CISA Practice Test 40 — 15 Questions

Question 1

An IS auditor is planning an audit of a financial application. The auditor wants to ensure that audit effort is focused on areas with the highest risk. Which approach should the auditor adopt?

Accepted Answer

Risk-based audit approach. A risk-based audit approach prioritizes high-risk areas for more intensive testing, aligning with ISACA standards.

Answer

Substantive approach

Answer

Control self-assessment approach

Answer

Compliance-based approach

Question 2

An IS auditor is reviewing automated job scheduling controls. A critical batch job failed due to a dependency on a previous job that had not completed. The system did not alert operations staff. Which control weakness is most significant?

Accepted Answer

Missing dependency management in job scheduling.. The job failed because it ran before its prerequisite job completed, which is a classic dependency management failure in job scheduling. The scheduler should have enforced the dependency so the downstream job waits for the upstream job's successful completion. The absence of an alert is a secondary symptom of the same missing control, but the root control weakness is the lack of dependency management.

Answer

Insufficient capacity management to handle job load.

Answer

Inadequate rerun procedures for the failed job.

Answer

Lack of a known error database entry for this issue.

Question 3

An IS auditor is evaluating the effectiveness of a backup strategy for a critical database. Which TWO of the following are essential controls to ensure data recoverability?

Accepted Answer

Storing backups offsite. Option A (storing backups offsite) is essential because it protects the backup copies from the same physical disaster, theft, or site-wide outage that could destroy the primary database and any locally retained media, thereby preserving recoverability. Option C (performing regular restoration tests) is essential because a backup is only proven recoverable when it can actually be restored; periodic restore drills validate media integrity, backup completeness, and the recovery procedures and RTO/RPO assumptions. The unmarked options do not belong: encrypting backup tapes (B) is a confidentiality control that protects data at rest but does not by itself ensure the data can be recovered, labeling tapes with dates (D) is merely a media-management aid, and using high-capacity media (E) is a capacity/efficiency choice unrelated to recoverability.

Answer

Encrypting backup tapes

Answer

Labeling tapes with dates

Answer

Using high-capacity media

Question 4

Which type of audit is primarily concerned with evaluating the efficiency and effectiveness of operations?

Accepted Answer

Operational audit. An operational audit evaluates the efficiency and effectiveness of an organization's operations, including processes, resource utilization, and goal achievement. It goes beyond mere compliance or financial accuracy to assess whether things are being done well. This is distinct from financial, compliance, and IS audits, which focus on different objectives.

Answer

Financial audit

Answer

Compliance audit

Answer

IS audit

Question 5

An organization is replacing its legacy customer relationship management (CRM) system. Which of the following is the MOST important control to ensure data integrity during the data conversion process?

Accepted Answer

Perform reconciliation of total record counts and key field sums before and after conversion.. Reconciliation of total record counts and key field sums before and after conversion is the most direct control to ensure data integrity during data conversion. It verifies that all records were transferred and that key values (e.g., totals, hashes) match, detecting any loss or alteration. While encryption, UAT, and data mapping are important, they do not provide the same level of assurance that the data itself is complete and accurate after conversion.

Answer

Implement encryption for data in transit during migration.

Answer

Conduct user acceptance testing on the new system.

Answer

Ensure data mapping documents are approved by business owners.

Question 6

An IS auditor is evaluating a system development project that uses an outsourced team. The contract allows the vendor to reuse some of the developed code in other projects. What is the auditor's PRIMARY concern?

Accepted Answer

The organization may lose control of intellectual property.. The contract clause allowing the vendor to reuse developed code in other projects directly transfers ownership or licensing rights of the intellectual property (IP) to the vendor. This means the organization may lose exclusive control over the code, potentially allowing competitors to access proprietary logic or algorithms. The IS auditor's primary concern is safeguarding the organization's IP assets, as this loss can have long-term strategic and competitive implications.

Answer

The vendor might not deliver on time.

Answer

The vendor may not maintain the code after the project ends.

Answer

The vendor may use substandard development practices.

Question 7

When implementing a commercial off-the-shelf (COTS) system, what is the MOST important factor?

Accepted Answer

Alignment with business processes with minimal modification. When implementing a commercial off-the-shelf (COTS) system, the most important factor is alignment with business processes with minimal modification. COTS systems are designed to provide standardized functionality; extensive customization undermines the core benefits of reduced cost, faster deployment, and easier vendor support. Modifying the COTS codebase creates a 'forked' version that complicates patch management, increases testing overhead, and risks incompatibility with future vendor updates, directly contradicting the acquisition rationale.

Answer

Customization to fit all requirements

Answer

Lowest total cost

Answer

Vendor reputation

Question 8

An IS auditor is evaluating the design of controls over a critical financial application. The auditor performs a walkthrough and identifies that a control is missing but management has compensating controls. Which of the following is the auditor's BEST next step?

