CISA Practice Test 27 — 15 Questions

Question 1

A company plans to implement a commercial off-the-shelf (COTS) application and requires significant customization to match its unique business processes. The vendor advises against extensive customization because it may complicate future upgrades. What is the BEST course of action?

Accepted Answer

Avoid customization and re-engineer business processes to match the COTS application. The best course of action is to avoid customization and re-engineer business processes to match the COTS application. This approach preserves the integrity of the vendor's standard codebase, ensuring that future upgrades and patches can be applied with minimal friction. Extensive customization creates a fork from the vendor's baseline, leading to costly regression testing, potential security gaps, and upgrade incompatibilities that undermine the long-term value of the COTS investment.

Answer

Use the vendor's customization module to minimize upgrade risks

Answer

Customize but maintain detailed documentation for upgrade impact analysis

Answer

Proceed with extensive customization to meet business needs

Question 2

An organization has implemented a role-based access control (RBAC) system. A user complains that they cannot access a file needed to complete a critical task. The file's permission indicates that only the 'Manager' role has read access. The user is assigned to the 'Analyst' role. Which of the following is the BEST course of action?

Accepted Answer

Submit a request for temporary access approval via change management. Option B is correct because in a properly implemented RBAC system, access changes must follow the principle of least privilege and be formally approved through change management to maintain audit trails and security controls. Granting temporary access via a documented change request ensures that the access is justified, time-bound, and reviewed, preventing unauthorized privilege escalation. This aligns with the CISA domain of Protection of Information Assets, where access control changes must be controlled and monitored.

Answer

Assign the user to the Manager role temporarily

Answer

Create a new role with only read access to that file

Answer

Change the file permissions to include Analyst role

Question 3

A company is designing a public cloud-based application that processes highly sensitive personal data. Which of the following data protection strategies provides the STRONGEST assurance that data remains confidential even if the cloud provider's infrastructure is compromised?

Accepted Answer

Implement client-side encryption with customer managed keys. Client-side encryption with customer managed keys ensures that data is encrypted before it leaves the client environment, and the cloud provider never has access to the plaintext data or the encryption keys. Even if the cloud provider's infrastructure is fully compromised, the attacker cannot decrypt the data because the keys are never stored or processed by the provider. This provides the strongest assurance of confidentiality because the data remains encrypted end-to-end, independent of the provider's security controls.

Answer

Use server-side encryption with cloud provider managed keys

Answer

Enable encryption in transit using TLS 1.3

Answer

Apply data masking at the application layer

Question 4

An organization's IT department implemented a new change management process that requires all changes to be approved by a change advisory board (CAB). A critical security patch needs to be deployed within 2 hours to address an active zero-day vulnerability. The change request was submitted but the CAB is not scheduled to meet for another 24 hours. What is the BEST course of action?

Accepted Answer

Use the emergency change process to obtain expedited approval from a designated CAB member.. Option D is correct because it aligns with the ITIL-based emergency change process, which allows for expedited approval from a designated CAB member or emergency authority when a critical security patch must be deployed within hours to mitigate an active zero-day vulnerability. This ensures the change is authorized without waiting for the full CAB meeting, maintaining security while preserving governance and audit trails.

Answer

Deploy the patch and inform the CAB after the fact during the next meeting.

Answer

Wait for the next scheduled CAB meeting to approve the change.

Answer

Deploy the patch immediately without any approval as it is a critical security fix.

Question 5

Which TWO of the following are essential components of a disaster recovery plan (DRP)?

Accepted Answer

Steps for restoring IT systems. Option A is correct because the primary purpose of a DRP is to restore IT systems and operations after a disaster. The plan must include step-by-step recovery procedures for critical systems, applications, and data to ensure business continuity. Without these steps, the DRP cannot guide the recovery team through the technical restoration process.

Answer

Detailed financial audit procedures

Answer

Employee performance reviews

Answer

Backup media rotation schedule

Question 6

Which TWO of the following are key performance indicators (KPIs) for IT operations?

Accepted Answer

Mean time to repair (MTTR). Mean time to repair (MTTR) measures the average time taken to restore a failed IT service or component, directly reflecting operational efficiency and incident response effectiveness. It is a standard KPI for IT operations because it quantifies the speed of recovery, which is critical for minimizing downtime and maintaining service levels.

Answer

Number of unresolved incidents

Answer

Employee satisfaction score

Answer

Budget variance

Question 7

Based on the exhibit, what is the most likely control weakness that allowed this condition?

Accepted Answer

Lack of individual accountability for privileged actions. The exhibit shows that multiple users are sharing a single privileged account (e.g., 'root' or 'admin') to perform administrative actions. Without unique user IDs for each administrator, it is impossible to map specific actions (e.g., a 'sudo' command or a configuration change) back to an individual. This lack of individual accountability is the core control weakness, as it violates the audit principle of non-repudiation and prevents effective forensic investigation.

