CISA Practice Test 46 — 15 Questions

Question 1

A company's backup policy requires that backup tapes be stored offsite for at least one year. During an audit, the auditor finds that the offsite storage facility is not access-controlled and backup tapes are not encrypted. Which of the following is the auditor's BEST recommendation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Encrypt all backup tapes before sending them offsite. The core issue is that backup tapes contain sensitive data and are stored in an uncontrolled environment. Encrypting the tapes before transport ensures that even if the physical security of the offsite facility is compromised, the data remains confidential. This directly addresses the risk of unauthorized access to the data, which is the primary concern, and is a cost-effective, immediate control that does not disrupt operations.

Answer

Negotiate a new contract with a different offsite storage provider

Answer

Move the tapes back to the primary site until the offsite facility is secured

Answer

Implement a check-in/check-out log for the offsite facility

Question 2

When implementing a commercial off-the-shelf (COTS) software package, which of the following is the MOST important activity to ensure the software meets business requirements?

Accepted Answer

Performing a gap analysis between requirements and software features. Performing a gap analysis is the most important activity because it systematically maps each business requirement against the COTS software's delivered features, identifying any shortfalls that must be addressed through configuration, customization, or process adaptation. Without this structured comparison, the organization risks deploying software that fails to support critical business processes, leading to costly rework or project failure.

Answer

Conducting a vendor demonstration

Answer

Developing a project plan with milestones

Answer

Reviewing the software's technical architecture

Question 3

Which of the following is the BEST indicator that an organization's incident management process is effective?

Accepted Answer

The percentage of recurring incidents is decreasing over time. A decreasing number of recurring incidents indicates that root causes are being identified and resolved, which is a key measure of incident management effectiveness. Option A focuses on resolution speed, which is not the best indicator of effectiveness; Option B may indicate better detection, not effectiveness; Option C is about logging timeliness, which is a process compliance metric, not effectiveness.

Answer

The average time to resolve incidents is under 1 hour

Answer

The number of incidents reported per month is increasing

Answer

All incidents are logged within 10 minutes of detection

Question 4

An IS auditor is evaluating the effectiveness of an organization's business continuity plan (BCP). Which of the following findings would be of GREATEST concern?

Accepted Answer

The BCP has not been tested in over two years. The BCP has not been tested in over two years is the greatest concern because testing is the only way to validate that the plan works under real-world conditions. Without recent testing, the organization cannot be confident that recovery time objectives (RTOs) and recovery point objectives (RPOs) are achievable, and any gaps or assumptions in the plan remain undiscovered. ISACA standards recommend testing at least annually, and a two-year gap significantly increases the risk of plan failure during an actual disaster.

Answer

The backup tapes are stored in a locked cabinet in the server room

Answer

The BCP contact list has not been updated in six months

Answer

The BCP relies on manual workarounds for critical systems

Question 5

An organization is implementing a privacy program to comply with GDPR. Which THREE of the following are essential elements for managing cross-border data transfers?

Accepted Answer

Standard Contractual Clauses (SCCs). Under GDPR, cross-border data transfers require appropriate safeguards such as Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or an adequacy decision by the European Commission.

Answer

Data Protection Impact Assessment (DPIA)

Answer

Data encryption at rest

Question 6

A multinational company must comply with GDPR and local data protection laws when transferring personal data from the EU to a subsidiary in the US. Which transfer mechanism is most commonly accepted as providing adequate protection?

Accepted Answer

Standard Contractual Clauses (SCCs) adopted by the European Commission.. Standard Contractual Clauses (SCCs) are pre-approved model contracts issued by the European Commission that provide a legally recognized mechanism for transferring personal data from the EU to a third country, such as the US, without requiring additional authorization. They are the most commonly accepted transfer mechanism because they impose contractual obligations on both the data exporter and importer to ensure adequate data protection, aligning with GDPR Article 46 requirements.

Answer

A data protection impact assessment (DPIA) approved by the local supervisory authority.

Answer

Explicit consent from each data subject for the transfer.

