. The primary benefit is operational efficiency in access control, not direct security features like encryption or malware protection.

Answer

Encryption of sensitive data at rest

Answer

Elimination of compliance requirements

Answer

Improved protection against malware

Question 10

Refer to the exhibit. A developer is inserting a new employee record. What is the cause of this error?

Accepted Answer

The email 'john.doe@example.com' already exists in the table. The error message indicates a violation of a UNIQUE constraint on the 'email' column. The INSERT statement attempts to add 'john.doe@example.com', but that value already exists in the table. The database rejects the operation because the constraint ensures no duplicate email addresses are allowed.

Answer

The column 'email' does not exist

Answer

The table is full

Answer

The employee_id 101 already exists

Question 11

An IT auditor is evaluating the change management process for a financial trading system. Which of the following is the BEST indicator of a mature change management process?

Accepted Answer

All changes are logged and require automated approval workflows. Option B is correct because a mature change management process requires that all changes be formally logged and subjected to automated approval workflows. This ensures traceability, segregation of duties, and auditability, which are critical for a financial trading system where unauthorized or untracked changes could lead to financial loss or regulatory non-compliance.

Answer

Changes are documented after deployment

Answer

Developers can deploy changes directly to production if urgent

Answer

Changes are approved verbally by the IT manager

Question 12

Which TWO of the following are benefits of using a version control system in software development?

Accepted Answer

Rollback to previous versions. Option D is correct because version control systems (e.g., Git, SVN) allow developers to revert code to a previous commit or tag, enabling recovery from bugs or regressions. This rollback capability is a core feature that preserves the history of the codebase and supports safe experimentation.

Answer

Generate test cases

Answer

Eliminate all bugs

Answer

Automate deployment

Question 13

An organization uses a third-party vendor for application support. The vendor has subcontracted some support activities to another firm (fourth party). The contract with the vendor requires the vendor to ensure fourth-party compliance, but there is no direct oversight. What is the IS auditor's primary recommendation?

Accepted Answer

Include a right-to-audit clause for all subcontractors in the contract.. The primary recommendation is to include a right-to-audit clause for all subcontractors in the contract. This ensures the organization retains direct oversight and contractual leverage over fourth-party risks, as relying solely on the vendor's assurance without audit rights creates a blind spot in the supply chain. Without such a clause, the organization cannot independently verify the fourth party's compliance with security controls, which is critical for maintaining business resilience.

Answer

Perform a vulnerability assessment on the fourth party.

Answer

Terminate the contract with the vendor.

Answer

Require the vendor to provide evidence of fourth-party compliance.

Question 14

Based on the exhibit, which user account poses the HIGHEST security risk?

Accepted Answer

admin. The 'admin' account poses the highest security risk because it typically has elevated privileges (e.g., sudo or administrator group membership) and is often configured with a default or weak password. Unlike 'root', which can be locked or disabled for direct SSH login, the 'admin' account is commonly used for day-to-day administrative tasks and may have password-based authentication enabled, making it a prime target for brute-force attacks. In many Linux/Unix systems, 'admin' is a standard user with UID 0 or sudo rights, and its compromise grants full system control.

Answer

root

Answer

test

Answer

None of the accounts are risky

Question 15

An organization is implementing a data loss prevention (DLP) solution. Which of the following is the BEST approach to reduce false positives during initial deployment?

Accepted Answer

Deploy in monitor-only mode and analyze alerts for a period. Deploying a DLP solution in monitor-only mode allows the organization to observe what data is being transmitted and generate alerts without blocking any traffic. This enables security teams to analyze the alerts against actual business workflows, fine-tune policies, and eliminate false positives before moving to an active enforcement mode. It is a best practice for initial deployment to avoid disrupting legitimate business operations.

Answer

Use default policies without modification

Answer

Limit scope to one department to minimize noise

Answer

Block all sensitive data transmissions immediately

Question 16

During a penetration test, a tester discovers that an application stores passwords using a reversible encryption algorithm. Which of the following is the BEST remediation?

Accepted Answer

Implement a strong one-way hashing algorithm such as bcrypt. Storing passwords using reversible encryption is fundamentally flawed because any encryption key can be compromised, allowing an attacker to decrypt all passwords. The best remediation is to use a strong, one-way hashing algorithm like bcrypt, which is designed to be computationally expensive and includes a built-in salt to resist rainbow table attacks and brute-force attempts. Unlike encryption, hashing is irreversible, so even if the database is breached, the original passwords cannot be recovered.

Answer

Use MD5 hashing with a salt

Answer

Replace the encryption algorithm with AES-256

Answer

Add a random salt before encryption

Question 17

Which TWO of the following are examples of administrative controls for information security? (Choose two.)

Accepted Answer

Incident response policy. Option C is correct because an incident response policy is a documented set of procedures that defines roles, responsibilities, and steps to be taken when a security incident occurs. This is an administrative control as it governs human behavior and organizational processes, not technology. It aligns with the CISA domain of Protection of Information Assets by establishing a framework for detecting, responding to, and recovering from security events.

Answer

Encryption of data at rest

Answer

Biometric access controls

Answer

Firewall configuration

Question 18

An IS auditor is reviewing an organization's data classification policy. Which of the following findings is MOST critical?

Accepted Answer

Data owners have not been identified for most data assets. Without identified data owners, no one is accountable for classifying, protecting, or granting access to data assets. This foundational gap undermines the entire data classification policy, making it impossible to enforce controls like encryption or access reviews. The CISA emphasizes that data owner assignment is the first step in any data governance framework.

Answer

Employees receive data classification training only once per year

Answer

Data classification is performed manually without automated tools

Answer

Sensitive data is not encrypted at rest

Question 19

An organization uses automated job scheduling for batch processing. A critical job fails due to a dependency on another job that has not completed. Which of the following controls would BEST prevent this issue?

Accepted Answer

Dependency management. Dependency management is the correct control because it ensures that job scheduling logic explicitly defines and enforces the order of execution based on predecessor/successor relationships. By configuring dependencies (e.g., using job control language (JCL) with COND parameters or scheduling tools like CA Workload Automation ESP), the system will automatically hold a job until all prerequisite jobs have completed successfully, preventing the failure scenario described.

Answer

Job failure alerts

Answer

Manual job scheduling

Answer

Rerun procedures

Question 20

During a software asset management (SAM) audit, it is discovered that the organization is using software that has reached end-of-life. Which of the following is the MOST significant risk associated with this situation?

Accepted Answer

Lack of security patches. End-of-life software no longer receives security patches from the vendor, meaning any newly discovered vulnerabilities will remain unaddressed. This creates a direct and exploitable attack surface, making lack of security patches the most significant risk because it can lead to data breaches, system compromise, and regulatory non-compliance.

Answer

Incompatibility with new hardware

Answer

Increased maintenance costs

Answer

License compliance issues