CISA Practice Test 35 — 15 Questions

Question 1

An organization has outsourced its IT operations to a third-party provider. The IS auditor is planning an audit of the outsourced services. What is the most appropriate source of audit evidence?

Accepted Answer

Service auditor's SOC 2 report. A SOC 2 report (Service Organization Control 2) is specifically designed to provide assurance over a service provider's controls related to security, availability, processing integrity, confidentiality, and privacy. It is issued by an independent service auditor and is the most reliable and relevant source of audit evidence when auditing outsourced IT operations, as it directly addresses the controls in place at the provider.

Answer

Service provider's financial statements

Answer

Interviews with provider's staff

Answer

Internal audit reports from the provider

Question 2

Which THREE are indicators of a possible data exfiltration attempt via the network? (Choose three.)

Accepted Answer

Use of unauthorized encryption or tunneling protocols. Option A is correct because attackers commonly hide stolen data inside unauthorized encryption or tunneling protocols (e.g., DNS tunneling, SSH, or custom TLS on nonstandard ports) to evade content inspection and DLP controls, making it a strong network exfiltration indicator. Option B is correct because exfiltration frequently occurs during non-business hours to avoid detection, and abnormal outbound volume spikes at those times deviate from the baseline of normal traffic behavior. Option D is correct because repeated unauthorized access attempts to sensitive databases indicate an adversary probing or harvesting data, which often precedes or accompanies exfiltration over the network. Option C is not a network exfiltration indicator; phishing emails targeting executives are an initial access or social-engineering tactic, not evidence of data leaving the network. Option E is not inherently suspicious because numerous HTTPS connections to legitimate cloud services are common in normal business operations and are only meaningful if correlated with other anomalies such as unusual volume, timing, or destination.

Answer

Increase in phishing emails targeting executives

Answer

Large number of HTTPS connections to legitimate cloud services

Question 3

A company is in the process of acquiring a new customer relationship management (CRM) system. During which phase of the systems development life cycle (SDLC) should the business requirements be formally documented?

Accepted Answer

Requirements phase (Planning). The business requirements for a new CRM system must be formally documented during the Requirements phase (Planning) of the SDLC. This phase establishes the functional and non-functional needs that the system must satisfy, serving as the foundation for all subsequent design, development, and testing activities. Without a formal requirements document, the project risks scope creep, misalignment with business objectives, and costly rework during later phases.

Answer

Implementation phase

Answer

Design phase

Answer

Maintenance phase

Question 4

Arrange the steps to set up a virtual private network (VPN) for remote access in the correct order.

Accepted Answer

Configure VPN server, Provision user accounts, Install VPN client software, Test the connection, Monitor VPN usage. VPN setup: server configuration, user provisioning, client installation, connection testing, and monitoring.

Answer

Install VPN client software, Configure VPN server, Provision user accounts, Test the connection, Monitor VPN usage

Answer

Configure VPN server, Install VPN client software, Test the connection, Provision user accounts, Monitor VPN usage

Answer

Provision user accounts, Configure VPN server, Install VPN client software, Test the connection, Monitor VPN usage

Question 5

Which TWO of the following are examples of detective controls? (Choose two.)

Accepted Answer

Regular review of security incident logs.. Option B (regular review of security incident logs) is a detective control because examining logs after events occur identifies suspicious or malicious activity that has already happened, enabling detection rather than prevention. Option C (intrusion detection system (IDS) alerts) is also detective because an IDS monitors network or host activity and raises alerts when it recognizes known attack signatures or anomalies, revealing incidents in progress or after the fact. By contrast, option A (firewall rules that block unauthorized traffic) is a preventive control, since it stops traffic before it reaches protected resources. Option D (encryption of sensitive data at rest) is preventive, protecting data confidentiality if storage is compromised. Option E (ACLs on network devices) is preventive, as it filters and permits or denies traffic to enforce access policy.

Answer

Firewall rules that block unauthorized traffic.

Answer

Encryption of sensitive data at rest.

Answer

Access control lists (ACLs) on network devices.

Question 6

Which THREE of the following are responsibilities of the board of directors regarding IT governance? (Choose three.)

Accepted Answer

Setting IT risk appetite. Option B is correct because setting the IT risk appetite is a core board-level governance responsibility: the board defines how much risk the organization is willing to accept in pursuit of its objectives, which then guides management's risk decisions. Option C is correct because reviewing IT performance is a board oversight duty — the board monitors whether IT is delivering value, meeting objectives, and staying within risk tolerances, typically through metrics and reporting. Option E is correct because approving IT strategy is a fundamental board responsibility, ensuring IT initiatives align with and support the enterprise's overall business strategy and goals. Options A and D are not board responsibilities: designing network security architecture (A) and implementing IT controls (D) are hands-on operational and technical tasks performed by IT management and staff, not by the board, which focuses on direction, oversight, and accountability rather than execution.

Answer

Designing network security architecture

Answer

Implementing IT controls

Question 7

Which of the following is the PRIMARY objective of a penetration test?

Accepted Answer

To identify vulnerabilities that could be exploited by an attacker. The primary objective of a penetration test is to identify vulnerabilities that could be exploited by an attacker, simulating real-world attack techniques to uncover weaknesses before malicious actors do. While penetration tests can inform control validation and compliance, their core purpose is offensive discovery of exploitable weaknesses, which then feeds remediation and risk management. This distinguishes them from vulnerability scans, which are automated and broader but less deep.

