CISA Practice Test 28 — 15 Questions

Question 1

An IS auditor is testing the effectiveness of a control that involves a manual review of exception reports. The population of exceptions is 5,000 items. The auditor wants to achieve a 95% confidence level with a tolerable error rate of 2%. Which sampling method is MOST appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Statistical attribute sampling. Statistical attribute sampling is the most appropriate method when the auditor wants to achieve a specified confidence level and tolerable error rate for a control that has a binary outcome (exception or no exception). It allows the auditor to project the exception rate to the population and conclude whether the control is operating effectively within the tolerable deviation rate.

Answer

Systematic sampling

Answer

Judgmental sampling

Answer

Stratified sampling

Question 2

A company is implementing a new IT governance framework. Which of the following is the PRIMARY benefit of aligning IT strategy with business strategy?

Accepted Answer

Ensures IT investments support business objectives. Aligning IT strategy with business strategy ensures that technology investments, projects, and resources are directed toward achieving the organization's business goals, which is the fundamental purpose of IT governance frameworks like COBIT. This alignment translates business objectives into IT priorities so that every dollar and hour spent on IT delivers measurable business value.

Answer

Simplifies IT architecture

Answer

Improves IT staff morale

Answer

Reduces IT costs

Question 3

A small business wants to protect customer data stored on a local file server. Which of the following is the MOST cost-effective control to prevent unauthorized access?

Accepted Answer

Configure file-level permissions. Configuring file-level permissions (e.g., NTFS permissions on Windows or POSIX ACLs on Linux) is the most cost-effective control because it directly restricts which users or groups can read, write, or modify specific files and folders on the server. This granular access control prevents unauthorized access without requiring additional hardware or complex management, making it ideal for a small business with limited budget.

Answer

Enable detailed audit logs

Answer

Implement full-disk encryption

Answer

Deploy biometric authentication

Question 4

Which THREE of the following are typical phases in the system development life cycle (SDLC)?

Accepted Answer

Implementation.. The SDLC is commonly modeled as a sequence of phases such as requirements gathering/analysis, design, development, testing, implementation/deployment, and maintenance. Option D (Requirements analysis) is correct because it is the phase where business and functional needs are elicited, documented, and validated, forming the basis for all later work. Option E (Design) is correct because it translates the approved requirements into system architecture, components, interfaces, and detailed specifications before coding begins. Option B (Implementation) is correct because it is the phase in which the designed system is built, coded, tested at the unit level, and deployed into production or a target environment. Option A (Unit testing) is a testing activity performed within the development/implementation phase rather than a distinct top-level SDLC phase, and Option C (Patch management) is an ongoing IT operations/maintenance process for applying vendor fixes, not a standard SDLC phase.

Answer

Unit testing.

Answer

Patch management.

Question 5

An organization uses automated job scheduling with dependency management. A critical nightly batch job failed because a prerequisite job did not complete successfully. The job scheduler automatically attempted to rerun the failed job three times, each time failing due to the same dependency. The operations team was not alerted until the next morning. What control should the auditor recommend to improve this process?

Accepted Answer

Implement real-time alerts for job failures and dependency issues.. The core issue is the lack of timely notification, not the number of retries or the dependency logic itself. The job scheduler correctly identified the dependency failure and attempted reruns, but the operations team remained unaware until the next morning. Implementing real-time alerts for job failures and dependency issues (Option B) ensures that the operations team can intervene immediately, rather than discovering the problem hours later during a manual check.

Answer

Increase the number of automatic rerun attempts.

Answer

Remove dependency management for critical jobs.

Answer

Schedule all critical jobs to run sequentially without dependencies.

Question 6

An IS auditor is reviewing an emergency change that was implemented to fix a critical security vulnerability. What is the most important post-implementation step?

Accepted Answer

Document the change and obtain retrospective approval. Documenting the change and obtaining retrospective approval is the most important step because emergency changes bypass normal change control, and without proper documentation and after-the-fact authorization, the organization loses accountability and auditability. This step ensures the change is formally recorded in the change log and reviewed by the change advisory board (CAB) or equivalent authority, closing the governance gap created by the emergency. It also provides the audit trail needed for future reviews and compliance.

Answer

Update the configuration management database

Answer

Notify all users

Answer

Conduct a risk assessment

Question 7

A multinational corporation is evaluating its IT governance structure. The board wants to ensure that IT investments are prioritized based on risk and value. Which framework component is MOST critical?

Accepted Answer

Portfolio management process. A portfolio management process systematically evaluates and prioritizes investments based on risk and value, aligning with board objectives. Steering committee provides oversight, but portfolio management is the mechanism for prioritization.

Answer

Service level agreements

Answer

Balanced scorecard

Answer

IT steering committee

Question 8

Which TWO of the following are key components of an effective information security awareness program?