Answer

Binding Corporate Rules (BCRs) for intra-group transfers.

Question 7

A company is using an agile development methodology for a critical business application. The IS auditor is concerned about the lack of formal documentation. What is the BEST approach to mitigate this risk?

Accepted Answer

Ask the team to maintain a lightweight document of important decisions and changes.. The best approach because it balances agile principles with the need for auditability. In agile, lightweight documentation (e.g., architecture decision records, user story acceptance criteria) captures key decisions and changes without the overhead of full waterfall documentation. This mitigates the risk of knowledge loss while preserving the team's velocity.

Answer

Require the project to switch to a waterfall methodology.

Answer

Accept the lack of documentation because agile emphasizes working software.

Answer

Perform a detailed code review to compensate for missing documentation.

Question 8

An online retail company runs its e-commerce platform on a virtualized infrastructure with 50 virtual servers. The platform experiences intermittent slowdowns during peak hours, and recent monitoring reports show that disk I/O latency on the storage area network (SAN) frequently exceeds 50 ms during these periods. The SAN has two fabric switches and a single storage array with 12 TB of usable capacity, currently at 80% utilization. The company’s disaster recovery plan requires recovery point objective (RPO) of 1 hour and recovery time objective (RTO) of 4 hours for the e-commerce platform. During a recent test failover to the disaster recovery site, the IT team discovered that the replication link between primary and DR sites is saturated, causing replication lag of up to 3 hours. The team also noted that the DR site storage has only 6 TB of usable capacity, now at 60% utilization. The IT manager is concerned about meeting the RPO and RTO. Which course of action should the IT team take first?

Accepted Answer

Upgrade the replication link between primary and DR sites to a higher bandwidth connection. The immediate issue preventing the organization from meeting its RPO of 1 hour is the saturated replication link, which causes replication lag of up to 3 hours. Upgrading the link to a higher bandwidth connection directly addresses the bottleneck, reducing replication time and enabling the RPO to be met. Other options, while potentially beneficial, do not resolve the primary cause of the RPO failure.

Answer

Upgrade the SAN fabric switches to support higher throughput and reduce disk I/O latency

Answer

Add additional storage capacity to the DR site to reduce storage utilization

Answer

Implement more frequent incremental backups and reduce retention period to free up storage

Question 9

A large organization is implementing a new HR management system to handle payroll and employee data. The project is currently in the build phase with a planned go-live in three months. Recently, the vendor notified the project team that a critical security patch will be released in two months that addresses a data leakage vulnerability present in the current version. The patch includes new features that are not in the contract. The project manager estimates that integrating the patch and re-testing will delay the project by at least four months. Business stakeholders insist on meeting the original go-live date because the legacy system is being decommissioned. The organization has a strict policy that all systems processing sensitive data must have the latest security patches within 30 days of release. What should the project team do?

Accepted Answer

Delay the go-live and integrate the security patch before going live. The organization's policy mandates that all systems processing sensitive data must have the latest security patches within 30 days of release. Going live without the patch would violate this policy and expose the system to a known data leakage vulnerability for up to 30 days, even with compensating controls. Delaying go-live to integrate the patch before going live ensures compliance and mitigates the risk. Option A is incorrect because applying a compensating control does not satisfy the policy requirement and leaves the vulnerability unpatched. Option B is incorrect because going live without the patch and applying it after go-live would still result in a period of non-compliance and potential data leakage. Option D is incorrect because relying on negotiation for an early fix is uncertain and may not resolve the issue within the required timeframe, and the delay for integration and testing would still occur.

Answer

Proceed with go-live but apply a compensating control to mitigate the vulnerability until the patch is applied

Answer

Continue with the current version, go live as planned, and schedule the security patch installation after go-live within the 30-day window

Answer

Negotiate with the vendor to obtain an early fix for the vulnerability without the new features to minimize delay

Question 10

An IS auditor is reviewing the audit follow-up process. The auditor notes that management has implemented corrective actions for 80% of previous audit findings. What should the auditor conclude?