Answer

To test the incident response capability

Answer

To validate the effectiveness of security controls

Answer

To ensure compliance with security standards

Question 8

A large financial institution has a well-defined IT governance framework with a clear organizational structure, policies, and processes. However, the internal audit department has identified that several IT projects are over budget and behind schedule. The project managers blame unclear requirements and scope creep. The IT governance committee meets monthly but reviews projects only at a high level. The auditor's best recommendation to improve project governance is to:

Accepted Answer

Establish a project management office (PMO) to oversee project governance and reporting. Establishing a project management office (PMO) provides standardized project management practices, oversight, and controls to prevent scope creep and improve delivery. Option A is tactical and focuses on security, not project delivery. Option B changes meeting frequency but does not establish a dedicated project governance function. Option D mandates a tool but does not address underlying governance processes.

Answer

Increase the frequency of security reviews for all projects

Answer

Change the IT steering committee's meeting frequency to weekly with detailed reviews

Answer

Require all projects to use a specific project management software tool

Question 9

A large enterprise recently experienced a data breach due to an insider threat. The IT governance committee is reviewing the incident and considering measures to prevent recurrence. Which of the following is the BEST course of action to address the root cause?

Accepted Answer

Implement a privileged access management (PAM) solution to control and monitor elevated access.. A privileged access management (PAM) solution directly addresses the root cause of an insider threat by controlling, monitoring, and auditing elevated access rights. Since the breach was caused by an insider, limiting and tracking privileged accounts prevents unauthorized or excessive use of administrative credentials, which is the most effective preventive measure against recurrence.

Answer

Increase logging and auditing of all user activities.

Answer

Deploy a security information and event management (SIEM) tool.

Answer

Terminate the employment of the insider who caused the breach.

Question 10

In a waterfall SDLC, when should user acceptance testing (UAT) typically occur?

Accepted Answer

After system testing and before deployment. In a waterfall SDLC, UAT is the final validation step performed by end users after the system has been fully built and verified by the development team. System testing confirms the solution meets technical specifications, and only then do users validate it against business requirements in a production-like environment. Deployment follows only after users formally accept the system, ensuring defects are caught before go-live.

Answer

After deployment

Answer

After coding but before unit testing

Answer

During the requirements phase

Question 11

An organization is implementing a new release management process. Which TWO activities are essential components of a successful release?

Accepted Answer

Release planning. Release planning (B) is essential because it defines the scope, schedule, resources, and coordination of the release, ensuring that the release package and its deployment are agreed upon and aligned with business needs. Testing (E) is essential because the release must be validated against defined acceptance criteria and quality requirements before deployment, reducing the risk of defects or failed changes reaching production. The other options are not core release activities: service desk operations (A) handle day-to-day user support and incident intake, capacity management (C) ensures sufficient resource capacity for services, and incident management (D) restores normal service operation after disruptions, all of which are separate ITIL practices rather than essential components of a release itself.

Answer

Service desk operations

Answer

Capacity management

Answer

Incident management

Question 12

Refer to the exhibit. An application log shows an error. What is the MOST likely cause of this error?

Accepted Answer

A duplicate username was inserted into the USERS table. The error message 'Duplicate entry 'admin' for key 'PRIMARY'' indicates a violation of the PRIMARY KEY constraint on the USERS table. Since the username field is the primary key, inserting a second row with the same username (e.g., 'admin') causes MySQL to reject the INSERT operation with error code 1062. This is a unique constraint violation, not a connectivity or privilege issue.

Answer

The database server is offline

Answer

The user does not have insert privileges

Answer

The data type of the username field is incorrect

Question 13

An organization is planning to replace its legacy accounting system with a commercial off-the-shelf (COTS) software package. Which of the following is the PRIMARY risk of using a COTS solution?

Accepted Answer

The software may not fully align with the organization's business processes. The primary risk of a COTS solution is that it is designed for a broad market and may not fully align with the organization's specific business processes. This misalignment can force the organization to change its workflows or perform costly customizations, which can negate the benefits of a packaged solution and introduce project delays or failures.

Answer

The total cost of ownership is likely to be higher than custom development

Answer

The software may have inherent security vulnerabilities

Answer

Vendor support may be discontinued after a few years

Question 14

During a software asset management (SAM) audit, the IS auditor discovers that the organization is using software versions that are no longer supported by the vendor. What is the primary risk?

Accepted Answer

Exposure to security vulnerabilities without patches.. The primary risk of using unsupported software versions is the absence of vendor-provided security patches. Without these patches, known vulnerabilities remain unaddressed, exposing the organization to exploitation, data breaches, and system compromise. This directly impacts the confidentiality, integrity, and availability of information assets.

Answer

Inability to recover data from backups.

Answer

Increased licensing costs due to non-compliance.

Answer

Difficulty in migrating to new versions.

Question 15

Which TWO of the following are phases of the audit process? (Select two.)

Accepted Answer

Planning. Option B, Planning, is correct because planning is the foundational phase of the audit process, where the auditor defines the audit scope, objectives, criteria, and methodology before fieldwork begins. Option E, Reporting, is correct because reporting is the concluding phase in which the auditor documents findings, conclusions, and recommendations in the audit report for management and stakeholders. The audit process is commonly structured as planning, fieldwork/execution, and reporting, so these two options align with the recognized phase model. Option A, Budgeting, is not a distinct audit phase; budgeting is a management activity that may support planning but is not itself a phase. Option C, Risk assessment, is a technique or activity performed within the audit process (particularly during planning and fieldwork) rather than a standalone phase. Option D, Training, is an administrative or professional-development activity and is not one of the phases of the audit process.

Answer

Budgeting

Answer

Risk assessment

Answer

Training