Accepted Answer

Mandatory training for all employees. Mandatory training for all employees (C) is a core component of an awareness program because it ensures every user receives consistent, documented instruction on policies, threats, and safe behaviors, which is the primary mechanism for changing human behavior. Phishing simulation exercises (E) are also essential because they provide realistic, measurable practice that reinforces training and identifies users who need additional coaching, directly testing the human layer that awareness programs target. By contrast, periodic review of security logs (A) and regular vulnerability scans (D) are technical security operations controls that detect and manage system weaknesses, not activities that educate or influence user behavior. An annual password change policy (B) is an authentication control or policy requirement; while it may be communicated through awareness efforts, the policy itself does not train or educate employees, so it is not a key component of an awareness program.

Answer

Periodic review of security logs

Answer

Annual password change policy

Answer

Regular vulnerability scans

Question 9

Which of the following is the primary purpose of conducting a static application security test (SAST) during the development phase of the SDLC?

Accepted Answer

To identify security vulnerabilities in the source code. Static Application Security Testing (SAST) analyzes source code, bytecode, or binaries without executing the application, to identify security vulnerabilities such as SQL injection, buffer overflows, and insecure cryptographic practices. Its primary purpose during development is to find security flaws early in the SDLC, when they are cheaper to fix. It does not validate business requirements or runtime behavior.

Answer

To ensure the application is free of runtime errors

Answer

To validate that the application meets business requirements

Answer

To test the application's performance under load

Question 10

Which ITIL 4 guiding principle emphasizes understanding the current state and building on existing capabilities rather than starting from scratch?

Accepted Answer

Start where you are. Start where you are means assessing current services and processes to identify what can be reused or improved.

Answer

Focus on value

Answer

Progress iteratively

Answer

Keep it simple

Question 11

An IS auditor is planning an audit of a small organization with limited IT staff. Which of the following is a key consideration for the audit approach?

Accepted Answer

Greater reliance on detective and compensating controls. In a small organization with limited IT staff, the auditor should expect a greater reliance on detective and compensating controls because preventive controls such as segregation of duties and automated enforcement are often impractical. The audit approach must recognize this reality and focus on whether detective controls adequately mitigate the increased risk.

Answer

Reduced audit scope because of limited staff

Answer

Increased reliance on preventive controls due to limited staff

Answer

Use of extensive substantive testing to compensate for weak controls

Question 12

An IT department is structured with a central group that manages infrastructure and security, while business units have their own IT staff for application support. This is an example of which IT organizational structure?

Accepted Answer

Hybrid. A hybrid (or federated) structure combines centralized and decentralized elements, where some functions are centralized and others are distributed.

Answer

Matrix

Answer

Centralized

Answer

Decentralized

Question 13

Which THREE of the following are components of the COBIT 2019 governance system?

Accepted Answer

Organizational structures. COBIT 2019 defines a governance system as comprising several distinct types of components, and among the listed choices the three that belong are A (Organizational structures), B (Information items), and C (Processes). Organizational structures are correct because COBIT 2019 explicitly names them as a component type, covering the various decision-making bodies and roles (such as boards, committees, and executive management) that carry out governance and management activities. Information items are correct because COBIT 2019 lists them as a component, referring to the information produced and used by the governance system to enable informed decision-making and effective operation. Processes are correct because COBIT 2019 identifies processes as a core component type, encompassing the organized sets of practices and activities (the governance and management objectives) used to achieve enterprise goals. The unmarked options do not belong: a service desk (D) is a specific IT service management function rather than a COBIT 2019 governance system component type, and a project management office (E) is a particular organizational entity or function, not one of the defined component categories in the COBIT 2019 governance system.

Answer

Service desk

Answer

Project management office

Question 14

An organization is planning to purchase a cloud-based HR system. Which THREE of the following should be included in the vendor contract to ensure adequate control and oversight? (Select three.)

Accepted Answer

Right to audit the vendor's controls. Option B is correct because a right-to-audit clause contractually guarantees the organization can assess the vendor's security controls, either directly or via a third-party assessment such as SOC 2, which is essential for ongoing oversight of a cloud HR system holding sensitive employee data. Option C is correct because an SLA defining uptime and response times establishes measurable performance and availability commitments, giving the organization enforceable remedies if service levels are missed. Option E is correct because data ownership and data protection clauses clarify that the organization retains ownership of its HR data and obligate the vendor to safeguard it in line with applicable privacy and security requirements. Option A is not among the marked answers, and while subprocessor transparency is useful, it is not one of the three required contract elements here. Option D is not marked because a fixed-price payment schedule addresses commercial cost certainty, not control and oversight of the vendor's security and service performance.

Answer

A list of all subprocessors

Answer

A fixed-price payment schedule

Question 15

Match each type of access control to its definition.

Accepted Answer

Discretionary Access Control (DAC): Access decisions are based on the identity of the user and the rules defined by the data owner.. The correct matches are: DAC = owner-defined rules, MAC = system-enforced labels, RBAC = role assignments, ABAC = attribute policies. Common confusions include swapping MAC and DAC definitions.

Answer

Discretionary Access Control (DAC): Access is based on security labels assigned by the system administrator.

Answer

Mandatory Access Control (MAC): Access decisions are made by the data owner.