CISA Practice Test 34 — 15 Questions

Question 1

Which TWO of the following are BEST indicators that a system development project is at risk of failure?

Accepted Answer

Frequent scope changes. Frequent scope changes (A) are a classic risk indicator because they disrupt the project's baseline requirements, leading to rework, budget overruns, and schedule delays. In system development, uncontrolled scope creep often results in 'analysis paralysis' and can cause the final product to deviate from original objectives, increasing the likelihood of failure.

Answer

Clear communication

Answer

Robust testing

Answer

High team morale

Question 2

An organization's IT department is considering a shift from insourcing to co-sourcing for application development. What is a PRIMARY advantage of co-sourcing?

Accepted Answer

Provides access to specialized expertise while maintaining internal control. Co-sourcing combines internal and external resources, allowing access to specialized skills while retaining control.

Answer

Eliminates the cost of employee benefits

Answer

Simplifies performance management

Answer

Reduces the need for IT governance

Question 3

A company is in the process of acquiring a new customer relationship management (CRM) system. During which phase of the systems development life cycle (SDLC) should the business requirements be formally documented?

Accepted Answer

Requirements phase (Planning). The business requirements for a new CRM system must be formally documented during the Requirements phase (Planning) of the SDLC. This phase establishes the functional and non-functional needs that the system must satisfy, serving as the foundation for all subsequent design, development, and testing activities. Without a formal requirements document, the project risks scope creep, misalignment with business objectives, and costly rework during later phases.

Answer

Implementation phase

Answer

Design phase

Answer

Maintenance phase

Question 4

An organization is implementing a new IT governance framework. Which of the following is a key component of the COBIT 2019 governance system?

Accepted Answer

Evaluate, Direct, Monitor. COBIT 2019 defines governance as having three key objectives: evaluate, direct, and monitor. Management objectives are grouped into domains like APO, BAI, DSS, MEA.

Answer

Plan, Do, Check, Act

Answer

Service value system

Answer

Four dimensions model

Question 5

Which TWO of the following are essential components of a business case for a new system?

Accepted Answer

Alignment with business strategy.. A business case must justify the investment in a new system by demonstrating how it supports the organization's strategic goals and provides net financial benefit. Alignment with business strategy (C) ensures the system directly enables key objectives, while cost-benefit analysis (E) quantifies the expected return on investment, making both essential for approval.

Answer

Implementation schedule.

Answer

Detailed system architecture.

Answer

Risk assessment for all identified risks.

Question 6

An organization uses a chargeback model to allocate IT costs to business units. What is a PRIMARY benefit of this approach?

Accepted Answer

Encourages responsible consumption of IT resources. Chargeback increases transparency and encourages business units to use IT resources efficiently.

Answer

Reduces total IT costs

Answer

Eliminates the need for an IT steering committee

Answer

Simplifies IT budgeting process

Question 7

In a large enterprise, the IT department uses a RACI matrix for its change management process. The change manager is responsible for executing the change, but which role is typically accountable for the success or failure of the change?

Accepted Answer

The IT director. In a RACI matrix, the accountable person (A) is ultimately answerable for the outcome. For change management, the change advisory board (CAB) or a senior manager is often accountable.

Answer

The end user representative

Answer

The system owner

Answer

The change manager

Question 8

An IS auditor is reviewing the human resources practices in the IT department. Which THREE of the following controls are most effective in reducing the risk of fraud?

Accepted Answer

Job rotation among IT roles. Job rotation (C) is effective because it prevents any single employee from maintaining exclusive control over critical IT functions over time, reducing the window for concealing fraudulent activities. By periodically rotating roles, anomalies or unauthorized actions that might otherwise go unnoticed are more likely to be detected by the incoming staff member, thereby deterring fraud.

Answer

Annual security awareness training

Answer

Background checks on new hires

Question 9

An organization is acquiring a third-party SaaS application. Which of the following should be included in the contract to ensure data protection?

Accepted Answer

Right to audit the vendor's security practices. A right to audit the vendor's security practices is essential in a SaaS contract because it allows the organization to independently verify that the vendor's controls (e.g., access management, patch management, incident response) meet contractual and regulatory requirements. Without this clause, the organization must rely solely on the vendor's self-assessments or third-party reports like SOC 2, which may not cover all relevant risks or may be outdated. This right is a key mechanism for ensuring ongoing data protection in a shared responsibility model.

Answer

Service level agreement (SLA) for uptime

Answer

Data ownership and location specification

Answer

Data encryption clause for data at rest and in transit

Question 10

An organization is implementing a business continuity plan (BCP). Which of the following is the PRIMARY purpose of conducting a business impact analysis (BIA)?

Accepted Answer

To identify critical business processes and their recovery time objectives (RTOs). The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the impact of their disruption, which directly drives the recovery time objectives (RTOs) and recovery point objectives (RPOs). These RTOs and RPOs form the foundation for selecting appropriate recovery strategies and technologies, such as synchronous replication for near-zero RPO or warm standby sites for specific RTO windows. Without a BIA, the BCP would lack the business-driven metrics needed to prioritize recovery efforts and allocate resources effectively.

Answer

To document the step-by-step recovery procedures for each system

Answer

To identify potential threats and vulnerabilities to the organization

Answer

To inventory all IT assets and their configurations

Question 11

According to ITIL 4, which guiding principle emphasizes understanding the current state before making improvements?

Accepted Answer

Start where you are. ITIL 4's guiding principle 'Start where you are' advises assessing the current state before embarking on improvements.

Answer

Progress iteratively

Answer

Focus on value

Answer

Keep it simple and practical

Question 12

An organization is developing a web application using an Agile methodology. The security team wants to integrate security testing early in the development lifecycle. Which of the following is the BEST approach to achieve this?

Accepted Answer

Implement static application security testing (SAST) in the continuous integration pipeline. Integrating SAST into the CI pipeline allows automated scanning of source code for vulnerabilities (e.g., SQL injection, XSS) as code is committed, aligning with Agile's iterative development. This shift-left approach catches flaws early, reducing remediation cost and effort compared to later stages.

Answer

Conduct a penetration test after each sprint

Answer

Schedule an annual vulnerability scan of the production environment

Answer

Perform dynamic application security testing (DAST) on deployed builds

Question 13

In a RACI matrix, the person who is ultimately accountable for a process outcome is assigned which role?

Accepted Answer

Accountable. Accountable (A) is the person ultimately answerable for the task or decision. Responsible (R) does the work.

Answer

Informed

Answer

Consulted

Answer

Responsible

Question 14

Which of the following is a key performance indicator (KPI) for IT service management?

Accepted Answer

Help desk first-call resolution rate. IT service management KPIs often include help desk metrics such as average resolution time.

Answer

Number of security incidents

Answer

Number of employees trained on security

Answer

Percentage of IT budget spent on new projects

Question 15

A company is migrating its on-premises data center to a public cloud provider. Which of the following is the MOST important control to implement before migration to ensure data security?

Accepted Answer

Implement data encryption at rest and in transit. Data encryption at rest and in transit is the most important control before migration because it protects sensitive data from exposure during the transfer process and after it is stored in the cloud. Without encryption, data could be intercepted over the network or accessed by unauthorized parties in the cloud provider's infrastructure. This control directly addresses the core risk of data leakage during and after migration, which is a fundamental security requirement.

Answer

Enable multi-factor authentication (MFA) for all cloud accounts

Answer

Deploy a cloud access security broker (CASB)

Answer

Establish a virtual private network (VPN) between on-premises and cloud