CISA Practice Test 2 — 30 Questions

Question 1

An IS auditor is reviewing an organization's data classification policy. Which of the following findings is MOST critical?

Accepted Answer

Data owners have not been identified for most data assets. Without identified data owners, no one is accountable for classifying, protecting, or granting access to data assets. This foundational gap undermines the entire data classification policy, making it impossible to enforce controls like encryption or access reviews. The CISA emphasizes that data owner assignment is the first step in any data governance framework.

Answer

Employees receive data classification training only once per year

Answer

Data classification is performed manually without automated tools

Answer

Sensitive data is not encrypted at rest

Question 2

Which THREE of the following are acceptable methods for gathering audit evidence? (Select THREE.)

Accepted Answer

Observation of processes being performed. Observation of processes being performed (Option B) is an acceptable audit evidence-gathering technique because the auditor directly witnesses the execution of controls or procedures, providing firsthand evidence of their operation. This method is particularly valuable for assessing the effectiveness of manual controls or physical security measures, as it allows the auditor to verify that the process is performed as documented and to identify any deviations in real-time.

Answer

Accepting management's assertions without corroboration

Answer

Obtaining hearsay from third parties

Question 3

Refer to the exhibit. An IS auditor is reviewing an IAM policy for a cloud data platform. The auditor notices that user jdoe has READ_ONLY access to all tables matching 'sales_', but asmith has READ_WRITE access to the same set of tables. Which of the following is the MOST critical control issue?

Accepted Answer

The resource pattern '.*' in the regex could grant access to unintended tables. The regex pattern '.*' in the resource block is overly permissive and could match unintended tables beyond the intended 'sales_' prefix. In AWS IAM policies, the resource element uses regex-like patterns, and '.*' after 'sales_' would match any characters, including tables like 'sales_archive_private' or 'sales_2024_sensitive', potentially exposing sensitive data. This violates the principle of least privilege and is a critical control issue.

Answer

Users should not be directly assigned roles; use groups

Answer

The roles data_analyst and data_scientist have overlapping permissions

Answer

User jdoe should not have access to the sales_ tables

Question 4

An IT manager needs to ensure that the organization's IT resources are used efficiently. Which of the following is the BEST metric to measure IT resource utilization?

Accepted Answer

Average server CPU utilization. Average server CPU utilization directly measures how much of the computing capacity is being consumed over time, making it the most relevant metric for assessing whether IT resources are being used efficiently. High or low CPU utilization can indicate over-provisioning, under-utilization, or potential performance bottlenecks, enabling the IT manager to optimize resource allocation.

Answer

System uptime percentage

Answer

Number of help desk tickets resolved per day

Answer

Percentage of projects completed on time

Question 5

An organization is developing a critical application using an agile methodology. The project sponsor demands frequent deliveries but the development team is concerned about insufficient testing. Which of the following BEST mitigates this risk?

Accepted Answer

Implement continuous integration and automated testing. Continuous integration (CI) and automated testing enable frequent, reliable code integration and immediate feedback on defects, directly addressing the tension between rapid delivery and insufficient testing. Automated tests run on every commit, catching regressions early without manual overhead, which is essential for agile sprints where manual testing alone cannot scale to match delivery velocity.

Answer

Deploy with known defects and fix them in the next sprint

Answer

Increase manual testing effort at the end of each sprint

Answer

Extend the release cycle to allow more time for testing

Question 6

Order the steps for conducting an audit engagement from start to finish.

Accepted Answer

Step 1: Planning (scope, program), Step 2: Fieldwork, Step 3: Analysis, Step 4: Reporting with management review. Audit engagement follows: planning (scope, program), fieldwork, analysis, and reporting with management review.

Answer

Step 1: Planning, Step 2: Analysis, Step 3: Fieldwork, Step 4: Reporting

Answer

Step 1: Fieldwork, Step 2: Planning, Step 3: Analysis, Step 4: Reporting

Answer

Step 1: Planning, Step 2: Fieldwork, Step 3: Reporting, Step 4: Analysis

Question 7

Which TWO of the following are primary objectives of a data loss prevention (DLP) strategy?

Accepted Answer

Identify and classify sensitive data. Identifying and classifying sensitive data is the foundational step in a DLP strategy. Without knowing where sensitive data resides (e.g., PII, PCI, IP), DLP policies cannot accurately detect or prevent unauthorized transfers. Classification enables the DLP system to apply context-aware rules, such as blocking credit card numbers in email attachments or flagging confidential documents uploaded to cloud storage.

