CISA Practice Test 41 — 15 Questions

Question 1

A system has a Mean Time Between Failures (MTBF) of 200 hours and a Mean Time To Repair (MTTR) of 20 hours. What is the availability of the system?

Accepted Answer

90.9%. Availability is calculated as MTBF / (MTBF + MTTR). With MTBF = 200 hours and MTTR = 20 hours, availability = 200 / (200 + 20) = 200/220 = 0.90909..., which rounds to 90.9%. This formula reflects the proportion of total time the system is operational versus the total time including repair.

Answer

95.0%

Answer

91.0%

Answer

90.0%

Question 2

An organization is implementing an ERP system and is concerned about segregation of duties conflicts. What is the most effective control to address this risk during implementation?

Accepted Answer

Implementing role-based access controls. Role-based access controls (RBAC) are the most effective control to address segregation of duties conflicts during ERP implementation because they allow the organization to define roles with specific permissions and assign users to roles, preventing conflicting access. RBAC enforces SoD by design, ensuring that no single user has incompatible duties.

Answer

Performing a data migration risk assessment

Answer

Reviewing vendor SOC 2 reports

Answer

Conducting user acceptance testing

Question 3

An IS auditor is reviewing a project that uses an iterative SDLC approach. Which THREE controls should the auditor expect to see in place during the development iterations? (Select THREE)

Accepted Answer

Code reviews. In an iterative SDLC, controls must fit each short development cycle, so the auditor should expect code reviews (B), because peer inspection of each increment catches defects and insecure coding early before they propagate into later iterations. Static application security testing (D) is also expected, since SAST tools scan source code or bytecode for vulnerabilities such as injection flaws during development, aligning with the shift-left security principle in iterative builds. Unit testing (E) is likewise a core iterative control, as developers verify individual functions or modules after each change, providing fast feedback and regression protection within the iteration. Formal sign-off on requirements before each iteration (A) is not typical because iterative methods embrace evolving requirements and continuous stakeholder feedback rather than frozen, pre-iteration approvals. User acceptance testing before each iteration (C) is also not expected, since UAT is normally performed at the end of a release or increment on a potentially shippable product, not before every development iteration.

Answer

Formal sign-off on requirements before each iteration

Answer

User acceptance testing (UAT) before each iteration

Question 4

A multinational corporation's data center in the European Union (EU) stores personal data of EU citizens. The company must comply with the General Data Protection Regulation (GDPR), which requires that personal data be protected and that data subjects have the right to erasure ('right to be forgotten'). The company's IT team uses a centralized identity management system that stores user credentials and personal data in an active directory (AD) forest. The AD forest is replicated across multiple data centers worldwide, including a non-EU country. The data protection officer (DPO) is concerned that personal data might be inadvertently replicated to jurisdictions without adequate protection. Which of the following is the most effective way to address this concern?

Accepted Answer

Implement data residency controls to ensure EU personal data is only stored and processed within the EU. GDPR mandates that personal data of EU citizens must not be transferred to countries without adequate protection unless specific safeguards are in place. Implementing data residency controls ensures that EU personal data is stored and processed only within the EU, preventing inadvertent replication to non-EU jurisdictions via AD replication. This directly addresses the DPO's concern by enforcing geographic boundaries on data storage and processing.

Answer

Pseudonymize all personal data before storing it in AD

Answer

Encrypt all personal data at rest and in transit, with keys held solely within the EU

Answer

Obtain explicit consent from all EU data subjects for international data transfer

Question 5

An IS auditor is reviewing the logical access controls for a cloud-based HR system. The system contains sensitive employee data. The auditor notes that user provisioning is performed by the HR department without IT involvement, and there is no formal access request or approval process. Which THREE of the following are the MOST significant risks?

Accepted Answer

There is no audit trail of who granted access and why. Option A is correct because provisioning without a formal access request or approval process means there is no documented record of who authorized or granted each user's access, eliminating the audit trail needed to trace accountability for access decisions. Option B is correct because HR performing user provisioning without IT involvement removes the segregation of duties between the department that owns the employee data and the function that administers system access, allowing a single group to both request and grant privileges. Option D is correct because without a formal request and approval workflow, there is no validation against job roles, so users can be provisioned with rights exceeding their job requirements (excessive privileges). Options C and E are not among the most significant risks here because password policy enforcement and account lockout after failed logins are authentication controls configured within the system itself, and nothing in the scenario indicates these controls are absent or affected by the HR provisioning process.

Answer

Password policies may not be enforced

Answer

User accounts may not be locked after multiple failed login attempts

Question 6

An IT auditor is reviewing capacity management. The server team monitors CPU utilization and disk space. They receive alerts when thresholds are exceeded. Which practice is most effective for proactive capacity planning?

Accepted Answer

Analyzing historical utilization trends. Analyzing historical utilization trends allows the team to identify growth patterns, seasonal peaks, and long-term capacity exhaustion points before thresholds are breached. This is the essence of proactive capacity planning: using past data to predict future demand rather than reacting to alerts. Threshold alerts and manual checks are reactive or operational, not strategic planning practices.

Answer

Performing weekly manual checks

Answer

Increasing server resources quarterly

Answer

Setting threshold alerts at 90% utilization

Question 7

An IS auditor is reviewing firewall rule sets and discovers a rule that permits any source IP to access the internal database server on TCP port 1433 (Microsoft SQL). The rule was documented as a temporary measure but has been in place for 18 months. What is the auditor's BEST course of action?

