CISA Practice Test 3 — 30 Questions

Question 1

An organization is deploying a major system upgrade. The change request has been approved by CAB, but the deployment plan does not include a rollback procedure. As an IS auditor, what should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Delay the deployment until a rollback plan is created and tested. A rollback plan is a mandatory component of any production change because it provides the mechanism to restore the prior known-good state if the deployment fails or causes outages. Without a tested rollback procedure, the organization has no controlled recovery path, exposing it to extended downtime and data integrity risk. As an IS auditor, the correct recommendation is to delay deployment until a rollback plan is created and tested, regardless of CAB approval.

Answer

Perform the deployment during off-peak hours to minimize impact

Answer

Document the decision to skip rollback in the change record

Answer

Proceed with deployment as CAB approval is sufficient

Question 2

Which TWO of the following are BEST indicators that a system development project is at risk of failure?

Accepted Answer

Frequent scope changes. Frequent scope changes (A) are a classic early warning sign of project failure because uncontrolled scope creep invalidates baselines, disrupts design and testing, and causes cost and schedule overruns. An unrealistic schedule (D) is also a strong risk indicator, since compressing effort below what the work actually requires forces shortcuts in analysis, coding, and testing, leading to defects and missed milestones. In contrast, clear communication (B), robust testing (C), and high team morale (E) are all positive project health indicators that reduce risk rather than signal failure.

Answer

Clear communication

Answer

Robust testing

Answer

High team morale

Question 3

A retail company is merging with a competitor. The IT departments of both organizations have different IT governance structures: Company A uses a centralized model with strict change management, while Company B uses a decentralized model with autonomous business unit IT. The CIO has been tasked with integrating the IT functions post-merger. The board expects cost synergies and improved service levels. The integration team is facing resistance from Company B's business heads who fear loss of agility. The CIO needs to propose a governance model for the merged entity. Which approach would BEST meet the board's expectations while addressing resistance?

Accepted Answer

Implement a phased integration with a transitional governance structure that includes representatives from both sides.. A phased integration with a transitional governance structure that includes representatives from both sides allows the merged entity to gradually converge governance models, manage change and resistance, and work toward cost synergies and improved service levels without immediately disrupting business operations. Option A is incorrect because keeping both models separate permanently fails to achieve the desired integration and synergies. Option B is incorrect because fully adopting the decentralized model may not deliver the cost synergies and centralized control expected by the board. Option C is incorrect because immediately imposing a centralized model would likely cause strong resistance from Company B's business heads and disrupt agility, undermining the merger's success.

Answer

Keep both models separate and allow business units to choose their preferred model.

Answer

Adopt Company B's decentralized model to preserve agility.

Answer

Immediately impose Company A's centralized model across the merged entity.

Question 4

Which IT sourcing model involves using an external provider to manage some IT functions while retaining others in-house?

Accepted Answer

Co-sourcing. Co-sourcing is a hybrid model where certain IT functions are outsourced and others are kept in-house.

Answer

Cloud services

Answer

Insourcing

Answer

Outsourcing

Question 5

An organization is evaluating its business continuity plan (BCP) to ensure alignment with the IT disaster recovery plan. Which TWO of the following are critical elements that should be included in the BCP to support effective business resilience?

Accepted Answer

Procedures for manual operations during system unavailability.. Option B is correct because a BCP must define manual workaround procedures (e.g., paper-based processing, offline approvals) so that essential business functions can continue while IT systems are unavailable, directly supporting business resilience during a disaster. Option D is correct because the BCP must include up-to-date contact information for key stakeholders, business unit owners, and emergency response teams so that activation, escalation, and coordination can occur quickly when an incident strikes. Option A is not the best fit because application recovery priorities belong primarily to the IT disaster recovery plan, which the BCP aligns with rather than duplicates. Option C is not a critical BCP element; a hardware and software license inventory is an asset management concern and does not by itself ensure continuity of business operations. Option E is also not appropriate because detailed network restoration procedures are technical DR runbooks, not business continuity content.

Answer

A list of all critical IT applications with their recovery priorities.

Answer

A complete inventory of hardware and software licenses.

Answer

Detailed step-by-step procedures for restoring network connectivity.

Question 6

During an ERP implementation, the project team decides to customize the software to align with existing business processes. Which of the following risks is MOST likely to increase as a result of extensive customization?

Accepted Answer

Higher costs for future upgrades. Extensive customization of an ERP system typically involves modifying the core code or configuration beyond standard parameters. This creates a custom code base that diverges from the vendor's standard release, making future upgrades significantly more complex and costly because each upgrade requires re-applying and testing all customizations against the new version, often requiring specialized skills and extensive regression testing.

Answer

Increased vendor lock-in

Answer

Simpler data migration

Answer

Reduced user acceptance

Question 7

An IT policy exception is requested to allow a legacy system that cannot be patched to remain in operation. What is the BEST way to manage this exception?

