CISA Practice Test 38 — 15 Questions

Question 1

An organization performs daily full backups of its critical database. The recovery time objective (RTO) is 4 hours. During a disaster, it takes 6 hours to restore the database. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Recovery procedures are not tested against the RTO.. If the restore takes longer than the RTO, the backup and recovery process does not meet the required timeline. This could be due to inadequate infrastructure or testing.

Answer

Offsite storage location is too far.

Answer

The backup type (full) is insufficient.

Answer

Backup retention period is too short.

Question 2

Which TWO of the following are recommended practices for aligning IT strategy with business goals, according to COBIT 2019?

Accepted Answer

Adopting a governance framework that covers all IT-related activities and stakeholder needs. COBIT 2019 explicitly requires a governance framework that covers all IT-related activities and stakeholder needs to ensure alignment with business goals. This framework integrates enterprise governance principles, such as the Governance System and Governance Framework components, to bridge IT and business strategy through policies, structures, and processes.

Answer

Implementing a continuous monitoring system for IT operational metrics

Answer

Conducting monthly IT steering committee meetings to review project status

Answer

Using agile development methodologies for all IT projects

Question 3

In an Agile software development project, who is primarily responsible for prioritizing the product backlog?

Accepted Answer

Product Owner. The Product Owner owns the backlog and prioritizes items based on business value. Option A is wrong because Scrum Master facilitates but does not prioritize. Option B is wrong because the team estimates effort but does not set priority. Option C is wrong because Agile projects typically do not have a traditional project manager.

Answer

Scrum Master

Answer

Development Team

Answer

Project Manager

Question 4

A university's research department stores sensitive research data on a file server that is shared among faculty and graduate students. The server is accessible from the campus network and via VPN for remote access. Recently, a student downloaded a large dataset containing personally identifiable information (PII) of research subjects to a personal laptop. The laptop was later stolen. The university's incident response team determines that the student had legitimate access to the data for research purposes. Which control would have most effectively prevented the data exposure?

Accepted Answer

Implement a DLP solution that restricts downloads of sensitive data to unmanaged devices. A Data Loss Prevention (DLP) solution can inspect the content of files being transferred and block downloads of sensitive data like PII to unmanaged devices such as a personal laptop. This would prevent the initial data exposure. Option A, full-disk encryption, protects data on the stolen laptop but does not prevent the download. Option B, restricting VPN access to university-issued devices, would not stop the student from downloading data while on campus or via VPN with a personal device if allowed. Option C, annual access reviews, is a periodic control that would not prevent this real-time action.

Answer

Require full-disk encryption on all laptops

Answer

Restrict VPN access to only university-issued devices

Answer

Conduct annual access reviews for the file server

Question 5

Which of the following is a key performance indicator (KPI) for IT service management?

Accepted Answer

Help desk resolution time. Help desk resolution time is a common KPI for IT service management, measuring efficiency.

Answer

IT budget as a percentage of revenue

Answer

Number of IT staff

Answer

Number of servers

Question 6

In a traditional waterfall SDLC, when should the test plan be developed?

Accepted Answer

During the design phase. In a traditional waterfall SDLC, the test plan should be developed during the design phase because testing activities must be planned in parallel with system design to ensure that test cases, test data, and acceptance criteria are aligned with the design specifications. This allows for early identification of testability issues and ensures that the test plan is ready before coding begins, enabling a structured and efficient testing process.

Answer

During the implementation phase

Answer

During the coding phase

Answer

During the requirements phase

Question 7

During an incident response, the IT team isolates a compromised system from the network. Which of the following is the primary purpose of this action?

Accepted Answer

To prevent further damage and contain the incident.. Isolating a compromised system from the network (e.g., by disconnecting the Ethernet cable, disabling the switch port, or applying a host-based firewall rule to drop all traffic) immediately stops the system from communicating with other hosts. This containment action prevents the attacker from moving laterally, exfiltrating data, or deploying additional malware, thereby limiting the blast radius and stopping ongoing damage.

Answer

To preserve evidence for forensic analysis.

Answer

To allow the system to be patched offline.

Answer

To comply with regulatory requirements.

Question 8

An organization is implementing a backup strategy for its critical database. The database is updated continuously during business hours, and the recovery point objective (RPO) is 15 minutes. Which backup method should be used to meet the RPO while minimizing backup storage and performance impact?

Accepted Answer

Perform incremental backups with transaction log backups every 15 minutes. Incremental backups with transaction log backups every 15 minutes meets the 15-minute RPO by capturing all changes since the last full or incremental backup, while transaction log backups record every individual database transaction. This method minimizes storage by only backing up changes and reduces performance impact compared to continuous replication, as log backups are lightweight and can be scheduled without constant I/O overhead.

