CISA Practice Test 42 — 15 Questions

Question 1

An IT governance framework has been implemented, but the board is not receiving regular reports on IT performance. Which of the following is the BEST course of action?

Accepted Answer

Develop a dashboard that presents key IT metrics to the board.. The best course of action because a dashboard provides a regular, concise view of key IT metrics for the board, directly addressing the lack of reporting. Option A (risk assessment) focuses on risk rather than reporting. Option C (balanced scorecard) is a broader strategic alignment tool. Option D (assigning a CIO) changes reporting structure but does not ensure regular reports.

Answer

Conduct an IT risk assessment to identify critical areas.

Answer

Implement an IT balanced scorecard that aligns with corporate strategy.

Answer

Assign a chief information officer (CIO) to report directly to the board.

Question 2

During a post-implementation review of a financial system, an IS auditor finds that several critical reports are not being generated correctly. Which of the following should the auditor recommend FIRST?

Accepted Answer

Review the system configuration and compare with user requirements.. Reviewing the system configuration against user requirements (option B) is the correct first step because it directly addresses the root cause of incorrect report generation by verifying alignment with documented requirements. Conducting new user acceptance testing (option A) is premature without understanding the configuration issue; disabling reports (option C) and patching (option D) are reactive and skip necessary diagnosis.

Answer

Conduct a new round of user acceptance testing.

Answer

Disable the incorrect reports and create manual workarounds.

Answer

Immediately patch the system to fix the report generation.

Question 3

Refer to the exhibit. An auditor finds that the file 'sensitive.txt' has world-writable permissions. Which of the following is the most appropriate remediation action?

Accepted Answer

Remove world-writable permissions using chmod 644.. The file 'sensitive.txt' has world-writable permissions, meaning any user on the system can modify or delete it. The most direct and appropriate remediation is to remove the world-writable permission using `chmod 644`, which sets the file to owner read-write, group read, and others read. This eliminates the security risk while preserving necessary access for the owner and group.

Answer

Encrypt the file using GnuPG to protect its contents.

Answer

Apply an ACL to restrict access only to specific users.

Answer

Change the file owner to a different user using chown.

Question 4

A small business wants to protect customer data stored on a local file server. Which of the following is the MOST cost-effective control to prevent unauthorized access?

Accepted Answer

Configure file-level permissions. Configuring file-level permissions (e.g., NTFS permissions on Windows or POSIX ACLs on Linux) is the most cost-effective control because it directly restricts which users or groups can read, write, or modify specific files and folders on the server. This granular access control prevents unauthorized access without requiring additional hardware or complex management, making it ideal for a small business with limited budget.

Answer

Enable detailed audit logs

Answer

Implement full-disk encryption

Answer

Deploy biometric authentication

Question 5

A hospital is implementing a new electronic health record (EHR) system. The project team includes clinicians and IT staff. During integration testing, the system fails to exchange lab results with the existing legacy system due to format mismatches. The IT team suggests developing a custom interface. The clinical team is concerned that any custom solution may not comply with health data privacy regulations. The project sponsor pressures the team to quickly fix the issue to avoid delays. The IS auditor is reviewing this situation. What is the MOST appropriate action for the auditor to recommend?

Accepted Answer

Conduct a privacy impact assessment on the custom interface and ensure controls are in place before deployment.. The custom interface introduces a new data exchange path between the EHR and legacy system. Without a privacy impact assessment (PIA), the auditor cannot verify that the interface will enforce encryption, access controls, and audit logging required by HIPAA or similar regulations. A PIA identifies risks like unauthorized disclosure of protected health information (PHI) during format translation, ensuring controls are implemented before deployment. This aligns with the IS auditor's role to safeguard data privacy, not just meet deadlines.

Answer

Proceed with the custom interface to meet the project deadline.

Answer

Reject the custom interface and delay the project until a standard solution is found.

Answer

Replace the legacy system with a new one that is compatible.

Question 6

A company is implementing IT governance based on COBIT 2019. Which of the following design factors would have the GREATEST impact on the governance system design?

Accepted Answer

The industry and regulatory environment.. According to COBIT 2019, the industry and regulatory environment is a key design factor that significantly influences the governance system design, as it dictates compliance and risk management requirements. Options A, B, and C are factors but have a lesser impact compared to industry and regulatory considerations.

Answer

The IT infrastructure complexity.

Answer

The size of the organization.

Answer

The number of IT staff.

Question 7

An IS auditor is using statistical sampling to test a population of 10,000 transactions. The desired confidence level is 95%, and the tolerable error rate is 5%. Which of the following factors would MOST likely increase the required sample size?

Accepted Answer

An increase in the expected error rate to 6%. An increase in the expected error rate increases the required sample size because the sample size formula includes the term p × (1-p), where p is the expected error rate. As p increases from 5% to 6%, this product increases, raising the variance and thus the sample size. While a decrease in tolerable error rate also increases sample size, the question asks for the factor that most likely increases sample size in the context of audit sampling. An increase in expected error rate directly signals higher risk, making it the primary driver for increasing sample size. Therefore, option A is correct.

