CISA Practice Test 35 — 15 Questions

Question 1

Refer to the exhibit. An IS auditor is reviewing firewall logs and notices repeated denied SSH attempts from an internal host (10.0.1.50) to a server (172.16.0.1). After the denied attempts, the host initiates permitted HTTPS connections to another server (172.16.0.5). Which of the following is the BEST interpretation of this pattern?

Accepted Answer

The host may be attempting to bypass security controls by using different protocols. The pattern of denied SSH attempts followed by successful HTTPS connections suggests the internal host is probing for an open SSH service and, when blocked, switches to an allowed protocol (HTTPS) to communicate with a different server. This behavior indicates an attempt to bypass security controls by leveraging a permitted protocol after initial reconnaissance or direct access attempts fail. The firewall logs show the host adapts its method, which is a classic indicator of protocol hopping or tunneling attempts.

Answer

The firewall rule 101 is misconfigured and blocking legitimate traffic

Answer

The host is performing reconnaissance and has mapped allowed services

Answer

The host successfully accessed server 172.16.0.1 via SSH

Question 2

An IS auditor is reviewing the audit follow-up process. The auditor notes that management has implemented corrective actions for 80% of previous audit findings. What should the auditor conclude?

Accepted Answer

Further investigation of outstanding findings is needed. An 80% closure rate indicates that 20% of findings remain unresolved. ISACA standards require auditors to verify that all high-risk findings are remediated before concluding on control effectiveness. Without evidence that the outstanding 20% are low-risk or have an accepted risk, the auditor must investigate further to ensure residual risk is within the organization's appetite.

Answer

The audit scope was too narrow

Answer

The audit process is effective

Answer

Management is compliant with all recommendations

Question 3

An IS auditor is reviewing the logical access controls of a financial application. Which of the following is the BEST way to verify that user access rights are appropriate?

Accepted Answer

Compare the user access rights with the job descriptions and responsibilities.. Option D is correct because comparing user access rights directly against job descriptions and responsibilities is the most effective method to verify that access is appropriate based on the principle of least privilege. This approach ensures that each user's permissions align with their actual job functions, which is the core objective of a logical access control review. Interviewing or reviewing lists alone does not validate the appropriateness of access against business roles.

Answer

Interview the IT security manager about the access control process.

Answer

Review the access control list for each user.

Answer

Re-perform a sample of transactions to detect unauthorized access.

Question 4

Refer to the exhibit. An IS auditor is reviewing backup error logs. The error indicates a failed backup due to a missing file. What is the MOST likely cause?

Accepted Answer

A file in the source volume was moved or deleted during the backup window. The error indicates a failed backup due to a missing file. The most likely cause is that a file in the source volume was moved or deleted during the backup window. Backup processes that use file-level snapshots or open-file managers (e.g., Volume Shadow Copy Service on Windows) capture a point-in-time view; if a file is moved or deleted after the snapshot is taken but before it is read by the backup agent, the backup will fail with a 'missing file' error. This is a classic race condition in file-level backups without proper snapshot consistency.

Answer

The backup job was scheduled during peak hours causing timeout

Answer

The destination path '\BackupServer01\Backup\Shares' is invalid

Answer

Insufficient disk space on the backup destination

Question 5

You are an information security manager for a global financial services company. The organization maintains a hybrid infrastructure with critical customer data stored on an on-premises Oracle database server (DB-SRV-01) and in an AWS S3 bucket (customer-data-prod). At 10:00 AM, the security operations center (SOC) alerts you to an anomalous outbound data transfer from DB-SRV-01 to an unknown IP address in a high-risk country. The transfer started at 9:45 AM and involves 500 MB of data, likely including personally identifiable information (PII). The SOC has already quarantined the server's network egress by blocking all outbound traffic from DB-SRV-01, but the server remains connected to the internal production network. Meanwhile, a separate analysis indicates that the S3 bucket has been accessed via an IAM key that was stolen from a compromised developer workstation three days ago. The key has not been rotated. The incident response team is preparing to act. The primary objective is to protect information assets and minimize data exposure. Given this scenario, which of the following actions should the team take FIRST?