Accepted Answer

Approve with compensating controls and a sunset date. The best way to manage a policy exception for an unpatachable legacy system is to approve it conditionally — with compensating controls that reduce the residual risk and a sunset date that forces eventual decommissioning or replacement. This aligns with ISACA's risk management guidance: exceptions should be time-bound, risk-assessed, and mitigated, never open-ended. Compensating controls (e.g., network segmentation, enhanced monitoring, virtual patching) address the risk that patching would normally cover.

Answer

Reject the request and force the system to be patched

Answer

Escalate to the board for decision

Answer

Approve the exception indefinitely to avoid disruption

Question 8

An organization has the storage bucket policy shown. Which of the following is the MOST likely intent of this policy?

Accepted Answer

Prevent deletion of objects from the bucket over unencrypted connections.. The bucket policy uses a condition that denies the storage.objects.delete permission when the request is not over HTTPS (i.e., when secure transport is false), which specifically blocks object deletion over unencrypted connections while still allowing deletion over HTTPS. This is a targeted control to prevent accidental or malicious deletion on plaintext channels without disabling deletion entirely. The intent is therefore to prevent deletion of objects over unencrypted connections.

Answer

Prevent all deletion of objects from the bucket.

Answer

Prevent access to the bucket over HTTP.

Answer

Allow deletion only over HTTPS.

Question 9

An auditor is reviewing IT policy compliance and finds that a critical policy was last updated three years ago. The organization has undergone significant changes. What is the auditor's PRIMARY concern?

Accepted Answer

The policy may not be aligned with current business objectives. The primary concern with a policy that has not been updated for three years amid significant organizational change is that it may no longer align with current business objectives, risks, and operating environment. Policy relevance is the root issue; awareness, approval, and enforcement are downstream symptoms that may or may not exist. An outdated policy can direct behavior toward obsolete goals and create compliance gaps.

Answer

Employees may not be aware of the policy

Answer

The policy may not have been approved by management

Answer

The policy may not be enforced

Question 10

An organization is deciding between building a custom application and purchasing a commercial off-the-shelf (COTS) product. The primary factor favoring the build option is:

Accepted Answer

Greater control over features. Building a custom application allows for tailored functionality that meets unique business requirements, which is a key advantage over COTS.

Answer

Faster time to market

Answer

Lower initial cost

Answer

Reduced vendor dependency

Question 11

A project team is using a prototyping approach for a new system. Which of the following is the BEST control to ensure the prototype accurately reflects user needs?

Accepted Answer

Involve users in each iteration and obtain formal sign-off.. In prototyping, iterative user involvement with formal sign-off at each iteration ensures that evolving requirements are captured and validated continuously. This control directly verifies that each prototype increment aligns with user needs before proceeding, reducing the risk of building a system that fails to meet expectations.

Answer

Conduct a post-implementation review.

Answer

Require the project sponsor to approve the final design.

Answer

Perform regression testing after each prototype iteration.

Question 12

An IS auditor is using analytical procedures during the planning phase. Which of the following is an example of an analytical procedure?

Accepted Answer

Comparing current-year expenses to prior-year expenses. Analytical procedures involve evaluating financial information by analyzing plausible relationships among data — comparing current-year expenses to prior-year expenses is a textbook example of such a comparison. It helps the auditor identify unusual fluctuations or trends that warrant further investigation during planning. This is distinct from tests of details and substantive procedures that involve direct evidence gathering.

Answer

Observing the inventory count

Answer

Inspecting authorization forms for signatures

Answer

Confirming account balances with third parties

Question 13

An IS auditor is preparing the audit report. According to ISACA standards, which of the following should be included in the final audit report?

Accepted Answer

Findings, recommendations, and management action plans. According to ISACA's IT Audit Framework and the ISACA Code of Professional Ethics, the final audit report must include the audit findings, recommendations, and management's action plans. Findings describe the condition, criteria, cause, and effect; recommendations provide guidance for remediation; and management action plans document the agreed-upon corrective steps and timelines. This triad ensures the report is complete, actionable, and supports follow-up.

Answer

Only the audit findings

Answer

Only the recommendations

Answer

The audit program and procedures

Question 14

An IS auditor is reviewing a project that replaced a legacy system. The project used a phased cutover, with each phase going live in a different region. After the final phase, the auditor finds that the legacy system was kept in read-only mode for six months, but no formal reconciliation was performed between legacy and new system balances during that period. Which of the following is the MOST significant concern?

Accepted Answer

Undetected data discrepancies may have persisted, and the organization may have lost the ability to correct them after the legacy system was retired.. When a legacy system remains available after cutover, it offers a baseline for verifying that the new system contains complete and accurate data. Without formal reconciliation, differences can go undetected. Retiring the legacy system then eliminates the source data needed to investigate and correct those differences. The most significant concern is therefore the permanent loss of the ability to identify and remediate data discrepancies, which can affect financial reporting and operational decisions.

Answer

The project team may have incurred unnecessary licensing and maintenance costs by keeping the legacy system available for six months.