Answer

A decrease in the tolerable error rate to 3%

Answer

A decrease in the confidence level to 90%

Answer

An increase in the population size to 15,000

Question 8

An IS auditor is planning an audit of a newly implemented ERP system. The auditor wants to ensure that the audit covers critical controls. Which of the following is the most appropriate first step in the audit planning process?

Accepted Answer

Conduct a risk assessment of the ERP implementation.. C is correct because the IS auditor must first conduct a risk assessment of the ERP implementation to identify and prioritize the critical controls specific to the new system. This step ensures that the audit scope is aligned with the highest risks, such as segregation of duties conflicts, interface integrity, and configuration vulnerabilities, before any detailed planning occurs.

Answer

Interview the system administrator.

Answer

Review prior audit workpapers.

Answer

Develop a detailed audit program.

Question 9

An organization is implementing a data loss prevention (DLP) solution. Which TWO of the following are key considerations for effective DLP deployment?

Accepted Answer

Implementing DLP in monitoring mode initially to baseline traffic. Options A and D are correct. A: Implementing DLP in monitoring mode initially allows baselining of normal traffic, reducing false positives when policies are enforced later. D: Classifying data based on sensitivity and criticality is fundamental for defining appropriate DLP policies and rules. B is incorrect because policies should be defined before deploying agents to ensure targeted coverage. C is incorrect because encryption is a separate control; DLP can monitor and protect data without requiring encryption of all data. E is incorrect because DLP does not replace user security awareness training; it is a technical control that complements training.

Answer

Deploying DLP agents on all endpoints before defining policies

Answer

Encrypting all data at rest and in transit as a prerequisite

Answer

Replacing user security awareness training with automated DLP

Question 10

Which THREE of the following are essential components of a change management process?

Accepted Answer

Impact analysis. Impact analysis (B) is essential because it evaluates the potential effects of a proposed change on system functionality, security, and performance before implementation. This ensures that risks are identified and mitigated, preventing unintended disruptions to production environments. Without impact analysis, changes could introduce vulnerabilities or cause system outages, violating IT governance principles.

Answer

Immediate implementation without review

Answer

Bypassing testing for urgent changes

Question 11

An organization is planning to purchase a cloud-based HR system. Which THREE of the following should be included in the vendor contract to ensure adequate control and oversight? (Select three.)

Accepted Answer

Right to audit the vendor's controls. A right to audit the vendor's controls (Option B) is essential for ensuring that the cloud-based HR system's security and operational controls are functioning as agreed. This contractual clause allows the organization to verify compliance with policies, regulations, and the vendor's own security assertions, such as SOC 2 Type II reports or ISO 27001 certifications, through direct examination or independent third-party assessments.

Answer

A list of all subprocessors

Answer

A fixed-price payment schedule

Question 12

An IS auditor reviews the disposal process of hard drives. Which of the following methods provides the HIGHEST assurance that data cannot be recovered?

Accepted Answer

Physical shredding.. Physical shredding physically destroys the media, making data recovery virtually impossible. Overwriting with zeros may leave residual data due to bad sectors or advanced recovery techniques. Degaussing is effective on magnetic media but not on SSDs. Quick format only removes file pointers, leaving data recoverable.

Answer

Overwriting with zeros.

Answer

Degaussing.

Answer

Quick format.

Question 13

An organization is implementing a new identity management system. Which testing approach is MOST effective for verifying access controls?

Accepted Answer

User acceptance testing including role-based test cases. User acceptance testing (UAT) with role-based test cases is the most effective approach because it directly validates that the identity management system enforces the correct access controls for each user role in real-world scenarios. Unlike lower-level tests, UAT involves actual users executing role-specific transactions to confirm that permissions, segregation of duties, and policy rules are properly implemented. This ensures that the system behaves as intended from an end-user and auditor perspective, which is critical for compliance and security.

Answer

Regression testing

Answer

Unit testing

Answer

System integration testing

Question 14

An organization is implementing a new IT governance framework. Which of the following is the PRIMARY benefit of aligning IT strategy with business strategy?

Accepted Answer

Improved resource allocation. The primary benefit of aligning IT strategy with business strategy is improved resource allocation (Option B). This alignment ensures that IT investments and projects are directed toward activities that directly support business goals, maximizing value and minimizing waste. While increased technical efficiency (Option A), reduced IT costs (Option C), and enhanced security posture (Option D) are possible outcomes, they are not the primary benefit; they are secondary benefits that may result from proper alignment.

Answer

Increased technical efficiency

Answer

Reduced IT costs

Answer

Enhanced security posture

Question 15

An IT steering committee is reviewing a proposal for a new customer relationship management (CRM) system. What is the committee's MOST important role?

Accepted Answer

Ensuring alignment with business objectives. The IT steering committee's most important role is to ensure that proposed IT projects align with the organization's business objectives. Option A is incorrect as technical specifications are typically reviewed by technical architects or engineering teams. Option B is incorrect because vendor selection is often a procurement or business decision, and while the committee may provide input, it is not their primary role. Option D is incorrect because managing the project budget is the responsibility of the project manager and project team, not the steering committee.

Answer

Approving technical specifications

Answer

Selecting the vendor

Answer

Managing the project budget