Accepted Answer

Isolate DB-SRV-01 from the internal network by disconnecting its network cable or disabling the virtual switch port.. Option C is correct because immediately isolating the affected server from the internal network is the most critical first step to prevent lateral movement and further data exfiltration. Option A is incorrect because patching the server without understanding the attack vector could destroy forensic evidence and may not address the active compromise. Option B is incorrect because notifying the data protection authority is a legal requirement but not an immediate containment action. Option D is incorrect because restoring from backup would eliminate any forensic evidence and may reintroduce the same vulnerability, and it does not address the S3 bucket issue.

Answer

Restore DB-SRV-01 from a clean backup taken before the incident and change the IAM keys for the S3 bucket.

Answer

Notify the appropriate data protection authority within the required 72-hour timeframe.

Answer

Patch the Oracle database server to the latest version to close any known vulnerabilities.

Question 6

A financial institution recently experienced a data breach where an attacker exfiltrated customer data through an SQL injection vulnerability in a web application. The IS auditor has been asked to review the application security controls. The web application is developed in-house and runs on an application server behind a web application firewall (WAF). The auditor reviews the WAF logs and finds that no SQL injection attacks were detected before the breach, but the logs show many blocked XSS attempts. The developer states that all input validation is performed on the client side using JavaScript. During the audit, the auditor also finds that the application uses a shared database account with DBA privileges for all connections. What is the MOST significant weakness that directly contributed to the breach?

Accepted Answer

Client-side input validation is insufficient and server-side validation is missing.. Option B is correct because client-side validation is easily bypassed, and lack of server-side validation allowed SQL injection. Option A is possible but not confirmed. Option C is a weakness but not the direct cause of SQLi. Option D is not supported by evidence.

Answer

The use of a shared DBA database account violates the principle of least privilege.

Answer

The WAF is misconfigured to detect only XSS attacks but not SQL injection.

Answer

The application server is not patched against known SQL injection vulnerabilities.

Question 7

A medium-sized e-commerce company recently suffered a ransomware attack that encrypted critical databases. The IT team restored systems from backups, but the incident exposed a lack of clear roles and responsibilities for incident response. The board has asked the IT governance committee to review and improve the incident response governance. The committee notes that while there is an incident response policy, it is not regularly tested, and staff are unsure of their roles. The company also lacks a formal communication protocol for notifying stakeholders. What should the committee prioritize to strengthen governance over incident response?

Accepted Answer

Define and communicate clear roles and responsibilities for incident response, and establish accountability.. Option A is correct because a governance framework must include clear roles, responsibilities, and accountability, which is the root cause. Option B is wrong because technology alone does not fix governance gaps. Option C is wrong while testing is valuable, it should follow role definition. Option D is wrong because outsourcing does not address internal governance deficiencies.

Answer

Invest in advanced endpoint detection and response tools.

Answer

Outsource incident response to a managed security service provider.

Answer

Conduct a tabletop exercise to test the current plan.

Question 8

A financial services company is migrating its core banking system to a public cloud to improve scalability and reduce costs. The project is high-risk due to regulatory compliance requirements (e.g., data residency, audit trails). The IT governance committee has reviewed the project plan and finds that the risk assessment is incomplete – it does not address the potential impact of a cloud provider outage on critical transactions. The committee must approve the project or request changes. The project manager argues that the cloud provider's SLA guarantees 99.99% uptime and that additional controls would delay the project. What should the governance committee do?

Accepted Answer

Request a revised risk assessment that includes contingency plans for provider outages.. Option D is correct because the committee's duty is to ensure risks are adequately addressed; requiring a comprehensive risk assessment and contingency plans is necessary. Option A is wrong because committees should not bypass governance processes. Option B is wrong because SLAs do not cover all risks (e.g., data residency). Option C is wrong because a pilot does not address the missing assessment.

