CISA Practice Test 36 — 15 Questions

Question 1

An IS auditor is auditing the user access management process for a large healthcare organization that uses an electronic health records (EHR) system. The organization has 5,000 users including doctors, nurses, and administrative staff. The auditor reviews a sample of access requests and finds that 20% of the requests were approved by the user's manager but the approval was not documented in the system. The auditor also finds that there is no periodic review of user access rights. The IT security manager states that users are automatically provisioned based on their role in the HR system, and that access reviews are performed manually by managers but not documented. What is the auditor's BEST recommendation to address the most significant risk?

Accepted Answer

Implement an automated access recertification process with quarterly reviews.. The most significant risk is the lack of periodic review of user access rights, which can lead to excessive or inappropriate access (e.g., a former nurse retaining EHR access). Automating access recertification with quarterly reviews directly addresses this by enforcing a regular, documented validation of user entitlements against their current roles, reducing the risk of unauthorized access to protected health information (PHI) under HIPAA. While the undocumented approvals are a control weakness, the absence of any review cycle is a systemic failure that automated recertification resolves.

Answer

Disable automatic provisioning and require manual approval for all access.

Answer

Require that all access approvals be documented and stored in the system.

Answer

Perform a risk assessment to determine appropriate access controls.

Question 2

An IS auditor is conducting an audit of a small manufacturing company's IT operations. The company has 50 employees and uses a single server running Windows Server 2019 for file sharing and print services. There is no formal change management process. The IT manager, who also doubles as the system administrator, has full administrative rights and is the only person who can make changes to the server. During the audit, the auditor notices that the server's local security policy is configured to allow unlimited password attempts and no account lockout. The IT manager states that this is to avoid locking out users who forget their passwords. The auditor also finds that the guest account is enabled on the server. What should the auditor recommend as the HIGHEST priority action?

Accepted Answer

Disable the guest account and enforce account lockout policy.. Option A is correct because the most immediate vulnerabilities are the enabled guest account and lack of lockout, which increase risk of unauthorized access. Option B is important but less urgent. Option C is a broader governance issue. Option D is too general.

Answer

Train employees on password security.

Answer

Implement a formal change management process.

Answer

Separate the roles of IT manager and system administrator.

Question 3

A financial institution operates a critical payment processing system that must maintain 99.999% availability. The system is deployed across two data centers in active-active mode with load balancing. During a routine maintenance window, a network misconfiguration caused all traffic to be directed to one data center, which then became overloaded and crashed, resulting in 30 minutes of downtime. The incident response team wants to prevent recurrence. Which of the following is the BEST action?

Accepted Answer

Configure health checks on the load balancers to detect and isolate unhealthy nodes.. Option B is correct because health checks on load balancers can automatically detect an overloaded node and redirect traffic to the healthy one. Option A assumes a failover mechanism that is not needed in active-active. Option C is costly and does not prevent similar misconfigurations. Option D does not address the technical root cause.

Answer

Schedule all maintenance during non-peak hours only.

Answer

Increase the capacity of each data center to handle full traffic load.

Answer

Implement automatic failover to the backup data center when a threshold is exceeded.

Question 4

A multinational organization operates a critical ERP system on a virtualized infrastructure across two data centers (primary and DR). The primary data center is located in Region A, and the DR site in Region B, 500 km away. The ERP database is 2 TB and changes at an average rate of 10 MB per second. The organization uses synchronous replication between the two sites over a dedicated 10 Gbps WAN link. During a recent disaster simulation, the IT team observed that the replication link experienced 15 ms latency, causing the primary database to slow down significantly under peak load, ultimately missing the defined RTO of 4 hours for full failover. The business has an RPO of 15 minutes. The CISO asks the IS auditor to recommend a solution that balances cost and performance while meeting both RTO and RPO. Which of the following is the BEST course of action?

Accepted Answer

Change replication to asynchronous mode and implement continuous data protection (CDP) to meet the 15-minute RPO.. Synchronous replication over long distance introduces latency that degrades primary performance. Changing to asynchronous replication with continuous data protection (CDP) can meet the 15-minute RPO without impacting the primary site. Upgrading bandwidth does not reduce latency; backup-to-disk with hourly logs may not meet RPO due to potential data loss; reducing RPO changes the business requirement unacceptably.

Answer

Reduce the RPO to 30 minutes and perform snapshots every 30 minutes on the primary site.

