CISA Practice Test 44 — 15 Questions

Question 1

An organization is implementing a new cloud-based HR system. The project sponsor wants to skip regular project status meetings to speed up delivery. Which THREE of the following are the MOST significant risks of eliminating these meetings?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Stakeholders may be unaware of critical project issues.. Option B is correct because regular status meetings are the primary mechanism for surfacing critical project issues to stakeholders; without them, stakeholders lose visibility into risks, blockers, and changes, which is especially dangerous in a cloud HR implementation with many interested parties. Option D is correct because status meetings serve as a forum where decisions are made, confirmed, and communicated; skipping them increases the likelihood that important decisions are never documented or shared, leading to misalignment and rework. Option E is correct because these meetings are where cross-team dependencies, task sequencing, and integration points (for example, between the cloud HR system and existing identity or payroll systems) are coordinated; without them, dependencies can be missed and cause schedule slips. Option A is not marked correct because security requirements are typically captured through dedicated security and compliance activities, architecture reviews, and requirements-gathering sessions rather than routine status meetings, so their omission is not the most direct risk of canceling status meetings. Option C is not marked correct because budget tracking is normally handled through financial reporting, earned value analysis, and cost-control processes, so overruns are not primarily detected in status meetings and would not be the most significant risk of eliminating them.

Answer

Security requirements may be overlooked.

Answer

Budget overruns may go unnoticed until the end.

Question 2

During an IT audit, the auditor discovers that the IT department has not conducted a business impact analysis (BIA) for three years. The organization's disaster recovery plan (DRP) is based on the previous BIA. The IT manager argues that the DRP is still valid because no major changes have occurred. What should the auditor recommend?

Accepted Answer

Recommend that a new BIA be conducted to validate and update the DRP.. A business impact analysis (BIA) is the foundation of a valid disaster recovery plan (DRP). Without a current BIA, the DRP may not reflect the organization's current critical processes, recovery time objectives (RTOs), or recovery point objectives (RPOs). Even if no major changes are perceived, subtle shifts in dependencies, resource availability, or regulatory requirements can render the DRP ineffective. Therefore, the auditor should recommend conducting a new BIA to validate and update the DRP.

Answer

Accept the IT manager's rationale and close the finding.

Answer

Recommend terminating the current DRP until the BIA is completed.

Answer

Recommend accepting the risk and documenting the decision.

Question 3

Which of the following is the most reliable form of audit evidence?

Accepted Answer

Re-performance of a control by the auditor. Reperformance by the auditor is the most reliable form of audit evidence because the auditor directly executes the control or procedure and observes the outcome, eliminating reliance on the representations or actions of others. This direct, independent verification provides strong evidence about whether the control operates effectively. Inquiry, observation, and inspection are all less reliable because they are indirect or can be manipulated.

Answer

Inquiry of management about a control

Answer

Observation of a control being performed

Answer

Inspection of signed approval forms

Question 4

Which of the following is a characteristic of non-statistical (judgmental) sampling?

Accepted Answer

The auditor uses professional judgment to select sample items. Non-statistical (judgmental) sampling is characterized by the auditor's use of professional judgment to select sample items, determine sample size, and evaluate results. Unlike statistical sampling, it does not rely on probability theory or mathematical formulas. The auditor chooses items based on risk, materiality, and experience — for example, selecting all transactions above a threshold or focusing on high-risk areas.

Answer

Every item has an equal chance of selection

Answer

The sample size is determined using statistical formulas

Answer

The sample results can be projected to the population with known confidence

Question 5

A company plans to outsource its data center operations to a cloud service provider. What is the MOST important governance consideration for the board before finalizing the contract?

Accepted Answer

Ensure the contract includes clauses for regulatory compliance and audit rights.. The board's primary governance responsibility is to ensure the organization remains compliant with all applicable laws and regulations, even when operations are outsourced. Without explicit contractual clauses for regulatory compliance and audit rights, the company loses visibility and control over how its data is handled, creating legal and reputational risk. This is the most critical governance consideration because it directly addresses accountability and oversight.

Answer

Select a provider with the lowest cost per transaction.

Answer

Negotiate the transfer of existing IT staff to the provider.

Answer

Define a detailed exit strategy for transitioning to another provider.

Question 6

A multinational corporation is implementing a global IT governance framework. Which of the following challenges is MOST likely to arise?

Accepted Answer

Conflicting regulatory requirements. A global IT governance framework must reconcile laws, regulations, and industry standards across many jurisdictions. Multinationals face conflicting requirements — for example, GDPR data residency in the EU versus data localization laws in other countries, or differing breach-notification timelines. These conflicts directly shape governance policies, controls, and reporting, making them the most likely and most impactful challenge.

Answer

Standardizing hardware across regions

Answer

Training users on new procedures

Answer

Software licensing costs

Question 7

Which type of disaster recovery test involves actually switching over to the alternate site and processing live transactions, but does not require the primary site to be shut down?

Accepted Answer

Parallel test. Parallel testing is the correct answer because it involves processing live transactions at the alternate site while the primary site remains fully operational. This allows validation of the disaster recovery (DR) systems without risking a service outage, as both sites run concurrently and results are compared for consistency. Unlike a full interruption test, the primary site is not shut down, ensuring business continuity during the test.

Answer

Simulation test

Answer

Full interruption test

Answer

Tabletop test

Question 8

An IS auditor is reviewing the change management process for a critical financial application. Which of the following findings would be of GREATEST concern?

