CISA Practice Test 48 — 15 Questions

Question 1

Which TWO of the following are phases of the audit process? (Select two.)

Accepted Answer

Planning. The audit process includes planning, fieldwork, reporting, and follow-up.

Answer

Budgeting

Answer

Risk assessment

Answer

Training

Question 2

During which phase of the IS audit process does the auditor perform walkthroughs and test controls?

Accepted Answer

Fieldwork. Walkthroughs and control testing are performed during fieldwork, where the auditor executes planned audit procedures.

Answer

Reporting

Answer

Planning

Answer

Follow-up

Question 3

An organization is implementing a custom ERP system. During user acceptance testing (UAT), critical bugs are found that affect core financial processing. The project sponsor suggests deploying the system on schedule and fixing bugs after go-live. What is the BEST course of action?

Accepted Answer

Delay go-live until all critical bugs are resolved and UAT is successfully completed. Deploying an ERP system with unresolved critical bugs in core financial processing violates the fundamental principle of system integrity and accuracy. UAT must be successfully completed to validate that the system meets business requirements and processes financial transactions correctly; going live with known critical defects introduces unacceptable risk of financial misstatement, regulatory non-compliance, and data corruption. Delaying go-live ensures that all critical bugs are resolved and retested, preserving the reliability of financial data and audit trails.

Answer

Go live as planned and fix bugs post-implementation

Answer

Accept the bugs with documented risk acceptance from management

Answer

Go live but include a rollback plan and deploy fixes immediately

Question 4

During a system deployment, the above error occurs. What is the MOST likely cause?

Accepted Answer

Firewall blocking the database port. The error message (not shown but implied from context) typically indicates a network-level connectivity failure, such as 'cannot connect to server' or 'connection timed out'. A firewall blocking the database port (e.g., TCP 1433 for SQL Server, 3306 for MySQL, 1521 for Oracle) is the most likely cause because it prevents the application from establishing a TCP handshake with the database server, even if the server name, password, and database service are all correct.

Answer

Incorrect server name in connection string

Answer

Invalid password

Answer

Database service not running on the server

Question 5

An IS auditor is reviewing an agile project. Which THREE of the following are controls the auditor should evaluate?

Accepted Answer

Sprint review. In agile, sprint reviews, product backlog prioritization, and retrospective actions are key controls to ensure quality and continuous improvement.

Answer

Burndown charts

Answer

Daily standup

Question 6

An IT department is structured with a central group that manages infrastructure and security, while business units have their own IT staff for application support. This is an example of which IT organizational structure?

Accepted Answer

Hybrid. A hybrid (or federated) structure combines centralized and decentralized elements, where some functions are centralized and others are distributed.

Answer

Matrix

Answer

Centralized

Answer

Decentralized

Question 7

Which TWO of the following are indicators that an IS auditor may need to adjust the audit approach during fieldwork? (Select TWO.)

Accepted Answer

Inability to obtain sufficient appropriate audit evidence. If the IS auditor cannot obtain sufficient appropriate audit evidence, the audit approach must be adjusted—for example, by expanding sample sizes, using alternative procedures, or re-evaluating the reliance on controls. This directly impacts the ability to form an audit opinion and is a key fieldwork trigger per ISACA audit standards.

Answer

Completion of the initial risk assessment

Answer

Audit team members are behind schedule

Answer

Management requests a change in audit scope

Question 8

A retail company is merging with a competitor. The IT departments of both organizations have different IT governance structures: Company A uses a centralized model with strict change management, while Company B uses a decentralized model with autonomous business unit IT. The CIO has been tasked with integrating the IT functions post-merger. The board expects cost synergies and improved service levels. The integration team is facing resistance from Company B's business heads who fear loss of agility. The CIO needs to propose a governance model for the merged entity. Which approach would BEST meet the board's expectations while addressing resistance?

Accepted Answer

Implement a phased integration with a transitional governance structure that includes representatives from both sides.. A phased integration with a transitional governance structure that includes representatives from both sides allows the merged entity to gradually converge governance models, manage change and resistance, and work toward cost synergies and improved service levels without immediately disrupting business operations. Option A is incorrect because keeping both models separate permanently fails to achieve the desired integration and synergies. Option B is incorrect because fully adopting the decentralized model may not deliver the cost synergies and centralized control expected by the board. Option C is incorrect because immediately imposing a centralized model would likely cause strong resistance from Company B's business heads and disrupt agility, undermining the merger's success.

Answer

Keep both models separate and allow business units to choose their preferred model.

