CISA Practice Test 32 — 15 Questions

Question 1

An organization's IT department is structured with a central unit that provides infrastructure and support, while individual business units have their own application development teams. This structure is BEST described as:

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Federated (hybrid) IT. A centralized IT structure consolidates IT functions in a central unit, while a decentralized structure distributes IT across business units. A hybrid (federated) structure combines aspects of both, with some functions centralized and others decentralized.

Answer

Outsourced IT

Answer

Centralized IT

Answer

Decentralized IT

Question 2

An IT auditor is reviewing the business continuity plan (BCP) testing schedule. The organization conducts a test where participants discuss their roles and responses to a scenario without any actual system activation. Which type of test is this?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based BCP test where participants verbally walk through their roles and responses to a hypothetical scenario without activating systems or relocating staff. It is the least disruptive and least expensive test type, used to validate plans, clarify roles, and identify gaps before conducting more resource-intensive tests. Because the question specifies 'discuss their roles and responses... without any actual system activation,' this maps directly to a tabletop exercise.

Answer

Parallel test

Answer

Walkthrough

Answer

Simulation

Question 3

A small manufacturing company decides to acquire an off-the-shelf inventory management system. The purchasing manager selects a vendor based solely on the lowest price, ignoring the vendor's financial stability and support history. After purchase, the vendor declares bankruptcy, leaving the company without support. The system has a critical bug that halts inventory tracking. The IT manager considers hiring a consultant to fix the bug. As an IS auditor, what should the auditor's PRIMARY concern be?

Accepted Answer

The vendor selection process lacked due diligence.. The primary concern for an IS auditor is that the vendor selection process lacked due diligence, as this directly violates the principle of proper acquisition governance. By selecting a vendor based solely on lowest price without evaluating financial stability and support history, the company exposed itself to significant operational risk, which materialized when the vendor declared bankruptcy. This oversight is a root cause failure in the information systems acquisition and implementation process, making it the most critical audit finding.

Answer

There is no backup system for inventory management.

Answer

The company may have legal recourse against the vendor.

Answer

The critical bug disrupts inventory tracking.

Question 4

An organization is implementing a change management process. A change that requires approval from the Change Advisory Board (CAB) but is scheduled to be implemented during the next maintenance window is classified as which type of change?

Accepted Answer

Normal change. A normal change is any change that is not a standard (pre-approved, low-risk, routine) change and not an emergency change; it must go through the full change management process including CAB review and approval, and is typically scheduled for a maintenance window. Because the change requires CAB approval and is scheduled for the next maintenance window, it fits the definition of a normal change. Standard changes are pre-authorized and do not require CAB review, while emergency changes bypass the normal schedule.

Answer

Emergency change

Answer

Standard change

Answer

Minor change

Question 5

During a review of the incident management process, the IS auditor finds that the incident response (IR) team conducts tabletop exercises annually, but the scenarios are limited to malware outbreaks. Which of the following should be the auditor's GREATEST concern?

Accepted Answer

The IR plan may not address all relevant incident types. If tabletop exercises only cover malware outbreaks, the incident response plan may not be validated against other relevant incident types such as ransomware, insider threats, DDoS, or data breaches. The greatest concern is that the IR plan has untested gaps for scenarios the organization is likely to face. This is a coverage and validation issue, not a frequency or capability issue.

Answer

The IR team may not have adequate forensic capabilities

Answer

The exercises are not conducted quarterly

Answer

The IR team is not following the defined procedures

Question 6

Based on the exhibit, what is the most likely control weakness that allowed this condition?

Accepted Answer

Lack of individual accountability for privileged actions. The exhibit shows that multiple users are sharing a single privileged account (e.g., 'root' or 'admin') to perform administrative actions. Without unique user IDs for each administrator, it is impossible to map specific actions (e.g., a 'sudo' command or a configuration change) back to an individual. This lack of individual accountability is the core control weakness, as it violates the audit principle of non-repudiation and prevents effective forensic investigation.

Answer

Weak password complexity requirements

Answer

Failure to disable the default administrator account

Answer

Inadequate segregation of duties between IT and security teams

Question 7

An organization is implementing COBIT 2019. Which TWO of the following are governance enablers? (Choose two.)

Accepted Answer

Organizational structures. In COBIT 2019, governance enablers are the components that make governance and management of enterprise IT possible, and the framework defines seven enabler categories: principles/policies/frameworks, processes, organizational structures, culture/ethics/behavior, information, services/infrastructure/applications, and people/skills/competencies. Option C (Organizational structures) is correct because it is one of these seven enabler categories, covering the decision-making roles, boards, and committees that define accountability for I&T governance. Option E (Culture, ethics and behavior) is also correct because it is explicitly listed as an enabler category, capturing the values and behaviors of individuals and the enterprise that influence governance outcomes. Options A (Hardware configuration), B (Project schedule), and D (Network performance) are not governance enablers; they are specific technical or project-level artifacts that fall under other domains (e.g., services/infrastructure or management processes) rather than being one of COBIT's defined enabler categories.

