CISA Practice Test 31 — 15 Questions

Question 1

An organization is designing an IT balanced scorecard to align IT performance with business goals. Which perspective would include metrics related to IT employee skills and training?

Accepted Answer

Learning and growth. The learning and growth perspective in a balanced scorecard focuses on employee capabilities, skills, and training.

Answer

Internal process

Answer

Customer

Answer

Financial

Question 2

During a vendor audit, an IS auditor discovers that a cloud service provider uses subcontractors to manage data storage. The contract does not mention subcontracting. Which THREE risks should the auditor highlight to management?

Accepted Answer

Vendor concentration risk from subcontractor dependency. Vendor concentration risk arises if the subcontractor is a single point of failure. Fourth-party risk means the organization has no direct control. Exit strategy concerns include difficulty in transitioning if the subcontractor fails.

Answer

Improved service level performance

Answer

Increased licensing costs

Question 3

An IS auditor is reviewing the change management process for a financial application. Which of the following findings would be of MOST concern?

Accepted Answer

Emergency changes are not reviewed within 30 days. Emergency changes bypass normal controls; failure to review them within a reasonable time (e.g., 30 days) increases risk of undocumented changes. Logging in spreadsheet, pre-approved standard changes, and defined change windows are acceptable or even good practices.

Answer

Change requests are logged in a spreadsheet

Answer

Standard changes are pre-approved

Answer

Change windows are defined in the policy

Question 4

A company is experiencing frequent server crashes due to memory leaks. The operations team has implemented a monitoring solution. Which of the following is the BEST indicator to trigger an automated failover to a standby server?

Accepted Answer

Memory usage exceeding 90% for more than 5 minutes. Memory leaks cause gradual memory consumption; sustained high memory usage directly indicates the condition. CPU spikes, disk latency, and packet loss are less specific to memory leaks.

Answer

Disk I/O latency greater than 10ms

Answer

CPU utilization spikes above 80% for 1 minute

Answer

Network packet loss exceeding 1%

Question 5

An organization is implementing a data masking solution for a non-production database. Which of the following is the MOST important requirement?

Accepted Answer

Masked data should maintain referential integrity.. In a non-production database, data masking must preserve referential integrity to ensure that relationships between tables (e.g., foreign keys) remain valid after masking. Without referential integrity, application logic that relies on these relationships would break, making the non-production environment unusable for testing or development. This is the most critical requirement because masked data must still function correctly within the database schema.

Answer

Masked data should be encrypted.

Answer

Masked data should be irreversible.

Answer

Masked data should be randomized across all columns.

Question 6

Refer to the exhibit. A CISA is analyzing these logs. What is the MOST likely security incident?

Accepted Answer

Compromised administrator account used to establish a command and control channel. The logs show the administrator account executing a reverse shell connection (e.g., using PowerShell or netcat) to an external IP address on a non-standard port (e.g., 4444 or 8080). This outbound connection initiated by the admin account is a classic indicator of a command and control (C2) channel, where an attacker who has compromised the account uses it to maintain persistent remote access. Legitimate administrative activity would not typically involve establishing a reverse shell to an unknown external host.

Answer

Legitimate system maintenance activity

Answer

Brute force attack on the administrator account

Answer

Unauthorized installation of a critical update

Question 7

Which THREE are indicators of a possible data exfiltration attempt via the network? (Choose three.)

Accepted Answer

Use of unauthorized encryption or tunneling protocols. Data exfiltration often involves bypassing security controls by using unauthorized encryption or tunneling protocols (e.g., SSH over port 443, IPsec over UDP, or custom VPNs) to hide malicious traffic within legitimate-looking flows. Such protocols can encapsulate stolen data and evade deep packet inspection (DPI) or data loss prevention (DLP) systems, making them a strong indicator of exfiltration attempts.

Answer

Increase in phishing emails targeting executives

Answer

Large number of HTTPS connections to legitimate cloud services

Question 8

Which of the following are effective controls to protect sensitive data in use? (Choose TWO.)

