CISA Practice Test 46 — 15 Questions

Question 1

An organization has defined an RTO of 4 hours for its critical financial system. During a disaster recovery test, the system was recovered in 3.5 hours, but data loss was 30 minutes. Which metric is most directly addressed by the recovery time?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

RTO. The Recovery Time Objective (RTO) defines the maximum acceptable downtime for a system after a disaster. Since the organization's RTO is 4 hours and the system was recovered in 3.5 hours, the recovery time directly satisfies the RTO metric. The 30 minutes of data loss is irrelevant to RTO; it pertains to the Recovery Point Objective (RPO).

Answer

RPO

Answer

MTBF

Answer

MTTR

Question 2

You are an IS auditor reviewing the remote access configuration for a medium-sized enterprise. The company uses a VPN concentrator to allow employees to connect from home. The VPN is configured with IPsec using pre-shared keys (PSK) and requires no multi-factor authentication. Employees use company-issued laptops with full disk encryption. The VPN logs show that connections are coming from a wide range of IP addresses, including some from countries where the company has no business operations. The IT manager argues that the PSK is changed monthly and that full disk encryption mitigates any risk. However, during the audit, you find that the PSK is stored in a shared document on an internal file server accessible to all employees. Additionally, the VPN concentrator uses a single PSK for all users. Which of the following is the MOST critical finding?

Accepted Answer

The VPN uses a single pre-shared key for all users, increasing the risk of widespread compromise. The use of a single pre-shared key (PSK) for all VPN users is the most critical finding because it creates a single point of failure: if that key is compromised, an attacker can impersonate any authorized user and gain full network access. The fact that the PSK is stored in a shared document accessible to all employees dramatically increases the likelihood of exposure, and changing it monthly does not remediate the fundamental lack of user-level authentication. Without per-user credentials or multi-factor authentication, the VPN concentrator cannot distinguish between legitimate employees and an attacker who possesses the shared key.

Answer

The PSK is changed monthly, but the change interval is too long

Answer

Full disk encryption on laptops is not sufficient to protect VPN credentials

Answer

VPN connections from unexpected countries indicate possible unauthorized access

Question 3

An organization is considering whether to build a custom application or purchase a commercial off-the-shelf (COTS) product. Which of the following factors is MOST important when deciding to build rather than buy?

Accepted Answer

Need for highly specialized functionality not available in the market. When an organization requires highly specialized functionality that is not available in any commercial off-the-shelf (COTS) product, building a custom application becomes the only viable option. COTS products are designed for broad market needs and often lack the unique features or compliance requirements that a custom solution can provide. This factor overrides cost, time, and maintenance considerations because no amount of configuration or customization of a COTS product can meet the specific functional gap.

Answer

Reduced need for ongoing maintenance

Answer

Faster time to market

Answer

Lower initial cost

Question 4

An organization uses risk-based authentication (RBA) for user access. Which of the following factors would MOST likely trigger a step-up authentication?

Accepted Answer

User accessing sensitive data from an unusual location.. Risk-based authentication (RBA) evaluates the risk level of each access attempt based on contextual factors. An unusual location is a high-risk indicator because it deviates from the user's established behavioral baseline, often triggering step-up authentication (e.g., requiring a one-time passcode or biometric verification) to verify the user's identity before granting access to sensitive data.

Answer

User logging in from a known device.

Answer

User entering correct password.

Answer

User logging in during business hours.

Question 5

An IS auditor is planning an audit of a newly implemented ERP system. The auditor wants to ensure that the audit covers critical controls. Which of the following is the most appropriate first step in the audit planning process?

Accepted Answer

Conduct a risk assessment of the ERP implementation.. C is correct because the IS auditor must first conduct a risk assessment of the ERP implementation to identify and prioritize the critical controls specific to the new system. This step ensures that the audit scope is aligned with the highest risks, such as segregation of duties conflicts, interface integrity, and configuration vulnerabilities, before any detailed planning occurs.

Answer

Interview the system administrator.

Answer

Review prior audit workpapers.

Answer

Develop a detailed audit program.

Question 6

An IS auditor is evaluating the effectiveness of an organization's information security awareness program. Which of the following is the BEST indicator of program effectiveness?

Accepted Answer

Trend in security incidents attributed to human error. The best indicator because it directly measures the program's outcome: a reduction in security incidents caused by human error. While training completion, policy acknowledgment, and quiz scores measure activity or knowledge, they do not confirm that employees have changed their behavior. A downward trend in human-error-related incidents provides empirical evidence that the awareness program is effectively influencing employee actions in real-world scenarios.

Answer

Percentage of employees who completed the training

Answer

Number of employees who acknowledged the security policy

Answer

Average score on the post-training quiz

Question 7

Which of the following is a key performance indicator (KPI) for IT service management?

Accepted Answer

Help desk first-call resolution rate. IT service management KPIs often include help desk metrics such as average resolution time.

Answer

Number of security incidents

Answer

Number of employees trained on security

Answer

Percentage of IT budget spent on new projects

Question 8

An IS auditor is auditing the user access management process for a large healthcare organization that uses an electronic health records (EHR) system. The organization has 5,000 users including doctors, nurses, and administrative staff. The auditor reviews a sample of access requests and finds that 20% of the requests were approved by the user's manager but the approval was not documented in the system. The auditor also finds that there is no periodic review of user access rights. The IT security manager states that users are automatically provisioned based on their role in the HR system, and that access reviews are performed manually by managers but not documented. What is the auditor's BEST recommendation to address the most significant risk?