Answer

Upgrade the WAN link to 40 Gbps to reduce latency and improve replication throughput.

Answer

Implement a backup-to-disk solution with daily full backups and hourly transaction log backups to the DR site.

Question 5

A healthcare organization is required to comply with HIPAA regulations for data backup and disaster recovery. They operate a primary data center and a colocation facility for disaster recovery. The current backup strategy involves nightly full backups to tape, which are stored off-site monthly. The recovery time for the electronic health record (EHR) system is estimated at 8 hours, but the RTO required by the business is 2 hours. Additionally, the RPO requirement is 15 minutes. The IT manager proposes implementing a continuous data protection (CDP) solution. However, the CFO is concerned about the cost. Which of the following is the BEST argument to justify the CDP investment?

Accepted Answer

CDP can achieve an RPO of seconds and significantly reduce recovery time.. Option A is correct because CDP provides near-zero RPO and can significantly reduce recovery time, directly meeting the RTO and RPO requirements. Option B is false; CDP still requires off-site storage for disaster recovery. Option C is incorrect; HIPAA does not mandate CDP. Option D is a benefit but not the primary justification.

Answer

CDP is required by HIPAA for all healthcare systems.

Answer

CDP will reduce the need for IT staff to perform backups.

Answer

CDP eliminates the need for any off-site storage, reducing costs.

Question 6

A medium-sized retail company relies on an ERP system for order processing and inventory management. The system is hosted on-premises with daily backups stored on tape. The company's business continuity plan specifies an RTO of 4 hours and an RPO of 1 hour for the ERP system. During a recent fire drill, it was discovered that restoring the ERP system from tape took over 6 hours, and the most recent backup was from the previous day. Which of the following is the BEST course of action to meet the RTO and RPO goals?

Accepted Answer

Implement a hot standby site with real-time replication.. Option A is correct because a hot standby site with real-time replication can achieve an RPO near zero and an RTO within 4 hours. Option B reduces RPO but does not improve the long restore time. Option C increases RPO to days, which is worse. Option D does not address the recovery capability.

Answer

Increase the frequency of tape backups to every 30 minutes.

Answer

Conduct quarterly fire drills instead of annually.

Answer

Replace tape backups with weekly cloud backups.

Question 7

A small e-commerce company uses a cloud-based e-commerce platform with automatic scaling. The company's business continuity plan relies on the cloud provider's promise of 99.99% uptime. During a regional outage affecting the cloud provider's primary availability zone, the company's website became unavailable for 2 hours, resulting in lost sales. The IT manager wants to improve resilience. Which of the following is the BEST action?

Accepted Answer

Implement a multi-cloud strategy with active-active deployment.. Option B is correct because deploying across multiple cloud providers (multi-cloud) with active-active configuration can withstand a single provider's regional outage. Option A only improves compensation, not availability. Option C is less scalable and may not integrate well. Option D helps with scaling but not with provider failure.

Answer

Maintain a secondary on-premises server for failover.

Answer

Increase the reserved capacity in the cloud to handle spikes.

Answer

Negotiate a higher service-level agreement (SLA) with the provider.

Question 8

A multinational manufacturing company with operations in 20 countries has historically allowed each regional division to manage its own IT systems independently. Recently, the company experienced a significant data breach originating from a region with weaker security controls, leading to financial losses and reputational damage. The board has mandated stronger IT governance to prevent future incidents. The CIO proposes implementing a global IT governance framework with centralized policy enforcement. However, regional directors argue that local regulations and business needs require autonomy. The governance committee must decide on a course of action that balances risk and business flexibility. Which of the following approaches is the MOST appropriate?

Accepted Answer

Adopt a federated governance model with global policies and local flexibility within defined tolerances.. Option C is correct because a federated model allows consistent governance at the top while permitting regional adaptations within defined boundaries, balancing control and flexibility. Option A is wrong because a fully centralized model may ignore local constraints and hinder business. Option B is wrong because the committee should not delegate entirely; the board expects governance. Option D is wrong because minimum standards are insufficient; a stronger framework is needed after a breach.

Answer

Allow each region to continue independently but require quarterly reporting to the committee.

Answer

Implement a fully centralized IT governance model with no regional deviations.

Answer

Maintain the status quo but enforce minimum security standards across all regions.

