CISA Practice Test 36 — 15 Questions

Question 1

A large financial institution is developing a new online banking platform using an Agile methodology. The development team has implemented continuous integration and continuous deployment (CI/CD) pipeline. During a routine security scan, the IS auditor discovers that a developer accidentally committed a configuration file containing database credentials into the public-facing code repository. The credentials were exposed for 48 hours before being detected. Which of the following is the most critical control failure that allowed this incident to occur?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CI/CD pipeline lacked automated secrets scanning and static application security testing (SAST). The most critical failure is the absence of automated secret scanning and SAST in the CI/CD pipeline. Such tools would have detected the credentials immediately upon commit and prevented their exposure. While code review, training, and access controls are important, automated scanning is a preventive detective control that operates at the speed of development. Without it, human errors can go unnoticed. Option A (code review) is a manual process that can miss subtle commits. Option C (training) is a soft control and does not prevent the act. Option D (permissions) might reduce the scope but does not catch the initial mistake.

Answer

The code review process did not catch the sensitive data in the commit

Answer

The repository access permissions were too permissive

Answer

The security awareness training for developers was inadequate

Question 2

An organization uses role-based access control (RBAC). An employee is transferred to a new department. According to best practices, what should be done regarding the employee's access rights?

Accepted Answer

Immediately revoke all previous access and assign new role permissions.. RBAC mandates that access rights are strictly tied to job functions. When an employee changes departments, their previous role permissions are no longer applicable and must be immediately revoked to prevent unauthorized access, while new role permissions are granted to align with their new responsibilities. This follows the principle of least privilege and ensures that access rights are always current with the employee's role.

Answer

Remove access to the previous department's resources after a grace period.

Answer

Keep all access but log usage.

Answer

Keep previous access and grant new role permissions.

Question 3

Which of the following are key considerations when implementing a data classification policy? (Choose THREE.)

Accepted Answer

Definition of classification categories. Defining classification categories (e.g., Public, Internal, Confidential, Restricted) is the foundational step in a data classification policy. These categories establish the criteria for labeling and handling data based on sensitivity and criticality, directly enabling consistent protection controls across the organization.

Answer

Encryption key management

Answer

Backup frequency requirements

Question 4

Which THREE of the following are typical objectives of an IT governance framework for system acquisition?

Accepted Answer

Risk management. Risk management (A) is a core objective of an IT governance framework for system acquisition because it ensures that risks related to system procurement, such as vendor lock-in, security vulnerabilities, and compliance gaps, are identified, assessed, and mitigated before deployment. Strategic alignment (B) ensures that the acquired system supports the organization's business goals and IT strategy, preventing investment in technology that does not deliver business value. Value delivery (C) focuses on optimizing costs and benefits throughout the system lifecycle, ensuring that the acquisition provides measurable returns and meets performance targets.

Answer

Resource management

Answer

Cost reduction

Question 5

Which TWO of the following are essential controls to ensure data integrity during a cloud migration project?

Accepted Answer

Implementing encryption at rest and in transit. Encryption at rest and in transit (Option B) is essential for maintaining data integrity during cloud migration because it prevents unauthorized modification or corruption of data while stored in the source or target systems and while being transferred over networks. Without encryption, data is vulnerable to tampering, which directly undermines integrity. This control aligns with the principle of protecting data throughout its lifecycle, a key requirement in cloud migration projects.

Answer

Granting all migration team members full database access

Answer

Using a phased migration approach without rollback capability

Answer

Performing a single full data validation after migration

Question 6

An IS auditor is auditing the user access management process for a large healthcare organization that uses an electronic health records (EHR) system. The organization has 5,000 users including doctors, nurses, and administrative staff. The auditor reviews a sample of access requests and finds that 20% of the requests were approved by the user's manager but the approval was not documented in the system. The auditor also finds that there is no periodic review of user access rights. The IT security manager states that users are automatically provisioned based on their role in the HR system, and that access reviews are performed manually by managers but not documented. What is the auditor's BEST recommendation to address the most significant risk?

Accepted Answer

Implement an automated access recertification process with quarterly reviews.. The most significant risk is the lack of periodic review of user access rights, which can lead to excessive or inappropriate access (e.g., a former nurse retaining EHR access). Automating access recertification with quarterly reviews directly addresses this by enforcing a regular, documented validation of user entitlements against their current roles, reducing the risk of unauthorized access to protected health information (PHI) under HIPAA. While the undocumented approvals are a control weakness, the absence of any review cycle is a systemic failure that automated recertification resolves.

Answer

Disable automatic provisioning and require manual approval for all access.

Answer

Require that all access approvals be documented and stored in the system.

Answer

Perform a risk assessment to determine appropriate access controls.

Question 7

An organization is planning to deploy a web application firewall (WAF) to protect a critical application. Which deployment mode should be used to ensure that the WAF can block malicious traffic without introducing a single point of failure?

Accepted Answer

Inline with high-availability clustering.. Inline with high-availability clustering ensures the WAF can actively inspect and block malicious traffic in real time while eliminating a single point of failure through automatic failover between clustered appliances. This mode maintains traffic flow even if one WAF node fails, meeting both security and availability requirements.

Answer

Out-of-band monitoring only.

