CISA Practice Test 39 — 15 Questions

Question 1

An organization uses a COTS (commercial off-the-shelf) ERP system with significant customizations. The IS auditor is reviewing the system's configuration management. Which of the following findings would MOST indicate a weakness?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The system administrator has the ability to modify both configuration and production data.. In a COTS ERP system with significant customizations, allowing the system administrator to modify both configuration and production data violates the principle of segregation of duties (SoD). This creates a risk of unauthorized or undetected changes, as the same individual can alter system configurations and then manipulate production data to conceal the impact, bypassing audit trails and controls.

Answer

The vendor releases quarterly patches but the organization only applies critical security patches.

Answer

Customizations are not tracked in a separate change management system.

Answer

The organization does not have a formal testing environment for customizations.

Question 2

During a security assessment, an auditor discovers that employees are sharing passwords to access a critical system. Which of the following controls would BEST mitigate this risk?

Accepted Answer

Implement multi-factor authentication. Multi-factor authentication (MFA) mitigates the risk of password sharing because even if credentials are shared, an attacker cannot authenticate without the second factor (e.g., a one-time passcode from a hardware token or authenticator app). MFA decouples authentication from a single shared secret, making shared passwords insufficient for access. This directly addresses the root cause—reliance on passwords alone—rather than attempting to prevent sharing behavior.

Answer

Provide security awareness training

Answer

Log all authentication attempts

Answer

Enforce complex password policies

Question 3

Refer to the exhibit. This log entry MOST likely indicates:

Accepted Answer

An attempt to escalate privileges or lateral movement. The log entry shows a service account (svc_backup) executing commands that create a new local user and add it to the Administrators group, which is a classic privilege escalation technique. The use of net user and net localgroup commands from a service account indicates an attempt to gain unauthorized administrative access, often as a precursor to lateral movement. This is not normal administrative activity because service accounts are typically restricted to specific tasks and should not be creating interactive user accounts.

Answer

A scheduled backup using the service account

Answer

A brute-force attack

Answer

Normal administrative activity

Question 4

An organization has outsourced its IT help desk to a third-party provider. Which of the following is the MOST critical control to ensure service quality?

Accepted Answer

Service level agreement (SLA) with key performance indicators. A Service Level Agreement (SLA) with key performance indicators (KPIs) is the most critical control because it defines measurable targets (e.g., average speed to answer, first-call resolution rate, ticket closure time) and establishes contractual remedies for non-compliance. Without an SLA, the organization has no enforceable mechanism to hold the provider accountable for service quality, making it the foundational control for outsourced IT help desk governance.

Answer

Regular background checks on provider employees

Answer

Access to provider's incident management system

Answer

Monthly meetings with provider management

Question 5

Match each disaster recovery site type to its description.

Accepted Answer

Hot Site: Fully operational facility with all hardware, software, and data replicated in real-time.. Recovery site types are categorized by readiness: hot sites have full replication, warm sites have partial, cold sites have only infrastructure. Common confusions include equating warm with hot or cold.

Answer

Hot Site: Basic shell with no equipment, requiring long setup time.

Answer

Warm Site: Fully replicated real-time data and equipment.

Question 6

An organization is implementing a public key infrastructure (PKI) to support digital certificates. Which of the following is the MOST critical control to ensure the integrity of the certificate lifecycle?

Accepted Answer

Establishment of a certificate policy (CP) and certification practice statement (CPS). A robust certificate policy (CP) and certification practice statement (CPS) define the rules and procedures for certificate management, ensuring consistency and security. Other controls are important but are defined within the CP/CPS.

Answer

Use of hardware security modules for key generation

Answer

Regular publication of certificate revocation lists (CRLs)

Answer

Secure storage of the root CA private key

Question 7

During a disaster recovery planning audit, the IS auditor notes that the organization's plan includes a hot standby site. However, the plan has not been updated in two years, and the last test was a tabletop exercise 18 months ago. The organization has recently implemented a new ERP system. Which THREE findings should the auditor report as most significant?

Accepted Answer

The DR plan has not been tested in over a year.. The plan is outdated (two years), the last test was only tabletop (not sufficient for a hot site), and the new ERP system is not reflected in the plan. These three issues directly impact the ability to recover effectively.

Answer

The hot standby site is located too far from the primary site.

Answer

The DR plan has not been reviewed and approved by senior management in the last year.

Question 8

An organization is considering acquiring a commercial off-the-shelf (COTS) ERP system. Which of the following risks is most effectively mitigated by including a contractual clause for audit rights?

Accepted Answer

Inadequate vendor security controls. Audit rights allow the organization to verify that the vendor's controls are operating effectively. This directly addresses the risk of inadequate vendor security controls, which could expose the organization to data breaches or compliance violations.

Answer

Incompatibility with existing infrastructure

Answer

Vendor lock-in due to proprietary data formats

Answer

Cost overruns from customization

Question 9

An IS auditor reviews the log entry above. Which of the following is the MOST likely cause of the authentication failure?

Accepted Answer

The client certificate presented has a common name that does not match the configured expected name.. The log entry indicates an authentication failure with a client certificate. The error 'CN mismatch' or similar certificate validation failure occurs when the Common Name (CN) in the client certificate does not match the expected name configured on the server (e.g., in a RADIUS or TLS mutual authentication context). This is a specific certificate-level issue, not a password or account lockout problem.

