CISA Practice Test 37 — 15 Questions

Question 1

Match each CISA domain to its focus.

Accepted Answer

Information System Auditing Process: Focus on auditing process, standards, and guidelines. Correct matches: Domain 1 focuses on auditing process, Domain 2 on governance and management, Domain 3 on acquisition and development. Distractors mix focuses from other domains.

Answer

Governance and Management of IT: Focus on project management and system development

Answer

Protection of Information Assets: Focus on governance and management of IT

Question 2

What is the PRIMARY purpose of conducting a feasibility study before acquiring a new information system?

Accepted Answer

To assess the technical, operational, and economic viability. The primary purpose of a feasibility study is to evaluate whether a proposed information system is technically achievable, operationally compatible with existing processes, and economically justified before committing resources. This upfront assessment prevents investment in systems that cannot be successfully implemented or sustained, directly addressing risk management in the acquisition lifecycle.

Answer

To define detailed system requirements

Answer

To select a vendor through a bidding process

Answer

To determine the total cost of ownership

Question 3

During the implementation of a new ERP system, the project team discovers that the legacy system data cannot be directly migrated due to incompatible data formats. The project manager proposes building a custom script to extract, transform, and load (ETL) data. Which of the following is the BEST course of action?

Accepted Answer

Proceed with the custom ETL script after thorough testing and validation.. Building a custom ETL script is a common and acceptable approach when legacy data formats are incompatible with a new ERP system. The key is that the script must undergo thorough testing and validation to ensure data integrity, completeness, and accuracy before migration. This balances the need for timely implementation with the risk of data corruption, which can be mitigated through rigorous quality assurance processes.

Answer

Manually re-enter all legacy data into the new system.

Answer

Delay the implementation until a commercial migration tool is available.

Answer

Abandon the legacy data and start fresh in the new system.

Question 4

Match each audit risk component to its definition.

Accepted Answer

Inherent Risk: The susceptibility of an account balance or class of transactions to a material misstatement assuming there are no related internal controls.. The audit risk model consists of inherent risk, control risk, detection risk, and overall audit risk. Inherent risk is the risk of misstatement without controls, control risk is the risk controls fail, detection risk is the risk audit procedures miss misstatements, and audit risk is the risk of issuing an inappropriate opinion. Common confusions include swapping the definitions of inherent and control risks or misattributing detection risk to inherent risk.

Answer

Inherent Risk: The risk that the auditor's procedures will fail to detect a material misstatement.

Answer

Control Risk: The susceptibility of an account balance to material misstatement assuming no internal controls.

Question 5

Which TWO of the following are primary objectives of information classification? (Choose two.)

Accepted Answer

Determine appropriate access controls and protection requirements.. Information classification is a foundational security process that assigns sensitivity labels (e.g., public, internal, confidential, restricted) to data assets. Its primary objectives are to determine the appropriate access controls and protection requirements for each classification level (Option B) and to ensure compliance with legal and regulatory requirements such as GDPR, HIPAA, or PCI DSS (Option D). These objectives directly drive the implementation of security controls like encryption, access control lists (ACLs), and data loss prevention (DLP) policies.

Answer

Simplify network architecture by segmenting data.

Answer

Improve system performance by prioritizing critical data.

Answer

Reduce storage costs by identifying duplicate data.

Question 6

Refer to the exhibit. An IS auditor is reviewing backup error logs. The error indicates a failed backup due to a missing file. What is the MOST likely cause?

Accepted Answer

A file in the source volume was moved or deleted during the backup window. The error indicates a failed backup due to a missing file. The most likely cause is that a file in the source volume was moved or deleted during the backup window. Backup processes that use file-level snapshots or open-file managers (e.g., Volume Shadow Copy Service on Windows) capture a point-in-time view; if a file is moved or deleted after the snapshot is taken but before it is read by the backup agent, the backup will fail with a 'missing file' error. This is a classic race condition in file-level backups without proper snapshot consistency.

Answer

The backup job was scheduled during peak hours causing timeout

Answer

The destination path '\BackupServer01\Backup\Shares' is invalid

Answer

Insufficient disk space on the backup destination

Question 7

An IS auditor is testing the effectiveness of a preventive control that rejects invalid transactions. The auditor uses a computer-assisted audit technique (CAAT) to create a set of test transactions. What is the primary risk associated with this approach?

Accepted Answer

Test transactions may be processed as real transactions. The primary risk is that test transactions may be processed as real transactions if the CAAT does not properly isolate them from the production environment. This could result in unintended data corruption, financial misstatements, or operational disruptions. The auditor must ensure that test data is clearly flagged or run in a separate test environment to avoid integration with live processing.

Answer

The audit may disrupt system performance

Answer

Test transactions may not be representative

Answer

The CAAT may corrupt production data

Question 8

A financial institution is implementing a data classification policy. Which of the following is the most important factor in determining the classification level of a data asset?

Accepted Answer

The sensitivity and criticality to business operations. The classification level of a data asset is determined by its sensitivity and criticality to business operations because these factors directly drive the required confidentiality, integrity, and availability controls. For example, personally identifiable information (PII) or financial transaction records require higher classification due to regulatory mandates (e.g., GDPR, PCI DSS) and the potential for severe business impact if compromised. Cost, format, or location are secondary attributes that do not inherently define the risk profile or protection needs of the data.

Answer

The cost of acquiring the data

Answer

The format of the data (structured vs unstructured)

Answer

The storage location of the data

Question 9

Which TWO of the following are key responsibilities of an IT steering committee?

