CISA Practice Test 45 — 15 Questions

Question 1

An IS auditor is reviewing a waterfall SDLC project that has completed the requirements phase. Which of the following is the greatest risk to the project?

Accepted Answer

A key business stakeholder did not sign off on the requirements.. In waterfall, requirements are defined upfront and changes are difficult. If a key stakeholder did not sign off, there is a risk that later phases will be based on incomplete or incorrect requirements.

Answer

The project manager left the company.

Answer

The development team is unfamiliar with the technology.

Answer

The design phase is behind schedule.

Question 2

An IS auditor is planning a risk-based audit of a financial system. Which TWO of the following factors should the auditor consider when assessing inherent risk? (Select two.)

Accepted Answer

Complexity of transactions. Inherent risk is the risk that exists before considering internal controls, so the auditor should focus on factors intrinsic to the system and its transactions. Option A, complexity of transactions, is correct because highly complex transactions increase the likelihood of errors, misstatements, or fraud going undetected, raising inherent risk. Option B, volume of transactions, is correct because a high volume of transactions increases the chance of errors and makes manual verification harder, which elevates inherent risk. Option C, auditor's experience with similar systems, is not an inherent risk factor; it affects the auditor's competence and detection risk, not the risk inherent in the system. Option D, results of prior audits, is not an inherent risk factor; it is evidence used to assess control risk and plan the audit, but it does not define inherent risk. Option E, effectiveness of internal controls, is not an inherent risk factor because inherent risk is assessed before considering controls; control effectiveness relates to control risk.

Answer

Auditor's experience with similar systems

Answer

Results of prior audits

Answer

Effectiveness of internal controls

Question 3

Which of the following is the PRIMARY purpose of a data classification scheme?

Accepted Answer

To ensure appropriate security controls are applied based on data sensitivity. A data classification scheme assigns sensitivity labels (e.g., public, internal, confidential, restricted) to information assets. Its primary purpose is to ensure that appropriate security controls—such as access control lists, encryption strength, and monitoring—are applied proportionally to the data's sensitivity. Without classification, controls would be either insufficient for high-risk data or overly restrictive for low-risk data, undermining both security and operational efficiency.

Answer

To enable encryption of all sensitive data

Answer

To meet regulatory compliance requirements

Answer

To define data retention periods

Question 4

A multinational corporation has defined its risk appetite as 'moderate' for IT investments. The IT steering committee is evaluating a new project with potential high returns but also significant cybersecurity risks. The project's risk profile is assessed as 'high' by the risk management team. What should the committee do FIRST?

Accepted Answer

Request the project team to identify risk mitigation measures.. When a project's risk profile exceeds the organization's defined risk appetite, the FIRST step is to understand whether the risk can be brought within tolerance through mitigation. The committee cannot make an informed accept/reject/escalate decision until the risk management team and project team have identified possible controls and residual risk. Requesting mitigation measures preserves the opportunity for high returns while aligning the project with the 'moderate' appetite.

Answer

Approve the project but increase monitoring.

Answer

Escalate the decision to the board of directors.

Answer

Reject the project immediately as it exceeds risk appetite.

Question 5

During an audit, the IS auditor discovers that the audit log for a critical server is overwritten every 24 hours. The auditor wants to ensure logs are preserved for a longer period. Which of the following recommendations is most appropriate?

Accepted Answer

Configure the server to archive logs to a centralized log management system. The most appropriate recommendation is to configure the server to archive logs to a centralized log management system. This ensures logs are preserved beyond the 24-hour overwrite window by sending them to a separate, persistent storage location, which also supports security monitoring, forensics, and compliance requirements. Centralized logging (e.g., using syslog, SIEM, or a dedicated log collector) provides redundancy, integrity checks, and long-term retention without relying on the local server's limited storage.

Answer

Implement a manual backup of logs daily

Answer

Reduce the logging level to minimize data

Answer

Increase the log size to retain more data

Question 6

An IS auditor is reviewing the user access recertification process. Which of the following findings would MOST concern the auditor regarding the effectiveness of access reviews?

