CISA Practice Test 33 — 15 Questions

Question 1

Refer to the exhibit. During a security audit, an IS analyst identifies that a critical business application hosted on 192.168.1.100:443 is unreachable from the 10.0.1.0/24 subnet. Which of the following is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The first rule blocks all traffic from 10.0.1.0/24. The first rule in the exhibit explicitly denies all traffic from the 10.0.1.0/24 subnet, which is the source subnet in the scenario. Since firewall rules are processed sequentially from top to bottom, this deny rule matches the traffic before any subsequent permit rules can be evaluated, making the host at 192.168.1.100:443 unreachable from that subnet.

Answer

The second rule blocks HTTPS traffic from any source to the host

Answer

The third rule permits all traffic from the 10.0.0.0/16 subnet

Answer

The firewall is misconfigured for TCP traffic

Question 2

During an information systems audit, the IS auditor finds that data classification labels are not consistently applied across the organization. What is the most likely root cause of this issue?

Accepted Answer

Insufficient training and awareness programs on data classification.. Inconsistent application of data classification labels is most commonly caused by insufficient training and awareness programs. Without proper education, users do not understand how to correctly classify data according to the policy, leading to inconsistent labeling across the organization.

Answer

The data classification policy is too complex and has too many levels.

Answer

The organization does not enforce consequences for misclassification.

Answer

Lack of automated classification tools integrated with the document management system.

Question 3

An IS auditor is assessing network security controls. Which TWO of the following are key elements of a firewall rule review?

Accepted Answer

Verifying that each rule has a business justification. A firewall rule review is fundamentally about validating the rulebase itself, so option B is correct: verifying that each rule has a business justification ensures no unnecessary, stale, or overly permissive rules remain, directly supporting least-privilege and reducing the attack surface. Option C is also correct because comparing the actual running rulebase against the documented/approved rules detects unauthorized changes, configuration drift, and shadowed or redundant rules, which is the core purpose of a rule review. Option A is not a rule-review element but a configuration/hardening check for default credentials, which is a separate control. Option D concerns resilience and availability testing (failover), not rule correctness, and option E addresses capacity/performance monitoring rather than the appropriateness of the rules themselves.

Answer

Checking for default passwords on firewall

Answer

Testing firewall failover capabilities

Answer

Reviewing firewall performance metrics

Question 4

Order the steps for responding to a security incident in the correct sequence.

Accepted Answer

Detection, then Containment, then Eradication/Recovery, then Review, then Improvement. Incident response follows: detection, containment, eradication/recovery, review, and improvement.

Answer

Containment, then Detection, then Eradication/Recovery, then Review, then Improvement

Answer

Detection, then Eradication/Recovery, then Containment, then Review, then Improvement

Answer

Detection, then Containment, then Review, then Eradication/Recovery, then Improvement

Question 5

In business continuity planning, a company identifies a critical business process with a maximum tolerable downtime (MTD) of 4 hours. What is the primary purpose of this metric?

Accepted Answer

To determine the recovery time objective (RTO). The maximum tolerable downtime (MTD) defines the maximum time a business process can be unavailable before unacceptable consequences occur. The recovery time objective (RTO) is derived from the MTD — it is the target time within which the process must be restored, and it must be less than the MTD to provide a safety margin. Therefore, the primary purpose of the MTD is to determine the RTO for the process.

Answer

To define the backup frequency

Answer

To calculate the mean time between failures (MTBF)

Answer

To establish service level agreements (SLAs)

Question 6

A financial services organization recently experienced a data breach where customer financial records were exfiltrated. The investigation reveals that an attacker gained access through a compromised privileged account belonging to a database administrator. The attacker used valid credentials to log into the database server and then exported a large volume of data using native database tools. The security team notes that the organization has multi-factor authentication (MFA) enabled for all remote access, but the database server was accessed from an internal IP address. The organization also has a data loss prevention (DLP) system, but it did not alert on the export because the traffic was encrypted. The database activity monitoring (DAM) system did log the export, but alerts were not reviewed due to high volume and many false positives. Which of the following would have been most effective in preventing this breach?

Accepted Answer

Implementing a privileged access management (PAM) solution that requires approval for elevated actions and records sessions. The breach occurred because a privileged database administrator account was compromised, and the attacker used native database tools to export data from an internal IP address, bypassing MFA. A privileged access management (PAM) solution would have required approval for elevated actions (e.g., exporting large volumes of data) and recorded the session, providing both preventive control (approval workflow) and detective control (session recording) to stop or immediately detect the abuse of valid credentials. This directly addresses the root cause—compromised privileged credentials—rather than relying on network or alerting controls that were circumvented.

Answer

Deploying a DLP solution that can inspect encrypted traffic via SSL interception

Answer

Segmenting the database server onto a separate network with strict firewall rules

Answer

Improving the database activity monitoring (DAM) alerting to reduce false positives

Question 7

An organization is migrating data from a legacy system to a new ERP. What is the most critical data migration risk?

Accepted Answer

Data loss or corruption. Data loss or corruption is the most critical risk because it directly compromises the integrity and completeness of the migrated data, which is the core asset being transferred. Unlike cost or schedule overruns, corrupted data can lead to incorrect business decisions, regulatory non-compliance, and financial misstatements that may go undetected for long periods. The primary objective of any data migration is to preserve data accuracy and completeness, making this the highest-priority risk.

