CISA Practice Test 5 — 25 Questions

Question 1

An IT auditor is reviewing the change management process for a financial application. The auditor finds that emergency changes are frequently implemented without post-implementation review. What is the MOST significant risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security vulnerabilities may be introduced and remain undetected. Emergency changes bypass the normal change management controls, including post-implementation review. Without a post-implementation review, any security vulnerabilities introduced by the change (e.g., misconfigurations, unpatched code, or weakened access controls) will not be identified and remediated. In a financial application, this can lead to data breaches, fraud, or regulatory non-compliance. Thus, the most significant risk is that security vulnerabilities remain undetected.

Answer

The change may not be documented properly

Answer

The change may cause an outage during the next backup cycle

Answer

Users may not be notified of the change

Question 2

A financial institution is evaluating its IT governance structure. Which of the following roles is BEST suited to ensure independent oversight of IT investments?

Accepted Answer

IT Audit Committee. The IT Audit Committee is the correct answer because it provides independent oversight of IT investments by operating outside of management's direct reporting structure. Unlike the CIO, PMO director, or CISO, who are all part of management and may have vested interests in project approvals or resource allocation, the IT Audit Committee reports to the board of directors and ensures that IT investments align with enterprise strategy, risk appetite, and regulatory requirements without bias.

Answer

Chief Information Officer (CIO)

Answer

Project Management Office (PMO) director

Answer

Chief Information Security Officer (CISO)

Question 3

After a security incident, an organization discovers that an employee accessed sensitive files without authorization. Which of the following is the most effective preventive control to reduce the risk of such unauthorized access?

Accepted Answer

Conducting regular access reviews and recertification.. Regular access reviews and recertification (Option C) are the most effective preventive control because they ensure that user permissions are periodically validated against current job roles and business needs. By systematically revoking excessive or outdated entitlements, this process directly reduces the attack surface for unauthorized access, addressing the root cause of privilege creep rather than merely detecting or deterring misuse.

Answer

Deploying a data loss prevention (DLP) solution.

Answer

Implementing background checks on all employees.

Answer

Enforcing strong password policies.

Question 4

An IS auditor is selecting an appropriate audit sample. Which THREE of the following are factors that affect the sample size?

Accepted Answer

Tolerable error rate. Tolerable error rate (A) is correct because it defines the maximum deviation from the control that the auditor is willing to accept while still relying on the control; a lower tolerable rate requires a larger sample to detect deviations. Confidence level (B) is correct because it reflects how certain the auditor wants to be that the sample result is representative of the population, and higher confidence directly increases the required sample size. Expected error rate (D) is correct because the auditor's estimate of the deviation rate in the population drives sample size upward as the expected rate approaches the tolerable rate. Sampling interval (C) is not a determinant of sample size; it is derived from the sample size and population size when using systematic selection. Population standard deviation (E) applies to variables sampling for monetary amounts, not to attribute sampling for control deviations, so it is not a general factor here.

Answer

Sampling interval

Answer

Population standard deviation

Question 5

An IS auditor is assessing the controls in an agile development environment. What is the MOST effective way to verify that security testing is performed iteratively?

Accepted Answer

Reviewing the project's definition of done for each sprint. In agile development, security testing must be integrated into each sprint to ensure continuous validation. The 'definition of done' (DoD) is the team's checklist for completing a user story; if it explicitly includes security testing tasks (e.g., static analysis, dynamic scans, or penetration tests), then verifying the DoD proves that security testing was performed iteratively. Option D directly examines this artifact, providing objective evidence of iterative security testing.

Answer

Observing a daily standup meeting

Answer

Interviewing the product owner about security priorities

Answer

Examining the final security test report after release

Question 6

An organization's IT governance committee is reviewing a proposal to use a public cloud provider that does not meet the organization's data encryption standards. The board has set a low risk appetite for data privacy. What is the BEST action?

Accepted Answer

Reject the proposal until encryption requirements are met. The board has set a low risk appetite for data privacy, meaning the organization is willing to accept only minimal risk in this area. A cloud provider that does not meet the organization's data encryption standards introduces a risk that exceeds this appetite. Therefore, the proposal must be rejected until the provider can comply with the encryption requirements. This aligns with governance principles where risk decisions must be made in accordance with the organization's risk appetite.

Answer

Accept the proposal with additional monitoring

Answer

Delegate the decision to the security team

Answer

Accept the proposal but require the provider to sign a waiver

Question 7

Based on the exhibit, what is the security risk of this bucket policy?