Answer

Reject the project and require the system to remain on-premises.

Answer

Approve the project based on the provider's strong SLA.

Answer

Approve a pilot migration for non-critical systems first.

Question 9

A multinational corporation operates in a highly regulated industry. The IT governance framework includes a risk appetite statement approved by the board. Recently, the company suffered a significant data breach due to an unpatched vulnerability that had been identified three months earlier. The IT audit found that the vulnerability was reported to the IT department but was not prioritized for remediation because it was deemed low risk by the IT operations team. The incident response plan was not activated because the breach was not initially detected. The board wants to strengthen governance to prevent recurrence. The most effective course of action for the auditor to recommend is:

Accepted Answer

Establishing a formal vulnerability management policy that requires risk-based prioritization in accordance with the risk appetite and escalation to the IT risk committee for decisions outside tolerance. Option D is correct because integrating vulnerability management with risk governance ensures that risk decisions are made according to the approved risk appetite, not solely by IT operations. Option A is too narrow. Option B addresses incident detection but not the governance gap. Option C is reactive and does not prevent future occurrences.

Answer

Deploying an intrusion detection system to identify breaches sooner

Answer

Disciplining the IT operations team for not escalating the vulnerability

Answer

Implementing a more robust patch management system with automated patching

Question 10

A government agency has an IT governance framework that includes an IT strategy committee, an IT steering committee, and a project management office. Despite this, there is a lack of transparency regarding IT spending and resource allocation. The agency's annual audit found that several IT initiatives were not approved by the steering committee and were funded out of operational budgets. The CFO is frustrated because IT costs are unpredictable. The agency's chief information officer (CIO) reports to the CFO but the IT steering committee is chaired by the CIO. The auditor's best recommendation to improve governance is to:

Accepted Answer

Change the steering committee chair to a senior business executive independent of IT. Option B is correct because having an independent steering committee chair (e.g., a business executive) ensures checks and balances and prevents the CIO from bypassing governance. Option A addresses approval but does not fix the conflict of interest. Option C is a policy change that can be ignored without structural change. Option D focuses on cost allocation but not the root cause of governance bypass.

Answer

Establish a chargeback system to allocate IT costs to business units

Answer

Require all IT projects to submit a business case to the steering committee for approval

Answer

Implement a policy that prohibits funding IT projects from operational budgets without steering committee approval

Question 11

A medium-sized manufacturing company has recently deployed an ERP system to integrate its financial, supply chain, and HR processes. The IT department is small (5 staff) and reports to the CFO. The company has no formal IT governance committee; IT decisions are made by the CFO and CEO informally. During a recent audit, it was found that several critical security patches for the ERP system have not been applied, and there are no documented procedures for change management. The IT manager states that patches are applied when time permits, and changes are discussed via email. The CFO argues that the ERP is running fine and the audit findings are low risk. The IS auditor needs to recommend a course of action to improve IT governance. Which of the following is the MOST appropriate initial step?

Accepted Answer

Recommend the formation of an IT steering committee comprising key business stakeholders to oversee IT strategy, risk, and resource allocation. Option A is correct because the fundamental issue is the lack of governance structure; establishing an IT steering committee with business representation ensures that IT decisions are aligned with business needs and risks are properly evaluated. Option B is premature because without governance, there is no process to prioritize patches. Option C is too narrow; it addresses only patches, not the underlying governance gap. Option D is incorrect because pushing the auditor's own opinion may create conflict and does not establish a sustainable governance process.

Answer

Elevate the issue to the board of directors with a recommendation to outsource IT management

Answer

Develop a comprehensive patch management policy and present it to the CFO for approval

Answer

Insist that the IT manager immediately apply all missing patches within one week

Question 12

A small manufacturing company uses a network-attached storage (NAS) device to store design files, financial records, and employee data. The NAS is backed up weekly to an external hard drive that is stored in the same office. The company has no encryption on the NAS or the backup drive. One weekend, the office is burglarized, and both the NAS and the backup drive are stolen. The company had no remote backup. Which of the following would have best protected the data in this scenario?

