CISA Practice Test 40 — 15 Questions

Question 1

A company is developing a new financial application. Which THREE of the following are valid reasons to involve internal audit during the development phase?

Accepted Answer

To ensure compliance with regulatory requirements. Options A, C, and E are correct because internal audit can provide assurance on compliance, internal controls, and security. Option B is incorrect because designing architecture is not an audit function. Option D is incorrect because approving requirements is a management responsibility.

Answer

To design the application architecture

Answer

To approve all user requirements

Question 2

A company is outsourcing software development. What is the IS auditor's PRIMARY concern?

Accepted Answer

Protection of intellectual property and data. Protection of intellectual property and data is the primary concern for an IS auditor when outsourcing software development because it represents the highest risk to the organization. While vendor methodology, financial stability, and SLA compliance are important, they are secondary to ensuring that sensitive data and proprietary information are safeguarded against unauthorized access or disclosure.

Answer

The vendor's development methodology

Answer

The vendor's financial stability

Answer

Compliance with service level agreements

Question 3

During a post-implementation review, an IS auditor identifies that the system's actual transaction processing time is significantly higher than the benchmark specified in the service level agreement (SLA). The vendor claims it is due to inadequate network bandwidth provided by the client. What should the auditor do first?

Accepted Answer

Review the SLA to determine responsibility for network performance. The SLA should define responsibilities for network performance. The auditor should first review the SLA to determine who is responsible. Option B is incorrect because recommending bandwidth increase without verifying responsibility is premature. Option C is incorrect because escalation to senior management is not the first step; review of SLA should occur first. Option D is incorrect because independent performance testing may be unnecessary if the SLA clarifies responsibility.

Answer

Recommend increasing network bandwidth

Answer

Escalate the issue to senior management

Answer

Perform independent performance testing

Question 4

During an audit of an organization's disaster recovery plan (DRP), the IS auditor finds that the plan was last tested 18 months ago and no test results were documented. What should the auditor recommend?

Accepted Answer

Conduct a DRP test and document the results within the next quarter. A recent test with documented results provides assurance. Option A is incorrect because testing frequency should be based on risk, not necessarily semiannual. Option B is wrong because the recommendation should address the lack of testing and documentation. Option D is incorrect because that is management's role; the auditor recommends.

Answer

Test the DRP semiannually

Answer

Document the results of all past tests

Answer

Assign responsibility for DRP testing to the IT manager

Question 5

An IS auditor is selecting an appropriate audit sample. Which THREE of the following are factors that affect the sample size?

Accepted Answer

Tolerable error rate. Sample size is influenced by the expected error rate, tolerable error rate, and confidence level.

Answer

Sampling interval

Answer

Population standard deviation

Question 6

An IS auditor is evaluating the use of continuous auditing techniques. Which of the following is the most significant benefit of implementing continuous monitoring over traditional periodic audits?

Accepted Answer

Timely detection of control deficiencies. Continuous monitoring provides timely detection of control deficiencies, enabling faster remediation.

Answer

Reduced need for substantive testing

Answer

Elimination of control risk assessments

Answer

Automated generation of audit reports

Question 7

Which of the following is the PRIMARY objective of an operational audit?

Accepted Answer

To assess the efficiency and effectiveness of operations. The primary objective of an operational audit is to assess the efficiency and effectiveness of operations. Option D correctly identifies this purpose. Option A (security vulnerabilities) is the focus of a security audit, Option B (financial reporting) is the focus of a financial audit, and Option C (compliance with laws) is the focus of a compliance audit. Therefore, only D accurately reflects the objective of an operational audit.

Answer

To identify security vulnerabilities

Answer

To evaluate financial reporting

Answer

To verify compliance with laws

Question 8

An IS auditor is reviewing a request for proposal (RFP) for a new system. Which TWO elements should be included in the RFP?

Accepted Answer

Vendor's financial stability information. In an RFP for a new system, including the vendor's financial stability information (B) is critical to assess the vendor's long-term viability and ability to support the system over its lifecycle. This helps mitigate the risk of vendor failure or bankruptcy, which could disrupt operations and leave the organization with an unsupported system.