Answer

Encrypt all data in transit

Answer

Replace all existing security controls

Answer

Ensure compliance with all regulations

Question 8

An IS auditor is reviewing the incident management process. Incidents are categorized as P1 (critical) through P4 (low). The SLA for P1 incidents requires initial response within 15 minutes and resolution within 4 hours. The auditor notes that the average time to respond to P1 incidents is 12 minutes, but the average resolution time is 6 hours. The root cause analysis shows that many P1 incidents are due to known errors documented in the known error database (KEDB). What is the most significant finding?

Accepted Answer

Problem management is not effectively utilizing the KEDB to prevent recurring incidents.. If known errors are causing P1 incidents, problem management should have identified workarounds or permanent fixes. The fact that these incidents recur indicates a weakness in the problem management process, which should reduce incidents from known errors.

Answer

The average resolution time for P1 incidents exceeds SLA.

Answer

The average response time for P1 incidents is within SLA.

Answer

Incident management is not escalating P1 incidents properly.

Question 9

During an agile software development project, a sprint review meeting is conducted. What is the PRIMARY purpose of this meeting from an IS audit perspective?

Accepted Answer

To demonstrate the working product increment to stakeholders and gather feedback. The sprint review is a key control in agile to demonstrate completed work to stakeholders and obtain feedback. It serves as a form of user acceptance testing and helps ensure the product meets stakeholder needs.

Answer

To identify and document lessons learned for process improvement

Answer

To assign tasks to team members for the current sprint

Answer

To plan the tasks for the next sprint

Question 10

An organization's backup strategy involves weekly full backups and daily incremental backups. After a system failure, the restoration takes longer than expected. What is the most likely cause?

Accepted Answer

Restoration process not tested. If the restoration process is not tested, unexpected issues (e.g., missing dependencies, corruption, or procedural errors) can cause delays, leading to longer restoration times. Option A (incremental backups not stored offsite) affects availability but not directly the restoration duration. Option B (full backup frequency too low) could increase restore time due to more increments, but testing is a more likely root cause for a specific delay. Option D (tape rotation failure) could cause missing backups, but the question states backup strategy worked; the issue is restore time, not backup failure.

Answer

Incremental backups not stored offsite

Answer

Full backup frequency too low

Answer

Tape rotation failure

Question 11

Refer to the exhibit. Which of the following statements is TRUE regarding this S3 bucket policy?

Accepted Answer

Anonymous read access is allowed only over HTTPS. The S3 bucket policy includes a condition `aws:SecureTransport` set to `true`, which explicitly denies any request that is not made over HTTPS. The `Effect: Allow` on the `Principal: "*"` grants anonymous read access, but the `Condition` block ensures that only HTTPS requests are permitted, making anonymous read access allowed only over HTTPS.

Answer

The bucket is fully public for all actions

Answer

Write access is allowed over HTTP

Answer

Only authenticated users can access objects

Question 12

During an IT audit, the auditor observes that mandatory vacation policies are not enforced for IT staff with access to financial systems. What is the PRIMARY risk associated with this finding?

Accepted Answer

Increased risk of undetected fraud. Mandatory vacation policies force the periodic removal of an employee's access, which allows detection of irregularities or fraudulent activities that require the employee's continued presence to conceal. Without enforcement, a malicious insider could perpetrate fraud (e.g., creating ghost vendors, altering payment records) and cover it up by maintaining daily control over transactions. This directly increases the risk that fraudulent actions will go undetected over extended periods.

Answer

Increased likelihood of system downtime

Answer

Inadequate segregation of duties

Answer

Non-compliance with licensing agreements

Question 13

An IS auditor is evaluating the effectiveness of an organization's change management process. Which of the following is the most important control to verify during the audit?

Accepted Answer

A segregation of duties exists between development and production.. Segregation of duties between development and production environments ensures that code cannot be directly moved from development to production without independent review and testing. This control prevents unauthorized or untested code from affecting live systems, which is a fundamental principle of change management. Without this separation, a developer could introduce malicious or defective code directly into production, bypassing all quality and security checks.

Answer

All changes are approved by the IT manager.