Answer

Perform full backups every 24 hours

Answer

Implement synchronous replication to a standby server

Answer

Perform differential backups every 6 hours

Question 9

A nonprofit organization develops a small online donation platform using a third-party payment gateway. The project team skips formal security testing because of budget constraints. After launch, a security researcher discovers that the application fails to validate input on the donation amount field, allowing manipulation. The nonprofit loses several thousand dollars before the issue is patched. The IS auditor is asked to review the system development process. Which of the following is the PRIMARY finding?

Accepted Answer

Security testing was not performed during development.. The primary finding for an IS auditor reviewing the system development process is the absence of security testing during development. Skipping formal security testing (e.g., static application security testing, dynamic application security testing, or penetration testing) violates the secure development lifecycle (SDLC) best practices and directly led to the input validation vulnerability. The IS auditor's focus is on process deficiencies, not the specific exploit or financial loss.

Answer

The donation amount field was not validated.

Answer

The organization lost money due to the exploit.

Answer

The payment gateway was not properly integrated.

Question 10

Which TWO of the following are guiding principles of ITIL 4? (Select TWO)

Accepted Answer

Progress iteratively with feedback. ITIL 4 has seven guiding principles. 'Focus on value' and 'Progress iteratively with feedback' are two of them. 'Centralize decision making' and 'Standardize services' are not ITIL 4 principles, and 'Automate everything' is not a principle.

Answer

Automate everything

Answer

Standardize services

Answer

Centralize decision making

Question 11

Match each encryption key type to its usage.

Accepted Answer

Symmetric key: Used for bulk encryption and decryption with the same key. Symmetric keys are used for bulk encryption with a shared key, while public keys are distributed for encryption/verification. Asymmetric keys involve a key pair and are not optimized for bulk encryption; private keys must be kept secret for decryption/signing.

Answer

Asymmetric key: Used for encrypting large amounts of data quickly

Answer

Private key: Used to encrypt data that will be decrypted with a public key

Question 12

Based on the exhibit, which control is most likely missing to prevent this type of event?

Accepted Answer

Implementing account lockout after three failed attempts. The exhibit describes a brute-force attack against an SSH service, where an attacker repeatedly attempts to guess credentials. Implementing account lockout after three failed attempts is the most direct control to prevent this type of event, as it halts further login attempts after a threshold, stopping the attack in its tracks regardless of password strength or patching.

Answer

Applying the latest security patches to the SSH service

Answer

Disabling direct root login via SSH

Answer

Enforcing strong password complexity

Question 13

During a systems audit, the auditor finds that the project did not follow the organization's systems development methodology. What should the auditor do FIRST?

Accepted Answer

Report the deviation and assess the impact on controls. The auditor's first responsibility upon discovering a deviation from the organization's systems development methodology is to report the finding and assess the impact on internal controls. This aligns with ISACA's audit standards, which require auditors to evaluate whether the deviation introduces risks to data integrity, security, or project governance. Without this assessment, the auditor cannot determine the severity of the non-compliance or recommend appropriate corrective actions.

Answer

Accept if the project is on schedule

Answer

Recommend that the project be stopped

Answer

Interview the project team to understand why

Question 14

An IS auditor is reviewing the release management process for a critical application. The release strategy includes a phased rollout to 10% of users initially, then 50%, then 100%. The first phase revealed a data integrity issue that affected a subset of transactions. The release manager decided to continue with the next phase while a patch was being developed. What should the auditor most recommend?

Accepted Answer

Halt the rollout until the data integrity issue is resolved.. Continuing the rollout while a data integrity issue exists could affect more users. Best practice is to halt the rollout until the issue is resolved and patched, to prevent further impact and ensure the fix is effective.

Answer

Document the issue as a known error and proceed.

Answer

Accelerate the rollout to quickly identify all issues.

Answer

Increase testing in the next phase to catch issues earlier.

Question 15

Which TWO of the following are examples of administrative controls for information security? (Choose two.)

Accepted Answer

Incident response policy. An incident response policy is a documented set of procedures that defines roles, responsibilities, and steps to be taken when a security incident occurs. This is an administrative control as it governs human behavior and organizational processes, not technology. It aligns with the CISA domain of Protection of Information Assets by establishing a framework for detecting, responding to, and recovering from security events.

Answer

Encryption of data at rest

Answer

Biometric access controls

Answer

Firewall configuration