CISA Practice Test 45 — 15 Questions

Question 1

A hospital is implementing a new electronic health records (EHR) system. The system will be used by doctors, nurses, and administrative staff. During the user acceptance testing (UAT) phase, the nursing staff reports that the interface for entering patient vitals is too slow and requires many clicks, which slows down their workflow. The project team has already completed system testing and is preparing for go-live in two weeks. The development team can make a quick fix to streamline the vital signs entry by adding a shortcut, but this change has not been tested. The IT director is concerned about patient safety and wants to ensure the system is usable. What is the BEST course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assess the risk, develop the fix, fast-track testing, and if successful, include it in the go-live. It balances patient safety with project timelines by formally assessing the risk of the untested fix, developing it, and then fast-tracking a targeted regression test. This approach ensures the usability issue is resolved without bypassing necessary quality controls, which is critical for a clinical system where data entry errors could directly impact patient care. The IT director's concern about patient safety is addressed by the risk assessment and focused testing, while the go-live date is preserved if the fix passes.

Answer

Implement the quick fix immediately and go live as scheduled

Answer

Proceed with go-live as planned and address usability issues in a future release

Answer

Delay go-live by one month to fully test the fix

Question 2

Which TWO of the following are essential components of an effective incident response plan? (Select exactly 2.)

Accepted Answer

Clearly defined roles and responsibilities. Clearly defined roles and responsibilities (C) are essential because they ensure that during a security incident, every team member knows their specific tasks, such as who leads the investigation, who communicates with stakeholders, and who executes containment actions. Without this clarity, response efforts become chaotic, leading to delays and missed containment windows, which directly impacts the organization's ability to minimize damage and recover quickly.

Answer

Root cause analysis procedures

Answer

Detailed vulnerability scanning schedules

Answer

List of all hardware vendors and support contacts

Question 3

A company has multiple business units with conflicting IT priorities. Which governance body should resolve this?

Accepted Answer

IT steering committee. An IT steering committee, comprising business and IT leadership, is responsible for prioritizing IT initiatives and resolving conflicts. IT management may lack authority; board and audit committee have broader oversight roles.

Answer

Board of directors

Answer

IT management

Answer

Audit committee

Question 4

An IT auditor is reviewing the system development life cycle (SDLC) process for a critical application. Which of the following findings would be of MOST concern?

Accepted Answer

Developers have production database access. Developers having direct production database access violates the principle of segregation of duties and poses a significant risk of unauthorized data modification, deletion, or exfiltration. In a well-controlled SDLC, production access should be restricted to operations or DBA teams, with changes promoted through automated deployment pipelines. This finding directly undermines data integrity and confidentiality controls.

Answer

Test data is refreshed from production monthly

Answer

Developers use local development environments

Answer

Code reviews are performed by senior developers

Question 5

A small manufacturing company uses a network-attached storage (NAS) device to store design files, financial records, and employee data. The NAS is backed up weekly to an external hard drive that is stored in the same office. The company has no encryption on the NAS or the backup drive. One weekend, the office is burglarized, and both the NAS and the backup drive are stolen. The company had no remote backup. Which of the following would have best protected the data in this scenario?

Accepted Answer

Enabling full-disk encryption on the NAS. Full-disk encryption (FDE) on the NAS would render the data unreadable without the decryption key, even if the physical device is stolen. Since the backup drive was also unencrypted and stored in the same location, both were equally vulnerable. FDE protects data at rest, which is the primary risk in a theft scenario where physical access is obtained.

Answer

Implementing strong passwords and user authentication on the NAS

Answer

Storing a backup offsite in a secure location

Answer

Installing a security camera and alarm system

Question 6

An auditor is reviewing the encryption strategy for a healthcare application that stores protected health information (PHI) in a database. The database currently uses transparent data encryption (TDE). What is a key risk associated with TDE?

Accepted Answer

It does not protect against privileged database users. TDE protects data at rest but does not protect against privileged database users because decryption happens transparently at the database level, allowing authorized users (e.g., DBAs) to access plaintext. This is a key risk, as it does not provide access control. Option A is wrong because key management is a consideration but not the primary risk. Option B is wrong because performance impact is typically minor with modern hardware. Option D is wrong because TDE can coexist with column-level encryption, but column-level encryption is not a substitute for the overall risk.

Answer

It requires complex key management

Answer

It significantly degrades database performance

Answer

It cannot be used with column-level encryption

Question 7

Based on the exhibit, what should the IS auditor MOST likely recommend?

Accepted Answer

Review the criteria for emergency changes and enforce proper classification. The exhibit shows changes classified as 'emergency' bypassing the standard approval process. The IS auditor's primary concern is that emergency changes may be misclassified to avoid proper review, increasing risk. Option D is correct because it addresses the root cause: reviewing the criteria for emergency changes and enforcing proper classification ensures that only truly urgent changes bypass standard controls, while all others follow the required approval path.

Answer

Investigate whether any changes are missing from the log

Answer

Immediately block all direct production access for developers

Answer

Require all changes to go through the standard approval process

Question 8

In an agile development environment, an IS auditor reviews the backlog and finds that security requirements are not explicitly included. What is the best recommendation?