Answer

Emergency changes are documented after implementation.

Answer

Change requests are prioritized by business impact.

Question 14

During an audit, the IS auditor discovers that the audit log for a critical server is overwritten every 24 hours. The auditor wants to ensure logs are preserved for a longer period. Which of the following recommendations is most appropriate?

Accepted Answer

Configure the server to archive logs to a centralized log management system. The most appropriate recommendation is to configure the server to archive logs to a centralized log management system. This ensures logs are preserved beyond the 24-hour overwrite window by sending them to a separate, persistent storage location, which also supports security monitoring, forensics, and compliance requirements. Centralized logging (e.g., using syslog, SIEM, or a dedicated log collector) provides redundancy, integrity checks, and long-term retention without relying on the local server's limited storage.

Answer

Implement a manual backup of logs daily

Answer

Reduce the logging level to minimize data

Answer

Increase the log size to retain more data

Question 15

A multinational corporation is deploying a data loss prevention (DLP) solution across its network. The DLP system must be configured to prevent the exfiltration of personally identifiable information (PII) while minimizing false positives. Which approach is most effective?

Accepted Answer

Use regex patterns for PII combined with context-aware policies (e.g., user role, destination domain). Using regex patterns for PII combined with context-aware policies (e.g., user role, destination domain) allows the DLP system to accurately detect sensitive data while minimizing false positives. Option A is too simplistic; keyword-based blocking can cause high false positives. Option B relies on user training and self-reporting, which is not a technical DLP control and is ineffective. Option C (encryption) protects data at rest and in transit but does not prevent exfiltration; it is not a DLP method.

Answer

Block all outbound email containing keywords such as 'SSN' or 'credit card'

Answer

Require all users to complete annual data handling training and rely on self-reporting

Answer

Implement full disk encryption on all endpoints and encrypt all outbound traffic

Question 16

An IS auditor is reviewing the logical access controls of a financial application. Which of the following is the BEST way to verify that user access rights are appropriate?

Accepted Answer

Compare the user access rights with the job descriptions and responsibilities.. Comparing user access rights directly against job descriptions and responsibilities is the most effective method to verify that access is appropriate based on the principle of least privilege. This approach ensures that each user's permissions align with their actual job functions, which is the core objective of a logical access control review. Interviewing or reviewing lists alone does not validate the appropriateness of access against business roles.

Answer

Interview the IT security manager about the access control process.

Answer

Review the access control list for each user.

Answer

Re-perform a sample of transactions to detect unauthorized access.

Question 17

An IS auditor is preparing the audit report. According to ISACA standards, which of the following should be included in the final audit report?

Accepted Answer

Findings, recommendations, and management action plans. The final audit report should include findings, recommendations, and management's action plans to provide a complete picture and enable follow-up.

Answer

Only the audit findings

Answer

Only the recommendations

Answer

The audit program and procedures

Question 18

An IS auditor is reviewing a change management process. Which TWO elements should be documented in a normal change request to ensure adequate governance? (Select TWO)

Accepted Answer

Test plan. A change request should include a test plan to verify the change works as intended and a rollback plan to revert if the change fails. These are critical for risk management and governance.

Answer

Vendor contact information

Answer

Change requester's name

Answer

Project budget remaining

Question 19

An IS auditor is reviewing a vulnerability scan report and finds that a critical vulnerability on a web server has been open for 90 days beyond the remediation SLA. The system owner states that the vulnerability cannot be patched because it would break a legacy application. What should the auditor recommend?

Accepted Answer

Require the system owner to sign a risk acceptance form. The appropriate action is to formally accept the risk through a documented risk acceptance process, with sign-off from management. This ensures accountability and awareness. The other options are either premature or inappropriate.

Answer

Escalate the issue to the board of directors

Answer

Implement compensating controls and close the finding

Answer

Recommend decommissioning the web server

Question 20

An IS auditor is evaluating the change management process. Which of the following is the BEST indicator that emergency changes are being properly controlled?

Accepted Answer

Emergency changes are documented with a justification and promptly reviewed after implementation. Emergency changes require a documented rationale and timely post-implementation review to ensure proper authorization and minimal risk.

Answer

Emergency changes are approved by the change manager within 24 hours

Answer

Emergency changes are tested in a production-like environment before implementation

Answer

Emergency changes require approval from the CAB before implementation