CISA Practice Test 39 — 15 Questions

Question 1

During an audit, the auditor uses a sampling method where the population is divided into subgroups, and samples are selected from each subgroup. This method is known as:

Accepted Answer

Stratified sampling. Stratified sampling divides the population into homogeneous subgroups (strata) — such as by department, transaction type, or risk level — and then draws samples from each stratum, often proportionally or with higher sampling in high-risk strata. This guarantees representation of every subgroup and reduces sampling risk compared to simple random sampling. It is the standard ISACA-recommended technique when the population is heterogeneous and the auditor needs coverage across distinct categories.

Answer

Systematic sampling

Answer

Judgmental sampling

Answer

Random sampling

Question 2

An IS auditor is reviewing how a data center protects its backup tapes while they are in transit to an offsite storage facility. Management states that tapes are encrypted before shipment and that a courier transports them in sealed containers. Which of the following is the MOST appropriate evidence to confirm that the tapes are protected in transit?

Accepted Answer

Inspect the courier's chain-of-custody logs and verify the sealed-container handoff signatures.. The scenario tests physical media protection during transit, so the auditor needs evidence covering the movement of tapes between sites. Signed chain-of-custody documentation with sealed-container handoffs directly evidences that custody was maintained and containers stayed intact from pickup to delivery, which is the specific control objective. Encryption, interviews, and vendor-side reports each address different phases of the media lifecycle and cannot substitute for transit custody records.

Answer

Review the encryption algorithm and key length used for the backup tapes.

Answer

Interview the backup administrator about the tape pickup schedule.

Answer

Examine the offsite storage vendor's SOC 2 report.

Question 3

A project uses a waterfall model. After design, the team discovers that the requirements have changed significantly. What is the BEST action?

Accepted Answer

Update the requirements and proceed with the design revision. In a waterfall model, each phase must be completed before the next begins, but when requirements change significantly after design, the best action is to update the requirements and revise the design. This preserves the structured, sequential nature of the waterfall while ensuring the final product meets the new needs. Canceling or ignoring changes would waste resources, and switching methodologies mid-project introduces integration risks and process discontinuity.

Answer

Cancel the project and start over

Answer

Continue with original requirements as planned

Answer

Switch to an agile methodology for the remainder of the project

Question 4

During the fieldwork phase, an IS auditor uses analytical procedures to compare current year IT expenses to prior year. A significant increase is noted. What should the auditor do next?

Accepted Answer

Investigate the reason for the increase. Analytical procedures are used to identify unusual fluctuations that may indicate errors, fraud, or changes in the environment. A significant increase in IT expenses compared to the prior year is an unexpected variance that must be investigated to determine its cause before concluding whether it represents a finding. Only after understanding the reason can the auditor decide whether it is a reportable issue.

Answer

Report the increase as a finding

Answer

Ignore the increase if it is within budget

Answer

Expand the sample size for testing

Question 5

Refer to the exhibit. A CISA is reviewing this S3 bucket policy. What is the PRIMARY security concern?

Accepted Answer

The bucket is configured for public read access. The bucket policy explicitly grants `s3:GetObject` to `Principal: "*"` with `Effect: "Allow"`, which means any unauthenticated user on the internet can read objects in the bucket. This is a classic misconfiguration that leads to public read access, exposing sensitive data. While encryption and versioning are important security controls, the immediate and most severe risk is unauthorized data disclosure via public read.

Answer

Encryption is not enforced on the bucket

Answer

The policy allows unauthorized write access

Answer

Versioning is not enabled on the bucket

Question 6

During an audit, an IS auditor finds that the organization uses a cloud-based identity provider (IdP) for single sign-on (SSO) but does not enforce multi-factor authentication (MFA) for all users. Which of the following is the BEST recommendation to reduce risk?

Accepted Answer

Enforce MFA for all users accessing any application. Enforcing MFA for all users accessing any application is the best recommendation because it directly addresses the lack of a second authentication factor, which is the primary control to mitigate credential theft and unauthorized access. In a cloud-based IdP SSO environment, a single compromised password grants access to all integrated applications, so MFA must be applied universally to protect the entire trust boundary, not just external-facing apps. This aligns with NIST SP 800-63B and zero-trust principles, ensuring that every authentication request is verified with something the user knows and something they have.

Answer

Require MFA only for external-facing applications

Answer

Disable SSO and require separate passwords for each application

Answer

Reduce session timeout to 15 minutes

Question 7

Which backup method copies all data that has changed since the last full backup, regardless of subsequent incremental backups, and is often used to reduce restore time?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of any incremental backups taken in between. This approach reduces restore time because only the last full backup and the most recent differential backup are needed, unlike incremental backups which require the full backup plus every subsequent incremental in sequence.

Answer

Full backup

Answer

Incremental backup

Answer

Mirror backup

Question 8

An organization is implementing a new IT policy. What is the MOST important step to ensure compliance?

Accepted Answer

Conducting training and awareness sessions. Conducting training and awareness sessions is the most important step to ensure compliance because employees must understand the policy and their responsibilities before they can comply. Training translates policy into actionable behavior, addresses questions, and builds the knowledge needed for consistent adherence. Without awareness, even a well-written policy is unlikely to be followed.

