CISA Practice Test 35 — 15 Questions

Question 1

Which COBIT 2019 governance objective describes the board's responsibility for overseeing IT?

Accepted Answer

Evaluate, Direct, and Monitor (EDM). COBIT 2019 defines the governance objective as Evaluate, Direct, and Monitor (EDM), which is the board's responsibility.

Answer

Deliver, Service, and Support (DSS)

Answer

Align, Plan, and Organize (APO)

Answer

Build, Acquire, and Implement (BAI)

Question 2

An IS auditor is reviewing the configuration for a web application. Which of the following is the MOST significant security weakness?

Accepted Answer

The authentication method is Basic. Basic authentication transmits credentials in Base64-encoded plaintext over the network, which is trivially decoded and captured by any attacker with access to the traffic. Even when used over HTTPS, the credentials are exposed in the browser's cache and server logs, making this the most significant weakness among the options.

Answer

Session timeout is set to 600 seconds (10 minutes)

Answer

The base URL uses HTTPS

Answer

Encryption uses SSL instead of TLS

Question 3

Which of the following is a principle of ISO/IEC 38500 for corporate governance of IT?

Accepted Answer

Strategy. ISO/IEC 38500 outlines six principles: responsibility, strategy, acquisition, performance, conformance, and human behavior.

Answer

Start where you are

Answer

Optimise and automate

Answer

Focus on value

Question 4

What is the primary security concern in this architecture?

Accepted Answer

Traffic between application and database servers is not encrypted. The primary security concern is that traffic between the application and database servers is not encrypted. In a typical three-tier web architecture, sensitive data such as authentication credentials, SQL queries, and result sets are transmitted in cleartext if TLS/SSL is not enforced between the application layer and the database layer. This exposes the data to eavesdropping or man-in-the-middle attacks on the internal network, which is a direct violation of the principle of defense in depth and common compliance requirements like PCI DSS or HIPAA.

Answer

Web servers are directly accessible from the internet

Answer

Database port is exposed to application servers

Answer

Lack of intrusion detection

Question 5

A company outsources its data center operations. Which IT governance practice is MOST critical to ensure the outsourcing arrangement meets business requirements?

Accepted Answer

Establishing a service level agreement (SLA) with key performance indicators. Service level management ensures that the outsourcer's performance is monitored against agreed-upon metrics.

Answer

Performing a total cost of ownership analysis

Answer

Creating a RACI matrix for the outsourced processes

Answer

Conducting background checks on outsourcer employees

Question 6

Which of the following is the BEST method to ensure that a system development project is completed on time?

Accepted Answer

A realistic project schedule with milestones. A realistic project schedule with milestones (Option B) is the best method because it establishes a time-phased plan with measurable checkpoints, enabling early detection of delays and facilitating proactive corrective actions. Without a realistic baseline, even the best tracking tools or meetings cannot prevent schedule overruns, as the schedule itself is the foundation for monitoring and controlling project progress.

Answer

Regular status meetings

Answer

Frequent scope changes

Answer

Use of a project management software

Question 7

In the context of IT governance, what is the PRIMARY purpose of an exception management process for IT policies?

Accepted Answer

To allow temporary deviations from policy under controlled conditions with appropriate approvals. Exception management allows controlled deviations from policy when required, while ensuring accountability and documentation.

Answer

To automatically update policies based on changing business needs

Answer

To provide a mechanism for employees to bypass security controls

Answer

To eliminate the need for policy compliance monitoring

Question 8

An IS auditor is reviewing the termination procedure for IT employees. Which of the following is the most critical control to ensure immediate effectiveness?

Accepted Answer

Revoking physical and logical access immediately. Immediate revocation of access rights upon termination is the most critical control to prevent unauthorized access.

Answer

Collecting company property

Answer

Notifying the IT department within 24 hours

Answer

Conducting an exit interview

Question 9

An organization uses role-based access control (RBAC) for its enterprise resource planning (ERP) system. What is the greatest risk if user role assignments are not reviewed regularly?

Accepted Answer

Privilege creep, where users retain permissions no longer needed.. In RBAC, permissions are assigned to roles, and users inherit those permissions through role membership. Without regular reviews, users may retain roles (and thus permissions) long after their job functions change, leading to privilege creep. This violates the principle of least privilege and increases the risk of unauthorized access or data breaches within the ERP system.

Answer

Inconsistent application of password policies across roles.