Answer

Confidentiality agreement

Answer

Sample contract terms

Answer

Employee resumes for the proposed team

Question 9

An organization uses a hot site for disaster recovery. During a recent test, the hot site did not have the latest version of the application software. What is the MOST likely cause?

Accepted Answer

Inadequate change management procedures. The hot site missing the latest application version points to a failure in ensuring updates are deployed to the DR environment. This is a change management failure, as proper procedures would require that software changes be replicated to the hot site. Option B (failure to synchronize data) deals with data, not application software. Option C (lack of backup media) relates to data backups. Option D (insufficient bandwidth) affects data replication speed, not version updates. Therefore, inadequate change management procedures (option A) are the most likely cause.

Answer

Failure to synchronize data

Answer

Lack of backup media

Answer

Insufficient bandwidth

Question 10

A company's backup policy requires daily full backups to tape and offsite storage. After a ransomware attack, the IT team discovers that the latest backup set is corrupted. Which of the following controls would have BEST prevented this?

Accepted Answer

Implementation of immutable backup storage. Immutable backup storage ensures backups cannot be altered or deleted, preventing corruption from ransomware. Encryption protects confidentiality, not integrity; logging detects but does not prevent; restoration testing detects corruption after the fact.

Answer

Encryption of backup tapes

Answer

Periodic restoration testing

Answer

Journaling of backup logs

Question 11

An organization wants to ensure that IT performance is measured against strategic goals. Which tool is BEST suited?

Accepted Answer

Balanced scorecard. A balanced scorecard translates strategic goals into performance metrics across financial, customer, internal process, and learning perspectives. Gantt charts, SWOT analysis, and Pareto charts are not designed for this purpose.

Answer

Pareto chart

Answer

SWOT analysis

Answer

Gantt chart

Question 12

An organization is implementing IT governance based on COBIT. Which THREE of the following are enablers? (Select exactly three.)

Accepted Answer

Organizational structures. COBIT defines enablers as factors that influence the effectiveness of governance. Processes, organizational structures, and culture/ethics/behavior are key enablers. Network infrastructure and application software are resources, not enablers in the COBIT framework.

Answer

Application software

Answer

Network infrastructure

Question 13

An organization is implementing COBIT 2019. Which TWO of the following are governance enablers? (Choose two.)

Accepted Answer

Organizational structures. Options C and E are correct because organizational structures and culture, ethics, and behavior are governance enablers in COBIT 2019. Option A (Hardware configuration) is incorrect as it is an implementation detail, not a governance enabler. Option B (Project schedule) is incorrect as it is a project management artifact. Option D (Network performance) is incorrect as it is operational.

Answer

Hardware configuration

Answer

Project schedule

Answer

Network performance

Question 14

A large enterprise is assessing its IT governance maturity. Which THREE of the following are indicators of a mature governance process? (Select exactly three.)

Accepted Answer

There is a formal IT governance committee. Mature governance involves board-level review of IT strategy, linking IT metrics to business outcomes, and having a formal governance committee. Decisions in silos and historical budget allocation are signs of low maturity.

Answer

IT decisions are made in silos

Answer

IT budget is allocated based on historical spending

Question 15

A multinational corporation has defined its risk appetite as 'moderate' for IT investments. The IT steering committee is evaluating a new project with potential high returns but also significant cybersecurity risks. The project's risk profile is assessed as 'high' by the risk management team. What should the committee do FIRST?

Accepted Answer

Request the project team to identify risk mitigation measures.. The correct first step. When a project's risk profile exceeds the defined risk appetite, the committee should not immediately reject or approve it. Instead, they should first explore whether risk mitigation measures can reduce the risk to an acceptable level. This aligns with governance best practices to balance risk and reward. Option B is premature without assessing mitigation. Option C escalates too early before considering mitigations. Option D rejects the opportunity without considering potential mitigation, which may discard valuable projects.

Answer

Approve the project but increase monitoring.

Answer

Escalate the decision to the board of directors.

Answer

Reject the project immediately as it exceeds risk appetite.