CISA Practice Test 44 — 15 Questions

Question 1

An IS auditor is conducting an audit of a small manufacturing company's IT operations. The company has 50 employees and uses a single server running Windows Server 2019 for file sharing and print services. There is no formal change management process. The IT manager, who also doubles as the system administrator, has full administrative rights and is the only person who can make changes to the server. During the audit, the auditor notices that the server's local security policy is configured to allow unlimited password attempts and no account lockout. The IT manager states that this is to avoid locking out users who forget their passwords. The auditor also finds that the guest account is enabled on the server. What should the auditor recommend as the HIGHEST priority action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable the guest account and enforce account lockout policy.. The most immediate vulnerabilities are the enabled guest account and lack of account lockout, which significantly increase the risk of unauthorized access. Disabling the guest account and enforcing an account lockout policy directly mitigate these risks. While employee training (A) and implementing change management (B) are beneficial, they are not as urgent as addressing the technical controls. Separating roles (D) is a governance improvement but also less urgent. Therefore, the highest priority action is to disable the guest account and enforce account lockout.

Answer

Train employees on password security.

Answer

Implement a formal change management process.

Answer

Separate the roles of IT manager and system administrator.

Question 2

A medium-sized retail company relies on an ERP system for order processing and inventory management. The system is hosted on-premises with daily backups stored on tape. The company's business continuity plan specifies an RTO of 4 hours and an RPO of 1 hour for the ERP system. During a recent fire drill, it was discovered that restoring the ERP system from tape took over 6 hours, and the most recent backup was from the previous day. Which of the following is the BEST course of action to meet the RTO and RPO goals?

Accepted Answer

Implement a hot standby site with real-time replication.. A hot standby site with real-time replication can achieve an RPO near zero and an RTO within 4 hours, directly addressing both goals. Option A reduces the RPO but does not improve the restore time from tape, which exceeds the RTO. Option B increases the frequency of testing but does not change the recovery capability. Option D replaces tape with cloud backups, but weekly backups fail the 1-hour RPO, and restore time from the cloud may also be too long.

Answer

Increase the frequency of tape backups to every 30 minutes.

Answer

Conduct quarterly fire drills instead of annually.

Answer

Replace tape backups with weekly cloud backups.

Question 3

Which TWO of the following are primary objectives of an information system audit?

Accepted Answer

Identify areas for improvement in IT processes. Identifying areas for improvement in IT processes is a primary objective of an information system audit. The audit evaluates the design and operational effectiveness of controls, then recommends enhancements to align IT processes with business goals, risk appetite, and regulatory requirements. This goes beyond mere compliance to drive continuous improvement in governance and control frameworks.

Answer

Ensure optimal performance of IT systems

Answer

Implement security patches and updates

Answer

Prepare financial statements for external reporting

Question 4

Which of the following are COBIT 2019 management objectives?

Accepted Answer

APO01 - Manage the IT Management Framework. COBIT 2019 management objectives are classified under the APO, BAI, DSS, and MEA domains. APO01, DSS04, BAI06, and MEA02 are all valid management objectives. EDM03 is a governance objective, not a management objective. Therefore, the correct answers are A, B, C, and D.

Answer

EDM03 - Ensure Risk Optimization

Question 5

Given this configuration, which is the PRIMARY concern?

Accepted Answer

Bandwidth may be insufficient to meet RPO. The primary concern is that bandwidth may be insufficient to meet the Recovery Point Objective (RPO). In synchronous replication, every write must be acknowledged by the remote site before the local write completes, so the link bandwidth must be at least equal to the peak data change rate. If bandwidth is lower, replication cannot keep up, causing the RPO (maximum acceptable data loss) to be violated as the backlog grows. This directly threatens the organization's ability to recover data within the defined time window.

Answer

Data change rate exceeds bandwidth

Answer

RTO may not be achievable

Answer

Synchronous replication may impact application performance

Question 6

A company's security policy requires that all laptops have full-disk encryption. During an audit, 10% of laptops are found without encryption. Which of the following is the MOST effective corrective action?

Accepted Answer

Deploy centralized endpoint management to enforce encryption. Centralized endpoint management (e.g., Microsoft Intune, SCCM, or a third-party MDM) allows administrators to enforce full-disk encryption (such as BitLocker or FileVault) via policy, automatically encrypting non-compliant laptops and preventing users from disabling encryption. This is the most effective corrective action because it addresses the root cause—lack of enforcement—rather than relying on user action or manual processes.

Answer

Require users to manually enable encryption

Answer

Distribute encryption keys to users

Answer

Conduct security awareness training on encryption

Question 7

An organization is selecting a key performance indicator (KPI) to measure the effectiveness of its patch management process. Which of the following is the MOST appropriate KPI?

Accepted Answer

Patch compliance percentage. Patch compliance percentage directly measures the effectiveness of patch management by indicating the proportion of systems that have required patches applied within a defined timeframe.

Answer

Number of patches released

Answer

Number of security incidents

Answer

Average time to deploy critical patches

Question 8

An IT manager submits a request to change the firewall configuration during business hours. According to best practices for change management, what should be done FIRST?