Answer

Hardware configuration

Answer

Project schedule

Answer

Network performance

Question 8

A small business wants to protect customer data collected through its e-commerce website. Which control is most appropriate for protecting the data at rest and in transit?

Accepted Answer

Use encryption for data at rest and in transit.. Encryption is the only control that directly protects the confidentiality and integrity of data both at rest (e.g., AES-256 for database files) and in transit (e.g., TLS 1.3 for HTTPS). It renders data unreadable without the proper decryption key, ensuring that even if storage media or network traffic is intercepted, the customer data remains secure.

Answer

Implement a network firewall to block unauthorized access.

Answer

Perform regular backups of the database to ensure data availability.

Answer

Deploy an intrusion detection system (IDS) to monitor for threats.

Question 9

During the user acceptance testing (UAT) phase of a new financial application, the business users report that the system calculates interest incorrectly for certain loan types. The project manager wants to fix this quickly. Which of the following is the BEST course of action?

Accepted Answer

Log the defect and perform impact analysis before approving a fix. In the UAT phase, any defect must be formally logged and subjected to impact analysis before a fix is approved. This ensures that the proposed change does not introduce new risks, break other functionality, or violate regulatory compliance—critical for a financial application handling interest calculations. Skipping this process could lead to cascading failures or audit findings.

Answer

Instruct the business to work around the issue until the next release

Answer

Authorize the development team to fix the bug immediately and re-deploy

Answer

Roll back to the previous version of the application

Question 10

An organization is implementing a change management process based on ITIL. Which THREE change types should be included in the policy?

Accepted Answer

Emergency change – requires immediate implementation to resolve a major incident.. Option B is correct because ITIL defines an emergency change as one that must be implemented immediately, typically to resolve a major incident or restore a critical service, and it follows an expedited approval path (e.g., Emergency CAB). Option C is correct because a standard change is a pre-authorized, low-risk, routine change with a documented procedure, so it does not require individual CAB review each time. Option E is correct because a normal change is the standard ITIL category that must be assessed and approved by the Change Advisory Board (CAB) before implementation. Option A is incorrect because planned changes are not a distinct ITIL change type and, more importantly, scheduled changes still require appropriate authorization rather than 'no approval needed.' Option D is incorrect because 'major change' is not one of the three ITIL change types; major changes are handled as normal or emergency changes with escalated approval and risk assessment.

Answer

Planned change – scheduled during maintenance windows with no approval needed.

Answer

Major change – requires executive approval and a separate risk assessment.

Question 11

Which of the following is the PRIMARY purpose of a change advisory board (CAB) in the change management process?

Accepted Answer

To assess, prioritize, and authorize changes. The CAB is responsible for reviewing and approving changes, assessing risks, and ensuring proper planning and testing.

Answer

To approve all standard changes without review

Answer

To authorize emergency changes immediately

Answer

To develop technical solutions for change requests

Question 12

An auditor finds that access reviews have not been completed for two quarters. What is the MOST significant risk?

Accepted Answer

Unauthorized access may be granted and persist. The most significant risk of missed access reviews is that unauthorized or excessive access rights remain in place undetected, allowing users to retain privileges they should no longer have (e.g., after role changes or terminations). This directly enables insider threats and privilege creep, which is the core control objective of periodic access reviews.

Answer

Data integrity may be compromised

Answer

System performance may degrade

Answer

Audit findings may be reported to management

Question 13

An organization is implementing a data retention policy for personally identifiable information (PII) to comply with GDPR. Which of the following is the MOST appropriate approach?

Accepted Answer

Define retention periods based on legal and business requirements and securely delete after. GDPR mandates that PII must not be kept longer than necessary for the purpose for which it was collected. Defining retention periods based on legal and business requirements ensures compliance with the storage limitation principle (Article 5(1)(e)), and secure deletion (e.g., using cryptographic erasure or overwriting with tools like shred on Linux) prevents unauthorized recovery. This approach balances regulatory compliance with operational needs.

Answer

Delete PII as soon as it is collected

Answer

Anonymize PII after a fixed period and retain indefinitely

Answer

Retain PII indefinitely for historical analysis

Question 14

During a change advisory board (CAB) meeting, a proposed change to the database server is discussed. The change involves implementing a security patch that requires a reboot. The change is categorized as 'normal' and has been risk-assessed as low impact. What is the most likely role of the CAB in this scenario?

Accepted Answer

Review and approve the change. The CAB's primary role is to review and approve (or reject) proposed changes by assessing risk, impact, and readiness. In this scenario, the change is a normal change that has been risk-assessed as low impact, so the CAB's most likely action is to review and approve it for implementation during the maintenance window. The CAB does not implement changes, nor does it arbitrarily reject or defer changes that are properly justified and assessed.

Answer

Implement the change directly

Answer

Reject the change as unnecessary

Answer

Defer the change to the next release cycle

Question 15

Which of the following audit types is performed by an independent third-party auditor and is typically required for regulatory compliance?

Accepted Answer

External audit. External audits are conducted by third-party auditors to provide independent assurance, often required by regulations or standards.

Answer

Operational audit

Answer

IS audit

Answer

Internal audit