Accepted Answer

Managers approve all access requests without verifying job requirements. Managers approving all access requests without verifying job requirements is the most concerning finding because it defeats the purpose of recertification: access is rubber-stamped rather than validated against least privilege. This creates a systemic risk of privilege creep and unauthorized access that no amount of process formality can offset. The other findings are either positive or minor operational issues.

Answer

The recertification report includes all users with active accounts

Answer

Reviews are performed quarterly instead of annually

Answer

Some users did not respond to the recertification request within the deadline

Question 7

Which of the following is the PRIMARY benefit of using a hardware security module (HSM) for key management?

Accepted Answer

It provides tamper-resistant storage for encryption keys.. The primary benefit of a hardware security module (HSM) is that it provides tamper-resistant, physically secured storage for encryption keys. HSMs are designed to protect keys from extraction or modification, even if an attacker gains physical access to the device, which is critical for maintaining the confidentiality and integrity of cryptographic operations. This aligns with the core purpose of an HSM: to safeguard the root of trust in a key management infrastructure.

Answer

It reduces the cost of key management.

Answer

It improves encryption speed.

Answer

It simplifies key distribution.

Question 8

Scenario: A healthcare organization is implementing a new electronic health records (EHR) system. The project has been delayed due to scope creep and resource constraints. The project sponsor is pressuring the project manager to accelerate the timeline by skipping user acceptance testing (UAT) and going live immediately. The organization has a governance policy that requires all IT projects to complete UAT before deployment. The project manager is concerned about quality and patient safety. Which of the following is the BEST course of action?

Accepted Answer

Adhere to the governance policy and escalate the risk to the steering committee for a decision.. The governance policy mandates UAT before deployment, and skipping it could compromise patient safety and data integrity in the EHR system. By escalating the risk to the steering committee, the project manager ensures that the decision is made at the appropriate governance level, balancing project pressures with compliance and quality. This approach aligns with the CISA domain of Governance and Management of IT, where adherence to policies and risk escalation are key controls.

Answer

Compromise by conducting a limited UAT on only critical functionalities.

Answer

Resign from the project due to ethical concerns.

Answer

Accept the sponsor's request and skip UAT to meet the deadline.

Question 9

During a post-implementation review of a new HR system, the auditor finds that the system's disaster recovery plan (DRP) was not tested before go-live. Which of the following is the BEST recommendation?

Accepted Answer

Conduct a DRP test immediately and document results. The best recommendation is to conduct a DRP test immediately and document the results. A DRP that has not been tested poses a significant risk because it may not work as intended. Testing validates the plan, identifies gaps, and ensures that recovery objectives can be met. Accepting the risk is not appropriate, implementing a backup procedure is only part of DRP, and scheduling a test within six months delays mitigation of a critical gap.

Answer

Accept the risk because the system is new

Answer

Implement a backup procedure for the system

Answer

Schedule a DRP test within the next six months

Question 10

An organization's IT strategy is developed by the IT department without input from business stakeholders. Which of the following is the MOST significant risk?

Accepted Answer

IT strategy may not support business objectives.. An IT strategy developed in isolation from business stakeholders risks being misaligned with organizational goals, meaning IT investments may not deliver business value or support strategic objectives. This is the most significant risk because it undermines the entire purpose of IT governance—ensuring IT enables and extends business strategy. Other risks like obsolescence, budget overruns, or skill gaps are secondary symptoms that may result from misalignment.

Answer

Technology may become obsolete quickly.

Answer

IT projects may exceed budget.

Answer

IT staff may lack required skills.

Question 11

During an audit, the IS auditor finds that the business continuity plan (BCP) was last updated two years ago and does not include new cloud-based applications. The organization has not conducted a BCP test in 18 months. What should the auditor recommend FIRST?

