CISA Practice Test 47 — 15 Questions

Question 1

An IT auditor is reviewing the policy hierarchy of an organization. Which of the following correctly describes the relationship between a policy and a procedure?

Accepted Answer

A policy defines the 'what' and 'why', while a procedure defines the 'how'.. Policies are high-level statements of intent, while procedures provide detailed step-by-step instructions for implementing policies.

Answer

A policy is reviewed annually, while a procedure is reviewed every five years.

Answer

A policy is a detailed step-by-step instruction, while a procedure is a high-level statement.

Answer

A policy is a mandatory requirement, while a procedure is optional.

Question 2

Which THREE of the following are commonly accepted practices for securing mobile devices in an enterprise environment?

Accepted Answer

Use containerization for corporate data. Containerization (Option B) is a commonly accepted practice for securing mobile devices in an enterprise environment because it creates a separate, encrypted workspace on the device that isolates corporate data and applications from personal data. This approach, often implemented through Mobile Device Management (MDM) or Enterprise Mobility Management (EMM) solutions, uses technologies like sandboxing and per-container encryption (e.g., AES-256) to prevent data leakage between the corporate and personal environments. It allows the enterprise to enforce security policies (e.g., remote wipe of only the container) without compromising the user's personal privacy, which is a key requirement for BYOD (Bring Your Own Device) programs.

Answer

Install antivirus on all devices

Answer

Disable all third-party apps

Question 3

An organization has implemented role-based access control (RBAC). Which of the following is the PRIMARY benefit of RBAC?

Accepted Answer

Simplified user permission management. RBAC simplifies user permission management by assigning permissions to roles rather than individuals, allowing administrators to grant or revoke access by modifying role memberships. This reduces administrative overhead and the risk of permission errors, as changes propagate automatically to all users in a role. The primary benefit is operational efficiency in access control, not direct security features like encryption or malware protection.

Answer

Encryption of sensitive data at rest

Answer

Elimination of compliance requirements

Answer

Improved protection against malware

Question 4

Arrange the steps to implement a password policy in the correct order.

Accepted Answer

Define password requirements, then set password expiration, then configure account lockout, then communicate policy to users, then enforce policy.. Password policy implementation: define requirements, set expiration, lockout, communicate, and enforce.

Answer

Communicate policy to users, then define password requirements, then set password expiration, then configure account lockout, then enforce policy.

Answer

Define password requirements, then communicate policy to users, then set password expiration, then configure account lockout, then enforce policy.

Answer

Define password requirements, then set password expiration, then communicate policy to users, then configure account lockout, then enforce policy.

Question 5

An organization is implementing a new customer relationship management (CRM) system using an agile methodology. Which THREE areas should the IS auditor focus on to assess the effectiveness of controls during the development process?

Accepted Answer

Inclusion of security requirements in user stories. In agile, security requirements must be integrated into user stories, code reviews and static analysis are key for code quality, and sprint retrospectives help identify process improvements. Maintaining a detailed project plan is less relevant in agile, and formal change requests are not typical.

Answer

Use of formal change request documentation for each change

Answer

Adherence to the original detailed project plan

Question 6

Which THREE of the following are phases of the audit process as defined by ISACA? (Select THREE.)

Accepted Answer

Fieldwork. The audit process phases include planning, fieldwork, reporting, and follow-up.

Answer

Remediation

Answer

Execution

Question 7

An auditor finds that access reviews have not been completed for two quarters. What is the MOST significant risk?

Accepted Answer

Unauthorized access may be granted and persist. Access reviews are essential for detecting and revoking unauthorized or excessive permissions. Without them, unauthorized access may go undetected and persist, leading to potential security breaches. Option A is incorrect because while data integrity could be compromised as a secondary effect, the most direct risk is unauthorized access. Option C is incorrect: system performance is unrelated to access reviews. Option D is incorrect because reporting audit findings is a consequence, not the primary risk.

Answer

Data integrity may be compromised

Answer

System performance may degrade

Answer

Audit findings may be reported to management

Question 8

A company is implementing a new procurement system. The project team is considering using a rapid application development (RAD) methodology. Which of the following is a potential risk of using RAD?

Accepted Answer

Inadequate documentation. RAD prioritizes speed and iterative prototyping over formal documentation. Because the focus is on quickly delivering working software through user feedback and short development cycles, comprehensive documentation is often neglected or produced after the fact, leading to inadequate records for maintenance, auditing, and compliance.

