CISA Practice Test 5 — 25 Questions

Question 1

Which THREE of the following are responsibilities of the board of directors regarding IT governance? (Choose three.)

Accepted Answer

Approving the IT strategy. Correct answers: B, C, E. The board is responsible for approving the IT strategy (B), reviewing and approving IT policies (C), and ensuring that IT risks are managed within acceptable levels (E). Implementing IT security controls (A) is a management duty, and monitoring daily IT operations (D) is an operational responsibility.

Answer

Implementing IT security controls

Answer

Monitoring daily IT operations

Question 2

Refer to the exhibit. The organization is planning to achieve the target level. What is the MOST appropriate action?

Accepted Answer

Implement process metrics and statistical controls. To move from Level 3 (Established) to Level 4 (Predictable), the process must be measured and controlled using statistical techniques. Implementing metrics and statistical controls directly addresses the gap. Documentation, ownership, and training are earlier-level activities.

Answer

Assign a process owner

Answer

Conduct awareness training

Answer

Increase process documentation

Question 3

Based on the exhibit, which control deficiency is most critical for the IS auditor to address?

Accepted Answer

The system lacks a policy to lock accounts after repeated failed login attempts. The most critical deficiency because without an account lockout policy, the system is vulnerable to brute-force password guessing attacks. Even if other controls like SSH key authentication are missing, a lockout policy is a fundamental defense that directly mitigates repeated login attempts, which is a primary attack vector for gaining unauthorized access.

Answer

SSH is configured to allow root login

Answer

The admin user logged in successfully with a password

Answer

Public key authentication is not being used

Question 4

Which physical security control is most effective for preventing unauthorized individuals from tailgating into a data center?

Accepted Answer

Mantrap (dual-door interlocking system).. A mantrap, or dual-door interlocking system, is the most effective physical security control against tailgating because it physically isolates individuals in a small vestibule where both doors cannot be opened simultaneously. This forces authentication and verification for each person before the second door unlocks, preventing an unauthorized person from following an authorized individual through a single entry point.

Answer

Security guards at the entrance.

Answer

Closed-circuit television (CCTV) surveillance.

Answer

Biometric fingerprint readers.

Question 5

Which TWO of the following are indicators of poor project governance that an IS auditor should identify?

Accepted Answer

Scope changes are frequently requested and approved verbally.. Verbal approval of scope changes bypasses formal change control processes, leading to undocumented scope creep, loss of audit trail, and increased risk of project failure. An IS auditor should identify this as a governance weakness because it violates the principle of documented authorization and traceability required for effective project oversight.

Answer

Project team uses an agile methodology.

Answer

Project status meetings are held weekly.

Answer

The project budget is reallocated across phases.

Question 6

Which TWO are primary criteria for classifying information assets within an organization? (Choose two.)

Accepted Answer

Business impact if the data is lost or disclosed. Business impact if the data is lost or disclosed (Option C) is a primary criterion because classification directly depends on the potential harm to the organization—confidentiality, integrity, and availability breaches drive the classification level (e.g., public, internal, confidential, restricted). Legal and regulatory requirements (Option E) are also primary because they mandate specific classification labels and handling controls (e.g., GDPR for PII, HIPAA for PHI, PCI DSS for cardholder data) that override internal business impact assessments. These two factors form the core of any information classification policy, as they dictate the protective measures required.

Answer

The format of the data (structured vs. unstructured)

Answer

The age of the data

Answer

Physical storage location of the data

Question 7

Refer to the exhibit. An application log shows an error. What is the MOST likely cause of this error?

Accepted Answer

A duplicate username was inserted into the USERS table. The error message 'Duplicate entry 'admin' for key 'PRIMARY'' indicates a violation of the PRIMARY KEY constraint on the USERS table. Since the username field is the primary key, inserting a second row with the same username (e.g., 'admin') causes MySQL to reject the INSERT operation with error code 1062. This is a unique constraint violation, not a connectivity or privilege issue.

Answer

The database server is offline

Answer

The user does not have insert privileges

Answer

The data type of the username field is incorrect

Question 8

A company decides to outsource the development of a customer portal. Which of the following is the MOST critical control to include in the contract?

Accepted Answer

Service level agreements. Service level agreements (SLAs) are the most critical control because they define measurable performance targets (e.g., uptime, response time, throughput) for the outsourced customer portal. Without enforceable SLAs, the company has no contractual mechanism to ensure the portal meets availability and responsiveness requirements, directly impacting customer experience and business operations.

Answer

Fixed price clause

Answer

Non-disclosure agreement

Answer

Termination for convenience clause

Question 9

An organization has the storage bucket policy shown. Which of the following is the MOST likely intent of this policy?

Accepted Answer

Prevent deletion of objects from the bucket over unencrypted connections.. The policy denies object deletion when the request is not over HTTPS (i.e., encrypted connection false), thereby blocking deletion over unencrypted connections but allowing deletion over HTTPS. Option B is incorrect because deletion over HTTPS is still allowed. Option C is incorrect because other actions like read are not restricted. Option D is incorrect because it does not specifically allow deletion only over HTTPS; it denies over unencrypted connections, so deletion over HTTPS is allowed implicitly.

Answer

Prevent all deletion of objects from the bucket.

Answer

Prevent access to the bucket over HTTP.

Answer

Allow deletion only over HTTPS.

Question 10

What is the FIRST step in implementing an identity and access management (IAM) program?

Accepted Answer

Performing a user access review.. Performing a user access review is the first step because it establishes a baseline of current access rights, identifies segregation of duties conflicts, and uncovers orphaned accounts or excessive privileges. Without this foundational assessment, subsequent IAM controls like SSO or MFA would be deployed on an insecure or non-compliant access framework, violating the principle of 'least privilege' and potentially failing audit requirements.

