CISA Practice Test 30 — 15 Questions

Question 1

An IS auditor is evaluating the encryption key management program of a healthcare organization that processes protected health information (PHI). The organization uses a mix of symmetric and asymmetric keys. Which TWO of the following are key management practices that should be addressed to ensure effective protection of PHI?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Storing encryption keys in a hardware security module (HSM). Effective key management includes secure key storage (e.g., HSM) and regular key rotation to limit exposure. Key escrow is not a standard requirement, and distributing keys with data increases risk. Using a single key for all data violates best practices.

Answer

Implementing a key escrow mechanism for all keys

Answer

Using the same key to encrypt all PHI for simplicity

Answer

Distributing keys to authorized users along with encrypted data

Question 2

An organization is implementing a new incident management process based on ITIL. An incident classified as P1 (Priority 1) occurs. According to ITIL best practices, what is the most appropriate initial action?

Accepted Answer

Immediately assign the incident to the appropriate support team for resolution.. P1 incidents are critical and require immediate response to restore service. The service desk should assign the incident to the appropriate support team without delay.

Answer

Escalate the incident to problem management for root cause analysis.

Answer

Update the known error database with a workaround.

Answer

Log the incident and inform the user that it will be handled within the next business day.

Question 3

During an audit of the information security program, the IS auditor reviews the organization's information security policy. Which of the following is the PRIMARY purpose of an information security policy?

Accepted Answer

To communicate management's commitment and direction for information security. An information security policy sets the high-level direction and principles for the security program, outlining management's commitment and expectations.

Answer

To provide detailed step-by-step instructions for implementing security controls

Answer

To specify the technical configurations for security devices

Answer

To define the roles and responsibilities for information security

Question 4

An IS auditor is reviewing a business continuity plan (BCP). Which TWO of the following are key components of the business continuity strategy? (Select two.)

Accepted Answer

Data backup and recovery. Alternate facilities and data backup and recovery are essential components of BC strategy.

Answer

Incident management procedures

Answer

Service desk procedures

Answer

Change management process

Question 5

An IS auditor is reviewing the capacity management process for a server hosting a critical application. The server's CPU utilization has been consistently above 90% for the past three months, and memory usage is at 85%. There are no threshold alerts configured. The capacity plan shows that additional resources are scheduled to be added in six months. What should the auditor most recommend?

Accepted Answer

Request immediate addition of resources to meet current demand.. The high utilization indicates a need for immediate capacity expansion. The existing plan is too far in the future, risking performance degradation or outages. The auditor should recommend expediting the addition of resources.

Answer

Review the capacity plan and adjust the forecast.

Answer

Accept the risk as the server has not failed yet.

Answer

Implement threshold alerts to monitor the situation.

Question 6

An IS auditor is evaluating the patch management process. The auditor notes that critical security patches are applied within 30 days, but the policy requires 7 days. The IT manager states that the delay is due to testing requirements. What should the auditor recommend?

Accepted Answer

Implement a risk-based patching process that allows faster deployment for critical patches. The auditor should recommend a risk-based approach that allows expedited patching for critical vulnerabilities while maintaining testing for less critical ones. The process should be reviewed to balance security and stability.

Answer

Require automated patching without testing

Answer

Accept the current practice as a compensating control

Answer

Modify the policy to align with the actual patching timeline

Question 7

An IT auditor is reviewing the change management process for a financial institution. The auditor finds that emergency changes are frequently approved by the change manager without CAB review. Which risk is most associated with this practice?

Accepted Answer

Increase in unauthorized changes. Emergency changes bypass normal review, increasing the risk of unauthorized or poorly tested changes that could disrupt operations or introduce security vulnerabilities.

Answer

Excessive documentation overhead

Answer

Delayed incident resolution

Answer

Inadequate backup procedures

Question 8

An IT auditor is evaluating the capacity management process. Which of the following findings would be of MOST concern?

Accepted Answer

Resource utilization trends are not monitored. The most concerning finding is that capacity planning is reactive, leading to performance degradation and potential outages before thresholds are raised. This indicates a lack of proactive management.

Answer

Alert thresholds are set at 80% utilization

Answer

Capacity thresholds are reviewed annually

Answer

Capacity reports are generated monthly

Question 9

During an audit of patch management, the IS auditor notes that several critical patches have not been applied within the defined SLA. Which of the following is the BEST approach to evaluate the risk acceptance of these unpatched vulnerabilities?