Answer

Adopt Company B's decentralized model to preserve agility.

Answer

Immediately impose Company A's centralized model across the merged entity.

Question 9

An organization is adopting agile development methodology. Which control is MOST critical to ensure security is integrated?

Accepted Answer

Including security stories in the product backlog. In agile development, security must be continuously integrated into each iteration. Including security stories in the product backlog ensures that security tasks are prioritized, estimated, and addressed during each sprint, making security an inherent part of the development lifecycle rather than an afterthought. This aligns with the principle of 'shifting left' on security, where controls are applied as early as possible.

Answer

Penetration testing before release

Answer

Code reviews after each sprint

Answer

Security requirements defined at project initiation

Question 10

A company is developing a custom application. During the requirements phase, the project manager documents that the system must encrypt all sensitive data at rest. Which of the following is the BEST control to ensure this requirement is met throughout the development lifecycle?

Accepted Answer

Create a requirements traceability matrix (RTM).. A requirements traceability matrix (RTM) links each requirement to corresponding design, development, and testing artifacts. By mapping the encryption-at-rest requirement to specific code modules, configuration settings, and test cases, the RTM ensures that the control is implemented and verified at every stage of the lifecycle, not just at the end. This makes it the best proactive control for continuous compliance throughout development.

Answer

Perform static code analysis on the final code.

Answer

Conduct a post-implementation security review.

Answer

Deploy a database activity monitoring tool.

Question 11

An IS auditor is planning an audit of a financial application. The auditor wants to ensure that audit effort is focused on areas with the highest risk. Which approach should the auditor adopt?

Accepted Answer

Risk-based audit approach. A risk-based audit approach prioritizes high-risk areas for more intensive testing, aligning with ISACA standards.

Answer

Substantive approach

Answer

Control self-assessment approach

Answer

Compliance-based approach

Question 12

Which of the following is the BEST control to ensure that system changes are authorized?

Accepted Answer

Change advisory board approval. The change advisory board (CAB) is the primary control for authorizing system changes because it provides a formal, documented approval process before any change is implemented. This ensures that changes are reviewed by stakeholders with appropriate authority, reducing the risk of unauthorized or poorly planned modifications. Without CAB approval, there is no definitive authorization step, making it the best control for ensuring authorization.

Answer

Audit trail of all changes

Answer

Segregation of duties between developers and operators

Answer

Version control system

Question 13

A company performs daily full backups of its database and weekly incremental backups. The backup retention policy requires keeping full backups for 30 days and incremental backups for 7 days. An auditor reviews the backup schedule. Which backup type provides the fastest restore?

Accepted Answer

Full backup. A full backup contains all data and requires only one restore operation, making it faster than restoring from incremental or differential backups.

Answer

Log backup

Answer

Incremental backup

Answer

Differential backup

Question 14

An organization uses the policy shown. Which of the following is an omission in the policy?

Accepted Answer

No specification of data disposal methods after retention periods. The policy does not specify data disposal methods after the retention period, which is a critical omission for data lifecycle management. Option A is incorrect because authorized users are likely defined elsewhere in the policy. Option B is incorrect because backup frequency is mentioned. Option D is incorrect because encryption may not be required for all log data based on the policy context.

Answer

No definition of authorized users

Answer

No mention of backup frequency

Answer

Missing encryption requirement for log data

Question 15

Scenario: A mid-sized manufacturing company has recently experienced a significant IT outage that halted production for 8 hours. The root cause was a failed firmware update on a core switch that was performed outside the change management process by a senior network engineer who claimed the update was urgent to patch a critical vulnerability. The company has a well-documented change management policy that requires all changes to be reviewed by the change advisory board (CAB) before implementation, except for emergency changes which require post-implementation review within 48 hours. The engineer did not follow the emergency change process; he implemented the update directly. The IT director wants to prevent such incidents in the future. Which of the following is the BEST action?

Accepted Answer

Enforce the change management policy by implementing stricter controls and disciplinary measures for non-compliance.. The root cause was a deliberate bypass of the existing change management policy, not a flaw in the policy itself. Enforcing stricter controls and disciplinary measures directly addresses the human factor by reinforcing accountability and deterring unauthorized changes, which is the most effective way to prevent recurrence when a well-documented process is already in place but ignored.

Answer

Implement automatic firmware updates to eliminate human error.

Answer

Increase the frequency of CAB meetings to weekly to expedite change approvals.

Answer

Remove the network engineer's administrative access to all network devices.