CISA Practice Test 28 — 15 Questions

Question 1

During a firewall rule review, an IS auditor identifies several rules that allow any-to-any traffic. Which THREE of the following should the auditor recommend as the MOST appropriate actions?

Accepted Answer

Obtain business justification for each any-to-any rule. Overly permissive rules should be reviewed to determine if they are needed, and if so, should be tightened. If no business justification exists, they should be removed. If needed, they should be replaced with specific rules.

Answer

Immediately delete all any-to-any rules without review

Answer

Increase logging for any-to-any rules to detect misuse

Question 2

An IT auditor is reviewing the problem management process. The IT team maintains a repository of known errors with documented workarounds. Which component of problem management is this?

Accepted Answer

Known error database. A known error database (KEDB) is used to store known errors and workarounds to expedite incident resolution.

Answer

Service request

Answer

Root cause analysis

Answer

Problem record

Question 3

An IS auditor is evaluating the effectiveness of a security awareness program. Which of the following metrics would BEST indicate that the program is achieving its objectives?

Accepted Answer

Reduction in the number of successful phishing attacks. A reduction in the number of successful phishing attacks over time demonstrates that employees are better at recognizing and reporting phishing attempts, indicating improved security awareness.

Answer

Scores on post-training quizzes

Answer

Percentage of employees who completed the annual training

Answer

Number of security incidents reported by employees

Question 4

An IS auditor is reviewing the password policy for a system that processes sensitive financial data. Which of the following is the MOST effective control to mitigate the risk of password cracking?

Accepted Answer

Implement account lockout after 5 failed attempts. Account lockout after a few failed attempts is the most effective control to prevent brute-force password cracking. Complexity and length help but do not prevent automated attacks; 2FA is strong but not specifically for cracking; password history prevents reuse but not cracking.

Answer

Require passwords of at least 12 characters with complexity

Answer

Maintain a password history to prevent reuse

Answer

Enforce two-factor authentication for all users

Question 5

An IS auditor is reviewing the vulnerability management program. The auditor notes that a critical vulnerability was identified in a production system six months ago and has not been patched due to a business impact assessment. Which of the following should the auditor examine NEXT?

Accepted Answer

Whether a formal risk acceptance and compensating controls are in place. The auditor should verify that the risk acceptance is formally documented and approved by the appropriate management, including compensating controls, to ensure the risk is managed.

Answer

The technical details of the vulnerability

Answer

The patch deployment schedule for the next quarter

Answer

The vendor's patch release notes

Question 6

An IS auditor is reviewing firewall rule sets and discovers a rule that permits any source IP to access the internal database server on TCP port 1433 (Microsoft SQL). The rule was documented as a temporary measure but has been in place for 18 months. What is the auditor's BEST course of action?

Accepted Answer

Determine if there is a business justification for the rule and, if not, recommend removal or restriction to specific IPs. Overly permissive rules that are not justified create significant risk. The auditor should first confirm the business need and then recommend removal or tightening of the rule. If no valid justification exists, the rule should be removed.

Answer

Report the issue to senior management as a critical finding

Answer

Recommend immediate removal of the rule

Answer

Accept the risk as a compensating control

Question 7

An IS auditor is reviewing an organization's vulnerability management program. The auditor notes that a critical vulnerability in a key application has not been patched for 90 days, and there is no documented risk acceptance. What should the auditor do FIRST?

Accepted Answer

Determine if compensating controls exist to mitigate the vulnerability. The auditor should determine if compensating controls are in place to mitigate the risk, as this information is essential to assess the residual risk.

Answer

Report the finding as a non-compliance with the patch management policy

Answer

Discuss with management the absence of a risk acceptance

Answer

Escalate the issue to senior management immediately

Question 8

During an audit of privacy controls, the IS auditor discovers that the organization processes personal data of EU residents but has not appointed a Data Protection Officer (DPO). Which regulation is MOST likely being violated?

Accepted Answer

GDPR. GDPR requires mandatory appointment of a DPO for organizations that process special categories of data or engage in large-scale systematic monitoring. The other regulations do not have a DPO requirement.

Answer

PCI DSS

Answer

SOX

Answer

HIPAA

Question 9

An IS auditor is reviewing the organization's data inventory process for privacy compliance. Which TWO of the following are the MOST important elements that should be included in the data inventory?

Accepted Answer

Data elements or fields containing personal data. Data inventory must identify what personal data is held, where it is stored, and how it flows. Legal basis and retention are also important, but location and data elements are foundational.

Answer

Data classification labels

Answer

Data retention periods

Answer

Data subject consent status

Question 10

Which of the following is the PRIMARY objective of a penetration test?

Accepted Answer

To identify vulnerabilities that could be exploited by an attacker. Penetration testing aims to identify exploitable vulnerabilities that could be used by an attacker.

Answer

To test the incident response capability

Answer

To validate the effectiveness of security controls

Answer

To ensure compliance with security standards

Question 11

An organization is implementing a new release management process. Which TWO activities are essential components of a successful release?

Accepted Answer

Release planning. Release planning defines the scope and schedule; testing ensures the release meets quality standards. Deployment is part of release, but planning and testing are foundational.

Answer

Service desk operations

Answer

Capacity management

Answer

Incident management

Question 12

An organization classifies IT incidents based on severity. A critical financial application is unavailable, impacting all users. According to ITIL best practices, which severity level should this incident be assigned?

Accepted Answer

P1. P1 incidents are the highest severity, typically involving a critical service outage affecting all users with significant business impact.

Answer

P2

Answer

P3

Answer

P4

Question 13

An IS auditor is reviewing the logical access controls for a financial application. The auditor notices that user access reviews are performed annually by the application owner, but there is no documentation indicating that managers confirm the continued need for access. Which of the following is the MOST significant risk associated with this finding?

Accepted Answer

Unauthorized access to sensitive data due to excessive privileges. Without manager confirmation, access may remain for users who no longer need it, leading to segregation of duties conflicts or unauthorized access. Annual reviews without manager sign-off increase the risk that access is not appropriately revoked when roles change.

Answer

Increased likelihood of successful social engineering attacks

Answer

Non-compliance with regulatory requirements for access controls

Answer

Inability to detect insider threats in a timely manner

Question 14

An organization is implementing an automated job scheduling system. Which of the following is the PRIMARY benefit of using dependency management in job scheduling?

Accepted Answer

Ensuring jobs execute in the correct sequence based on prerequisites. Dependency management ensures jobs run in the correct sequence based on prerequisites, reducing errors and manual intervention.

Answer

Reducing the need for backup procedures

Answer

Automatically rerunning failed jobs without notification

Answer

Eliminating the need for human operators

Question 15

An IT auditor is reviewing the capacity management process. Which TWO of the following are key activities that should be performed?

Accepted Answer

Monitoring resource utilization trends. Monitoring trends helps proactive planning; threshold alerts prevent overload.

Answer

Performing daily backup verification

Answer

Reviewing incident response times

Answer

Conducting annual disaster recovery tests