CISA Practice Test 29 — 15 Questions

Question 1

During an audit of the incident management process, the IS auditor finds that tabletop exercises have not been conducted in the past two years. What is the MOST significant risk associated with this finding?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Employees may not know their roles during an incident. Without regular testing, the incident response team may not be prepared to effectively handle a real incident.

Answer

The organization may fail to detect an incident in a timely manner

Answer

The organization may not comply with regulatory reporting requirements

Answer

The incident response plan may be outdated

Question 2

An organization is selecting an alternate site for disaster recovery. The site must have sufficient equipment to resume operations within a few hours, and the organization is willing to share the site with another business. Which type of alternate site is MOST appropriate?

Accepted Answer

Warm site. A hot site is fully equipped and can be operational quickly, but sharing is uncommon. A warm site has some equipment. A cold site has no equipment. A mobile site is not a standard classification.

Answer

Mobile site

Answer

Cold site

Answer

Hot site

Question 3

An IT auditor is reviewing capacity management. The server team monitors CPU utilization and disk space. They receive alerts when thresholds are exceeded. Which practice is most effective for proactive capacity planning?

Accepted Answer

Analyzing historical utilization trends. Analyzing historical utilization trends allows IT to predict future capacity needs and plan upgrades before issues occur.

Answer

Performing weekly manual checks

Answer

Increasing server resources quarterly

Answer

Setting threshold alerts at 90% utilization

Question 4

An IS auditor is reviewing automated job scheduling controls. A critical batch job failed due to a dependency on a previous job that had not completed. The system did not alert operations staff. Which control weakness is most significant?

Accepted Answer

Missing dependency management in job scheduling.. Job scheduling should include dependency management and failure alerts. The lack of an alert means the issue went unnoticed, potentially causing delays.

Answer

Insufficient capacity management to handle job load.

Answer

Inadequate rerun procedures for the failed job.

Answer

Lack of a known error database entry for this issue.

Question 5

During a review of the incident management process, the IS auditor finds that the incident response (IR) team conducts tabletop exercises annually, but the scenarios are limited to malware outbreaks. Which of the following should be the auditor's GREATEST concern?

Accepted Answer

The IR plan may not address all relevant incident types. Limited scenarios mean the IR team may not be prepared for other types of incidents, such as data breaches or insider threats, which require different response procedures.

Answer

The IR team may not have adequate forensic capabilities

Answer

The exercises are not conducted quarterly

Answer

The IR team is not following the defined procedures

Question 6

An IS auditor is reviewing the end-of-life (EOL) software policy. Which THREE risks are associated with running unsupported software? (Select THREE).

Accepted Answer

Regulatory non-compliance. Unsupported software no longer receives security patches, increasing vulnerability risk. It also may cause compatibility issues with other systems. Additionally, it may lead to non-compliance with regulations that require supported software.

Answer

Reduced need for data backups

Answer

Higher software licensing costs

Question 7

An organization's IT service desk categorizes incidents based on severity levels. A P1 incident is defined as a critical system outage affecting all users. Which of the following is the MOST appropriate target for the initial response time for a P1 incident?

Accepted Answer

Within 15 minutes. P1 incidents are critical and require immediate response, typically within minutes, not hours.

Answer

Within 4 hours

Answer

Within 1 business day

Answer

Within 30 minutes

Question 8

An organization's availability management team reports that a critical server has an MTBF of 720 hours and an MTTR of 4 hours. What is the availability percentage for this server?

Accepted Answer

99.45%. Availability = MTBF / (MTBF + MTTR) = 720 / (720 + 4) = 720/724 ≈ 0.9945, or 99.45%.

Answer

99.56%

Answer

99.72%

Answer

99.89%

Question 9

An organization is performing software asset management (SAM) to ensure license compliance. Which two activities should the auditor verify?

Accepted Answer

Reconciling installed software with purchase records. Regular license compliance audits ensure proper licensing. Reconciliation of installed software with purchased licenses identifies gaps or over-licensing.

Answer

Performing vulnerability scans

Answer

Monitoring network bandwidth usage

Answer

Tracking hardware depreciation

Question 10

During a review of encryption practices, the IS auditor finds that an organization uses the same encryption key for all customer data at rest. What is the PRIMARY concern?

Accepted Answer

Increased risk of data exposure if the key is compromised. Using a single key for all data increases the impact of key compromise. If the key is compromised, all data becomes accessible. Key management should include key rotation and different keys for different data sets.

Answer

Performance degradation due to key reuse

Answer

Inability to revoke access to specific data

Answer

Non-compliance with GDPR pseudonymization requirements

Question 11

During an audit of an organization's information security programme, the IS auditor finds that the security awareness training completion rate is 95% but phishing simulation tests show a 30% failure rate. What should the auditor recommend?

Accepted Answer

Revise the security awareness program content to focus on practical phishing recognition. The gap between high training completion and poor phishing test results indicates that the training content is not effective in changing behavior. The auditor should recommend reviewing and improving the training to address weaknesses.

Answer

Increase the frequency of phishing simulations to quarterly

Answer

Disciplinary action for employees who fail phishing tests

Answer

Mandate that all employees repeat the training annually

Question 12

An IS auditor is reviewing physical security controls at a data center. The data center hosts critical servers and uses a badge access system with PINs, CCTV cameras, and a mantrap entry. The auditor observes that employees sometimes hold the door open for others without badging. Which TWO of the following are the MOST effective controls to address this tailgating risk?

Accepted Answer

Conducting security awareness training on tailgating risks. Mantraps are specifically designed to prevent tailgating by allowing only one person at a time. Security awareness training educates employees on the risks of tailgating. Increasing camera coverage and PIN complexity do not directly prevent tailgating.

Answer

Requiring longer and more complex PINs

Answer

Installing additional access points

Answer

Increasing the number of CCTV cameras

Question 13

An IT auditor is reviewing backup procedures. The organization performs daily full backups and retains them for 30 days. Additionally, weekly backups are retained for 12 months. Which of the following is the MOST likely risk associated with this backup strategy?

Accepted Answer

Excessive storage consumption and longer backup windows. Full backups every day consume large amounts of storage and time; incremental backups are more efficient.

Answer

Backup data may not be recoverable

Answer

Inability to meet recovery point objectives

Answer

Backup encryption may be weak

Question 14

An IS auditor is reviewing the privileged access management (PAM) process. The auditor finds that shared administrative accounts are used for critical system maintenance and that passwords are changed quarterly. Which of the following is the BEST recommendation to mitigate the risk of audit trail loss?

Accepted Answer

Implement individual accounts with privilege escalation for administrative tasks. Shared accounts make it impossible to attribute actions to specific individuals. Implementing individual accounts with privilege escalation (e.g., sudo) allows for accountability and detailed audit trails.

Answer

Implement a password vault with automatic checkout and check-in

Answer

Increase the frequency of password changes to monthly

Answer

Require two-factor authentication for shared account usage

Question 15

An organization's backup strategy includes daily incremental backups and weekly full backups. During a disaster recovery test, the restoration of a critical server fails because a required incremental backup is corrupt. Which control should the organization implement to verify the integrity of backups?

Accepted Answer

Perform periodic restore verification tests. Regular restore verification tests confirm that backups can be successfully restored. This is a key control to ensure backup integrity.

Answer

Implement backup encryption

Answer

Use a different backup software

Answer

Increase the frequency of full backups