Accepted Answer

Assess the impact and risk of the proposed change. The first step in any change management process is to assess the impact and risk of the proposed change. This assessment informs subsequent steps such as approval, notification, and implementation. Option A (CAB approval) should occur after the impact and risk assessment is completed. Option B (notifying users) is typically done after the change is approved and scheduled. Option D (immediate implementation) bypasses the necessary assessment and approval steps, which is not best practice even for urgent threats—a risk assessment should still be conducted.

Answer

Obtain approval from the change advisory board

Answer

Notify all users of the planned change

Answer

Implement the change immediately to address an urgent threat

Question 9

Match each regulatory standard to its focus area.

Accepted Answer

SOX: Financial reporting and internal controls. The correct matches are SOX to financial reporting, GDPR to data privacy, HIPAA to healthcare data, and PCI DSS to payment card security. Common confusions include swapping definitions between SOX and GDPR.

Answer

SOX: Data privacy and protection for EU citizens

Answer

GDPR: Financial reporting and internal controls

Question 10

A medium-sized manufacturing company has a decentralized IT structure where each business unit manages its own IT budget and projects. The CEO is concerned that IT investments are not aligned with corporate strategy and that there is duplication of effort. The IT department lacks a formal project portfolio management process. The company has experienced several project failures due to poor prioritization. The CEO has asked the newly hired IT auditor to recommend an initial step to improve IT governance. The auditor should recommend:

Accepted Answer

Establishing an IT steering committee with representatives from business units and IT. An IT steering committee provides governance oversight, ensures alignment with corporate strategy, and helps prioritize projects to avoid duplication. This foundational step addresses the root cause of poor alignment and project failures before implementing tools or processes. Option B is premature because a tool without governance oversight may not improve prioritization. Option C focuses on security, not overall strategic alignment. Option D is drastic and does not address internal governance issues.

Answer

Implementing a project portfolio management software tool immediately to track all projects

Answer

Conducting a security risk assessment of all IT systems

Answer

Outsourcing IT management to a third-party provider

Question 11

Which TWO of the following are the MOST effective controls to prevent unauthorized changes to production data?

Accepted Answer

Requiring change management approval for all production changes. Requiring change management approval for all production changes is a preventive control that ensures every modification to production data is formally authorized, reviewed, and documented before implementation. This directly prevents unauthorized changes by enforcing a gatekeeping process where only approved changes proceed, reducing the risk of data integrity breaches. Without this control, even with other safeguards, an attacker or insider could bypass technical controls by simply requesting a change through official channels.

Answer

Implementing audit logging of all data changes

Answer

Encrypting production data at rest

Answer

Using automated testing for all code changes

Question 12

An organization is adopting a DevOps approach for system development. Which THREE controls should an IS auditor expect to see in place to maintain security and compliance?

Accepted Answer

Automated security scanning integrated into the CI/CD pipeline. In DevOps, automated security scanning, infrastructure as code with security review, and continuous monitoring are key controls to integrate security into the pipeline.

Answer

Annual penetration testing after the release

Answer

Manual code review for every change before deployment

Question 13

An organization's IT department is structured with a central unit that provides infrastructure and support, while individual business units have their own application development teams. This structure is BEST described as:

Accepted Answer

Federated (hybrid) IT. A centralized IT structure consolidates IT functions in a central unit, while a decentralized structure distributes IT across business units. A hybrid (federated) structure combines aspects of both, with some functions centralized and others decentralized.

Answer

Outsourced IT

Answer

Centralized IT

Answer

Decentralized IT

Question 14

An organization is planning a full interruption test of its disaster recovery plan. Which THREE of the following should the IS auditor recommend as best practices for this type of test? (Select three.)

Accepted Answer

Notify all relevant stakeholders in advance. Notifying all relevant stakeholders in advance is a best practice for a full interruption test. This ensures that business units, IT teams, and external vendors are prepared for the planned outage, minimizing confusion and allowing coordinated execution. Without prior notification, the test could cause unnecessary panic or operational disruption, undermining the controlled nature of the exercise.

Answer

Conduct the test during peak business hours to simulate real conditions

Answer

Ensure the test is scheduled after a major system upgrade to validate changes

Question 15

An organization is implementing a new financial system and has completed user acceptance testing (UAT). The project manager reports that all critical defects have been fixed and retested, but several low-severity issues remain unresolved. What is the BEST course of action?

Accepted Answer

Document the unresolved defects as known issues in a risk acceptance form with a remediation plan, then proceed with go-live. In a financial system implementation, low-severity issues that do not impair core financial processing or controls can be accepted as known risks. Documenting them with a remediation plan and proceeding with go-live aligns with ISACA’s guidance that UAT sign-off does not require zero defects, only that critical and high-severity defects are resolved. This approach balances business needs with risk management, avoiding unnecessary delays while ensuring accountability through formal risk acceptance.

Answer

Re-run all UAT test cases to ensure no regression occurs

Answer

Delay go-live until all defects are resolved

Answer

Obtain sign-off from business stakeholders acknowledging the risks and proceed with go-live