CISA Practice Test 27 — 15 Questions

Question 1

An organization is implementing a privileged access management (PAM) solution. Which of the following is the PRIMARY benefit of using a PAM tool?

Accepted Answer

Centralized management and monitoring of privileged account usage. PAM tools primarily help control and monitor the use of privileged accounts, thus reducing the risk of misuse by enforcing policies like session recording and just-in-time access.

Answer

Elimination of shared accounts by providing individual credentials

Answer

Enforcement of segregation of duties between IT and security teams

Answer

Automated password resets for user accounts

Question 2

An IS auditor is reviewing the physical access controls at a data center. Which of the following is the MOST effective control to prevent tailgating?

Accepted Answer

Mantrap. A mantrap requires one person to enter at a time and prevents unauthorized individuals from following an authorized person through a door.

Answer

Security guards at the entrance

Answer

CCTV cameras at the entrance

Answer

Biometric readers at all entrances

Question 3

An IS auditor is reviewing the incident response (IR) process. Which of the following is the BEST way to test the effectiveness of the IR plan?

Accepted Answer

Conducting a tabletop exercise. Tabletop exercises simulate real incidents and allow the team to practice their response, revealing gaps in the plan and coordination.

Answer

Checking the availability of forensic tools

Answer

Interviewing the IR team

Answer

Reviewing IR policies and procedures

Question 4

Which of the following is the PRIMARY reason for implementing network segmentation?

Accepted Answer

To contain security breaches and limit lateral movement.. Segmentation limits the spread of attacks by isolating sensitive systems.

Answer

To comply with licensing requirements.

Answer

To simplify IP address management.

Answer

To improve network performance.

Question 5

An IS auditor is reviewing the organization's encryption key management program. Which of the following is the MOST critical control to ensure the confidentiality of encrypted data in the event of a key compromise?

Accepted Answer

Key rotation at regular intervals. Key rotation ensures that if a key is compromised, only data encrypted with that key after a certain point is at risk; data encrypted with previous keys remains protected if those keys are properly destroyed.

Answer

Key generation using a strong random number generator

Answer

Key destruction procedures for retired keys

Answer

Key distribution via secure channels

Question 6

An IS auditor is reviewing the user access recertification process. Which of the following findings would MOST concern the auditor regarding the effectiveness of access reviews?

Accepted Answer

Managers approve all access requests without verifying job requirements. If managers approve access without verifying actual job requirements, the recertification process is ineffective. This indicates a rubber-stamping issue. The other options are less critical or address different aspects.

Answer

The recertification report includes all users with active accounts

Answer

Reviews are performed quarterly instead of annually

Answer

Some users did not respond to the recertification request within the deadline

Question 7

An IS auditor is reviewing the logical access controls for a cloud-based HR system. The system contains sensitive employee data. The auditor notes that user provisioning is performed by the HR department without IT involvement, and there is no formal access request or approval process. Which THREE of the following are the MOST significant risks?

Accepted Answer

There is no audit trail of who granted access and why. Without formal access controls, users may receive excessive privileges, there is no audit trail for access grants, and segregation of duties is violated. While password security and user lockout are relevant, the primary risks stem from the lack of control over provisioning.

Answer

Password policies may not be enforced

Answer

User accounts may not be locked after multiple failed login attempts

Question 8

A system has a Mean Time Between Failures (MTBF) of 200 hours and a Mean Time To Repair (MTTR) of 20 hours. What is the availability of the system?

Accepted Answer

90.9%. Availability = MTBF / (MTBF + MTTR) = 200 / (200 + 20) = 200 / 220 ≈ 0.909 = 90.9%.

Answer

95.0%

Answer

91.0%

Answer

90.0%

Question 9

An IS auditor is reviewing the access recertification process for a financial application. The process requires users' managers to confirm access rights quarterly. Which of the following findings should MOST concern the auditor?

Accepted Answer

There is no process to act on access changes identified during recertification.. The recertification process should include a timely follow-up on access changes. Without this, outdated permissions may persist, increasing risk.

Answer

Access rights are recertified annually instead of quarterly.

Answer

Recertification forms are completed by users themselves rather than managers.

Answer

Recertification results are not documented or retained.

Question 10

During an audit of the incident response process, the IS auditor finds that the organization relies on shared accounts for system administration. Which TWO of the following are the MOST significant risks associated with shared accounts?

Accepted Answer

Lack of individual accountability for actions performed. Shared accounts make it difficult to attribute actions to specific individuals and can lead to loss of audit trail, increasing the risk of undetected misuse.

Answer

Increased complexity in password management

Answer

Increased overhead for account provisioning

Answer

Higher likelihood of password sharing outside the authorized group

Question 11

An organization is conducting a Business Impact Analysis (BIA). Which of the following metrics defines the maximum acceptable outage time for a critical business process?

Accepted Answer

Maximum Tolerable Downtime (MTD). Maximum Tolerable Downtime (MTD) is the total time a process can be disrupted without causing significant business damage.

Answer

Recovery Point Objective (RPO)

Answer

Recovery Time Objective (RTO)

Answer

Work Recovery Time (WRT)

Question 12

An IS auditor is evaluating the incident response (IR) plan. Which of the following is the BEST indicator that the plan is effective?

Accepted Answer

Lessons learned from tabletop exercises are incorporated into the plan. Lessons learned from tabletop exercises demonstrate that the plan is tested and improved. Other options are components but do not directly indicate effectiveness.

Answer

The plan is approved by senior management

Answer

The plan is updated annually

Answer

The plan includes contact information for key stakeholders

Question 13

During a privacy audit, the IS auditor discovers that the organization does not have a complete data inventory. What is the PRIMARY risk associated with this finding?

Accepted Answer

Inability to fulfill data subject access requests within required timeframes. Without knowing where PII is stored and processed, the organization cannot effectively protect it, respond to data subject requests, or ensure compliance with privacy regulations like GDPR.

Answer

Increased likelihood of data breaches

Answer

Higher costs for data storage

Answer

Difficulty in encrypting data at rest

Question 14

During a change management board (CAB) meeting, a proposed change to the network firewall configuration is discussed. The change is considered low risk and pre-approved. Which type of change does this represent?

Accepted Answer

Standard change. Standard changes are pre-approved, low-risk, and follow a defined procedure, often requiring only a CAB notification.

Answer

Emergency change

Answer

Major change

Answer

Normal change

Question 15

An IS auditor is reviewing an organization's key management program. Which of the following is the GREATEST risk associated with using a single key for both encryption and decryption of sensitive data?

Accepted Answer

Key rotation requires re-encrypting all data encrypted with that key.. Symmetric keys must be protected; if compromised, both confidentiality and integrity are at risk. However, the primary risk is the inability to rotate keys without re-encrypting all data, leading to potential exposure if the key is compromised.

Answer

The key management system cannot generate such a key.

Answer

The key may be more easily guessed by attackers.

Answer

Non-repudiation cannot be achieved.