CISA Practice Test 4 — 10 Questions

Question 1

In a RACI matrix for an IT process, which role should be assigned to the person who ultimately approves the outcome and is held accountable for its success?

Accepted Answer

Accountable (A). In a RACI matrix, the Accountable (A) role is assigned to the person who ultimately approves the outcome and is held answerable for its success or failure. This is the single individual who owns the process or decision and has the authority to sign off. The Accountable person must be unique per activity to avoid ambiguity in ownership and decision-making.

Answer

Consulted (C)

Answer

Responsible (R)

Answer

Informed (I)

Question 2

A security review of the above Apache configuration identifies a critical vulnerability. Which of the following is the MOST significant issue?

Accepted Answer

Directory listing is enabled (Indexes option). The Indexes option in Apache enables directory listing, which exposes the entire contents of a directory when no index file (e.g., index.html) is present. This can reveal sensitive files, configuration backups, or source code, making it a critical information disclosure vulnerability. Unlike other options, Indexes directly leads to unauthorized data exposure without requiring any additional conditions.

Answer

Default DocumentRoot path is used

Answer

AllowOverride All allows .htaccess overrides

Answer

Require all granted permits all access

Question 3

An organization uses a COTS (commercial off-the-shelf) ERP system with significant customizations. The IS auditor is reviewing the system's configuration management. Which of the following findings would MOST indicate a weakness?

Accepted Answer

The system administrator has the ability to modify both configuration and production data.. In a COTS ERP system with significant customizations, allowing the system administrator to modify both configuration and production data violates the principle of segregation of duties (SoD). This creates a risk of unauthorized or undetected changes, as the same individual can alter system configurations and then manipulate production data to conceal the impact, bypassing audit trails and controls.

Answer

The vendor releases quarterly patches but the organization only applies critical security patches.

Answer

Customizations are not tracked in a separate change management system.

Answer

The organization does not have a formal testing environment for customizations.

Question 4

Match each security control to its category.

Accepted Answer

Firewall: Prevents unauthorized network access by filtering traffic.. Firewalls are preventive controls that block unauthorized access, IDS are detective controls that monitor and alert, and data backups are corrective controls that restore data after loss. The distractors swap these definitions.

Answer

Firewall: Monitors network traffic for suspicious activity and alerts.

Answer

Intrusion Detection System (IDS): Restores lost or corrupted data from copies.

Answer

Data Backup: Prevents unauthorized network access by filtering traffic.

Question 5

An organization's IT security policy requires background checks for all IT staff handling sensitive data. Which of the following is the PRIMARY reason for this requirement?

Accepted Answer

To reduce the risk of insider threats by verifying the trustworthiness of personnel. Background checks verify the integrity, identity, and criminal history of personnel before granting access to sensitive data, directly mitigating the risk that a trusted insider will misuse their privileges. Insider threats — whether malicious, negligent, or coerced — are among the hardest to detect because insiders already possess legitimate access. Pre-employment screening is a preventive control that reduces the likelihood of hiring individuals who pose an elevated trust risk.

Answer

To ensure employees have the necessary technical skills

Answer

To reduce employee turnover

Answer

To comply with industry regulations

Question 6

Which THREE of the following are essential components of a change management process?

Accepted Answer

Impact analysis. Impact analysis (B) is essential because it identifies the potential effects, risks, and dependencies of a proposed change on systems, services, and users before implementation, allowing informed decision-making. A rollback plan (C) is essential because it defines the documented procedure and criteria for reverting a change if it fails or causes unintended consequences, minimizing downtime and restoring the prior known-good state. Change request approval (E) is essential because it provides formal authorization from the Change Advisory Board (CAB) or designated authority, ensuring changes are reviewed, prioritized, scheduled, and aligned with business and IT governance. Options A and D do not belong: immediate implementation without review (A) bypasses the required assessment and authorization steps, and bypassing testing for urgent changes (D) skips validation that the change works as intended and does not introduce regressions, both of which violate core change management controls even under emergency change procedures.

Answer

Immediate implementation without review

Answer

Bypassing testing for urgent changes

Question 7

What is the primary purpose of a chargeback model for IT services?

Accepted Answer

To provide transparency and encourage efficient use of IT resources. Chargeback models allocate IT costs to business units based on usage, promoting accountability and cost awareness.

Answer

To increase the IT budget

Answer

To simplify IT financial management

Answer

To centralize IT decision-making

Question 8

During which phase of the audit process does the auditor perform procedures such as inquiry, observation, and inspection?

Accepted Answer

Fieldwork. Fieldwork is the phase where the auditor executes the planned audit procedures, including inquiry, observation, inspection, reperformance, and data analysis, to gather evidence and evaluate controls. Planning is about understanding the process and designing procedures; reporting is about communicating results; follow-up addresses remediation. Therefore, the procedures listed are performed during fieldwork.

Answer

Follow-up

Answer

Reporting

Answer

Planning

Question 9

An organization is considering whether to build a custom application or purchase a commercial off-the-shelf (COTS) product. Which of the following factors would most strongly support a build decision?

Accepted Answer

The required functionality is unique to the organization's competitive advantage.. When the required functionality is unique to the organization's competitive advantage, building a custom application is justified because COTS products cannot provide differentiated capabilities that create strategic value. Custom development allows the organization to tailor features, integrate proprietary processes, and maintain exclusive control over the intellectual property. This factor most strongly supports a build decision because it directly ties the software to business differentiation.

Answer

Short time to market is critical.

Answer

The vendor offers a robust service-level agreement (SLA).

Answer

The organization has limited in-house development resources.

Question 10

According to ITIL 4, which guiding principle emphasizes understanding the current state before making improvements?

Accepted Answer

Start where you are. ITIL 4's guiding principle 'Start where you are' advises assessing the current state before embarking on improvements.

Answer

Progress iteratively

Answer

Focus on value

Answer

Keep it simple and practical