Accepted Answer

Homomorphic encryption. Homomorphic encryption allows computations to be performed directly on encrypted data without decrypting it first, thereby protecting the data while it is in use. This is a critical control for scenarios where sensitive data must be processed by untrusted environments, as the plaintext is never exposed during processing.

Answer

Transport Layer Security (TLS)

Answer

Access control lists (ACLs)

Answer

Hashing

Question 9

Which THREE of the following are commonly used data encryption standards? (Choose three.)

Accepted Answer

3DES. 3DES (Triple Data Encryption Standard) is a symmetric-key block cipher that applies the DES algorithm three times to each data block, effectively increasing the key length to 168 bits. It was widely adopted as a secure replacement for single DES, though it is now considered legacy due to performance and security limitations.

Answer

SHA-256

Answer

MD5

Question 10

During an audit of a healthcare organization's information security program, the IS auditor finds that the security awareness training is conducted only at hire. Which of the following is the MOST significant risk associated with this practice?

Accepted Answer

Employees may not be aware of new security threats and vulnerabilities. Without ongoing training, employees are less likely to stay informed about evolving threats, increasing the risk of security incidents due to human error.

Answer

Failure to comply with regulatory data protection requirements

Answer

Increased cost of incident response due to lack of preparedness

Answer

Increased likelihood of password sharing among employees

Question 11

A company stores sensitive customer data in a database. To comply with privacy regulations, the data must be anonymized for analytics. Which technique provides the strongest anonymization while preserving data utility?

Accepted Answer

Differential privacy with calibrated noise.. Differential privacy with calibrated noise is the strongest anonymization technique because it provides a formal mathematical guarantee that the output of a query does not reveal whether any specific individual's data was included. By adding carefully calibrated noise to query results, it preserves statistical utility for analytics while ensuring that re-identification is provably infeasible, meeting strict privacy regulations like GDPR or CCPA.

Answer

Tokenization with a reversible mapping.

Answer

Removing direct identifiers like names and SSNs.

Answer

Data masking with static substitution.

Question 12

Which of the following is the most important factor to consider when determining sample size for a compliance test?

Accepted Answer

Tolerable error rate. In compliance testing (attribute sampling), the tolerable error rate is the maximum deviation rate from a control that the auditor is willing to accept without concluding the control is ineffective. It directly determines the required sample size because a lower tolerable error rate demands a larger sample to achieve sufficient precision, while a higher rate allows a smaller sample. This factor is more critical than others because it sets the boundary for the auditor's risk assessment.

Answer

Expected error rate

Answer

Population size

Answer

Sampling method

Question 13

Which TWO of the following are essential components of a disaster recovery plan (DRP)?

Accepted Answer

Steps for restoring IT systems. The primary purpose of a DRP is to restore IT systems and operations after a disaster. The plan must include step-by-step recovery procedures for critical systems, applications, and data to ensure business continuity. Without these steps, the DRP cannot guide the recovery team through the technical restoration process.

Answer

Detailed financial audit procedures

Answer

Employee performance reviews

Answer

Backup media rotation schedule

Question 14

Which TWO of the following are key performance indicators (KPIs) for IT operations?

Accepted Answer

Mean time to repair (MTTR). Mean time to repair (MTTR) measures the average time taken to restore a failed IT service or component, directly reflecting operational efficiency and incident response effectiveness. It is a standard KPI for IT operations because it quantifies the speed of recovery, which is critical for minimizing downtime and maintaining service levels.

Answer

Number of unresolved incidents

Answer

Employee satisfaction score

Answer

Budget variance

Question 15

Arrange the steps to perform a risk assessment in the correct order.

Accepted Answer

Asset identification, then Threat/vulnerability identification, then Risk analysis, then Prioritization, then Documentation of treatment. Risk assessment begins with asset identification, then threat/vulnerability identification, followed by risk analysis, prioritization, and documentation of treatment.

Answer

Threat/vulnerability identification, then Asset identification, then Risk analysis, then Prioritization, then Documentation of treatment

Answer

Asset identification, then Risk analysis, then Threat/vulnerability identification, then Prioritization, then Documentation of treatment

Answer

Documentation of treatment, then Asset identification, then Threat/vulnerability identification, then Risk analysis, then Prioritization