Accepted Answer

Perform a risk assessment to prioritize changes. Before updating the BCP or scheduling tests, the IS auditor must ensure that a current risk assessment is performed to identify and prioritize the impact of changes—such as the introduction of cloud-based applications—on business continuity. Without a risk assessment, updates or tests may address the wrong threats or miss critical dependencies, violating the principle that BCP updates should be risk-driven. This aligns with ISACA's guidance that risk assessment is the foundation for BCP maintenance and testing frequency.

Answer

Obtain management approval for BCP updates

Answer

Immediately schedule a full-scale test

Answer

Update the BCP to include cloud applications

Question 12

An IS auditor is reviewing the software asset management (SAM) process. The organization uses a mix of commercial off-the-shelf (COTS) and open-source software. The auditor finds that several servers are running end-of-life (EOL) operating systems that are no longer patched. Which TWO risks are most directly associated with this finding?

Accepted Answer

Increased risk of security breaches due to unpatched vulnerabilities.. Option A is correct because EOL operating systems no longer receive vendor security patches, so known vulnerabilities (e.g., unpatched CVEs) remain exploitable, directly raising the likelihood of security breaches, malware infection, and unauthorized access. Option C is correct because many regulatory and compliance frameworks (e.g., PCI DSS, HIPAA, ISO 27001) mandate timely patching and vulnerability management; running unpatched EOL systems constitutes a direct compliance violation subject to audit findings, fines, or loss of certification. Option B is not the most direct risk, since integration difficulty is an operational/interoperability concern rather than the primary consequence of missing patches. Option D is not directly tied to EOL status, as reduced performance stems from hardware or software age, not the absence of security patches. Option E is unrelated, because licensing costs depend on contract terms and usage, not on whether an OS is EOL or unpatched.

Answer

Difficulty in integrating with newer systems.

Answer

Reduced performance due to outdated software.

Answer

Higher software licensing costs.

Question 13

An IS auditor is reviewing an agile software development project. Which of the following would be the BEST evidence that adequate controls are in place for user acceptance?

Accepted Answer

Each sprint concludes with a sprint review attended by stakeholders. In agile development, the sprint review is the ceremony where the team demonstrates the completed increment to stakeholders, who provide feedback and formally accept or reject the work. This stakeholder participation at the end of each sprint is the strongest evidence that user acceptance controls are functioning, because acceptance is continuous rather than deferred to a single end-of-project event. It directly addresses the risk that delivered functionality diverges from business needs.

Answer

The product backlog is managed by the product owner

Answer

Daily standup meetings are held to track progress

Answer

Retrospectives are conducted after each sprint

Question 14

An IT manager needs to ensure that the organization's IT resources are used efficiently. Which of the following is the BEST metric to measure IT resource utilization?

Accepted Answer

Average server CPU utilization. Average server CPU utilization directly measures how much of the computing capacity is being consumed over time, making it the most relevant metric for assessing whether IT resources are being used efficiently. High or low CPU utilization can indicate over-provisioning, under-utilization, or potential performance bottlenecks, enabling the IT manager to optimize resource allocation.

Answer

System uptime percentage

Answer

Number of help desk tickets resolved per day

Answer

Percentage of projects completed on time

Question 15

A company is migrating its customer database to a public cloud provider. Which of the following encryption strategies best protects data while minimizing performance impact on queries?

Accepted Answer

Use column-level encryption and tokenization for sensitive fields.. Column-level encryption and tokenization allow sensitive fields (e.g., SSNs, credit card numbers) to be protected while leaving non-sensitive columns unencrypted, preserving query performance on indexed and frequently queried data. Tokenization replaces sensitive values with non-sensitive placeholders, enabling joins and lookups without decryption overhead, and column-level encryption limits decryption to only the required fields per query.

Answer

Encrypt the entire database at rest using AES-256, and decrypt for each query.

Answer

Encrypt the database at the application layer before storage.

Answer

Rely on the cloud provider's default encryption for the storage.