Accepted Answer

Determine if there is a business justification for the rule and, if not, recommend removal or restriction to specific IPs. The auditor's best course of action is to determine if there is a business justification for the rule and, if not, recommend removal or restriction to specific IPs, because audit findings must be based on evidence and business context rather than assumptions. A rule permitting any source IP to access TCP port 1433 is a significant security risk, but the auditor must first understand why it exists before recommending action. This approach ensures the recommendation is appropriate, justified, and aligned with business needs.

Answer

Report the issue to senior management as a critical finding

Answer

Recommend immediate removal of the rule

Answer

Accept the risk as a compensating control

Question 8

An IS auditor is reviewing an organization's vulnerability management program. The auditor notes that a critical vulnerability in a key application has not been patched for 90 days, and there is no documented risk acceptance. What should the auditor do FIRST?

Accepted Answer

Determine if compensating controls exist to mitigate the vulnerability. The auditor should first determine if compensating controls exist to mitigate the vulnerability, because the presence of effective compensating controls may reduce the residual risk to an acceptable level even without patching. This step gathers evidence before concluding on the adequacy of risk treatment. Only after understanding the control environment can the auditor assess whether the lack of patching and risk acceptance constitutes a significant finding.

Answer

Report the finding as a non-compliance with the patch management policy

Answer

Discuss with management the absence of a risk acceptance

Answer

Escalate the issue to senior management immediately

Question 9

During a change management board (CAB) meeting, a proposed change to the network firewall configuration is discussed. The change is considered low risk and pre-approved. Which type of change does this represent?

Accepted Answer

Standard change. A standard change is a pre-approved, low-risk change that follows a documented procedure and does not require additional review or approval from the change management board (CAB). Since the firewall change is described as low risk and pre-approved, it fits the definition of a standard change. Standard changes are routine and repeatable, allowing them to bypass the full CAB review process, which is reserved for normal or major changes.

Answer

Emergency change

Answer

Major change

Answer

Normal change

Question 10

A company uses a RAID 5 array for its file server. One disk fails, and the system continues to operate. However, during the rebuild process, a second disk fails. What is the likely consequence?

Accepted Answer

Data loss occurs. RAID 5 tolerates exactly one disk failure by storing distributed parity across all member disks. When one disk fails, the array enters degraded mode and can still serve data by reconstructing missing blocks from parity. However, if a second disk fails before the first is rebuilt, the parity information is insufficient to reconstruct two missing data sets, resulting in complete data loss for the array.

Answer

Performance degrades but data remains intact

Answer

Data is still available from parity

Answer

The system automatically switches to a hot spare

Question 11

An IS auditor is testing the effectiveness of a preventive control that rejects invalid transactions. The auditor uses a computer-assisted audit technique (CAAT) to create a set of test transactions. What is the primary risk associated with this approach?

Accepted Answer

Test transactions may be processed as real transactions. The primary risk is that test transactions may be processed as real transactions if the CAAT does not properly isolate them from the production environment. This could result in unintended data corruption, financial misstatements, or operational disruptions. The auditor must ensure that test data is clearly flagged or run in a separate test environment to avoid integration with live processing.

Answer

The audit may disrupt system performance

Answer

Test transactions may not be representative

Answer

The CAAT may corrupt production data

Question 12

During the feasibility study for a new inventory system, the project team identifies that the expected benefits are significantly lower than the initial estimates. What is the MOST appropriate action for the IS auditor to recommend?

Accepted Answer

Re-evaluate the feasibility study and update the business case.. When expected benefits fall significantly below initial estimates, the IS auditor should recommend re-evaluating the feasibility study and updating the business case. This ensures that the project's justification is based on current, accurate data before proceeding, which is a key control in the systems development lifecycle (SDLC) to prevent investment in a project that may no longer deliver adequate value.

Answer

Proceed with the project as planned, focusing on cost reduction.

Answer

Cancel the project immediately and document lessons learned.

Answer

Continue with the project but postpone the benefits realization.

Question 13

An IS auditor is planning an audit of a small organization with limited IT staff. Which approach is most appropriate?

Accepted Answer

Use a risk-based approach to focus on high-risk areas. A risk-based approach is most appropriate because it directs limited audit resources toward the areas of highest risk and impact, which is essential when the organization has constrained IT staffing. This aligns with ISACA's risk-based auditing methodology, ensuring audit effort is proportional to risk rather than spread uniformly or reduced arbitrarily.

Answer

Rely solely on inquiry to reduce workload

Answer

Postpone the audit until more staff are available

Answer

Audit all areas equally to ensure full coverage

Question 14

Which of the following is the PRIMARY benefit of using a prototype during system development?

Accepted Answer

Clarifying user requirements. A prototype is a working model built early to elicit and validate user requirements before full-scale development. Its primary benefit is clarifying and confirming what users actually need, reducing the risk of building the wrong system.

Answer

Accelerating coding

Answer

Minimizing documentation

Answer

Reducing development cost

Question 15

Which of the following is the PRIMARY objective of an operational audit?

Accepted Answer

To assess the efficiency and effectiveness of operations. The primary objective of an operational audit is to assess the efficiency and effectiveness of an organization's operations, including whether resources are used optimally and whether operational goals are met. It examines processes, controls, and performance rather than focusing solely on financial statements or legal compliance. This distinguishes it from financial, compliance, and security audits.

Answer

To identify security vulnerabilities

Answer

To evaluate financial reporting

Answer

To verify compliance with laws