CISA Practice Test 47 — 15 Questions

Question 1

Which of the following is the BEST method to ensure that a system development project is completed on time?

Accepted Answer

A realistic project schedule with milestones. A realistic project schedule with milestones (Option B) is the best method because it establishes a time-phased plan with measurable checkpoints, enabling early detection of delays and facilitating proactive corrective actions. Without a realistic baseline, even the best tracking tools or meetings cannot prevent schedule overruns, as the schedule itself is the foundation for monitoring and controlling project progress.

Answer

Regular status meetings

Answer

Frequent scope changes

Answer

Use of a project management software

Question 2

An organization is adopting ITIL 4 to improve its service management practices. Which guiding principle emphasizes understanding how different components work together to deliver value?

Accepted Answer

Think and work holistically. In ITIL 4, the guiding principle 'Think and work holistically' emphasizes understanding how all parts of the organization — people, processes, technology, partners, and information — work together as a system to deliver value. It discourages siloed thinking and encourages consideration of the entire value stream and its interdependencies. This directly matches the question's emphasis on understanding how different components work together.

Answer

Start where you are

Answer

Keep it simple and practical

Answer

Focus on value

Question 3

A multinational corporation is deploying a data loss prevention (DLP) solution across its network. The DLP system must be configured to prevent the exfiltration of personally identifiable information (PII) while minimizing false positives. Which approach is most effective?

Accepted Answer

Use regex patterns for PII combined with context-aware policies (e.g., user role, destination domain). The most effective DLP approach combines regex-based detection of PII patterns with context-aware policies that consider user role, destination domain, and other metadata. This reduces false positives by only blocking or alerting when sensitive data is leaving in a risky context (e.g., a finance user sending to an external domain), while allowing legitimate business flows. Pure pattern matching without context generates excessive false positives, and encryption or training alone do not prevent exfiltration.

Answer

Block all outbound email containing keywords such as 'SSN' or 'credit card'

Answer

Require all users to complete annual data handling training and rely on self-reporting

Answer

Implement full disk encryption on all endpoints and encrypt all outbound traffic

Question 4

A company's availability monitoring shows that a critical application has an average MTBF of 720 hours and an average MTTR of 4 hours. What is the availability percentage?

Accepted Answer

99.45%. Availability = MTBF / (MTBF + MTTR) = 720 / (720 + 4) = 720 / 724 ≈ 0.994475, or 99.45%.

Answer

99.72%

Answer

99.17%

Answer

99.95%

Question 5

An organization's IT service desk is the single point of contact for all incidents. The SLA for resolving P2 incidents is 8 hours. The auditor finds that the service desk frequently reassigns P2 incidents to second-level support without updating the incident record, causing delays in resolution. The average resolution time for P2 incidents is 10 hours. What is the primary control weakness?

Accepted Answer

Lack of automated escalation and tracking for incident reassignments.. The primary control weakness is the lack of automated escalation and tracking for incident reassignments. Without automated mechanisms (e.g., workflow triggers, timestamped reassignment logs, or integration with IT service management tools), the service desk can reassign P2 incidents to second-level support without updating the incident record, leading to untracked delays. This directly violates the SLA of 8 hours, as the average resolution time of 10 hours indicates that incidents are not being monitored or escalated properly, causing them to exceed the target.

Answer

Inadequate training of service desk staff.

Answer

SLA targets are too aggressive for P2 incidents.

Answer

Insufficient number of second-level support staff.

Question 6

An organization's backup strategy includes full backups every Sunday and incremental backups on other days. On Wednesday, a failure occurs. Which backups are needed to restore the data?

Accepted Answer

Sunday's full backup and Monday through Wednesday incremental backups. To restore from incremental backups, you need the last full backup (Sunday) and all incremental backups from Monday through Wednesday.

Answer

Sunday's full backup only

Answer

Sunday's full backup and Wednesday's incremental backup

Answer

Wednesday's incremental backup only

Question 7

An organization is disposing of old servers. The IS auditor reviews the asset disposition process and finds that hard drives are being erased using a standard format command. What is the auditor's primary concern?

Accepted Answer

The data on the hard drives may still be recoverable.. Standard format commands do not securely erase data; data can still be recovered. Secure sanitization methods (e.g., degaussing, shredding) should be used.

Answer

The drives are not being tested for functionality.

Answer

The software licenses are not being transferred.

Answer

The servers are not being recycled for environmental compliance.

Question 8

Which type of disaster recovery test involves a full switch-over from the primary site to the alternate site, resulting in actual disruption of normal operations?

Accepted Answer

Full interruption test. A full interruption test (also called full-scale test) involves actual failover, shutting down primary operations and running completely from the alternate site.

Answer

Tabletop test

Answer

Parallel test

Answer

Simulation test

Question 9

An organization is planning a full interruption test of its disaster recovery plan. Which THREE of the following should the IS auditor recommend as best practices for this type of test? (Select three.)