Accepted Answer

The bucket is publicly readable. The bucket policy grants public read access by setting `"Principal": "*"` and `"Effect": "Allow"` with `"Action": "s3:GetObject"`. This means any unauthenticated user on the internet can list and retrieve objects in the bucket, making it publicly readable. The policy does not require any authentication or authorization checks, which is a common misconfiguration leading to data exposure.

Answer

The bucket allows public write access

Answer

The bucket policy restricts access to a specific IAM role

Answer

The bucket policy is not encrypted

Question 8

Which of the following is a key difference between an internal audit and an external audit?

Accepted Answer

Internal auditors are employees of the organization, which may affect independence.. The key difference is that internal auditors are employees of the organization, which creates a potential impairment to independence and objectivity. External auditors are independent third parties engaged to provide an objective opinion on financial statements or specific subject matter.

Answer

External audits are always required by law, while internal audits are voluntary.

Answer

External auditors issue a report to management, while internal auditors report to the board.

Answer

Internal audits focus only on financial controls.

Question 9

An IT auditor is reviewing the release management process. Which of the following is the MOST important control to ensure that new releases do not negatively impact production systems?

Accepted Answer

Testing in a pre-production environment. Testing in a pre-production environment is the most critical control because it validates that the new release functions correctly and integrates with existing systems before it reaches production. This environment mirrors production, allowing defects, compatibility issues, and performance problems to be identified and resolved without impacting live operations. While other controls like rollback plans and approvals are important, they are reactive or administrative; pre-production testing is the primary proactive measure to prevent negative impacts.

Answer

Rollback plan

Answer

Communication to users

Answer

Approval from the change advisory board

Question 10

During system implementation, a critical defect is found in the production environment. The project manager wants to apply an emergency patch without full testing. Which of the following is the BEST course of action?

Accepted Answer

Conduct a risk assessment and obtain approval from the change control board. When a critical defect is found in production and an emergency patch is proposed without full testing, the BEST course of action is to conduct a risk assessment and obtain approval from the change control board (CAB). This ensures that the risk of applying an untested patch is formally evaluated, documented, and approved by the appropriate authority, balancing the need for a quick fix with proper change management controls. The CAB can also determine if emergency testing or a rollback plan is needed.

Answer

Apply the patch immediately without testing

Answer

Delay deployment until full testing can be completed

Answer

Revert to the previous version of the system

Question 11

An organization uses RAID 5 for its database server. Which of the following is the PRIMARY advantage of RAID 5?

Accepted Answer

Fault tolerance with one disk failure. RAID 5 uses block-level striping with distributed parity, allowing the array to survive a single disk failure without data loss. When one drive fails, the missing data can be reconstructed from parity information stored on the remaining drives. This fault tolerance is the primary advantage for a database server, ensuring availability and data integrity in case of a single disk failure.

Answer

Simplified backup process

Answer

Increased storage capacity without parity overhead

Answer

Improved read performance

Question 12

An organization is implementing a new identity management system. Which testing approach is MOST effective for verifying access controls?

Accepted Answer

User acceptance testing including role-based test cases. User acceptance testing (UAT) with role-based test cases is the most effective approach because it directly validates that the identity management system enforces the correct access controls for each user role in real-world scenarios. Unlike lower-level tests, UAT involves actual users executing role-specific transactions to confirm that permissions, segregation of duties, and policy rules are properly implemented. This ensures that the system behaves as intended from an end-user and auditor perspective, which is critical for compliance and security.

Answer

Regression testing

Answer

Unit testing

Answer

System integration testing

Question 13

An IT manager is developing a governance policy for change management. Which element is MOST important to include?

Accepted Answer

Roles and responsibilities. Roles and responsibilities are the cornerstone of any governance policy because they establish accountability and authority for change approval, implementation, and review. Without clearly defined roles (e.g., change manager, change advisory board, implementer), even well-documented procedures lack ownership and enforcement. Governance is about decision rights and accountability, not operational details. Thus, defining who is responsible for what is the most critical element to include.

Answer

Project management methodology

Answer

Detailed technical procedures

Answer

List of all applications

Question 14

An organization outsources its IT help desk to a third-party vendor. Which clause is MOST important for the IS auditor to verify in the contract to ensure the organization can assess the vendor's controls?

Accepted Answer

Right-to-audit clause. A right-to-audit clause in the contract explicitly grants the organization the right to audit the vendor's controls, processes, and compliance, which is essential for the IS auditor to assess the vendor's security posture. Without this clause, the organization may have no contractual authority to conduct audits or obtain audit reports, making it impossible to verify the effectiveness of controls.