Accepted Answer

Implement an automated access recertification process with quarterly reviews.. The most significant risk is the lack of periodic review of user access rights, which can lead to excessive or inappropriate access (e.g., a former nurse retaining EHR access). Automating access recertification with quarterly reviews directly addresses this by enforcing a regular, documented validation of user entitlements against their current roles, reducing the risk of unauthorized access to protected health information (PHI) under HIPAA. While the undocumented approvals are a control weakness, the absence of any review cycle is a systemic failure that automated recertification resolves.

Answer

Disable automatic provisioning and require manual approval for all access.

Answer

Require that all access approvals be documented and stored in the system.

Answer

Perform a risk assessment to determine appropriate access controls.

Question 9

An IT manager submits a request to change the firewall configuration during business hours. According to best practices for change management, what should be done FIRST?

Accepted Answer

Assess the impact and risk of the proposed change. Best-practice change management requires assessing the impact and risk of a proposed change before seeking approval or implementation. This assessment informs the change advisory board (CAB) decision and determines the appropriate approval path, rollback plan, and testing requirements. Without a risk assessment, approval would be uninformed and potentially unsafe.

Answer

Obtain approval from the change advisory board

Answer

Notify all users of the planned change

Answer

Implement the change immediately to address an urgent threat

Question 10

When implementing a data classification policy, which of the following roles is PRIMARILY responsible for assigning classification labels to data?

Accepted Answer

Data owner.. The data owner is the senior manager or business process owner who has the authority to determine the sensitivity and criticality of the data. They are primarily responsible for assigning classification labels because they understand the business impact if the data is compromised. This role defines the classification level (e.g., Public, Internal, Confidential, Restricted) based on the data's value and legal or regulatory requirements.

Answer

Data custodian.

Answer

Data user.

Answer

Data steward.

Question 11

According to ISACA IT Audit Standards, which of the following is the MOST important consideration when determining the scope of an IS audit?

Accepted Answer

The risk assessment of the area under review. The most important consideration when determining the scope of an IS audit is the risk assessment of the area under review. ISACA standards emphasize a risk-based approach, where audit resources are directed to areas with the highest risk. This ensures that the audit addresses the most significant threats to the organization.

Answer

The availability of audit staff

Answer

The budget approved for the audit

Answer

The results of prior audit findings

Question 12

An IS auditor is reviewing the disaster recovery plan (DRP) for an e-commerce company that generates 90% of its revenue online. The DRP states that the recovery time objective (RTO) for the transactional database is 4 hours, and the recovery point objective (RPO) is 1 hour. The current backup strategy includes nightly full backups and hourly transaction log backups stored on a local disk array. The backups are then copied to a remote datacenter via a WAN link with an average transfer speed of 10 Mbps. The database size is 500 GB. The auditor calculates that the time to transfer the full backup over the WAN is approximately 12 hours. The organization's management is confident that the DRP is adequate because they have never had to invoke it. What is the auditor's MOST critical finding?

Accepted Answer

The RTO of 4 hours is not achievable given the backup transfer time.. The DRP states an RTO of 4 hours for the transactional database, but the full backup transfer time over the 10 Mbps WAN link is approximately 12 hours. Since the backup must be restored before the database can be made available, the RTO cannot be met. This is the most critical finding because it directly invalidates a core recovery objective, regardless of whether the plan has been tested.

Answer

The DRP has never been tested, so its feasibility is unknown.

Answer

The backup strategy does not include encryption for data in transit.

Answer

The RPO of 1 hour is not achievable because transaction logs are only taken hourly.

Question 13

A company's backup policy requires that backup media be stored offsite. Which of the following is the PRIMARY reason for this requirement?

Accepted Answer

To ensure data is available in case of a site disaster. The primary reason for storing backup media offsite is to ensure data availability and recoverability in the event of a site-level disaster, such as a fire, flood, or physical destruction of the primary data center. This aligns with the core business continuity principle of geographic separation to avoid a single point of failure. Without offsite storage, a site disaster would destroy both primary and backup data, making recovery impossible.

Answer

To reduce backup storage costs

Answer

To comply with regulatory requirements

Answer

To protect against theft

Question 14

In an agile development environment, an IS auditor reviews the backlog and finds that security requirements are not explicitly included. What is the best recommendation?

Accepted Answer

Include security stories in the product backlog. In agile development, security should be integrated continuously rather than treated as an afterthought. Including security stories in the product backlog ensures that security requirements are prioritized, estimated, and implemented incrementally within each sprint, aligning with the agile principle of delivering value early and often. This approach embeds security into the development lifecycle from the start, reducing technical debt and vulnerabilities.

Answer

Engage external security auditors to define requirements

Answer

Allocate a separate sprint dedicated solely to security

Answer

Perform comprehensive security testing during the final sprint

Question 15

An organization is selecting a vendor for a new enterprise resource planning (ERP) system. Which of the following is the MOST critical factor in the vendor selection process?

Accepted Answer

Clearly define business requirements before issuing the request for proposal (RFP).. Clearly defining business requirements before issuing the RFP is the most critical factor because it ensures that the ERP system will align with the organization's operational needs, processes, and data flows. Without a precise requirements definition, the RFP will lack the necessary evaluation criteria, leading to mismatched vendor proposals, scope creep, and potential project failure. This step directly impacts the success of the acquisition, as it forms the foundation for all subsequent vendor evaluation and contract negotiations.

Answer

Negotiate service level agreements (SLAs) in the contract.

Answer

Check vendor references for similar projects.

Answer

Evaluate vendor financial stability.