CISA Practice Test 32 — 15 Questions

Question 1

Refer to the exhibit. A security analyst notices that users on the INSIDE network (10.1.1.0/24) can browse HTTPS websites but cannot resolve domain names. What is the most likely cause?

Accepted Answer

The ACL only permits DNS traffic to host 10.2.2.10, but users need to query a different DNS server. The exhibit shows an ACL that permits DNS traffic (UDP port 53) only to host 10.2.2.10. Since users can browse HTTPS (TCP/443) but cannot resolve domain names, the ACL is blocking DNS queries to any other DNS server. Option B correctly identifies that the ACL restricts DNS to a single server, and if users are configured to query a different DNS server, resolution fails.

Answer

The ACL denies TCP traffic to port 443

Answer

The DNS server at 10.2.2.10 is unreachable

Answer

The OUTSIDE interface has no security-level configured correctly

Question 2

An organization wants to protect its intellectual property from unauthorized disclosure via email. Which control should be implemented?

Accepted Answer

Implement a data loss prevention (DLP) system.. A DLP system is the correct control because it can inspect email content and attachments in real time, applying policies to block or quarantine unauthorized disclosures of intellectual property. Unlike encryption, which only protects data in transit but does not prevent an authorized user from sending sensitive information, DLP provides content-aware enforcement at the point of transmission.

Answer

Encrypt all outgoing emails.

Answer

Disable email altogether.

Answer

Require employees to sign non-disclosure agreements.

Question 3

Which TWO of the following are characteristics of the iterative SDLC model?

Accepted Answer

User feedback is incorporated after each iteration. Iterative models develop systems through repeated cycles (iterations) that incorporate user feedback, unlike waterfall where requirements are fixed upfront.

Answer

The final product is delivered only at the end of the project

Answer

Requirements are defined in detail at the start of the project

Answer

Risk analysis is performed only at the beginning

Question 4

Which TWO of the following are benefits of using a version control system in software development?

Accepted Answer

Rollback to previous versions. Version control systems (e.g., Git, SVN) allow developers to revert code to a previous commit or tag, enabling recovery from bugs or regressions. This rollback capability is a core feature that preserves the history of the codebase and supports safe experimentation.

Answer

Generate test cases

Answer

Eliminate all bugs

Answer

Automate deployment

Question 5

A multinational corporation's data center in the European Union (EU) stores personal data of EU citizens. The company must comply with the General Data Protection Regulation (GDPR), which requires that personal data be protected and that data subjects have the right to erasure ('right to be forgotten'). The company's IT team uses a centralized identity management system that stores user credentials and personal data in an active directory (AD) forest. The AD forest is replicated across multiple data centers worldwide, including a non-EU country. The data protection officer (DPO) is concerned that personal data might be inadvertently replicated to jurisdictions without adequate protection. Which of the following is the most effective way to address this concern?

Accepted Answer

Implement data residency controls to ensure EU personal data is only stored and processed within the EU. GDPR mandates that personal data of EU citizens must not be transferred to countries without adequate protection unless specific safeguards are in place. Implementing data residency controls ensures that EU personal data is stored and processed only within the EU, preventing inadvertent replication to non-EU jurisdictions via AD replication. This directly addresses the DPO's concern by enforcing geographic boundaries on data storage and processing.

Answer

Pseudonymize all personal data before storing it in AD

Answer

Encrypt all personal data at rest and in transit, with keys held solely within the EU

Answer

Obtain explicit consent from all EU data subjects for international data transfer

Question 6

An organization uses risk-based authentication (RBA) for user access. Which of the following factors would MOST likely trigger a step-up authentication?

Accepted Answer

User accessing sensitive data from an unusual location.. Risk-based authentication (RBA) evaluates the risk level of each access attempt based on contextual factors. An unusual location is a high-risk indicator because it deviates from the user's established behavioral baseline, often triggering step-up authentication (e.g., requiring a one-time passcode or biometric verification) to verify the user's identity before granting access to sensitive data.

Answer

User logging in from a known device.

Answer

User entering correct password.

Answer

User logging in during business hours.

Question 7

A company uses role-based access control (RBAC). An employee moves from one department to another but retains some previous access due to overlapping role permissions. This condition is known as:

Accepted Answer

Privilege creep. Privilege creep occurs when an employee accumulates access rights over time, often due to role changes or lateral moves, without corresponding removal of previous permissions. In RBAC, overlapping role permissions can cause this condition when old role memberships are not revoked, leading to excessive entitlements that violate the principle of least privilege.