Answer

Service level agreement (SLA) metrics

Answer

Subcontracting restrictions

Answer

Exit strategy provisions

Question 15

An IS auditor is reviewing the access recertification process for a financial application. The process requires users' managers to confirm access rights quarterly. Which of the following findings should MOST concern the auditor?

Accepted Answer

There is no process to act on access changes identified during recertification.. The most concerning finding is that there is no process to act on access changes identified during recertification. Even if recertification is performed, without follow-up to revoke or modify access, the process is ineffective and leaves inappropriate access in place, increasing the risk of unauthorized access. This directly undermines the control's purpose.

Answer

Access rights are recertified annually instead of quarterly.

Answer

Recertification forms are completed by users themselves rather than managers.

Answer

Recertification results are not documented or retained.

Question 16

An organization is acquiring a new financial system. The contract includes a clause that allows the organization to audit the vendor's controls. Which type of report would most efficiently provide assurance over the vendor's internal controls?

Accepted Answer

SOC 2 report. A SOC 2 report is specifically designed to provide assurance over a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy, which directly addresses the need to audit the vendor's internal controls for a financial system. It is more efficient than other options because it is a standardized, independent assessment that covers the control environment relevant to financial data processing.

Answer

Financial audit report

Answer

Penetration test report

Answer

ISO 27001 certificate

Question 17

During an audit of the incident response process, the IS auditor finds that the organization relies on shared accounts for system administration. Which TWO of the following are the MOST significant risks associated with shared accounts?

Accepted Answer

Lack of individual accountability for actions performed. Option B is correct because shared accounts eliminate the one-to-one mapping between a user identity and an account, so when multiple administrators use the same credentials there is no way to attribute a specific action to a specific individual, destroying individual accountability. Option D is correct because the audit logs generated under a shared account record only the account name, not the actual person, so the resulting audit trail cannot reliably support forensic investigations or non-repudiation. Options A and C are operational inconveniences rather than the most significant risks, and option E describes a possible consequence of poor password hygiene rather than the core accountability and forensic integrity risks that an IS auditor would emphasize.

Answer

Increased complexity in password management

Answer

Increased overhead for account provisioning

Answer

Higher likelihood of password sharing outside the authorized group

Question 18

An IS auditor is reviewing the release management process for a critical application. The release strategy includes a phased rollout to 10% of users initially, then 50%, then 100%. The first phase revealed a data integrity issue that affected a subset of transactions. The release manager decided to continue with the next phase while a patch was being developed. What should the auditor most recommend?

Accepted Answer

Halt the rollout until the data integrity issue is resolved.. Continuing the rollout while a data integrity issue exists could affect more users. Best practice is to halt the rollout until the issue is resolved and patched, to prevent further impact and ensure the fix is effective.

Answer

Document the issue as a known error and proceed.

Answer

Accelerate the rollout to quickly identify all issues.

Answer

Increase testing in the next phase to catch issues earlier.

Question 19

During an audit of privacy controls, the IS auditor discovers that the organization processes personal data of EU residents but has not appointed a Data Protection Officer (DPO). Which regulation is MOST likely being violated?

Accepted Answer

GDPR. The GDPR (EU Regulation 2016/679) governs the processing of personal data of EU residents and mandates the appointment of a Data Protection Officer (DPO) in specific circumstances—such as large-scale systematic monitoring or large-scale processing of special categories of data by public authorities or core-activity organizations. Processing EU residents' personal data without a required DPO is a direct GDPR Article 37 violation. The other regulations listed address payment card data, financial reporting integrity, and US healthcare information, none of which impose a DPO requirement for EU personal data.

Answer

PCI DSS

Answer

SOX

Answer

HIPAA

Question 20

A company is designing a public cloud-based application that processes highly sensitive personal data. Which of the following data protection strategies provides the STRONGEST assurance that data remains confidential even if the cloud provider's infrastructure is compromised?

Accepted Answer

Implement client-side encryption with customer managed keys. Client-side encryption with customer managed keys ensures that data is encrypted before it leaves the client environment, and the cloud provider never has access to the plaintext data or the encryption keys. Even if the cloud provider's infrastructure is fully compromised, the attacker cannot decrypt the data because the keys are never stored or processed by the provider. This provides the strongest assurance of confidentiality because the data remains encrypted end-to-end, independent of the provider's security controls.

Answer

Use server-side encryption with cloud provider managed keys

Answer

Enable encryption in transit using TLS 1.3

Answer

Apply data masking at the application layer