Question 9

A medium-sized financial services firm recently suffered a ransomware attack that encrypted critical servers and backups. The recovery process took three weeks because the backup tapes were stored in the same building (which was also infected) and the backup software had a vulnerability that allowed the ransomware to delete old backups. The firm's BCP did not account for simultaneous loss of primary and secondary data. As the IS auditor, you are asked to recommend the most effective improvement to the backup strategy to prevent recurrence and improve resilience. Which of the following actions should the firm implement?

Accepted Answer

Implement immutable backups and store them offsite or in a separate air-gapped environment. Immutable backups prevent modification or deletion by ransomware, even if the backup software or administrative credentials are compromised. Storing them offsite or in an air-gapped environment ensures that a simultaneous physical or logical attack cannot destroy both primary and secondary data, directly addressing the root cause of the three-week recovery delay.

Answer

Increase the frequency of full backups to daily

Answer

Conduct quarterly tabletop exercises to test recovery procedures

Answer

Move all backups to a cloud storage provider with default settings

Question 10

An organization has recently implemented a cloud-based identity provider (IdP) for single sign-on (SSO) across all SaaS applications. Users authenticate using their corporate credentials via SAML 2.0. After a week, the IT security team notices a significant increase in failed login attempts from various IP addresses targeting a specific user account. The helpdesk reports that the user, a senior executive, has not complained about any issues. The security team investigates and finds that the account lockout policy is set to 5 failed attempts within 15 minutes, after which the account is locked for 30 minutes. The failed attempts are occurring in bursts of 4, then stopping, then resuming from different IPs. The organization uses conditional access policies that require MFA from unknown locations. However, the failed attempts appear to be stopped at the authentication prompt and never reach the MFA stage. What is the most likely explanation and the best course of action?

Accepted Answer

The attacker is performing a password spraying attack, attempting to guess the password for that specific account. The organization should implement a CAPTCHA requirement after a few failed attempts.. Option C is correct because the attack pattern—bursts of exactly 4 failed attempts (just below the lockout threshold of 5) from different IPs, then stopping—is a textbook password spraying attack. The attacker is trying commonly used passwords against a high-value account (senior executive) while deliberately avoiding account lockout to remain undetected. Since the attempts stop at the SAML authentication prompt and never reach MFA, the attacker is testing passwords against the IdP's SAML endpoint, which validates credentials before triggering conditional access policies.

Answer

The user's credentials have been compromised, and the attacker is testing them across the IdP. The organization should immediately force a password reset for the user and enable MFA for all users.

Answer

A misconfiguration in the IdP allows pre-authentication enumeration. The organization should disable account lockout and implement rate limiting at the application proxy.

Answer

The IdP is experiencing integration issues with the AD domain controller, causing authentication failures that are logged as failed attempts. The organization should check the synchronization status and network connectivity.

Question 11

A software development company uses a cloud-based source code repository (e.g., GitHub) to store proprietary code. The company has two-factor authentication (2FA) enabled for all accounts. A developer's personal computer was infected with malware that stole the developer's session cookies and local credentials. The attacker used the stolen session to access the code repository and exfiltrated the entire codebase. The company's security team reviews the incident and notes that the repository has audit logging, but the logs were not monitored in real time. The team wants to implement additional controls to prevent a similar incident. Which control would have been most effective in preventing the exfiltration?

Accepted Answer

Require access to the code repository only from company-managed IP addresses. Option C is correct because restricting access to the code repository to only company-managed IP addresses (e.g., via a VPN or a corporate NAT gateway) would have prevented the attacker from using the stolen session cookies from an external, non-corporate IP. Even though the attacker had valid session tokens, the repository's access control list (ACL) would have blocked the connection at the network layer, stopping the exfiltration before it could begin. This control addresses the root cause—unauthorized network origin—rather than relying on detection or session management alone.

Answer

Use a SIEM to alert on unusual access patterns in real time

Answer

Enforce code signing for all commits

Answer

Implement a shorter session timeout for the code repository

Question 12

A multinational corporation's data center in the European Union (EU) stores personal data of EU citizens. The company must comply with the General Data Protection Regulation (GDPR), which requires that personal data be protected and that data subjects have the right to erasure ('right to be forgotten'). The company's IT team uses a centralized identity management system that stores user credentials and personal data in an active directory (AD) forest. The AD forest is replicated across multiple data centers worldwide, including a non-EU country. The data protection officer (DPO) is concerned that personal data might be inadvertently replicated to jurisdictions without adequate protection. Which of the following is the most effective way to address this concern?