Accepted Answer

Notify all relevant stakeholders in advance. Option A is correct because notifying all relevant stakeholders in advance is a best practice for a full interruption test, ensuring that business units, IT staff, and management are aware of the planned outage and can prepare for the disruption, thereby preventing unintended operational impact. Option C is correct because defining clear test objectives and success criteria provides measurable benchmarks for evaluating whether the disaster recovery plan achieves its recovery time objective (RTO) and recovery point objective (RPO), making the test meaningful and auditable. Option D is correct because having a rollback plan in case of failure is essential, as a full interruption test actually shuts down production systems, and if recovery fails, the organization must be able to restore normal operations quickly to avoid extended downtime. Option B is not recommended because conducting the test during peak business hours unnecessarily magnifies risk to critical operations; such tests are typically scheduled during off-peak or maintenance windows. Option E is not recommended because scheduling the test immediately after a major system upgrade introduces unvalidated changes and instability, which could confound test results and increase the risk of failure unrelated to the DR plan itself.

Answer

Conduct the test during peak business hours to simulate real conditions

Answer

Ensure the test is scheduled after a major system upgrade to validate changes

Question 10

An IS auditor is assessing the effectiveness of network segmentation for a payment card processing environment. Which of the following is the PRIMARY benefit of network segmentation in meeting PCI DSS requirements?

Accepted Answer

Reduced scope of the PCI DSS assessment. Network segmentation reduces the scope of the PCI DSS assessment by isolating the cardholder data environment from other networks, so only systems that handle card data need to comply with PCI DSS.

Answer

Improved network performance

Answer

Elimination of the need for firewalls

Answer

Simplified patch management

Question 11

Refer to the exhibit. An auditor notices this log entry during a review. The user john.doe does not have a legitimate business need to access executive salaries. Which of the following is the MOST likely control failure?

Accepted Answer

Inadequate access controls or role-based permissions. The log entry shows user john.doe successfully accessed executive salary data via a SELECT query. Since the user has no legitimate business need for this data, the most likely control failure is inadequate access controls or role-based permissions (RBAC). Proper RBAC would restrict access to sensitive columns or tables based on job function, preventing unauthorized queries regardless of other controls.

Answer

Database firewall misconfiguration

Answer

Audit logging is not enabled

Answer

Lack of encryption at rest

Question 12

A company is implementing a cloud-based identity and access management (IAM) system. Which of the following best describes the principle of least privilege in this context?

Accepted Answer

Permissions should be granted based on the user's role and need-to-know.. The principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions, based on their role and need-to-know. In a cloud-based IAM system, this is typically implemented through role-based access control (RBAC) or attribute-based access control (ABAC), ensuring minimal exposure to sensitive resources and reducing the attack surface.

Answer

Users should have administrative rights for troubleshooting.

Answer

Permissions should be revoked only when an employee leaves the company.

Answer

All users should have the same level of access for consistency.

Question 13

A company is implementing a new ERP system. The project team plans to use a parallel conversion strategy. What is the PRIMARY advantage of this approach?

Accepted Answer

Risk mitigation by allowing fallback to the old system.. The primary advantage of a parallel conversion strategy is risk mitigation. By running the new ERP system alongside the old system for a period, the organization can validate the new system's functionality and data integrity while retaining the ability to immediately fall back to the legacy system if critical failures occur. This approach ensures business continuity and reduces the impact of unforeseen issues during the transition.

Answer

Immediate realization of benefits from the new system.

Answer

Lower total cost due to reduced training requirements.

Answer

Faster implementation compared to phased approach.

Question 14

An IT governance framework should include which TWO key components? (Select exactly two.)

Accepted Answer

Strategic alignment. Strategic alignment (C) is a core component of any IT governance framework because governance must ensure that IT investments, priorities, and initiatives directly support the organization's business goals and objectives. Performance measurement (E) is equally essential, as governance requires metrics, KPIs, and monitoring mechanisms (such as balanced scorecards or COBIT goals) to verify that IT delivers value, manages risk, and meets agreed service levels. Together, these two components reflect the dual governance mandate of directing IT toward business strategy while measuring whether it actually delivers. The other options do not belong: user training (A) is an operational capability rather than a governance component, vendor lock-in (B) is a risk to be avoided, not a framework element, and network firewall rules (D) are technical security controls, not governance-level components.

Answer

User training

Answer

Vendor lock-in

Answer

Network firewall rules

Question 15

A government agency is developing a case management system for law enforcement. The project follows an agile approach, releasing iterations every two weeks. During a sprint demo, users discover that the system does not redact personally identifiable information (PII) in documents shared with external parties, violating privacy laws. The development team says they planned to add redaction in a future sprint. The product owner wants to prioritize PII redaction immediately. The project manager is concerned that this will disrupt the release schedule. The IS auditor is assessing the project's risk management. Which of the following is the BEST recommendation?

Accepted Answer

Re-estimate the sprint and include PII redaction as a top priority, adjusting the schedule accordingly.. It aligns with agile risk management principles: when a critical compliance vulnerability (PII exposure) is discovered, the highest-priority user story must be re-estimated and inserted into the current sprint backlog, even if it means adjusting the release schedule. The IS auditor’s focus is on ensuring that the risk is actively mitigated, not deferred, and re-prioritization is the standard agile response to newly identified high-severity risks.

Answer

Implement network-level restrictions to prevent external sharing.

Answer

Provide users with training on manual redaction as a workaround.

Answer

Document the risk and accept the compliance exposure until the planned sprint.