CISA Practice Test 43 — 15 Questions

Question 1

An IT auditor is reviewing the change management process for a financial application. The auditor finds that emergency changes are frequently implemented without post-implementation review. What is the MOST significant risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security vulnerabilities may be introduced and remain undetected. The most significant risk of implementing emergency changes without post-implementation review is that security vulnerabilities may be introduced and remain undetected (Option C). Without review, there is no assurance that the change did not compromise security controls, potentially exposing the application to threats. While other concerns such as lack of documentation (A), potential outages (B), or user notification (D) are important, they are not as critical as the undetected introduction of security vulnerabilities, which could have long-term impacts on data integrity and confidentiality.

Answer

The change may not be documented properly

Answer

The change may cause an outage during the next backup cycle

Answer

Users may not be notified of the change

Question 2

Which is the MOST likely cause?

Accepted Answer

Backup media is not connected. The error 'The device is not ready' indicates that the backup media is not connected or is unavailable. Option D is correct because this error typically occurs when the backup device (e.g., tape drive, external disk) is not properly connected to the system, not powered on, or not recognized. Option A (network connectivity lost) would result in a different error such as 'network path not found' or 'timeout'. Option B (backup software license expired) would produce a license-related error, not a device readiness error. Option C (backup media full) would show a 'disk full' or 'no space left' error.

Answer

Network connectivity lost

Answer

Backup software license expired

Answer

Backup media is full

Question 3

A company's IT service desk receives multiple reports of users being unable to access a cloud-based CRM system. The network team confirms that internet connectivity is working. Which of the following should be the FIRST step in troubleshooting the issue?

Accepted Answer

Check the vendor's service status page for any reported outages. Checking the vendor's service status page is the first logical step to determine if the issue is due to a known outage at the CRM provider. This aligns with best practices for troubleshooting – verify external dependencies before performing internal changes. Options A, B, and D are premature or secondary steps.

Answer

Ask a user to try accessing from a different device

Answer

Restart the company's firewall and proxy servers

Answer

Review recent change requests for the CRM system

Question 4

Which of the following is the PRIMARY purpose of an IT strategy committee?

Accepted Answer

To ensure IT investments support business objectives. The primary purpose of an IT strategy committee is to ensure that IT investments align with and support business objectives, providing strategic direction and governance. Option A is incorrect as monitoring project timelines is an operational task, not a strategic committee responsibility. Option B is incorrect because managing vendor contracts is typically handled by procurement or IT operations. Option C is incorrect because approving specific project budgets is a project-level decision, not the committee's primary focus.

Answer

To monitor IT project timelines

Answer

To manage IT vendor contracts

Answer

To approve IT project budgets

Question 5

An organization is evaluating a cloud-based identity as a service (IDaaS) for single sign-on (SSO). Which of the following security concerns is MOST critical to address?

Accepted Answer

Compromise of the identity provider's credentials. The compromise of the identity provider's (IdP) credentials is the most critical security concern because the IdP acts as the central trust anchor for all SSO transactions. If an attacker gains control of the IdP's signing key or administrative credentials, they can forge SAML assertions for any user, bypassing all downstream authentication and gaining unauthorized access to every connected service provider (SP). This represents a single point of failure that undermines the entire SSO trust model.

Answer

Lack of encryption for SAML assertions

Answer

Incompatibility with legacy applications

Answer

Downtime of the IDaaS provider

Question 6

An organization has implemented a balanced scorecard (BSC) for IT performance measurement. Which of the following is the PRIMARY benefit of using a BSC?

Accepted Answer

It ensures IT metrics are aligned with business strategy.. The primary benefit of a balanced scorecard (BSC) is to align IT metrics with business strategy across multiple perspectives (financial, customer, internal processes, learning and growth). Option A is incorrect because BSC does not simplify budgeting; it includes both financial and non-financial metrics. Option C is incorrect because BSC does not automate data collection; it is a framework for measurement, not automation. Option D is incorrect because BSC does not provide a single financial metric; it uses a balanced set of metrics from multiple perspectives.