Accepted Answer

Test the compensating controls to determine if they adequately mitigate the risk.. When a control gap is identified but management asserts compensating controls exist, the auditor cannot simply accept the assertion — the auditor must obtain evidence that the compensating controls actually operate effectively and reduce the risk to an acceptable level. Testing the compensating controls is the only way to determine whether the residual risk is adequately mitigated before concluding on the control environment.

Answer

Increase the sample size for substantive testing to compensate.

Answer

Immediately report the missing control as a material weakness.

Answer

Ignore the missing control since compensating controls exist.

Question 9

An organization is implementing a new identity management system. Which THREE of the following are essential requirements for the system?

Accepted Answer

Segregation of duties enforcement.. Segregation of duties enforcement is essential because it ensures that no single user has excessive privileges that could lead to fraud or error. In an identity management system, this is implemented through role-based access control (RBAC) and access review workflows, preventing conflicts of interest by separating critical functions like user creation, approval, and access assignment.

Answer

Single sign-on capability.

Answer

Support for biometric authentication.

Question 10

During a vendor evaluation for a critical system, the IS auditor notes that the vendor's SOC 2 report includes an adverse opinion. What should be the auditor's PRIMARY recommendation?

Accepted Answer

Evaluate compensating controls or seek an alternative vendor. An adverse SOC 2 opinion means the service auditor found that controls were not suitably designed or operating effectively, so the vendor cannot be relied upon to protect the organization's data. The auditor's primary recommendation must therefore be to evaluate compensating controls the organization can apply or to seek an alternative vendor, since accepting the vendor as-is would transfer unacceptable risk.

Answer

Negotiate a lower price to offset the risk

Answer

Accept the risk because the vendor is well-known

Answer

Request a customized SOC 2 report

Question 11

An IS auditor is reviewing the system design phase of a project. Which of the following activities is most important to ensure that security is adequately addressed?

Accepted Answer

Conducting a threat modeling exercise. Threat modeling is a structured, design-phase activity that systematically identifies threats, attack surfaces, and mitigations before code is written. It is the most important activity to ensure security is adequately addressed in system design because it directly influences architecture, trust boundaries, and control selection. Data flow diagrams support threat modeling but are an input, not the primary security assurance activity.

Answer

Creating a data flow diagram

Answer

Developing a detailed project schedule

Answer

Reviewing the budget for security tools

Question 12

Which of the following is a key objective of a post-implementation review?

Accepted Answer

To determine if the system meets user requirements. The key objective of a post-implementation review (PIR) is to determine whether the system meets user requirements and delivers the expected benefits. It evaluates the project's success against its original objectives, including functionality, performance, and user satisfaction. This helps the organization learn and improve future projects.

Answer

To conduct penetration testing

Answer

To approve the project budget

Answer

To select the vendor

Question 13

An IT department uses a balanced scorecard to measure performance. Which metric would BEST reflect the 'customer perspective'?

Accepted Answer

User satisfaction survey results. The customer perspective focuses on user satisfaction and service responsiveness. Option A is incorrect as training hours relate to learning and growth perspective. Option B is incorrect as system uptime is an internal process metric. Option D is incorrect as project completion rate is an internal efficiency metric.

Answer

Training hours per employee

Answer

System uptime percentage

Answer

Project completion rate

Question 14

During an ERP implementation, data migration is a critical activity. Which of the following controls would be most effective in ensuring the accuracy and completeness of migrated data?

Accepted Answer

Performing a trial migration and reconciling the results. A trial migration followed by reconciliation is the most effective control because it validates the accuracy and completeness of the migrated data by comparing source and target records before the final cutover. Reconciliation identifies discrepancies, missing records, and transformation errors, allowing correction before go-live. This directly addresses both accuracy and completeness.

Answer

Using automated data extraction tools

Answer

Assigning a data owner for each data field

Answer

Running parallel processing for one month

Question 15

An organization is implementing a new CRM system using an iterative development methodology. The IS auditor wants to verify that appropriate controls are in place. Which THREE of the following are essential controls for iterative development? (Select THREE.)

Accepted Answer

Risk assessment at the start of each iteration. Option B is correct because iterative development delivers functionality in short cycles, so a risk assessment must be repeated at the start of each iteration to identify new or changing risks (e.g., scope creep, integration issues, security flaws) before that increment is built. Option C is correct because iterative projects produce frequent code and artifact changes across parallel workstreams, making version control and configuration management essential to maintain baselines, traceability, and rollback capability. Option E is correct because iterative methodologies depend on continuous stakeholder involvement, and reviews/feedback after each iteration validate that the evolving product meets business needs and allow course corrections early. Option A is not appropriate because iterative development deliberately avoids freezing a complete requirements document up front; requirements evolve through iterations. Option D is not essential because requiring a change control board for every change would impose a heavyweight, waterfall-style gate that conflicts with the speed and flexibility of iterative delivery, where many changes are handled within the iteration backlog.

Answer

Formal sign-off on a complete requirements document before development begins

Answer

A mandatory change control board for every change