Answer

Increased storage costs

Answer

Longer migration time

Answer

Incompatible hardware

Question 8

Which TWO of the following are components of audit risk in IS auditing?

Accepted Answer

Detection risk. In IS auditing, audit risk is modeled as the risk that the auditor gives an inappropriate opinion on financial statements that are materially misstated, and its standard components are inherent risk, control risk, and detection risk. Detection risk (A) is correct because it is the risk that the auditor's procedures fail to detect a material misstatement that exists, and it is the component the auditor can directly manage by adjusting the nature, timing, and extent of audit procedures. Inherent risk (D) is correct because it is the susceptibility of an assertion to a material misstatement before considering any related internal controls, arising from factors such as complex IT environments, high transaction volumes, or estimation uncertainty. The other options do not belong: financial risk (B), business risk (C), and operational risk (E) are broader enterprise or management risk categories, not the defined components of the audit risk model used in IS auditing.

Answer

Financial risk

Answer

Business risk

Answer

Operational risk

Question 9

A compliance audit is primarily concerned with:

Accepted Answer

Determining whether the organization is following applicable laws and regulations. A compliance audit is primarily concerned with determining whether the organization is adhering to applicable laws, regulations, standards, and contractual obligations. It tests conformity against defined criteria rather than evaluating control effectiveness, operational efficiency, or strategic alignment. The other options describe operational, performance, or strategic audits.

Answer

Evaluating the effectiveness of internal controls

Answer

Assessing the efficiency of IT operations

Answer

Ensuring the organization is meeting its strategic objectives

Question 10

An organization uses automated job scheduling for batch processing. A critical job fails due to a dependency on another job that has not completed. Which of the following controls would BEST prevent this issue?

Accepted Answer

Dependency management. Dependency management is the correct control because it ensures that job scheduling logic explicitly defines and enforces the order of execution based on predecessor/successor relationships. By configuring dependencies (e.g., using job control language (JCL) with COND parameters or scheduling tools like CA Workload Automation ESP), the system will automatically hold a job until all prerequisite jobs have completed successfully, preventing the failure scenario described.

Answer

Job failure alerts

Answer

Manual job scheduling

Answer

Rerun procedures

Question 11

During an audit of network security controls, the IS auditor reviews firewall rule sets and identifies a rule that allows any-to-any traffic from the internal network to the Internet. The rule has a business justification. What is the auditor's BEST recommendation?

Accepted Answer

Implement a more restrictive rule set based on specific IP addresses and ports. An any-to-any rule from internal to Internet is overly permissive and violates the principle of least privilege, even if a business justification exists. The auditor's best recommendation is to implement a more restrictive rule set based on specific IP addresses, ports, and protocols, which enforces least privilege while still meeting business needs. A business justification does not make an overly broad rule acceptable; the control should be tightened to the minimum necessary access.

Answer

Add an intrusion prevention system (IPS) to monitor the traffic

Answer

Require all traffic to go through a proxy server

Answer

Accept the risk because there is a business justification

Question 12

A company has multiple business units with conflicting IT priorities. Which governance body should resolve this?

Accepted Answer

IT steering committee. An IT steering committee is the governance body composed of senior business and IT leaders that prioritizes IT investments and resolves conflicts between business units' competing IT priorities. It exists precisely to arbitrate cross-functional prioritization and align IT initiatives with business strategy, making it the correct forum for resolving conflicting priorities among business units.

Answer

Board of directors

Answer

IT management

Answer

Audit committee

Question 13

Arrange the steps to implement a patch management process in the correct order.

Accepted Answer

1. Inventory, 2. Evaluation, 3. Testing, 4. Deployment, 5. Verification. Patch management starts with inventory, then evaluation, testing, deployment, and verification.

Answer

1. Evaluation, 2. Inventory, 3. Testing, 4. Deployment, 5. Verification

Answer

1. Inventory, 2. Testing, 3. Evaluation, 4. Deployment, 5. Verification

Answer

1. Inventory, 2. Evaluation, 3. Deployment, 4. Testing, 5. Verification

Question 14

Which THREE of the following are common challenges when implementing a bring-your-own-device (BYOD) policy that affect information systems operations? (Select exactly 3.)

Accepted Answer

Difficulty in enforcing data encryption and remote wipe capabilities. Options A, D, and E are correct. BYOD introduces security risks such as difficulty enforcing data encryption and remote wipe (A), incompatibility between corporate apps and various platforms (D), and increased risk of malware from unmanaged devices (E). Option B is an advantage, not a challenge. Option C is a potential benefit, not a common challenge.

Answer

Reduced hardware procurement costs for the organization

Answer

Increased employee productivity due to device familiarity

Question 15

During an audit of a financial application, the IS auditor discovers that user access reviews are performed quarterly instead of monthly as required by policy. Which of the following is the BEST initial action for the auditor?

Accepted Answer

Determine if compensating controls mitigate the risk of less frequent reviews. The IS auditor's primary role is to assess risk, not to enforce policy blindly. Quarterly reviews may still be acceptable if compensating controls (e.g., automated provisioning/deprovisioning, real-time monitoring, or role-based access controls) effectively reduce the risk of unauthorized access between reviews. Determining the presence and effectiveness of such controls is the best initial action before deciding whether to report noncompliance.

Answer

Recommend that the policy be changed to allow quarterly reviews

Answer

Report the noncompliance with the policy as a finding immediately

Answer

Escalate the issue to senior management for immediate resolution