Answer

It simplifies the IT budgeting process.

Answer

It automates data collection for IT metrics.

Answer

It provides a single financial metric for IT performance.

Question 7

An IT department uses a balanced scorecard (BSC) to measure performance. The financial perspective shows that IT costs are within budget, but customer satisfaction scores are declining. The learning and growth perspective indicates low employee engagement. Which action should the IT governance committee prioritize?

Accepted Answer

Invest in training and development programs for IT staff.. Investing in training and development programs improves employee engagement (learning & growth perspective), which likely leads to better service and increased customer satisfaction. Option A is wrong because reducing costs further may harm service quality and not address the root cause of low engagement. Option C is wrong because simply hiring more staff does not necessarily improve engagement or customer satisfaction without proper training. Option D is wrong because outsourcing may provide short-term relief but does not address the underlying employee engagement issue and could lead to loss of control.

Answer

Reduce IT costs further to reallocate savings to customer service.

Answer

Increase the IT budget to hire more staff.

Answer

Outsource customer-facing IT support to a third party.

Question 8

An organization is implementing an IT governance framework to align IT with business objectives. Which TWO of the following are primary responsibilities of the IT steering committee?

Accepted Answer

Approving IT project budgets and priorities. Options C and E are correct. The IT steering committee is responsible for approving IT project budgets and priorities (C) and ensuring IT investments deliver value (E). Performing daily IT operations (A) is an operational management task. Defining IT security policies (B) is typically the responsibility of the security function. Conducting technical vulnerability assessments (D) is a technical operational activity.

Answer

Performing daily IT operations

Answer

Defining IT security policies

Answer

Conducting technical vulnerability assessments

Question 9

A multinational corporation is implementing a global IT governance framework. Which of the following challenges is MOST likely to arise?

Accepted Answer

Conflicting regulatory requirements. A multinational corporation implementing a global IT governance framework will most likely face conflicting regulatory requirements across different countries (option A). These legal and compliance issues are complex and vary significantly by jurisdiction (e.g., GDPR, data sovereignty), making them the primary challenge. Standardizing hardware (B) is a technical issue that can be addressed through procurement policies. Training users (C) is an operational challenge that can be managed with change management processes. Software licensing costs (D) are a financial concern but not as fundamental as legal compliance. Therefore, option A is the most likely challenge.

Answer

Standardizing hardware across regions

Answer

Training users on new procedures

Answer

Software licensing costs

Question 10

Which testing type is performed by end-users to verify that the system meets their needs?

Accepted Answer

User acceptance testing. User acceptance testing (UAT) is the final phase of the testing lifecycle where actual end-users validate that the system fulfills their business requirements and is ready for production deployment. Unlike technical testing types, UAT focuses on real-world workflows, data accuracy, and usability to confirm the system meets the agreed-upon acceptance criteria.

Answer

Security testing

Answer

Integration testing

Answer

Unit testing

Question 11

What is the MOST significant weakness in the planned remediation?

Accepted Answer

The remediation may not eliminate the segregation of duties issue.. The planned remediation (e.g., an automated code review tool) does not ensure that the developer who writes the code is different from the person who reviews it. This fails to address the root cause of segregation of duties, making it the most significant weakness. Options A, C, and D are either less critical or not as directly related to the core issue.

Answer

The remediation only addresses a subset of projects.

Answer

The remediation relies on technology rather than process.

Answer

The remediation does not include a compensating control.

Question 12

An organization's IT governance committee is reviewing a proposal to use a public cloud provider that does not meet the organization's data encryption standards. The board has set a low risk appetite for data privacy. What is the BEST action?

Accepted Answer

Reject the proposal until encryption requirements are met. Rejecting the proposal aligns with the board's low risk appetite for data privacy and ensures encryption standards are met before acceptance. Option A is incorrect because additional monitoring does not resolve the encryption gap. Option B is incorrect because delegation to the security team bypasses the governance committee's responsibility to enforce risk appetite. Option C is incorrect because waivers do not mitigate the fundamental encryption non-compliance.