Answer

Reduced stakeholder involvement

Answer

Longer development time

Answer

Difficulty in prototyping

Question 9

Which of the following is a key control during the deployment phase of a system development life cycle?

Accepted Answer

Rollback plan. The deployment phase should include a rollback plan to revert to the previous state if the new system fails. This is a critical control to minimize downtime and data loss.

Answer

Code review

Answer

Threat modeling

Answer

User acceptance testing (UAT)

Question 10

Based on the exhibit, what is the MOST likely compliance issue requiring immediate remediation?

Accepted Answer

Backup media lacks encryption.. The exhibit shows backup tapes stored in an unsecured cabinet without any indication of encryption. Since backup media often contains sensitive data, the lack of encryption exposes the organization to data breaches if the media is lost or stolen. This is a direct violation of data protection requirements and requires immediate remediation.

Answer

Access is not properly restricted.

Answer

Compliance checks are not being performed.

Answer

Retention period is too short.

Question 11

An organization's online transaction processing system experienced a sudden performance degradation. The database administrator checked system resources and found excessive I/O wait time on the storage subsystem. Which of the following is the MOST likely root cause?

Accepted Answer

Inadequate disk spindles or a storage area network (SAN) bottleneck. Excessive I/O wait time directly indicates that the storage subsystem is the bottleneck, not the database server's CPU or memory. Inadequate disk spindles or a SAN bottleneck (e.g., insufficient HBA queue depth, oversubscribed SAN links, or slow RAID rebuilds) cause the storage layer to become saturated, forcing the OS to wait for I/O completions. This is the most likely root cause because the symptom is specifically I/O wait, not CPU or memory pressure.

Answer

An inefficient SQL query causing table scans

Answer

Insufficient memory allocated to the database server

Answer

Network latency between the application and database servers

Question 12

Which TWO of the following are examples of IT governance frameworks? (Select TWO.)

Accepted Answer

COBIT 2019. COBIT and ISO/IEC 38500 are IT governance frameworks. ITIL and PMBOK are management frameworks.

Answer

PMBOK

Answer

ITIL 4

Answer

Six Sigma

Question 13

An organization uses automated job scheduling for batch processing. A critical job fails due to a dependency on another job that has not completed. Which of the following controls would BEST prevent this issue?

Accepted Answer

Dependency management. Dependency management is the correct control because it ensures that job scheduling logic explicitly defines and enforces the order of execution based on predecessor/successor relationships. By configuring dependencies (e.g., using job control language (JCL) with COND parameters or scheduling tools like CA Workload Automation ESP), the system will automatically hold a job until all prerequisite jobs have completed successfully, preventing the failure scenario described.

Answer

Job failure alerts

Answer

Manual job scheduling

Answer

Rerun procedures

Question 14

Refer to the exhibit. An IS auditor finds this bucket policy attached to an S3 bucket storing sensitive customer data. What should the auditor recommend?

Accepted Answer

Restrict the principal to specific IAM roles or users.. The bucket policy grants access to any principal ("Principal": "*"), meaning any AWS user or anonymous user can perform the allowed actions on the bucket. For a bucket storing sensitive customer data, this is a critical security risk. Restricting the principal to specific IAM roles or users (Option D) ensures only authorized identities can access the bucket, aligning with the principle of least privilege.

Answer

Change the Resource to a different bucket.

Answer

Remove the Action "s3:GetObject and add "s3:PutObject".

Answer

Encrypt the bucket at rest.

Question 15

A systems analyst is gathering requirements for a new customer relationship management (CRM) system. Which of the following is the MOST important activity to ensure that the final system meets user needs?

Accepted Answer

Conducting a joint requirements validation session with stakeholders.. Conducting a joint requirements validation session with stakeholders (Option B) is the most important activity because it ensures that the requirements are accurate, complete, and agreed upon before development begins. This collaborative review process directly involves end users and business owners, allowing for immediate clarification and correction of misunderstandings, which is critical for aligning the CRM system with actual business processes. Without this validation, even a perfectly built system may fail to meet user needs, leading to costly rework.

Answer

Creating a prototype and asking for feedback after development.

Answer

Developing a detailed technical specification before user sign-off.

Answer

Documenting all requirements in a formal specification.