Accepted Answer

Include security stories in the product backlog. In agile development, security should be integrated continuously rather than treated as an afterthought. Including security stories in the product backlog ensures that security requirements are prioritized, estimated, and implemented incrementally within each sprint, aligning with the agile principle of delivering value early and often. This approach embeds security into the development lifecycle from the start, reducing technical debt and vulnerabilities.

Answer

Engage external security auditors to define requirements

Answer

Allocate a separate sprint dedicated solely to security

Answer

Perform comprehensive security testing during the final sprint

Question 9

A database administrator accidentally deleted a critical table. The last full backup was taken 24 hours ago, and transaction logs are archived every 15 minutes. Which recovery method will minimize data loss?

Accepted Answer

Restore from full backup and apply transaction logs up to the time of deletion. Restoring from the full backup and applying transaction logs up to the time of deletion (Option D) recovers all data except the very last transactions, minimizing data loss. Option A (standby database) does not help with accidental deletion unless point-in-time recovery is used. Option B (point-in-time recovery using transaction logs) requires a full backup as a base; alone it is insufficient. Option C (full backup only) loses 24 hours of data.

Answer

Use a standby database

Answer

Point-in-time recovery using transaction logs

Answer

Restore from full backup only

Question 10

Refer to the exhibit. A security administrator is troubleshooting why external users cannot reach the web server at 203.0.113.10 from the internet. Based on the configuration, what is the MOST likely issue?

Accepted Answer

The 'no-proxy-arp' option prevents the ASA from responding to ARP requests for the public IP. The 'no-proxy-arp' command disables proxy ARP on the ASA interface for the public IP address 203.0.113.10. Without proxy ARP, the ASA will not respond to ARP requests from upstream routers for that IP, so traffic destined to the web server is never delivered to the ASA for NAT processing. This is the most likely cause because the NAT rule exists but the ASA cannot intercept the traffic at Layer 2.

Answer

No NAT rule is configured for the web server

Answer

The source address is not translated

Answer

The access list denies incoming web traffic

Question 11

An IS auditor reviews the exhibit during an audit of database controls. What is the most appropriate recommendation?

Accepted Answer

Implement a locking strategy to prevent resource contention. The exhibit (not shown here, but implied by the context) likely depicts a deadlock graph or lock-wait chain, indicating that concurrent transactions are blocking each other. The most appropriate recommendation is to implement a locking strategy (e.g., row-level locking, lock ordering, or using snapshot isolation) to prevent resource contention and avoid deadlocks. This directly addresses the root cause of the observed performance or failure issues.

Answer

Review the application code for missing commit statements

Answer

Enable automatic retry for failed transactions

Answer

Increase the database timeout parameter

Question 12

An organization uses the access list above on its perimeter firewall. Which of the following is a valid conclusion?

Accepted Answer

All HTTPS traffic from the 192.168.1.0 subnet is allowed.. The access list permits TCP traffic from source network 192.168.1.0/24 to destination port 443 (HTTPS). The permit statement for TCP with eq 443 explicitly allows HTTPS traffic from that subnet, and there is no subsequent deny statement blocking it.

Answer

All HTTP traffic from the 192.168.2.0 subnet is allowed.

Answer

All traffic from the 192.168.2.0 subnet is allowed.

Answer

All traffic from the Internet to internal hosts is denied.

Answer

All traffic from 192.168.1.0 subnet is allowed on any port.

Answer

All traffic from the Internet is denied.

Answer

The ACL allows SSH traffic from 192.168.1.0 subnet.

Question 13

Which THREE of the following are common challenges when implementing a bring-your-own-device (BYOD) policy that affect information systems operations? (Select exactly 3.)

Accepted Answer

Difficulty in enforcing data encryption and remote wipe capabilities. Options A, D, and E are correct. BYOD introduces security risks such as difficulty enforcing data encryption and remote wipe (A), incompatibility between corporate apps and various platforms (D), and increased risk of malware from unmanaged devices (E). Option B is an advantage, not a challenge. Option C is a potential benefit, not a common challenge.

Answer

Reduced hardware procurement costs for the organization

Answer

Increased employee productivity due to device familiarity

Question 14

An organization is evaluating two vendors for a critical cloud-based ERP system. Which TWO contractual clauses are most important to include to ensure the organization can monitor vendor performance and security? (Select TWO)

Accepted Answer

Audit rights. Service level agreements (SLAs) define performance metrics and remedies for breaches, ensuring accountability. Audit rights allow the organization to verify the vendor's controls, which is essential for security and compliance.

Answer

Data ownership clause

Answer

Indemnification clause

Answer

Non-disclosure agreement (NDA)

Question 15

An organization is migrating sensitive customer data to a public cloud. Which of the following encryption strategies provides the STRONGEST protection against data exposure to the cloud provider?

Accepted Answer

Implement client-side encryption with keys managed on-premises. Client-side encryption with keys managed on-premises ensures that the cloud provider never has access to the encryption keys or the plaintext data. Even if the cloud provider's infrastructure is compromised or they have administrative access, the data remains encrypted and unreadable. This provides the strongest protection because the cloud provider is excluded from the cryptographic trust boundary.

Answer

Use transport layer security (TLS) for data in transit

Answer

Encrypt data at rest using server-side encryption with AES-256

Answer

Enable the cloud provider's key management service