Answer

Increased authentication failures due to expired passwords.

Answer

Inability to track audit logs for user activity.

Question 10

During a security audit, it is discovered that a database containing customer credit card numbers is not encrypted at rest. The database is used by a legacy application that cannot be modified. Which compensating control most effectively reduces the risk?

Accepted Answer

Isolating the database server on a separate network segment with strict firewall rules. Isolating the database server on a separate network segment with strict firewall rules (e.g., using VLANs and ACLs to restrict traffic to only the legacy application’s IP and port) prevents unauthorized network-level access to the unencrypted data. This compensating control reduces the attack surface by ensuring that even if the database lacks encryption at rest, an attacker cannot reach it without first compromising the network segmentation, which is a critical defense-in-depth layer.

Answer

Enabling detailed audit logging for all database access

Answer

Requiring all users to sign a nondisclosure agreement (NDA)

Answer

Implementing dynamic data masking at the application level

Question 11

Based on the exhibit, what is the security risk of this bucket policy?

Accepted Answer

The bucket is publicly readable. The bucket policy grants public read access by setting `"Principal": "*"` and `"Effect": "Allow"` with `"Action": "s3:GetObject"`. This means any unauthenticated user on the internet can list and retrieve objects in the bucket, making it publicly readable. The policy does not require any authentication or authorization checks, which is a common misconfiguration leading to data exposure.

Answer

The bucket allows public write access

Answer

The bucket policy restricts access to a specific IAM role

Answer

The bucket policy is not encrypted

Question 12

During an information systems audit, the IS auditor finds that data classification labels are not consistently applied across the organization. What is the most likely root cause of this issue?

Accepted Answer

Insufficient training and awareness programs on data classification.. Inconsistent application of data classification labels is most commonly caused by insufficient training and awareness programs. Without proper education, users do not understand how to correctly classify data according to the policy, leading to inconsistent labeling across the organization.

Answer

The data classification policy is too complex and has too many levels.

Answer

The organization does not enforce consequences for misclassification.

Answer

Lack of automated classification tools integrated with the document management system.

Question 13

You are an IS auditor for a financial institution that processes credit card payments. The organization uses a key management system (KMS) to store encryption keys for point-of-sale (POS) data. The KMS is a hardware security module (HSM) located in a secured data center. The audit reveals that the HSM is administered by two individuals who both have full access to the HSM, including the ability to export keys. The organization has a policy requiring split knowledge and dual control for key management, but in practice, the two administrators often perform key ceremonies alone due to scheduling conflicts. The logs show that one administrator exported a key last month without the other present, and the export was approved via email by the other administrator after the fact. Which of the following is the BEST corrective action?

Accepted Answer

Configure the HSM to require two administrators to be physically present for key exports. The HSM must enforce split knowledge and dual control at the technical level, not rely on procedural compliance. By configuring the HSM to require two administrators to be physically present for key exports, the organization ensures that no single individual can export keys, directly addressing the policy violation and the log evidence of a solo export. This technical control is the most effective corrective action because it prevents the bypass of dual control even if administrators attempt to circumvent procedures.

Answer

Reduce the number of administrators to one to simplify accountability

Answer

Provide training to administrators on the importance of dual control

Answer

Implement automated key rotation every 90 days

Question 14

An organization is implementing a data loss prevention (DLP) solution. Which of the following is the MOST important step to ensure the DLP rules are effective?

Accepted Answer

Classify data based on sensitivity. Data classification is the foundational step for effective DLP rules because it defines which data is sensitive and how it should be handled. Without classification, DLP policies cannot accurately identify or enforce rules on sensitive content, leading to false positives or missed detections. Classification enables the DLP system to apply context-aware rules (e.g., regex patterns for PII, keywords for confidential documents) that align with the organization's data governance requirements.

Answer

Encrypt all data at rest

Answer

Establish an incident response team

Answer

Create user awareness training

Question 15

During user acceptance testing, a user with the above permission set cannot execute a fund transfer. What is the MOST likely reason?

Accepted Answer

Missing Write permission for transfers. The user can authenticate and access the system (since they are in user acceptance testing with the given permission set), but cannot execute a fund transfer. This indicates that the user lacks the necessary Write permission for the transfer operation, which is required to modify the database record or initiate the transaction. Without Write access, the application can read data but cannot commit the transfer, causing the operation to fail.

Answer

Incorrect username

Answer

Network connectivity issue

Answer

Database connection error