CISA Practice Test 33 — 15 Questions

Question 1

An organization is considering outsourcing its IT help desk. Which of the following is a key risk that should be addressed in the outsourcing contract?

Accepted Answer

Inadequate data privacy and security measures. Data privacy and security are critical when outsourcing services that handle sensitive information.

Answer

Reduced flexibility in service hours

Answer

Lack of technical expertise in the outsourcing provider

Answer

Higher cost compared to in-house operations

Question 2

Which ITIL 4 guiding principle emphasizes understanding the current state and building on existing capabilities rather than starting from scratch?

Accepted Answer

Start where you are. Start where you are means assessing current services and processes to identify what can be reused or improved.

Answer

Focus on value

Answer

Progress iteratively

Answer

Keep it simple

Question 3

An organization is evaluating a vendor for a custom application development. The vendor states they are assessed at CMMI Level 2 (Managed). Which of the following best describes the implication of this rating?

Accepted Answer

The vendor's projects have a basic project management process that is planned and executed.. CMMI Level 2 (Managed) indicates that the vendor has established basic project management processes to plan, execute, monitor, and control projects. This means projects are managed according to documented plans, with defined requirements, project planning, and configuration management, but processes are not yet standardized across the organization. Option D correctly captures this foundational level of process maturity.

Answer

The vendor's processes are defined and tailored from organization-wide standards.

Answer

The vendor's processes are continuously improved through quantitative feedback.

Answer

The vendor has a quantitatively managed process with statistical control.

Question 4

An IT steering committee is reviewing a proposed project to implement a new customer relationship management (CRM) system. The project has strong support from the sales department but is opposed by the finance department due to cost concerns. What is the primary role of the IT steering committee in this situation?

Accepted Answer

Evaluate the project's alignment with strategic goals and make a decision. The IT steering committee ensures that IT investments align with business strategy and provide value, balancing stakeholder needs.

Answer

Approve the project because sales is a revenue-generating department

Answer

Delegate the decision to the IT manager

Answer

Reject the project due to finance department opposition

Question 5

During a security audit, it was found that users in the finance department have unnecessary access to HR payroll data. Which access control principle has been violated?

Accepted Answer

Least privilege. The least privilege principle dictates that users should be granted only the minimum permissions necessary to perform their job functions. In this scenario, finance department users have unnecessary access to HR payroll data, directly violating this principle by providing more access than required.

Answer

Mandatory access control

Answer

Separation of duties

Answer

Need to know

Question 6

An IT manager wants to measure the effectiveness of the organization's patch management process. Which of the following KPIs would be most appropriate?

Accepted Answer

Percentage of systems with up-to-date patches. Patch compliance percentage directly measures how well the organization applies patches, indicating process effectiveness.

Answer

Average time to patch critical vulnerabilities

Answer

Number of security incidents related to unpatched vulnerabilities

Answer

Number of help desk tickets related to software issues

Question 7

An organization experiences a ransomware attack that encrypts critical files. Which of the following is the BEST recovery strategy to minimize data loss?

Accepted Answer

Restore from offline backups taken before the attack. Restoring from offline backups taken before the attack ensures that the recovered data is clean and free from encryption, as the ransomware cannot modify backups that are not connected to the network. This strategy minimizes data loss by reverting to the most recent known-good state without relying on potentially compromised or incomplete system restore points.

Answer

Disconnect the network and rebuild systems from scratch

Answer

Pay the ransom to decrypt files

Answer

Use system restore points on the same network

Question 8

A company is developing a mobile application that processes credit card payments. During the testing phase, which of the following types of testing is MOST critical to ensure security?

Accepted Answer

Penetration testing.. Penetration testing is the most critical testing type for a mobile application processing credit card payments because it simulates real-world attacks to identify exploitable vulnerabilities in the payment data flow, authentication mechanisms, and API endpoints. This directly addresses PCI DSS requirements for security testing of cardholder data environments, unlike other testing types that focus on functionality or user experience.

Answer

Interface testing.

Answer

Usability testing.

Answer

Regression testing.

Question 9

An IS auditor reviews the change request. Which of the following is the most significant risk?

Accepted Answer

The impact assessment is incorrect. An incorrect impact assessment (Option C) is the most significant risk because it directly undermines the change management process. If the impact is misjudged, the change may introduce unanticipated failures, data corruption, or security vulnerabilities into the production environment. Unlike vague descriptions or pending approvals, an incorrect impact assessment can lead to catastrophic system outages or compliance violations that are difficult to reverse.

Answer

The description is too vague

Answer

The approval is still pending close to the scheduled date

Answer

The change affects a financial module

Question 10

According to ISO/IEC 38500, which principle requires that IT investments are made for valid business reasons and with clear business outcomes?

Accepted Answer

Strategy. The 'Strategy' principle of ISO/IEC 38500 states that IT should be aligned with the business strategy and investments should be made for valid business reasons.

Answer

Performance

Answer

Acquisition

Answer

Responsibility

Question 11

An IT auditor is reviewing the organization's policy hierarchy. Which of the following correctly represents the typical order from highest to lowest level?

Accepted Answer

Policy, Standard, Guideline, Procedure, Work instruction. The hierarchy is: Policy (high-level principles), Standard (mandatory requirements), Guideline (recommended practices), Procedure (step-by-step instructions), Work instruction (detailed task-level instructions).

Answer

Policy, Guideline, Standard, Procedure, Work instruction

Answer

Procedure, Policy, Standard, Guideline, Work instruction

Answer

Standard, Policy, Guideline, Procedure, Work instruction

Question 12

Which of the following is the BEST indicator of IT performance from the customer perspective in an IT balanced scorecard?

Accepted Answer

Help desk resolution time. The customer perspective in an IT balanced scorecard focuses on how users perceive IT services. Help desk resolution time directly measures service quality from the customer's viewpoint.

Answer

Number of security incidents

Answer

System availability percentage

Answer

IT budget as a percentage of revenue

Question 13

Refer to the exhibit. During a security audit, an IS analyst identifies that a critical business application hosted on 192.168.1.100:443 is unreachable from the 10.0.1.0/24 subnet. Which of the following is the MOST likely cause?

Accepted Answer

The first rule blocks all traffic from 10.0.1.0/24. The first rule in the exhibit explicitly denies all traffic from the 10.0.1.0/24 subnet, which is the source subnet in the scenario. Since firewall rules are processed sequentially from top to bottom, this deny rule matches the traffic before any subsequent permit rules can be evaluated, making the host at 192.168.1.100:443 unreachable from that subnet.

Answer

The second rule blocks HTTPS traffic from any source to the host

Answer

The third rule permits all traffic from the 10.0.0.0/16 subnet

Answer

The firewall is misconfigured for TCP traffic

Question 14

An auditor discovers that a financial institution's IT department uses a decentralized model, with each business unit managing its own applications. What is a PRIMARY risk of this structure?

Accepted Answer

Inconsistent security controls across units. Decentralized IT often leads to inconsistent security controls and increased risk of data breaches.

Answer

Reduced agility in responding to business needs

Answer

Difficulty in scaling IT infrastructure

Answer

Higher IT costs due to duplication

Question 15

Which THREE of the following are common challenges when integrating a software package with existing legacy systems? (Select exactly three.)

Accepted Answer

Lack of documented application programming interfaces (APIs). Legacy systems often lack well-documented or standardized APIs, making it difficult to establish reliable interfaces for integration. Without clear API documentation, developers must reverse-engineer communication protocols or rely on outdated methods like screen scraping, which increases integration risk and effort.

Answer

Availability of modern integration middleware

Answer

Need for custom development to bridge the gap