Answer

The phased cutover may have caused inconsistent business processes across regions, leading to operational inefficiencies.

Answer

Users may have continued to access the legacy system for reporting and made decisions based on outdated information.

Question 15

An IT steering committee is reviewing a proposal for a new customer relationship management (CRM) system. Which of the following BEST demonstrates that the proposal aligns with the organization's strategic goals?

Accepted Answer

The business case includes a clear link to the organization's five-year strategic plan.. The business case including a clear link to the organization's five-year strategic plan directly demonstrates alignment with strategic goals. This shows that the CRM proposal is not just a tactical IT purchase but is explicitly tied to the long-term objectives of the organization, which is the best evidence of strategic alignment.

Answer

The project manager has extensive experience with CRM implementations.

Answer

The proposed system includes advanced analytics capabilities.

Answer

The vendor offers discounted licensing for the first year.

Question 16

An organization has experienced several security incidents due to unauthorized changes to production systems. Which governance mechanism should be strengthened?

Accepted Answer

Change management process. Unauthorized changes to production systems indicate a failure in the change management process, which is designed to control and authorize modifications. Strengthening change management ensures that all changes are reviewed, approved, and documented, reducing the risk of unauthorized alterations. The other mechanisms address asset inventory, configuration data, or incident response, but do not directly prevent unauthorized changes.

Answer

IT asset management

Answer

Configuration management database

Answer

Incident response plan

Question 17

Which TWO of the following are examples of analytical procedures used as audit evidence? (Select two.)

Accepted Answer

Ratio analysis. Ratio analysis (A) is a classic analytical procedure because it evaluates financial information by comparing relationships among accounts (e.g., current ratio, gross margin percentage) to identify unusual fluctuations or inconsistencies that may indicate misstatement. Trend analysis (D) is likewise analytical, as it compares financial data across periods (e.g., year-over-year revenue growth) to spot significant variances requiring further audit attention. Both fall under the analytical procedures defined in auditing standards (e.g., AU-C 520), which involve evaluations of financial information through analysis of plausible relationships among financial and nonfinancial data. By contrast, inquiry of management (B) is a form of audit evidence obtained through questioning, not analysis; inspection of documents (C) is a substantive test of details involving examination of records; and observation of process (E) is a procedure of watching a process or procedure being performed, none of which constitute analytical procedures.

Answer

Inquiry of management

Answer

Inspection of documents

Answer

Observation of process

Question 18

An IS auditor is assessing the security of an organization's virtualized environment. The organization uses a type 1 hypervisor and has multiple virtual machines (VMs) running on a single physical host. The auditor is concerned about the risk of VM escape, where an attacker compromises the hypervisor from within a VM. Which of the following controls are MOST effective in mitigating this risk? (Choose two.)

Accepted Answer

Ensuring the hypervisor is kept up to date with the latest security patches.. The most effective controls to mitigate VM escape are patching the hypervisor and hardening VM configurations by disabling unnecessary virtual hardware and shared folders. Patching addresses known vulnerabilities that could be exploited for escape, while reducing the attack surface limits the vectors an attacker can use. Together, these preventive measures significantly reduce the risk of a VM compromising the hypervisor.

Answer

Using a host-based intrusion detection system (HIDS) on each VM.

Answer

Regularly backing up VM images to a separate storage system.

Answer

Enabling promiscuous mode on the virtual switch to monitor all traffic.

Question 19

An organization is evaluating a cloud-based identity as a service (IDaaS) for single sign-on (SSO). Which of the following security concerns is MOST critical to address?

Accepted Answer

Compromise of the identity provider's credentials. The compromise of the identity provider's (IdP) credentials is the most critical security concern because the IdP acts as the central trust anchor for all SSO transactions. If an attacker gains control of the IdP's signing key or administrative credentials, they can forge SAML assertions for any user, bypassing all downstream authentication and gaining unauthorized access to every connected service provider (SP). This represents a single point of failure that undermines the entire SSO trust model.

Answer

Lack of encryption for SAML assertions

Answer

Incompatibility with legacy applications

Answer

Downtime of the IDaaS provider

Question 20

A company plans to implement a commercial off-the-shelf (COTS) application and requires significant customization to match its unique business processes. The vendor advises against extensive customization because it may complicate future upgrades. What is the BEST course of action?

Accepted Answer

Avoid customization and re-engineer business processes to match the COTS application. The best course of action is to avoid customization and re-engineer business processes to match the COTS application. This approach preserves the integrity of the vendor's standard codebase, ensuring that future upgrades and patches can be applied with minimal friction. Extensive customization creates a fork from the vendor's baseline, leading to costly regression testing, potential security gaps, and upgrade incompatibilities that undermine the long-term value of the COTS investment.

Answer

Use the vendor's customization module to minimize upgrade risks

Answer

Customize but maintain detailed documentation for upgrade impact analysis

Answer

Proceed with extensive customization to meet business needs