Answer

The user's account is locked.

Answer

The user's password is incorrect.

Answer

The RADIUS server is unavailable.

Question 10

Which of the following is the PRIMARY purpose of conducting a penetration test?

Accepted Answer

To exploit vulnerabilities to assess real-world impact. The primary purpose of a penetration test is to exploit vulnerabilities in a controlled manner to assess the real-world impact and business risk, not merely to list them. While vulnerability scanning identifies weaknesses, penetration testing goes further by simulating an attacker's actions to determine if and how a vulnerability can be leveraged to compromise systems, data, or operations. This aligns with the CISA focus on evaluating the effectiveness of security controls under realistic attack conditions.

Answer

To test incident response capabilities

Answer

To meet compliance requirements

Answer

To identify vulnerabilities in a system

Question 11

An organization uses a cloud-based CRM system. The asset management team has implemented tagging to track resource costs by department. During an audit, the IS auditor finds that several orphaned resources (e.g., virtual machines, storage volumes) exist that are not tagged and have been running for months. The cloud service provider's cost allocation report shows these resources under a default account. What is the most significant risk associated with this finding?

Accepted Answer

Inaccurate cost allocation and potential budget overruns.. The most significant risk is inaccurate cost allocation and potential budget overruns because the orphaned resources are not tagged and are billed under a default account, preventing the organization from accurately attributing cloud costs to the responsible departments. This undermines the purpose of the tagging strategy implemented by the asset management team and can lead to unplanned expenses that are not tracked against any budget owner, directly impacting financial control and operational accountability.

Answer

Increased attack surface from forgotten resources.

Answer

Security misconfiguration due to lack of ownership.

Answer

Compliance violation with data residency requirements.

Question 12

An organization has implemented a role-based access control (RBAC) system. A user complains that they cannot access a file needed to complete a critical task. The file's permission indicates that only the 'Manager' role has read access. The user is assigned to the 'Analyst' role. Which of the following is the BEST course of action?

Accepted Answer

Submit a request for temporary access approval via change management. In a properly implemented RBAC system, access changes must follow the principle of least privilege and be formally approved through change management to maintain audit trails and security controls. Granting temporary access via a documented change request ensures that the access is justified, time-bound, and reviewed, preventing unauthorized privilege escalation. This aligns with the CISA domain of Protection of Information Assets, where access control changes must be controlled and monitored.

Answer

Assign the user to the Manager role temporarily

Answer

Create a new role with only read access to that file

Answer

Change the file permissions to include Analyst role

Question 13

An organization uses automated job scheduling for batch processing. A critical payroll job fails due to a dependency on a prior job that did not complete. The job scheduler is configured to handle dependencies. What should the auditor verify regarding rerun procedures?

Accepted Answer

The rerun procedure specifies the correct restart point. The auditor should ensure that the rerun procedure specifies the correct restart point to avoid data corruption or reprocessing errors.

Answer

The job failure alert is sent to the IT manager

Answer

The job scheduler logs the dependency failure

Answer

The job automatically retries after the dependency completes

Question 14

An organization has recently implemented a cloud-based identity provider (IdP) for single sign-on (SSO) across all SaaS applications. Users authenticate using their corporate credentials via SAML 2.0. After a week, the IT security team notices a significant increase in failed login attempts from various IP addresses targeting a specific user account. The helpdesk reports that the user, a senior executive, has not complained about any issues. The security team investigates and finds that the account lockout policy is set to 5 failed attempts within 15 minutes, after which the account is locked for 30 minutes. The failed attempts are occurring in bursts of 4, then stopping, then resuming from different IPs. The organization uses conditional access policies that require MFA from unknown locations. However, the failed attempts appear to be stopped at the authentication prompt and never reach the MFA stage. What is the most likely explanation and the best course of action?

Accepted Answer

The attacker is performing a password spraying attack, attempting to guess the password for that specific account. The organization should implement a CAPTCHA requirement after a few failed attempts.. The attack pattern—bursts of exactly 4 failed attempts (just below the lockout threshold of 5) from different IPs, then stopping—is a textbook password spraying attack. The attacker is trying commonly used passwords against a high-value account (senior executive) while deliberately avoiding account lockout to remain undetected. Since the attempts stop at the SAML authentication prompt and never reach MFA, the attacker is testing passwords against the IdP's SAML endpoint, which validates credentials before triggering conditional access policies.

Answer

The user's credentials have been compromised, and the attacker is testing them across the IdP. The organization should immediately force a password reset for the user and enable MFA for all users.

Answer

A misconfiguration in the IdP allows pre-authentication enumeration. The organization should disable account lockout and implement rate limiting at the application proxy.

Answer

The IdP is experiencing integration issues with the AD domain controller, causing authentication failures that are logged as failed attempts. The organization should check the synchronization status and network connectivity.

Question 15

An IS auditor is assessing the effectiveness of network segmentation for a payment card processing environment. Which of the following is the PRIMARY benefit of network segmentation in meeting PCI DSS requirements?

Accepted Answer

Reduced scope of the PCI DSS assessment. Network segmentation reduces the scope of the PCI DSS assessment by isolating the cardholder data environment from other networks, so only systems that handle card data need to comply with PCI DSS.

Answer

Improved network performance

Answer

Elimination of the need for firewalls

Answer

Simplified patch management