Answer

Access aggregation

Answer

Segregation of duties conflict

Answer

Entitlement explosion

Question 8

Based on the exhibit, what is the MOST likely security risk?

Accepted Answer

Unrestricted traffic is allowed after the specific deny. The 'permit ip any any' at the end allows all traffic, bypassing earlier specific denials. Option A is not correct because the deny line only blocks other traffic, but the permit any any overrides it. Option B is not directly indicated. Option D is a risk but less direct than the rule order issue.

Answer

The web server is fully protected

Answer

Traffic to port 80 is not encrypted

Answer

The host 192.168.1.100 is exposed to denial-of-service attacks

Question 9

Arrange the steps to set up a virtual private network (VPN) for remote access in the correct order.

Accepted Answer

Configure VPN server, Provision user accounts, Install VPN client software, Test the connection, Monitor VPN usage. VPN setup: server configuration, user provisioning, client installation, connection testing, and monitoring.

Answer

Install VPN client software, Configure VPN server, Provision user accounts, Test the connection, Monitor VPN usage

Answer

Configure VPN server, Install VPN client software, Test the connection, Provision user accounts, Monitor VPN usage

Answer

Provision user accounts, Configure VPN server, Install VPN client software, Test the connection, Monitor VPN usage

Question 10

During an IS audit, the auditor finds that a control deficiency could result in a material misstatement. According to ISACA standards, this should be classified as:

Accepted Answer

A material weakness. A material weakness is a deficiency or combination of deficiencies that results in a reasonable possibility that a material misstatement will not be prevented or detected.

Answer

An observation

Answer

A deficiency

Answer

A finding

Question 11

Which TWO of the following are key responsibilities of an IT steering committee?

Accepted Answer

Approving the annual IT budget and major capital expenditures. The IT steering committee is a senior-level governance body responsible for aligning IT strategy with business objectives. Approving the annual IT budget and major capital expenditures (A) is a core fiduciary duty, ensuring resources are allocated to approved projects and initiatives. Defining IT policies and standards (C) establishes the governance framework for security, compliance, and operational consistency across the enterprise.

Answer

Performing daily system monitoring and incident response

Answer

Writing application code for new software features

Answer

Configuring firewall rules and network access controls

Question 12

During a nightly batch job, the above error appears in the application logs. The transaction table ACCT_TRANS has a unique constraint on the REF_NUM column. Which of the following is the MOST likely root cause?

Accepted Answer

The batch job is not idempotent and is re-processing previously successful transactions. The unique constraint violation on REF_NUM indicates that the batch job is attempting to insert a row with a REF_NUM value that already exists in the ACCT_TRANS table. This occurs when the job is not idempotent—meaning it does not check for or handle previously processed transactions—and re-processes the same data, leading to duplicate key errors.

Answer

The batch job lacks sufficient privileges to insert into the ACCT_TRANS table

Answer

There is a mismatch between the number of columns in the INSERT statement and the table definition

Answer

The batch job is missing an index on the REF_NUM column

Question 13

An organization is developing a new customer portal. The development team wants to use an agile methodology. Which of the following is a key benefit of using agile for this project?

Accepted Answer

Continuous stakeholder feedback is incorporated. Agile methodologies emphasize iterative development with continuous stakeholder feedback, which is critical for a customer portal where user needs evolve. This ensures the final product aligns with actual requirements, reducing rework and increasing satisfaction. Option A directly captures this core benefit.

Answer

Detailed requirements are defined upfront

Answer

Documentation is minimized to save time

Answer

The entire system is delivered at once

Question 14

During a business impact analysis (BIA), the auditor identifies a critical process with a maximum tolerable downtime (MTD) of 4 hours. The IT department proposes a recovery time objective (RTO) of 2 hours and a recovery point objective (RPO) of 1 hour. Which statement is correct?

Accepted Answer

The RTO is acceptable as it is less than the MTD. The RTO must be less than or equal to the MTD. Here, RTO (2 hours) is less than MTD (4 hours), so the recovery target is acceptable.

Answer

The MTD should be reduced to match the RTO

Answer

The RPO is too high because it exceeds the MTD

Answer

The RTO should be equal to the MTD

Question 15

What is the primary purpose of a chargeback model for IT services?

Accepted Answer

To provide transparency and encourage efficient use of IT resources. Chargeback models allocate IT costs to business units based on usage, promoting accountability and cost awareness.

Answer

To increase the IT budget

Answer

To simplify IT financial management

Answer

To centralize IT decision-making