CISA Practice Test 26 — 15 Questions

Question 1

An IS auditor is assessing the data inventory of a financial institution to ensure compliance with privacy regulations. Which TWO of the following are essential elements that should be included in the data inventory?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The location (systems and physical) where PII is stored. A data inventory should identify where PII is stored and the business purpose for processing, as these are critical for managing privacy risks.

Answer

The encryption algorithm used to protect the data

Answer

The cost of storing the data

Answer

The names of all employees who process the data

Question 2

An IS auditor is reviewing the change management process and notices that several emergency changes were implemented without post-implementation review. What is the PRIMARY concern?

Accepted Answer

Changes may not be properly documented. Emergency changes bypass normal controls, so post-implementation review is critical to ensure the change was effective and did not introduce risks. Without it, undocumented or unauthorized changes may persist.

Answer

The change may have caused an outage

Answer

The change may have exceeded budget

Answer

The change may have been unauthorized

Question 3

An organization has implemented a key management program. Which of the following is the MOST critical control for ensuring the security of cryptographic keys?

Accepted Answer

Secure key storage (e.g., HSM). Secure key storage, such as using a hardware security module (HSM) or key vault, is critical to prevent unauthorized access to keys. Without secure storage, other controls are less effective.

Answer

Key rotation policy

Answer

Key generation in a secure environment

Answer

Key destruction procedures

Question 4

An IS auditor is reviewing the process for granting access to a sensitive financial application. Which TWO of the following are the MOST important controls to ensure appropriate access?

Accepted Answer

Quarterly recertification of access by managers. Formal approval from the data owner ensures that access is authorized based on business need, and periodic recertification ensures that access remains appropriate over time.

Answer

Use of biometric authentication

Answer

Single sign-on for all applications

Answer

Automatic provisioning upon employee hire

Question 5

An IS auditor is reviewing an organization's logical access control processes. Which of the following is the primary purpose of conducting regular user access recertifications?

Accepted Answer

To verify that users' access rights remain appropriate for their roles. User access recertifications confirm that current access rights are still appropriate for users' job functions and that no excessive privileges exist. This ensures the principle of least privilege.

Answer

To identify inactive user accounts

Answer

To ensure compliance with password policies

Answer

To enforce segregation of duties

Question 6

An IS auditor is reviewing a third-party service provider's controls. Which of the following is the MOST important clause to include in the contract to ensure the auditor can assess the provider's controls?

Accepted Answer

Right-to-audit clause. A right-to-audit clause allows the customer or its auditor to review the provider's controls.

Answer

Service level agreement (SLA) with penalties

Answer

Exit strategy clause

Answer

Confidentiality clause

Question 7

An IS auditor is reviewing physical access controls at a data center. Which of the following controls is MOST effective for preventing tailgating?

Accepted Answer

Mantrap. A mantrap is a small room with two interlocking doors that prevents tailgating because only one person can pass through at a time.

Answer

CCTV cameras

Answer

Visitor log

Answer

Biometric readers

Question 8

An IS auditor is reviewing a penetration test report that shows a critical vulnerability in a web application. The IT manager states that the vulnerability will not be fixed because it requires significant code changes and the application is being decommissioned in six months. What should the auditor do?

Accepted Answer

Verify that the risk has been formally accepted and compensating controls are implemented. The auditor should verify that the risk is formally accepted by management and that compensating controls are in place to protect the application until decommissioning.

Answer

Accept the decision as business risk acceptance

Answer

Escalate to senior management as a critical finding

Answer

Recommend immediate decommissioning of the application

Question 9

An organization uses a cloud service provider (CSP) for critical applications. The IS auditor is reviewing the contract for vendor concentration risk. Which TWO clauses are MOST relevant to mitigating this risk?

Accepted Answer

A clause requiring the CSP to disclose and obtain approval for any subcontractors.. Vendor concentration risk is the risk of over-reliance on a single vendor. An exit strategy clause ensures the ability to transition away, and a subcontracting controls clause (fourth-party risk) addresses the CSP's use of other vendors that could increase concentration. SLA monitoring is important but not directly for concentration; right-to-audit is a general control; data encryption is about security.

Answer

A service level agreement (SLA) with financial penalties for non-performance.

Answer

A data encryption clause requiring encryption at rest and in transit.

Answer

A right-to-audit clause allowing the organization to audit the CSP.

Question 10

An IS auditor is reviewing the firewall rule base. Which of the following findings would be of MOST concern?

Accepted Answer

A rule that allows any service from the Internet to the internal network. An allow rule from any to any (any-any) is overly permissive and poses a significant security risk. The other options are also problems but are less severe than a wide-open rule.

Answer

A rule that has not been reviewed for 18 months

Answer

A rule that permits traffic from a specific IP to a database server on port 1433

Answer

A rule that allows any source IP to access a critical server on port 443

Question 11

An organization is implementing a new incident management process aligned with ITIL. The IT team discovers a critical system is down, affecting all users. According to ITIL, what severity level should be assigned to this incident?

Accepted Answer

P1. A P1 (Priority 1) incident is the highest severity, typically involving a critical system outage that affects all users or major business operations.

Answer

P3

Answer

P2

Answer

P4

Question 12

Which TWO of the following are important controls for managing cloud resources to prevent cost overruns? (Select TWO).

Accepted Answer

Automated resource tagging. Resource tagging helps allocate costs and track usage. Detecting orphaned resources (e.g., unused instances) prevents unnecessary charges. These are key cloud cost management controls.

Answer

Conducting vulnerability scans on cloud instances

Answer

Using multi-factor authentication for cloud access

Answer

Implementing encryption for data at rest

Question 13

An IS auditor is reviewing the key management program for an organization's encryption systems. Which of the following is the MOST critical control to ensure the security of encryption keys?

Accepted Answer

Implementing key rotation at defined intervals. Regular key rotation limits the amount of data compromised if a key is exposed.

Answer

Storing keys on hardware security modules (HSMs)

Answer

Using strong encryption algorithms

Answer

Ensuring keys are backed up

Question 14

During an audit of physical security, the IS auditor observes that employees frequently leave confidential documents on their desks overnight. Which TWO controls should the auditor recommend?

Accepted Answer

Conduct security awareness training. A clean desk policy requires employees to secure documents at end of day, and a security awareness program reminds them of the policy and consequences.

Answer

Deploy additional CCTV cameras

Answer

Implement a visitor management system

Answer

Install motion detectors

Question 15

An organization processes personal data of EU residents and has implemented pseudonymisation as a privacy control. The IS auditor is reviewing the effectiveness of this control in meeting GDPR requirements. Which of the following is the MOST important limitation of pseudonymisation?

Accepted Answer

Pseudonymised data is still considered personal data under GDPR. Pseudonymisation reduces the link between data and an individual but does not fully anonymize the data; the pseudonymised data remains personal data if the pseudonym can be reversed using additional information held separately.

Answer

Pseudonymisation eliminates the need for data subject rights

Answer

Pseudonymisation is not recognized by GDPR

Answer

Pseudonymisation cannot be applied to structured data