Answer

Transparent inline without failover.

Answer

Reverse proxy with active-passive clustering.

Question 8

An IS auditor reviews the exhibit. Which of the following is the most likely cause of the denied traffic?

Accepted Answer

Missing firewall rule allowing RDP traffic. The exhibit shows RDP traffic (TCP/3389) being denied at the firewall. Since the traffic reaches the firewall but is blocked, the most likely cause is a missing firewall rule that explicitly permits RDP traffic. A misconfigured VPN tunnel would typically prevent traffic from reaching the firewall at all, while an IPS block would generate an alert and often target specific signatures, not a blanket deny. Incorrect NAT would affect address translation but not cause a deny action at the firewall.

Answer

Misconfigured VPN tunnel

Answer

Intrusion prevention system blocking

Answer

Incorrect NAT configuration

Question 9

An IT manager is reviewing the access control model for a financial application. The policy requires that no single person can approve a transaction. Which access control principle does this policy enforce?

Accepted Answer

Separation of duties. The policy that no single person can approve a transaction enforces the separation of duties (SoD) principle. In financial applications, SoD requires that critical tasks, such as initiating and approving a transaction, be divided among multiple individuals to prevent fraud or error. This control ensures that no single user has the authority to complete a high-risk action alone, directly aligning with the requirement stated.

Answer

Least privilege

Answer

Mandatory access control

Answer

Need to know

Question 10

During an audit of a privileged access management (PAM) system, the auditor finds that privileged sessions are recorded but not reviewed. What is the primary risk?

Accepted Answer

Missing evidence of malicious activity after an incident.. Recording privileged sessions without review means that while a log of activities exists, it is not analyzed for signs of compromise or policy violations. The primary risk is that after a security incident, the recorded sessions may be the only source of evidence to reconstruct the attack, but without prior review, the organization may fail to identify malicious activity in a timely manner or may lose critical forensic data if logs are overwritten or deleted before an incident is discovered.

Answer

Inability to detect real-time threats.

Answer

Increased administrative overhead.

Answer

Non-compliance with licensing agreements.

Question 11

A security review of the above Apache configuration identifies a critical vulnerability. Which of the following is the MOST significant issue?

Accepted Answer

Directory listing is enabled (Indexes option). The Indexes option in Apache enables directory listing, which exposes the entire contents of a directory when no index file (e.g., index.html) is present. This can reveal sensitive files, configuration backups, or source code, making it a critical information disclosure vulnerability. Unlike other options, Indexes directly leads to unauthorized data exposure without requiring any additional conditions.

Answer

Default DocumentRoot path is used

Answer

AllowOverride All allows .htaccess overrides

Answer

Require all granted permits all access

Question 12

An organization has outsourced its IT operations to a third-party provider. The IS auditor is planning an audit of the outsourced services. What is the most appropriate source of audit evidence?

Accepted Answer

Service auditor's SOC 2 report. A SOC 2 report (Service Organization Control 2) is specifically designed to provide assurance over a service provider's controls related to security, availability, processing integrity, confidentiality, and privacy. It is issued by an independent service auditor and is the most reliable and relevant source of audit evidence when auditing outsourced IT operations, as it directly addresses the controls in place at the provider.

Answer

Service provider's financial statements

Answer

Interviews with provider's staff

Answer

Internal audit reports from the provider

Question 13

Which TWO of the following are essential elements of a business continuity plan (BCP) for a newly developed system?

Accepted Answer

Recovery time objectives (RTOs). Recovery time objectives (RTOs) are essential because they define the maximum acceptable downtime for the system, directly driving the design of backup and recovery strategies. Without RTOs, the BCP cannot prioritize recovery actions or allocate resources effectively, making them a foundational element for any newly developed system.

Answer

Testing schedule for the BCP

Answer

List of incident response team members

Answer

Detailed system architecture

Question 14

Refer to the exhibit. A tester executes test case TC-101 and records the result shown. What is the NEXT appropriate step in the testing process?

Accepted Answer

Log a defect in the defect tracking system. The tester executed TC-101 and observed a result that deviates from the expected behavior, indicating a defect. The immediate next step in the structured testing process is to log the defect in the defect tracking system to formally document the issue, assign severity, and initiate the resolution workflow. This aligns with the CISA testing lifecycle, where defects are captured before any re-testing or requirement changes.

Answer

Re-run the test case after the defect is fixed

Answer

Create a new test case to cover the error

Answer

Update the requirements to reflect the actual behavior

Question 15

During a penetration test, a tester discovers that an application stores passwords using a reversible encryption algorithm. Which of the following is the BEST remediation?

Accepted Answer

Implement a strong one-way hashing algorithm such as bcrypt. Storing passwords using reversible encryption is fundamentally flawed because any encryption key can be compromised, allowing an attacker to decrypt all passwords. The best remediation is to use a strong, one-way hashing algorithm like bcrypt, which is designed to be computationally expensive and includes a built-in salt to resist rainbow table attacks and brute-force attempts. Unlike encryption, hashing is irreversible, so even if the database is breached, the original passwords cannot be recovered.

Answer

Use MD5 hashing with a salt

Answer

Replace the encryption algorithm with AES-256

Answer

Add a random salt before encryption