CISA Practice Test 2 — 30 Questions

Question 1

An organization is implementing a new ERP system. The project sponsor requests a change that will significantly increase project scope without additional budget. Which of the following is the BEST action for the project manager?

Accepted Answer

Initiate the formal change control process and escalate to the steering committee.. The project manager must follow the formal change control process to evaluate the impact of a scope change that lacks additional budget. Escalating to the steering committee is appropriate because they have the authority to approve or reject changes that affect project constraints, ensuring alignment with organizational governance and IT strategy.

Answer

Accept the change and adjust the project timeline accordingly.

Answer

Implement the change and inform the steering committee later.

Answer

Reject the change because it is outside the original scope.

Question 2

Match each disaster recovery site type to its description.

Question 3

Match each COBIT 5 domain to its description.

Question 4

Match each type of access control to its definition.

Question 5

Match each encryption key type to its usage.

Question 6

Match each log type to its typical content.

Question 7

Match each testing technique to its description.

Question 8

Which TWO of the following are key responsibilities of an IT steering committee?

Accepted Answer

Approving the annual IT budget and major capital expenditures. The IT steering committee is a senior-level governance body responsible for aligning IT strategy with business objectives. Approving the annual IT budget and major capital expenditures (A) is a core fiduciary duty, ensuring resources are allocated to approved projects and initiatives. Defining IT policies and standards (C) establishes the governance framework for security, compliance, and operational consistency across the enterprise.

Answer

Performing daily system monitoring and incident response

Answer

Writing application code for new software features

Answer

Configuring firewall rules and network access controls

Question 9

During user acceptance testing (UAT) of a new financial system, users report that the system fails to enforce a segregation of duties rule where the same user should not be able to create a purchase order and approve it. The requirement was documented in the functional specifications. Which of the following is the MOST likely cause of this issue?

Accepted Answer

The system was not configured to enforce the control.. Option D is correct because the segregation of duties (SoD) rule is a functional control that must be explicitly configured in the system's authorization or workflow engine. Since the requirement was documented in the functional specifications, the most likely cause is that the system was not configured to enforce the control, meaning the access control list (ACL) or role-based access control (RBAC) settings did not prevent the same user from both creating and approving a purchase order.

Answer

Performance testing was prioritized over functional testing.

Answer

The functional requirements were incomplete.

Answer

The requirements were ambiguous and misinterpreted by developers.

Question 10

An IS auditor is reviewing the system development life cycle (SDLC) for a custom application. The project manager has decided to skip the design phase and proceed directly from requirements to coding. Which of the following risks are MOST likely to increase as a result? (Choose two.)

Accepted Answer

Inadequate security controls.. Skipping the design phase means that security requirements are never formally defined or integrated into the system architecture. Without a security design, controls such as authentication, authorization, encryption, and input validation are likely to be omitted or implemented ad hoc, leading to inadequate security controls. This directly increases the risk of vulnerabilities that could be exploited in production.

Answer

Delays in project schedule.

Answer

Increased cost due to rework.

Answer

Increased number of defects during unit testing.

Question 11

An organization is implementing a backup strategy for its critical database. The database is updated continuously during business hours, and the recovery point objective (RPO) is 15 minutes. Which backup method should be used to meet the RPO while minimizing backup storage and performance impact?

Accepted Answer

Perform incremental backups with transaction log backups every 15 minutes. Incremental backups with transaction log backups every 15 minutes meets the 15-minute RPO by capturing all changes since the last full or incremental backup, while transaction log backups record every individual database transaction. This method minimizes storage by only backing up changes and reduces performance impact compared to continuous replication, as log backups are lightweight and can be scheduled without constant I/O overhead.

Answer

Perform full backups every 24 hours

Answer

Implement synchronous replication to a standby server

Answer

Perform differential backups every 6 hours

Question 12

Based on the backup logs, the backup administrator notices that the incremental backup job failed due to insufficient storage. Which TWO actions should the administrator take to resolve the immediate issue and prevent recurrence?

Accepted Answer

Free up space on the backup storage device by removing old backup sets manually. Option A is correct because freeing up space on the backup storage device by removing old backup sets immediately resolves the insufficient storage issue that caused the incremental backup job to fail. This is a direct, short-term fix that reclaims capacity without altering backup schedules or configurations.

Answer

Check network bandwidth between the backup server and storage device

Answer

Increase the frequency of incremental backups to reduce data volume per job

Answer

Investigate and resolve the file-in-use warnings from the full backup job

Question 13

Refer to the exhibit. A security analyst notices that users on the INSIDE network (10.1.1.0/24) can browse HTTPS websites but cannot resolve domain names. What is the most likely cause?

Accepted Answer

The ACL only permits DNS traffic to host 10.2.2.10, but users need to query a different DNS server. The exhibit shows an ACL that permits DNS traffic (UDP port 53) only to host 10.2.2.10. Since users can browse HTTPS (TCP/443) but cannot resolve domain names, the ACL is blocking DNS queries to any other DNS server. Option B correctly identifies that the ACL restricts DNS to a single server, and if users are configured to query a different DNS server, resolution fails.