Answer

Weak password complexity requirements

Answer

Failure to disable the default administrator account

Answer

Inadequate segregation of duties between IT and security teams

Question 8

A large financial institution is implementing a new core banking system to replace a legacy system. The project has been underway for 18 months and is behind schedule. User acceptance testing (UAT) has revealed significant data integrity issues, including missing customer records and incorrect interest calculations. The project manager, under pressure from senior management to meet a regulatory deadline, proposes going live with a promise to fix the issues in a post-implementation phase. The development team has been making ad hoc code changes directly in the test environment without version control or proper testing. Additionally, the IS auditor discovers that the business requirements were never formally signed off by the user community; only verbal approvals were obtained. The project has consumed 90% of the budget but only 60% of the functionality is tested. Which of the following is the BEST course of action for the IS auditor to recommend?

Accepted Answer

Recommend halting the go-live until the business requirements are formally signed off and UAT is completed successfully with all critical defects resolved.. Option B is correct because the project lacks formal sign-off on business requirements, has unresolved critical data integrity issues, and has been making uncontrolled code changes without version control. Going live under these conditions would violate ISACA's IS acquisition and implementation standards, which require that all critical defects be resolved and UAT be successfully completed before production deployment. The regulatory deadline does not justify bypassing these fundamental controls, as post-implementation fixes cannot guarantee data integrity and could lead to regulatory penalties.

Answer

Allow the go-live with a formal post-implementation support plan and a dedicated team to address defects.

Answer

Suggest a phased go-live, releasing the tested modules to production while continuing development on the remaining modules.

Answer

Escalate the issues to the board of directors and recommend immediate termination of the project.

Question 9

Which TWO of the following are primary objectives of a business continuity plan (BCP)?

Accepted Answer

Maintain regulatory compliance during disruptions. Option D is correct because a primary objective of a BCP is to ensure that the organization can continue to meet legal and regulatory obligations during a disruption. This includes maintaining required data protection, reporting, and operational standards as mandated by regulations such as GDPR, HIPAA, or SOX, even when normal operations are impaired.

Answer

Replace the disaster recovery plan

Answer

Minimize financial loss

Answer

Guarantee 100% system uptime

Question 10

Which of the following is the PRIMARY benefit of using a hardware security module (HSM) for key management?

Accepted Answer

It provides tamper-resistant storage for encryption keys.. The primary benefit of a hardware security module (HSM) is that it provides tamper-resistant, physically secured storage for encryption keys. HSMs are designed to protect keys from extraction or modification, even if an attacker gains physical access to the device, which is critical for maintaining the confidentiality and integrity of cryptographic operations. This aligns with the core purpose of an HSM: to safeguard the root of trust in a key management infrastructure.

Answer

It reduces the cost of key management.

Answer

It improves encryption speed.

Answer

It simplifies key distribution.

Question 11

An organization uses risk-based authentication (RBA) for user access. Which of the following factors would MOST likely trigger a step-up authentication?

Accepted Answer

User accessing sensitive data from an unusual location.. Risk-based authentication (RBA) evaluates the risk level of each access attempt based on contextual factors. An unusual location is a high-risk indicator because it deviates from the user's established behavioral baseline, often triggering step-up authentication (e.g., requiring a one-time passcode or biometric verification) to verify the user's identity before granting access to sensitive data.

Answer

User logging in from a known device.

Answer

User entering correct password.

Answer

User logging in during business hours.

Question 12

Which of the following is the MOST effective control to prevent unauthorized USB devices from connecting to corporate workstations?

Accepted Answer

Device control software that blocks non-approved USB devices.. Device control software (e.g., endpoint DLP or USB whitelisting tools) operates at the OS kernel or driver level to enforce a hardware ID or vendor ID allowlist, blocking any USB device not explicitly approved. This is the only option that provides a preventive, automated, and continuous control against unauthorized USB connections, regardless of user behavior or physical access.

Answer

User awareness training.

Answer

Physical security guards.

Answer

Encrypting all USB devices.

Question 13

What is the FIRST step in implementing an identity and access management (IAM) program?

Accepted Answer

Performing a user access review.. Performing a user access review is the first step because it establishes a baseline of current access rights, identifies segregation of duties conflicts, and uncovers orphaned accounts or excessive privileges. Without this foundational assessment, subsequent IAM controls like SSO or MFA would be deployed on an insecure or non-compliant access framework, violating the principle of 'least privilege' and potentially failing audit requirements.

Answer

Selecting an IAM vendor.

Answer

Implementing multi-factor authentication.

Answer

Deploying single sign-on (SSO).

Question 14

Which THREE of the following are commonly used data encryption standards? (Choose three.)

Accepted Answer

3DES. 3DES (Triple Data Encryption Standard) is a symmetric-key block cipher that applies the DES algorithm three times to each data block, effectively increasing the key length to 168 bits. It was widely adopted as a secure replacement for single DES, though it is now considered legacy due to performance and security limitations.

Answer

SHA-256

Answer

MD5

Question 15

Refer to the exhibit. Which of the following is the most significant risk associated with the backup policy for critical data?

Accepted Answer

Retention period is insufficient to meet regulatory requirements. Option B is correct because the backup policy shows a retention period of only 30 days, which is insufficient to meet common regulatory requirements such as GDPR, HIPAA, or SOX that often mandate retention of critical data for months or years. Without adequate retention, the organization risks non-compliance, legal penalties, and inability to produce historical records during audits or litigation.

Answer

Offsite backup storage is not configured

Answer

Backup frequency is too low to meet recovery point objectives

Answer

Encryption is not enabled for backup data