CISA Practice Test 26 — 15 Questions

Question 1

Based on the exhibit, what is the MOST likely security risk?

Accepted Answer

Unrestricted traffic is allowed after the specific deny. Option C is correct because the 'permit ip any any' at the end allows all traffic, bypassing earlier specific denials. Option A is not correct because the deny line only blocks other traffic, but the permit any any overrides it. Option B is not directly indicated. Option D is a risk but less direct than the rule order issue.

Answer

The web server is fully protected

Answer

Traffic to port 80 is not encrypted

Answer

The host 192.168.1.100 is exposed to denial-of-service attacks

Question 2

A healthcare organization must comply with HIPAA regulations regarding patient data privacy. The IT department has implemented technical controls, but the compliance officer discovers that some employees are sharing passwords. What is the BEST governance response?

Accepted Answer

Enforce the existing policy through disciplinary actions and additional training.. Option D is correct because enforcing policy through disciplinary action and training addresses the root cause. Option A is wrong because over-reliance on technical controls may not prevent deliberate sharing. Option B is wrong because policy revision alone may not change behavior. Option C is wrong because reporting to regulator is premature.

Answer

Implement multi-factor authentication to prevent password sharing.

Answer

Report the incident to the regulatory authority as a data breach.

Answer

Revise the password policy to require more complex passwords.

Question 3

A large financial institution has a well-defined IT governance framework with a clear organizational structure, policies, and processes. However, the internal audit department has identified that several IT projects are over budget and behind schedule. The project managers blame unclear requirements and scope creep. The IT governance committee meets monthly but reviews projects only at a high level. The auditor's best recommendation to improve project governance is to:

Accepted Answer

Establish a project management office (PMO) to oversee project governance and reporting. Option C is correct because establishing a project management office (PMO) provides standardized project management practices, oversight, and controls to prevent scope creep and improve delivery. Option A is tactical and does not address governance. Option B focuses on security, not project delivery. Option D may improve business alignment but does not directly address project management issues.

Answer

Increase the frequency of security reviews for all projects

Answer

Change the IT steering committee's meeting frequency to weekly with detailed reviews

Answer

Require all projects to use a specific project management software tool

Question 4

An organization is planning to outsource its data center operations. Which of the following governance practices should be implemented to ensure proper oversight?

Accepted Answer

Establish a service level agreement (SLA) with key performance indicators (KPIs).. Option B is correct because an SLA with KPIs provides measurable performance targets and accountability. Option A is a certification but not a governance practice for oversight. Option C abdicates control. Option D is financial, not operational oversight.

Answer

Conduct annual financial audits of the outsourcer.

Answer

Require the outsourcer to obtain ISO 27001 certification.

Answer

Allow the outsourcer to manage all security controls independently.

Question 5

Which of the following is a potential risk in this RACI matrix?

Accepted Answer

The Change Manager is responsible but lacks authority to approve.. Option B is correct because the Change Manager is marked as Responsible but typically the Responsible party performs the work; for approval, the Responsible party may lack the authority to approve (which would be Accountable). This creates a risk of unauthorized approvals. Option A is not a risk because Accountable can be informed later. Option C is fine; consultation is normal. Option D is not a concern because IT Operations is informed appropriately.

Answer

The IT Director is accountable but not informed of all changes.

Answer

IT Operations is informed, but should be responsible for implementation.

Answer

The Business Process Owner is consulted, which may delay approvals.

Question 6

An organization's IT governance committee is reviewing a proposal to use a public cloud provider that does not meet the organization's data encryption standards. The board has set a low risk appetite for data privacy. What is the BEST action?

Accepted Answer

Reject the proposal until encryption requirements are met. Option A is correct because the proposal violates the board's risk appetite, so it should be rejected until requirements are met. Option B is incorrect because additional monitoring does not address the encryption gap. Option C is incorrect because waivers do not reduce the risk. Option D is incorrect because the committee should not delegate a decision that contradicts risk appetite.

Answer

Accept the proposal with additional monitoring

Answer

Delegate the decision to the security team

Answer

Accept the proposal but require the provider to sign a waiver

Question 7

A company outsources its data center operations to a third-party provider. Which of the following is the MOST important control to include in the outsourcing contract?