Answer

The ACL denies TCP traffic to port 443

Answer

The DNS server at 10.2.2.10 is unreachable

Answer

The OUTSIDE interface has no security-level configured correctly

Question 14

An IT manager is reviewing the service level agreements (SLAs) for a cloud-based email service. The SLA guarantees 99.9% uptime per month. The service experienced an outage of 45 minutes in a 30-day month. Did the service meet the SLA?

Accepted Answer

No, because the allowed downtime for 99.9% uptime is approximately 43 minutes.. The SLA guarantees 99.9% uptime per month. For a 30-day month (43,200 minutes), 99.9% uptime allows only 0.1% downtime, which is 43.2 minutes. The actual outage of 45 minutes exceeds this threshold, so the SLA was not met. Option D correctly identifies the allowed downtime as approximately 43 minutes.

Answer

Yes, because 45 minutes is within 0.1% of the total time.

Answer

Yes, because the SLA is calculated per day, not per month.

Answer

No, because any downtime exceeding 30 minutes is a violation.

Question 15

A company's security policy requires that all laptops have full disk encryption. During an audit, it is discovered that several laptops have encryption enabled but the recovery keys are stored on the local drive. What is the MOST significant risk?

Accepted Answer

Recovery keys can be used to bypass encryption.. Storing recovery keys on the local drive defeats the purpose of full disk encryption (FDE). If an attacker gains physical access to the laptop, they can simply boot an alternate OS or mount the drive and read the recovery key file, then use it to unlock the encrypted volume. This bypasses the encryption entirely, making the data vulnerable to unauthorized access despite encryption being enabled.

Answer

Performance degradation due to encryption overhead.

Answer

Unauthorized access to encrypted data.

Answer

Data corruption during encryption process.

Question 16

A company is migrating its on-premises data center to a public cloud provider. Which of the following is the MOST important control to implement before migration to ensure data security?

Accepted Answer

Implement data encryption at rest and in transit. Data encryption at rest and in transit is the most important control before migration because it protects sensitive data from exposure during the transfer process and after it is stored in the cloud. Without encryption, data could be intercepted over the network or accessed by unauthorized parties in the cloud provider's infrastructure. This control directly addresses the core risk of data leakage during and after migration, which is a fundamental security requirement.

Answer

Enable multi-factor authentication (MFA) for all cloud accounts

Answer

Deploy a cloud access security broker (CASB)

Answer

Establish a virtual private network (VPN) between on-premises and cloud

Question 17

An organization is planning to replace its legacy accounting system with a commercial off-the-shelf (COTS) software package. Which of the following is the PRIMARY risk of using a COTS solution?

Accepted Answer

The software may not fully align with the organization's business processes. The primary risk of a COTS solution is that it is designed for a broad market and may not fully align with the organization's specific business processes. This misalignment can force the organization to change its workflows or perform costly customizations, which can negate the benefits of a packaged solution and introduce project delays or failures.

Answer

The total cost of ownership is likely to be higher than custom development

Answer

The software may have inherent security vulnerabilities

Answer

Vendor support may be discontinued after a few years

Question 18

An organization is developing a web application using an Agile methodology. The security team wants to integrate security testing early in the development lifecycle. Which of the following is the BEST approach to achieve this?

Accepted Answer

Implement static application security testing (SAST) in the continuous integration pipeline. Integrating SAST into the CI pipeline allows automated scanning of source code for vulnerabilities (e.g., SQL injection, XSS) as code is committed, aligning with Agile's iterative development. This shift-left approach catches flaws early, reducing remediation cost and effort compared to later stages.

Answer

Conduct a penetration test after each sprint

Answer

Schedule an annual vulnerability scan of the production environment

Answer

Perform dynamic application security testing (DAST) on deployed builds

Question 19

Which THREE of the following are common challenges when integrating a software package with existing legacy systems? (Select exactly three.)

Accepted Answer

Lack of documented application programming interfaces (APIs). Legacy systems often lack well-documented or standardized APIs, making it difficult to establish reliable interfaces for integration. Without clear API documentation, developers must reverse-engineer communication protocols or rely on outdated methods like screen scraping, which increases integration risk and effort.

Answer

Availability of modern integration middleware

Answer

Need for custom development to bridge the gap

Question 20

An IS auditor is reviewing a change management process. A developer made an emergency change directly to production without following the standard change approval process. The change was later documented as a normal change. Which control weakness is MOST indicated by this scenario?

Accepted Answer

Inadequate segregation of duties between development and production environments. The developer bypassed the standard change approval process by making an emergency change directly to production, then retroactively documenting it as a normal change. This directly violates the principle of segregation of duties (SoD), as the same individual who implemented the change also controlled the documentation and approval trail, eliminating independent oversight. In a properly segregated environment, developers should not have direct write access to production systems without a separate change authorization and deployment step.

Answer

Absence of a rollback plan for emergency changes

Answer

Insufficient testing of emergency changes before deployment

Answer

Lack of a formal change documentation policy