Accepted Answer

Further investigation of outstanding findings is needed. An 80% closure rate indicates that 20% of findings remain unresolved. ISACA standards require auditors to verify that all high-risk findings are remediated before concluding on control effectiveness. Without evidence that the outstanding 20% are low-risk or have an accepted risk, the auditor must investigate further to ensure residual risk is within the organization's appetite.

Answer

The audit scope was too narrow

Answer

The audit process is effective

Answer

Management is compliant with all recommendations

Question 11

Which THREE are core components of a comprehensive identity and access management (IAM) system? (Choose three.)

Accepted Answer

Single sign-on (SSO) for simplified authentication.. The core components of an IAM system focus on managing digital identities and controlling access to resources. Single sign-on (SSO) simplifies authentication by allowing users to log in once and access multiple applications. Privileged access management (PAM) secures administrative accounts with elevated privileges. Role-based access control (RBAC) assigns permissions based on job roles, ensuring users have only necessary access. VPN and DLP are security controls but are not core IAM components; VPN provides network access, and DLP prevents data loss, neither directly manages identities or access rights.

Answer

Virtual private network (VPN) for remote network access.

Answer

Data loss prevention (DLP) to prevent data exfiltration.

Question 12

A company is developing a mobile banking application. Which test phase is MOST critical to ensure that the application functions correctly from the end user's perspective?

Accepted Answer

User acceptance testing (UAT).. User acceptance testing (UAT) is the most critical phase for verifying that the mobile banking application meets end-user requirements and functions correctly from their perspective. Unlike other testing phases that focus on technical correctness, UAT involves real users performing actual banking transactions (e.g., fund transfers, balance inquiries) in a production-like environment to validate usability, workflow accuracy, and compliance with business rules. This ensures the application is ready for deployment and will be accepted by its intended audience.

Answer

System testing.

Answer

Unit testing.

Answer

Integration testing.

Question 13

An IS auditor is performing a review of an organization's IT governance framework. Which of the following findings would be of MOST concern?

Accepted Answer

No documented IT strategy aligned with business strategy. The absence of a documented IT strategy aligned with the business strategy is the most critical governance finding. Without strategic alignment, IT decisions may not support business objectives, making all other controls less effective. Option B (incomplete project portfolio management) is tactical and can be addressed after strategic alignment. Option C (lack of an IT steering committee) is a structural issue but not as fundamental as lack of strategy. Option D (absence of an enterprise-wide information security policy) is operational and less strategic than the alignment issue.

Answer

Incomplete IT project portfolio management

Answer

Lack of an IT steering committee

Answer

Absence of an enterprise-wide information security policy

Question 14

An organization is implementing a cloud resource management strategy to optimize costs and prevent waste. Which three practices should the auditor recommend?

Accepted Answer

Detect and remove orphaned resources. Orphaned resources (e.g., unattached EBS volumes, unused Elastic IPs, stale load balancers) continue to incur costs without providing any business value. Detecting and removing them directly eliminates waste, which is a core principle of cloud cost optimization. This practice aligns with the AWS Well-Architected Framework's Cost Optimization pillar, specifically the 'Stop Spending Money on Undifferentiated Heavy Lifting' design principle.

Answer

Consolidate all resources into a single region

Answer

Use only Reserved Instances for all workloads

Question 15

During the requirements gathering phase for a new financial system, stakeholders disagree on the priority of security controls versus user convenience. Which of the following is the BEST approach?

Accepted Answer

Conduct a risk assessment to balance security and usability. A risk assessment provides a structured, evidence-based framework for balancing security controls against user convenience during requirements gathering. By evaluating the likelihood and impact of threats specific to financial systems (e.g., transaction fraud, data breaches) against usability needs, the organization can prioritize controls that mitigate high-risk exposures without unnecessarily impeding legitimate business processes. This aligns with the COBIT 5 principle of balancing benefits, risk, and resource optimization.

Answer

Postpone security decisions to later phases

Answer

Let the project team decide based on development ease

Answer

Implement all security controls regardless of convenience