Accepted Answer

Review the risk acceptance documentation approved by the system owner and CISO.. Risk acceptance should be formally documented with compensating controls and management sign-off.

Answer

Compute the aggregate risk score using a vulnerability management tool.

Answer

Recommend immediate application of all missing patches.

Answer

Verify that the patches are not applicable to the environment.

Question 10

An IS auditor is reviewing the incident response (IR) process. Which of the following is the MOST important characteristic of an effective tabletop exercise?

Accepted Answer

It involves all relevant stakeholders in a discussion format.. Tabletop exercises should focus on testing decision-making and communication, not just technical steps.

Answer

It measures the technical skills of the IR team.

Answer

It uses a realistic scenario based on current threats.

Answer

It is conducted without prior notice to participants.

Question 11

During a review of firewall rule sets, an IS auditor identifies a rule that allows 'any-any' traffic from an internal subnet to the DMZ. The rule was implemented six months ago based on a business request that has since been completed. The firewall administrator explains that the rule was kept for convenience. Which of the following is the BEST audit recommendation?

Accepted Answer

Remove the rule immediately and verify no impact. Keeping a rule after the business need has ended violates the principle of least privilege. The best recommendation is to remove the rule immediately, as retaining it increases risk without justification.

Answer

Conduct a penetration test to assess the risk

Answer

Document the rule with a risk acceptance signed by management

Answer

Modify the rule to allow only specific ports and protocols

Question 12

An IS auditor is reviewing the data subject rights fulfillment process for GDPR compliance. Which TWO of the following are required to be completed within the one-month response period?

Accepted Answer

Right to erasure (deleting personal data).. GDPR requires responses to access requests and erasure requests within one month, subject to certain conditions.

Answer

Right to object to processing (ceasing processing).

Answer

Right to rectification (correcting inaccurate data).

Answer

Right to data portability (transferring data to another controller).

Question 13

An organization experiences a critical system failure during non-business hours. The IT team discovers that the last full backup was 48 hours ago, and the incremental backups for the past 24 hours are corrupted. The recovery time objective (RTO) for this system is 4 hours, and the recovery point objective (RPO) is 1 hour. Which of the following is the MOST immediate concern?

Accepted Answer

The data loss may exceed the recovery point objective (RPO). The RPO of 1 hour means the organization can tolerate losing at most 1 hour of data. With the last full backup 48 hours old and incremental backups for the past 24 hours corrupted, the usable recovery point is at least 24 hours old, resulting in data loss far exceeding the 1-hour RPO. This gap between actual and acceptable data loss is the most immediate concern because it directly violates the business continuity requirement.

Answer

The backup schedule should be changed to daily full backups

Answer

The root cause of the failure must be determined before recovery

Answer

The recovery time objective (RTO) of 4 hours will be exceeded

Question 14

Refer to the exhibit. An IS auditor is reviewing firewall logs and notices repeated denied SSH attempts from an internal host (10.0.1.50) to a server (172.16.0.1). After the denied attempts, the host initiates permitted HTTPS connections to another server (172.16.0.5). Which of the following is the BEST interpretation of this pattern?

Accepted Answer

The host may be attempting to bypass security controls by using different protocols. The pattern of denied SSH attempts followed by successful HTTPS connections suggests the internal host is probing for an open SSH service and, when blocked, switches to an allowed protocol (HTTPS) to communicate with a different server. This behavior indicates an attempt to bypass security controls by leveraging a permitted protocol after initial reconnaissance or direct access attempts fail. The firewall logs show the host adapts its method, which is a classic indicator of protocol hopping or tunneling attempts.

Answer

The firewall rule 101 is misconfigured and blocking legitimate traffic

Answer

The host is performing reconnaissance and has mapped allowed services

Answer

The host successfully accessed server 172.16.0.1 via SSH

Question 15

During an incident, the IT team identifies that a critical patch was not applied due to an expired software maintenance contract. Which of the following is the BEST long-term remediation?

Accepted Answer

Implement a vulnerability management program. A vulnerability management program ensures systematic identification and remediation of missing patches, addressing the root cause. Immediate patching and isolation are tactical; renewing the contract is necessary but not a process improvement.

Answer

Renew the maintenance contract

Answer

Apply the patch immediately

Answer

Isolate the affected system