Answer

Publishing the policy on the intranet

Answer

Establishing penalties for non-compliance

Answer

Assigning a policy owner

Question 9

Which TWO of the following are indicators that a project is at risk of failure according to ISACA's project governance framework?

Accepted Answer

Lack of clear communication channels among team members.. Option B is correct because ISACA's project governance framework identifies poor or unclear communication among team members as a key warning sign of project failure, since it leads to misalignment, unresolved issues, and unmanaged dependencies. Option D is correct because frequent scope changes without formal approval indicate weak change control and governance, which ISACA cites as a major risk factor for cost overruns, schedule slippage, and loss of stakeholder confidence. The remaining options do not indicate risk: regular status meetings with stakeholders (A) and use of a PMO (E) are actually governance-strengthening practices that improve oversight and communication, while adoption of iterative development (C) is a legitimate delivery approach that, when properly governed, supports incremental value delivery rather than signaling failure.

Answer

Regular status meetings with stakeholders.

Answer

Adoption of iterative development.

Answer

Use of a project management office (PMO).

Question 10

During a post-implementation review, an IS auditor identifies that the system's actual transaction processing time is significantly higher than the benchmark specified in the service level agreement (SLA). The vendor claims it is due to inadequate network bandwidth provided by the client. What should the auditor do first?

Accepted Answer

Review the SLA to determine responsibility for network performance. The SLA should define responsibilities for network performance. The auditor should first review the SLA to determine who is responsible. Option B is incorrect because recommending bandwidth increase without verifying responsibility is premature. Option C is incorrect because escalation to senior management is not the first step; review of SLA should occur first. Option D is incorrect because independent performance testing may be unnecessary if the SLA clarifies responsibility.

Answer

Recommend increasing network bandwidth

Answer

Escalate the issue to senior management

Answer

Perform independent performance testing

Question 11

Which TWO of the following are primary objectives of information classification? (Choose two.)

Accepted Answer

Determine appropriate access controls and protection requirements.. Information classification is the process of labeling data based on its sensitivity and value, and its primary objectives include determining the appropriate access controls and protection requirements (B) — once data is classified (e.g., public, internal, confidential, secret), the organization can apply matching controls such as encryption, RBAC permissions, and handling procedures. It also ensures compliance with legal and regulatory requirements (D), because frameworks like GDPR, HIPAA, PCI DSS, and ISO/IEC 27001 mandate that data be categorized so that mandated safeguards and retention rules can be applied to each class. The remaining options do not belong: network segmentation (A) is a security architecture technique that may follow from classification but is not a primary objective of it, performance prioritization (C) is a QoS/operations concern unrelated to classification's purpose, and deduplication for storage savings (E) is a data-management/storage optimization activity, not a classification objective.

Answer

Simplify network architecture by segmenting data.

Answer

Improve system performance by prioritizing critical data.

Answer

Reduce storage costs by identifying duplicate data.

Question 12

An IS auditor selects a sample of 50 transactions from a population of 1,000 using a random number generator. This is an example of which sampling method?

Accepted Answer

Random sampling. Using a random number generator to select 50 transactions from a population of 1,000 is the definition of random sampling, where every item in the population has an equal chance of being selected. This method is a form of statistical sampling that supports projection of results to the population.

Answer

Stratified sampling

Answer

Systematic sampling

Answer

Judgmental sampling

Question 13

An organization has defined an SLA that requires critical incidents to be resolved within 4 hours. A P1 incident is reported at 10:00 AM. At what time must the incident be resolved to meet the SLA?

Accepted Answer

2:00 PM. The SLA requires critical incidents to be resolved within 4 hours. A P1 incident reported at 10:00 AM must therefore be resolved by 2:00 PM, which is exactly 4 hours later. This is a straightforward time calculation based on the SLA definition.

Answer

4:00 PM

Answer

6:00 PM

Answer

12:00 PM

Question 14

Which THREE of the following are commonly used data encryption standards? (Choose three.)

Accepted Answer

3DES. 3DES (A) is a symmetric block cipher that applies the DES algorithm three times to each data block, making it a widely recognized data encryption standard. RSA (C) is an asymmetric encryption standard based on public/private key pairs, commonly used for encrypting data and exchanging keys. AES (D) is the modern symmetric block cipher standard adopted by NIST, widely used for data-at-rest and data-in-transit encryption. SHA-256 (B) and MD5 (E) are cryptographic hash functions used for integrity and message digests, not for encrypting data, so they do not belong among encryption standards.

Answer

SHA-256

Answer

MD5

Question 15

What is the primary purpose of the planning phase in an IS audit?

Accepted Answer

To identify risks and define audit scope. The planning phase of an IS audit is where the auditor defines the audit objectives, identifies and assesses risks, determines the scope and criteria, and develops the audit program. This foundational phase ensures that the audit is focused on the areas of greatest risk and that resources are allocated effectively.

Answer

To execute audit tests

Answer

To issue the final report

Answer

To follow up on findings