Answer

Accept the proposal with additional monitoring

Answer

Delegate the decision to the security team

Answer

Accept the proposal but require the provider to sign a waiver

Question 13

Which of the following is a potential risk in this RACI matrix?

Accepted Answer

The Change Manager is responsible but lacks authority to approve.. The Change Manager is responsible but lacks authority to approve. In a RACI matrix, the Responsible (R) party performs the work, while the Accountable (A) party is ultimately answerable and has approval authority. If the Change Manager is marked as Responsible for change approval without being Accountable, there is a risk that they may not have the proper authority to approve changes, leading to potential unauthorized changes. Option A is not necessarily a risk because being Accountable does not require being informed of all changes. Option B: IT Operations being informed is appropriate; they do not need to be Responsible for implementation. Option C: The Business Process Owner being consulted is normal and may cause delays but is not as critical as the authority issue. Thus, D is the most significant risk.

Answer

The IT Director is accountable but not informed of all changes.

Answer

IT Operations is informed, but should be responsible for implementation.

Answer

The Business Process Owner is consulted, which may delay approvals.

Question 14

A multinational corporation operates in a highly regulated industry. The IT governance framework includes a risk appetite statement approved by the board. Recently, the company suffered a significant data breach due to an unpatched vulnerability that had been identified three months earlier. The IT audit found that the vulnerability was reported to the IT department but was not prioritized for remediation because it was deemed low risk by the IT operations team. The incident response plan was not activated because the breach was not initially detected. The board wants to strengthen governance to prevent recurrence. The most effective course of action for the auditor to recommend is:

Accepted Answer

Establishing a formal vulnerability management policy that requires risk-based prioritization in accordance with the risk appetite and escalation to the IT risk committee for decisions outside tolerance. The most effective because it ties vulnerability remediation directly to the board-approved risk appetite and ensures that decisions outside tolerance are escalated to the IT risk committee. This addresses the root cause: the IT operations team made a risk decision (deeming the vulnerability low risk) without governance oversight. Option A (deploying intrusion detection) focuses on detection, not prevention of the governance gap. Option C (disciplining the team) is reactive and does not fix the process. Option D (automated patching) may help with patching speed but does not ensure risk-based prioritization according to the risk appetite.

Answer

Deploying an intrusion detection system to identify breaches sooner

Answer

Disciplining the IT operations team for not escalating the vulnerability

Answer

Implementing a more robust patch management system with automated patching

Question 15

A multinational manufacturing company with operations in 20 countries has historically allowed each regional division to manage its own IT systems independently. Recently, the company experienced a significant data breach originating from a region with weaker security controls, leading to financial losses and reputational damage. The board has mandated stronger IT governance to prevent future incidents. The CIO proposes implementing a global IT governance framework with centralized policy enforcement. However, regional directors argue that local regulations and business needs require autonomy. The governance committee must decide on a course of action that balances risk and business flexibility. Which of the following approaches is the MOST appropriate?

Accepted Answer

Adopt a federated governance model with global policies and local flexibility within defined tolerances.. The most appropriate approach is the federated governance model (Option A), which establishes global policies and standards centrally while allowing regional divisions to adapt within defined risk tolerances. This balances the board's mandate for stronger IT governance with legitimate local regulatory and business needs. Option B (quarterly reporting) is insufficient because it does not enforce any binding controls, leaving the company vulnerable to future breaches. Option C (fully centralized) may ignore critical local regulations and hinder business agility, leading to non-compliance and operational friction. Option D (status quo with minimum standards) is too weak; after a significant breach, a more robust framework requiring proactive governance is needed, not just baseline security.

Answer

Allow each region to continue independently but require quarterly reporting to the committee.

Answer

Implement a fully centralized IT governance model with no regional deviations.

Answer

Maintain the status quo but enforce minimum security standards across all regions.