Answer

Selecting an IAM vendor.

Answer

Implementing multi-factor authentication.

Answer

Deploying single sign-on (SSO).

Question 11

During an audit, the auditor uses a sampling method where the population is divided into subgroups, and samples are selected from each subgroup. This method is known as:

Accepted Answer

Stratified sampling. Stratified sampling divides the population into subgroups (strata) and samples from each.

Answer

Systematic sampling

Answer

Judgmental sampling

Answer

Random sampling

Question 12

Which TWO of the following are types of analytical procedures used in an IS audit? (Select two.)

Accepted Answer

Ratio analysis. Ratio analysis and trend analysis are common analytical procedures.

Answer

Observation

Answer

Re-performance

Answer

Inquiry

Question 13

An organization is implementing a new ERP system. The project sponsor requests a change that will significantly increase project scope without additional budget. Which of the following is the BEST action for the project manager?

Accepted Answer

Initiate the formal change control process and escalate to the steering committee.. The project manager must follow the formal change control process to evaluate the impact of a scope change that lacks additional budget. Escalating to the steering committee is appropriate because they have the authority to approve or reject changes that affect project constraints, ensuring alignment with organizational governance and IT strategy.

Answer

Accept the change and adjust the project timeline accordingly.

Answer

Implement the change and inform the steering committee later.

Answer

Reject the change because it is outside the original scope.

Question 14

Which of the following is the PRIMARY benefit of using a prototype during system development?

Accepted Answer

Clarifying user requirements. Prototyping is primarily used to clarify and validate user requirements by providing a tangible model for users to interact with. This early feedback reduces the risk of misinterpretation and costly rework later. While prototyping may also accelerate development indirectly, its primary benefit is requirement clarification. Reducing development cost is not a primary benefit; in fact, prototyping can increase initial costs. Accelerating coding and minimizing documentation are secondary or not direct objectives.

Answer

Accelerating coding

Answer

Minimizing documentation

Answer

Reducing development cost

Question 15

An organization is implementing a new IT policy. What is the MOST important step to ensure compliance?

Accepted Answer

Conducting training and awareness sessions. Compliance depends on employees understanding the policy and knowing what is expected. Training and communication are critical to raise awareness and ensure adherence.

Answer

Publishing the policy on the intranet

Answer

Establishing penalties for non-compliance

Answer

Assigning a policy owner

Question 16

During the acquisition of a new software package, the procurement team evaluates two vendors. Vendor A offers a lower upfront cost but higher annual maintenance fees. Vendor B has a higher upfront cost but includes three years of maintenance. What is the MOST important factor for the IS auditor to consider?

Accepted Answer

The total cost of ownership over the expected life of the system.. Total cost of ownership (TCO) includes all direct and indirect costs over the system's expected life, providing a comprehensive comparison between Vendor A and Vendor B. Option A is incorrect because focusing solely on upfront cost ignores higher ongoing maintenance fees. Option B is incorrect because while vendor reputation is important, it is not the most critical factor in this cost-related decision. Option D is incorrect because budget constraints are a consideration but not the most important factor; the auditor should evaluate the total cost to ensure long-term financial viability.

Answer

The upfront cost of each vendor.

Answer

The vendor's market reputation.

Answer

The organization's budget constraints.

Question 17

An IT audit revealed that the organization's IT steering committee has not met in the past six months. Which of the following is the MOST likely consequence of this situation?

Accepted Answer

Delayed decision-making on IT investments.. The IT steering committee is responsible for approving and prioritizing IT investments; without meetings, decisions on investments are delayed. Option A is less direct, as turnover is influenced by many factors. Option B is incorrect because security incidents are typically addressed by operational security teams. Option C is incorrect because IT policies are usually set by separate governance processes, not solely by the steering committee.

Answer

Higher IT staff turnover.

Answer

Increased number of security incidents.

Answer

Inconsistent IT policies across departments.

Question 18

A company is implementing a new IT governance framework. Which of the following is the PRIMARY benefit of aligning IT strategy with business strategy?

Accepted Answer

Ensures IT investments support business objectives. Aligning IT strategy with business strategy ensures that IT investments support business objectives, delivering value and reducing waste. Reducing costs, improving morale, or simplifying architecture are secondary benefits.

Answer

Simplifies IT architecture

Answer

Improves IT staff morale

Answer

Reduces IT costs

Question 19

An organization is adopting COBIT 2019. Which TWO of the following are components of the governance system?

Accepted Answer

Processes. The correct answers are A (Processes) and D (Organizational structures). COBIT 2019 defines governance system components that include processes and organizational structures, among others. Processes describe the organized sets of practices, while organizational structures define roles and responsibilities. Option B (IT hardware inventory) is a resource or asset, not a component of the governance system. Option C (Information flows) is related to the Information component but is not a standalone component; information itself is a component, but flows are part of processes. Option E (Employee satisfaction surveys) is an HR activity, not a governance component.

Answer

IT hardware inventory

Answer

Information flows

Answer

Employee satisfaction surveys

Question 20

During an IT audit, the auditor discovers that the IT strategy is not formally documented. Which of the following is the MOST significant risk associated with this finding?

Accepted Answer

Lack of alignment between IT investments and business goals.. Without a formally documented IT strategy, IT investments may not be aligned with business goals, leading to misalignment and wasted resources. This is the most significant risk as it directly impacts the organization's ability to achieve its objectives. Option A is possible but less direct. Option B is a consequence but not the most significant. Option D is a potential outcome but not as critical as misalignment with business goals.

Answer

Difficulty in recruiting qualified IT staff.

Answer

Inability to measure the performance of IT systems.

Answer

Increased operational costs due to unplanned IT initiatives.