Accepted Answer

Monitoring IT performance and value delivery. The IT steering committee is a senior-level governance body responsible for aligning IT strategy with business objectives. Monitoring IT performance and value delivery (A) is a key responsibility because the committee must ensure that IT investments generate the expected business benefits and that service levels meet agreed targets. Prioritizing IT projects and allocating resources (D) is also a core duty, as the committee decides which initiatives receive funding and staffing based on strategic importance and risk, rather than operational urgency.

Answer

Managing day-to-day IT operations

Answer

Writing and testing application code

Answer

Conducting IT audit engagements

Question 10

Match each COBIT 5 domain to its description.

Accepted Answer

EDM: Ensures stakeholder needs are addressed, governance objectives are met, and the enterprise is directed and monitored.. COBIT 5 has five process domains: EDM (governance), APO (planning), BAI (acquisition/implementation), DSS (delivery/support), and MEA (monitoring). Correct matches are as above; common confusions involve swapping APO/MEA or DSS/APO.

Answer

MEA: Manages IT resources and capabilities to optimize performance.

Answer

DSS: Ensures alignment of IT strategy with business goals.

Question 11

During a software asset management (SAM) audit, the IS auditor discovers that the organization is using software versions that are no longer supported by the vendor. What is the primary risk?

Accepted Answer

Exposure to security vulnerabilities without patches.. The primary risk of using unsupported software versions is the absence of vendor-provided security patches. Without these patches, known vulnerabilities remain unaddressed, exposing the organization to exploitation, data breaches, and system compromise. This directly impacts the confidentiality, integrity, and availability of information assets.

Answer

Inability to recover data from backups.

Answer

Increased licensing costs due to non-compliance.

Answer

Difficulty in migrating to new versions.

Question 12

A multinational corporation operates an e-commerce platform hosted in a private cloud environment. The platform consists of web servers, application servers, and a database cluster. The database cluster uses synchronous replication across two data centers (Primary and DR) located 500 km apart. The recovery time objective (RTO) for the platform is 2 hours, and the recovery point objective (RPO) is 15 minutes. During a recent disaster simulation, the primary data center lost power completely. The IT team initiated failover to the DR site. However, the failover process took 3 hours due to a misconfiguration in the DNS failover scripts, and the database was found to be inconsistent because the replication link was broken 30 minutes before the power loss. The team had to restore from a backup that was 4 hours old. After the incident, management requests a review of the disaster recovery plan. Which of the following is the BEST course of action to address the issues identified?

Accepted Answer

Conduct a full-scale disaster recovery test including DNS failover and database consistency checks. The incident revealed failures in DNS failover scripts (causing RTO breach) and database consistency checks (causing RPO breach). A full-scale test that includes DNS failover and database consistency validation is the only option that directly addresses both root causes, ensuring the DR plan meets the stated RTO of 2 hours and RPO of 15 minutes. Without such a test, the organization cannot verify that the failover process and data integrity mechanisms work as intended under realistic conditions.

Answer

Increase the synchronous replication distance limit to ensure link stability over 500 km

Answer

Switch to asynchronous replication to avoid data loss during link failures

Answer

Implement automated DNS failover with health checks and reduce TTL values to 60 seconds

Question 13

An IS auditor is reviewing the system development life cycle (SDLC) for a custom application. The project manager has decided to skip the design phase and proceed directly from requirements to coding. Which of the following risks are MOST likely to increase as a result? (Choose two.)

Accepted Answer

Inadequate security controls.. Skipping the design phase means that security requirements are never formally defined or integrated into the system architecture. Without a security design, controls such as authentication, authorization, encryption, and input validation are likely to be omitted or implemented ad hoc, leading to inadequate security controls. This directly increases the risk of vulnerabilities that could be exploited in production.

Answer

Delays in project schedule.

Answer

Increased cost due to rework.

Answer

Increased number of defects during unit testing.

Question 14

An organization's data classification policy defines 'Confidential' data as requiring encryption at rest. An IS auditor discovers that a database containing customer personal information is not encrypted. What is the auditor's BEST course of action?

Accepted Answer

Report the finding to the data owner and IT management. The IS auditor's primary responsibility is to report findings to the appropriate stakeholders—the data owner and IT management—so they can take corrective action. Option A is incorrect because implementing controls is management's responsibility, not the auditor's. Option C is premature; compensating controls should be recommended after reporting and discussing the risk. Option D is unnecessary since the data classification policy already defines 'Confidential' data requiring encryption, and the auditor has identified a violation of that policy.

Answer

Encrypt the database immediately

Answer

Recommend a compensating control

Answer

Verify the classification of the data

Question 15

Refer to the exhibit. An administrator applied this ACL to a VLAN interface. The server at 10.0.0.100 hosts a web application. What is the effect of this ACL?

Accepted Answer

Allows HTTPS, but HTTP is allowed as well due to the permit ip any any. The ACL shown permits HTTPS (TCP port 443) from any source to the server at 10.0.0.100, and then has a 'permit ip any any' statement at the end. Because ACLs are processed top-down, the first match wins; HTTPS traffic matches the first line and is permitted, while HTTP (TCP port 80) is not explicitly denied, so it matches the 'permit ip any any' line and is also allowed. Thus, both HTTP and HTTPS are permitted, making option A correct.

Answer

Allows HTTPS, blocks HTTP, and blocks all other traffic

Answer

Blocks both HTTP and HTTPS

Answer

Only allows HTTP and blocks HTTPS