Accepted Answer

Right to audit the provider's facilities and processes. Option D is correct because the right to audit allows the company to verify the provider's compliance. Option A is important but less critical than audit rights. Option B is operational. Option C is a security control but not the most important contractual safeguard.

Answer

Detailed escalation procedures for incidents

Answer

Service level agreements with financial penalties

Answer

Requirements for encryption of data at rest

Question 8

An organization uses the policy shown. Which of the following is an omission in the policy?

Accepted Answer

No specification of data disposal methods after retention periods. Option A is correct because there is no rule for data disposal after retention. Option B is present. Option C is addressed. Option D is not mentioned but not an omission in this context.

Answer

No definition of authorized users

Answer

No mention of backup frequency

Answer

Missing encryption requirement for log data

Question 9

Which TWO of the following are primary objectives of IT governance as defined by COBIT 5?

Accepted Answer

Resource optimization. Options A and C are correct because COBIT 5 defines IT governance objectives as stakeholder value creation and resource optimization. Option B is a management objective, not governance. Option D is a goal of information security, not governance overall. Option E is too narrow (cost reduction) and not a primary governance objective.

Answer

Cost reduction

Answer

Incident response

Answer

Data encryption

Question 10

An IT governance framework has been implemented, but the board is not receiving regular reports on IT performance. Which of the following is the BEST course of action?

Accepted Answer

Develop a dashboard that presents key IT metrics to the board.. Option A is correct because a dashboard provides a concise, regular view of key metrics for the board. Option B may help but does not directly address reporting. Option C is a broader initiative. Option D focuses on risk, not reporting.

Answer

Conduct an IT risk assessment to identify critical areas.

Answer

Implement an IT balanced scorecard that aligns with corporate strategy.

Answer

Assign a chief information officer (CIO) to report directly to the board.

Question 11

What is the MOST significant weakness in the planned remediation?

Accepted Answer

The remediation may not eliminate the segregation of duties issue.. Option C is correct because an automated code review tool may still be run by the same developer, not ensuring segregation of duties. The remediation does not address the root cause of the same person performing both tasks. Option A (only addresses subset) is not the most significant; the tool could be applied to all projects. Option B (technology vs. process) is valid but secondary. Option D (no compensating control) is related but not as direct.

Answer

The remediation only addresses a subset of projects.

Answer

The remediation relies on technology rather than process.

Answer

The remediation does not include a compensating control.

Question 12

Which TWO of the following are key components of an IT governance framework? (Choose two.)

Accepted Answer

IT strategy. Options A and B are correct because an IT steering committee and an IT strategy are fundamental governance components. Option C is incorrect as hardware inventory is operational. Option D is incorrect as help desk procedures are operational. Option E is incorrect as network topology is technical.

Answer

Network topology diagram

Answer

Help desk procedures

Answer

Hardware inventory

Question 13

An IS auditor is reviewing the balanced scorecard for IT. Which of the following metrics BEST aligns with the 'customer perspective'?

Accepted Answer

Average system uptime for critical applications. Option B is correct because system uptime directly measures service delivery to customers. Option A aligns with financial perspective. Option C aligns with internal processes. Option D aligns with learning and growth.

Answer

Percentage of IT projects under budget

Answer

Number of change requests completed on time

Answer

Percentage of staff with ITIL certification

Question 14

Based on the log, what is the MOST likely root cause of the backup failure?

Accepted Answer

Insufficient storage capacity. Option D is correct because the log clearly indicates the target directory is full. Options A, B, C are not indicated in the log.

Answer

Network connectivity issues

Answer

Incorrect backup schedule

Answer

Backup software corruption

Question 15

Which THREE of the following are components of the COBIT 2019 governance system?

Accepted Answer

Organizational structures. Options A, C, and E are correct because COBIT 2019 includes governance components: Processes, Organizational Structures, and Information Items. Option B (Service Desk) is an operational process not a governance component. Option D (Project Management Office) is a management structure, not a governance component as defined in COBIT 2019.

Answer

Service desk

Answer

Project management office

CISA Practice Test 26 — 15 Questions

Exhibit

CISA Practice Test 26 — 15 Questions

Exhibit