Accepted Answer

Implement data residency controls to ensure EU personal data is only stored and processed within the EU. Option C is correct because GDPR mandates that personal data of EU citizens must not be transferred to countries without adequate protection unless specific safeguards are in place. Implementing data residency controls ensures that EU personal data is stored and processed only within the EU, preventing inadvertent replication to non-EU jurisdictions via AD replication. This directly addresses the DPO's concern by enforcing geographic boundaries on data storage and processing.

Answer

Pseudonymize all personal data before storing it in AD

Answer

Encrypt all personal data at rest and in transit, with keys held solely within the EU

Answer

Obtain explicit consent from all EU data subjects for international data transfer

Question 13

A financial services organization recently experienced a data breach where customer financial records were exfiltrated. The investigation reveals that an attacker gained access through a compromised privileged account belonging to a database administrator. The attacker used valid credentials to log into the database server and then exported a large volume of data using native database tools. The security team notes that the organization has multi-factor authentication (MFA) enabled for all remote access, but the database server was accessed from an internal IP address. The organization also has a data loss prevention (DLP) system, but it did not alert on the export because the traffic was encrypted. The database activity monitoring (DAM) system did log the export, but alerts were not reviewed due to high volume and many false positives. Which of the following would have been most effective in preventing this breach?

Accepted Answer

Implementing a privileged access management (PAM) solution that requires approval for elevated actions and records sessions. The breach occurred because a privileged database administrator account was compromised, and the attacker used native database tools to export data from an internal IP address, bypassing MFA. A privileged access management (PAM) solution would have required approval for elevated actions (e.g., exporting large volumes of data) and recorded the session, providing both preventive control (approval workflow) and detective control (session recording) to stop or immediately detect the abuse of valid credentials. This directly addresses the root cause—compromised privileged credentials—rather than relying on network or alerting controls that were circumvented.

Answer

Deploying a DLP solution that can inspect encrypted traffic via SSL interception

Answer

Segmenting the database server onto a separate network with strict firewall rules

Answer

Improving the database activity monitoring (DAM) alerting to reduce false positives

Question 14

A company has been developing a custom inventory management system using Scrum. In the current sprint, the team discovered that the integration module with the legacy ERP system has severe performance issues: under peak load, transactions time out and fail. The product owner is concerned because the release is scheduled in two weeks. The development team estimates that a proper fix will take three weeks. A similar issue occurred in a previous sprint and was temporarily resolved by reducing the number of concurrent transactions, which lowered performance but kept the system operational. The stakeholders are anxious about the deadline because the legacy ERP will be retired shortly after the planned go-live. What is the BEST action for the team to take?

Accepted Answer

Delay the release by one week to complete the proper fix (three weeks total). Option B is correct because delaying the release by one week allows the team to implement a proper, permanent fix for the ERP integration module's performance issue, which is critical given that the legacy ERP will be retired shortly after go-live. A temporary workaround would risk system instability and transaction failures under peak load, potentially causing data loss or corruption during the transition. The three-week estimate for a proper fix addresses the root cause, ensuring the system can handle peak loads reliably before the legacy system is decommissioned.

Answer

Reduce the scope of the release to exclude the ERP integration feature entirely

Answer

Add two additional developers to the team to complete the fix within the original two-week timeline

Answer

Apply the same workaround for the go-live and plan a permanent fix in a later release

Question 15

A hospital is implementing a new electronic health record (EHR) system. The project team includes clinicians and IT staff. During integration testing, the system fails to exchange lab results with the existing legacy system due to format mismatches. The IT team suggests developing a custom interface. The clinical team is concerned that any custom solution may not comply with health data privacy regulations. The project sponsor pressures the team to quickly fix the issue to avoid delays. The IS auditor is reviewing this situation. What is the MOST appropriate action for the auditor to recommend?

Accepted Answer

Conduct a privacy impact assessment on the custom interface and ensure controls are in place before deployment.. The custom interface introduces a new data exchange path between the EHR and legacy system. Without a privacy impact assessment (PIA), the auditor cannot verify that the interface will enforce encryption, access controls, and audit logging required by HIPAA or similar regulations. A PIA identifies risks like unauthorized disclosure of protected health information (PHI) during format translation, ensuring controls are implemented before deployment. This aligns with the IS auditor's role to safeguard data privacy, not just meet deadlines.

Answer

Proceed with the custom interface to meet the project deadline.

Answer

Reject the custom interface and delay the project until a standard solution is found.

Answer

Replace the legacy system with a new one that is compatible.