Accepted Answer

Emergency changes are implemented without subsequent CAB approval. Emergency changes implemented without subsequent CAB approval represent a critical control failure because emergency changes bypass the normal review and approval process, and if they are not retroactively reviewed, unauthorized or risky changes may remain in production. This creates a significant risk of undetected errors, fraud, or security vulnerabilities in a critical financial application. The lack of post-implementation approval means no oversight exists for changes that could directly affect financial reporting or data integrity.

Answer

Standard changes are documented but not tracked individually

Answer

Change requests are logged in a spreadsheet instead of a dedicated system

Answer

The CAB meets only once per month

Question 9

Which TWO of the following are essential components of a disaster recovery plan (DRP)?

Accepted Answer

Steps for restoring IT systems. Option A, steps for restoring IT systems, is correct because a DRP must define the documented procedures and sequence for recovering systems, applications, and data after a disruption, which is the plan's core operational purpose. Option D, a list of critical contacts, is correct because effective disaster recovery depends on reaching the right people—such as the DR team, vendors, and management—during an incident, so contact information is an essential DRP component. Option B, detailed financial audit procedures, is not part of a DRP; that belongs to financial auditing or accounting controls. Option C, employee performance reviews, is an HR function unrelated to disaster recovery. Option E, a backup media rotation schedule, is a backup/recovery operational detail that supports data restoration but is not itself one of the essential DRP components being tested here.

Answer

Detailed financial audit procedures

Answer

Employee performance reviews

Answer

Backup media rotation schedule

Question 10

An organization uses shared accounts for system administration. Which of the following is the BEST control to mitigate the risk of non-repudiation?

Accepted Answer

Implementing a privileged access management (PAM) solution with session recording.. A PAM solution with session recording uniquely ties each privileged session to an authenticated individual, even when a shared account is used, because users check out credentials and their keystrokes/commands are captured under their own identity. This provides the attribution needed for non-repudiation, which is the ability to prove who performed a specific action. Password changes, logging, and MFA on the shared account do not identify which individual used it.

Answer

Changing the shared account password after each use.

Answer

Logging all commands executed by the shared account.

Answer

Requiring two-factor authentication for the shared account.

Question 11

An IT governance framework has been implemented, but the board is not receiving regular reports on IT performance. Which of the following is the BEST course of action?

Accepted Answer

Develop a dashboard that presents key IT metrics to the board.. The gap identified is that the board is not receiving regular IT performance reports — a communication and reporting deficiency, not a risk identification or organizational design problem. Developing a dashboard that presents key IT metrics to the board (B) directly closes that gap by establishing a repeatable, structured reporting mechanism that gives the board visibility into IT performance. It is the most targeted, proportionate response to the stated deficiency.

Answer

Conduct an IT risk assessment to identify critical areas.

Answer

Implement an IT balanced scorecard that aligns with corporate strategy.

Answer

Assign a chief information officer (CIO) to report directly to the board.

Question 12

Which of the following is the BEST control to ensure that user acceptance testing (UAT) is effective?

Accepted Answer

UAT testers are from the business and use realistic data. UAT should be performed by actual end users using real data to validate business requirements.

Answer

UAT scripts are written by developers

Answer

UAT is performed after deployment

Answer

UAT is conducted by the quality assurance team

Question 13

An IS auditor is evaluating the change management process. Which of the following is the BEST indicator that emergency changes are being properly controlled?

Accepted Answer

Emergency changes are documented with a justification and promptly reviewed after implementation. The best indicator that emergency changes are properly controlled is that they are documented with a justification and promptly reviewed after implementation. Emergency changes, by definition, bypass the normal pre-approval and testing cycle, so the compensating control is retrospective review and documentation to ensure accountability and to catch any issues. This aligns with ITIL and COBIT guidance that emergency changes must be logged, justified, and reviewed post-implementation.

Answer

Emergency changes are approved by the change manager within 24 hours

Answer

Emergency changes are tested in a production-like environment before implementation

Answer

Emergency changes require approval from the CAB before implementation

Question 14

An organization uses a third-party cloud service for data storage. Which of the following is the BEST way to ensure data confidentiality in the event of a cloud provider breach?

Accepted Answer

Implement client-side encryption before uploading data. Client-side encryption ensures that data is encrypted before it leaves the organization's control, so the cloud provider never has access to the plaintext or the encryption keys. In the event of a provider breach, the encrypted data remains confidential because only the organization holds the keys to decrypt it. This is the only option that guarantees confidentiality regardless of the cloud provider's security posture.

Answer

Rely on the cloud provider's encryption at rest

Answer

Use TLS for data in transit

Answer

Deploy a cloud access security broker (CASB) with DLP

Question 15

An organization is implementing a data loss prevention (DLP) solution. Which of the following is the BEST approach to reduce false positives during initial deployment?

Accepted Answer

Deploy in monitor-only mode and analyze alerts for a period. Deploying a DLP solution in monitor-only mode allows the organization to observe what data is being transmitted and generate alerts without blocking any traffic. This enables security teams to analyze the alerts against actual business workflows, fine-tune policies, and eliminate false positives before moving to an active enforcement mode. It is a best practice for initial deployment to avoid disrupting legitimate business operations.

Answer

Use default policies without modification

Answer

Limit scope to one department to minimize noise

Answer

Block all sensitive data transmissions immediately