Accepted Answer

Enabling full-disk encryption on the NAS. Full-disk encryption (FDE) on the NAS would render the data unreadable without the decryption key, even if the physical device is stolen. Since the backup drive was also unencrypted and stored in the same location, both were equally vulnerable. FDE protects data at rest, which is the primary risk in a theft scenario where physical access is obtained.

Answer

Implementing strong passwords and user authentication on the NAS

Answer

Storing a backup offsite in a secure location

Answer

Installing a security camera and alarm system

Question 13

A small manufacturing company decides to acquire an off-the-shelf inventory management system. The purchasing manager selects a vendor based solely on the lowest price, ignoring the vendor's financial stability and support history. After purchase, the vendor declares bankruptcy, leaving the company without support. The system has a critical bug that halts inventory tracking. The IT manager considers hiring a consultant to fix the bug. As an IS auditor, what should the auditor's PRIMARY concern be?

Accepted Answer

The vendor selection process lacked due diligence.. The primary concern for an IS auditor is that the vendor selection process lacked due diligence, as this directly violates the principle of proper acquisition governance. By selecting a vendor based solely on lowest price without evaluating financial stability and support history, the company exposed itself to significant operational risk, which materialized when the vendor declared bankruptcy. This oversight is a root cause failure in the information systems acquisition and implementation process, making it the most critical audit finding.

Answer

There is no backup system for inventory management.

Answer

The company may have legal recourse against the vendor.

Answer

The critical bug disrupts inventory tracking.

Question 14

A university is implementing a new student information system. The project team uses an iterative development approach. During user acceptance testing, students report that the online course registration portal crashes when more than 100 users register simultaneously. The development team identifies a database connection pooling issue and estimates a fix will take three weeks. The project deadline is in two weeks. The project manager suggests deploying the system as is and fixing the issue after go-live, as the crash is rare. The IS auditor is consulted. What should the auditor recommend?

Accepted Answer

Delay the go-live until the defect is fixed and user acceptance testing is passed.. Option A is correct because deploying a system with a known critical defect that fails under expected load conditions violates the principle of delivering a reliable and secure system. The database connection pooling issue causes the portal to crash under concurrent user load, which is a functional failure that directly impacts business operations. Delaying go-live ensures the defect is fixed and user acceptance testing (UAT) is fully passed, aligning with the IS auditor's responsibility to recommend risk mitigation over acceptance of a preventable failure.

Answer

Document the risk and proceed with the go-live, planning to fix later.

Answer

Deploy on time but restrict registration to fewer than 100 students per session.

Answer

Implement a temporary increase in server capacity to handle the load.

Question 15

A large financial institution is developing a new online banking platform using an Agile methodology. The development team has implemented continuous integration and continuous deployment (CI/CD) pipeline. During a routine security scan, the IS auditor discovers that a developer accidentally committed a configuration file containing database credentials into the public-facing code repository. The credentials were exposed for 48 hours before being detected. Which of the following is the most critical control failure that allowed this incident to occur?

Accepted Answer

The CI/CD pipeline lacked automated secrets scanning and static application security testing (SAST). The most critical failure is the absence of automated secret scanning and SAST in the CI/CD pipeline. Such tools would have detected the credentials immediately upon commit and prevented their exposure. While code review, training, and access controls are important, automated scanning is a preventive detective control that operates at the speed of development. Without it, human errors can go unnoticed. Option A (code review) is a manual process that can miss subtle commits. Option C (training) is a soft control and does not prevent the act. Option D (permissions) might reduce the scope but does not catch the initial mistake.

Answer

The code review process did not catch the sensitive data in the commit

Answer

The repository access permissions were too permissive

Answer

The security awareness training for developers was inadequate

CISA Practice Test 35 — 15 Questions

Exhibit

CISA Practice Test 35 — 15 Questions

Exhibit