CISA Practice Test 48 — 15 Questions

Question 1

Which document is typically included in the permanent file of audit documentation?

Accepted Answer

Organizational chart. The permanent file contains information that is relevant for multiple audits, such as organizational charts and key contracts.

Answer

Management representation letter

Answer

Current year audit program

Answer

Working papers for testing

Question 2

Which TWO are primary criteria for classifying information assets within an organization? (Choose two.)

Accepted Answer

Business impact if the data is lost or disclosed. Option C is correct because the primary purpose of information asset classification is to determine the harm that loss, disclosure, alteration, or unavailability would cause to the organization, so business impact drives the assigned classification level (e.g., Public, Internal, Confidential, Restricted). Option E is correct because legal and regulatory requirements—such as GDPR, HIPAA, PCI DSS, or SOX—mandate specific handling and protection levels, making compliance obligations a fundamental classification criterion. By contrast, option A (data format) affects storage and tooling choices but not the sensitivity-based classification itself, option B (data age) is not a standard classification driver since old data can still be highly sensitive, and option D (physical storage location) is a deployment or residency consideration rather than a primary classification criterion.

Answer

The format of the data (structured vs. unstructured)

Answer

The age of the data

Answer

Physical storage location of the data

Question 3

An IT audit revealed that the organization's IT steering committee has not met in the past six months. Which of the following is the MOST likely consequence of this situation?

Accepted Answer

Delayed decision-making on IT investments.. The IT steering committee is responsible for strategic IT governance, including prioritizing and approving IT investments. If it does not meet, decisions on IT investments are delayed because there is no forum to review, prioritize, and approve them. This directly impacts the organization's ability to align IT with business goals and can stall critical projects.

Answer

Higher IT staff turnover.

Answer

Increased number of security incidents.

Answer

Inconsistent IT policies across departments.

Question 4

An IT manager is reviewing the access control model for a financial application. The policy requires that no single person can approve a transaction. Which access control principle does this policy enforce?

Accepted Answer

Separation of duties. The policy that no single person can approve a transaction enforces the separation of duties (SoD) principle. In financial applications, SoD requires that critical tasks, such as initiating and approving a transaction, be divided among multiple individuals to prevent fraud or error. This control ensures that no single user has the authority to complete a high-risk action alone, directly aligning with the requirement stated.

Answer

Least privilege

Answer

Mandatory access control

Answer

Need to know

Question 5

Which of the following is the MOST important objective of system testing?

Accepted Answer

Verify that the system meets specified requirements. System testing is a formal, structured process that validates the entire integrated system against its specified requirements. The primary goal is to confirm that the system behaves as defined in the functional and technical specifications, ensuring that all requirements are correctly implemented before user acceptance testing. While user satisfaction and defect removal are important, they are secondary to verifying requirement compliance, which is the core objective of system testing.

Answer

Confirm that end users are satisfied

Answer

Ensure the code is free of defects

Answer

Validate system performance under load

Question 6

A company outsources its IT help desk to a third-party vendor. The service level agreement (SLA) specifies that all P1 incidents must be resolved within 2 hours. During an audit, the auditor finds that the vendor’s average resolution time for P1 incidents is 3 hours. What is the most appropriate recommendation?

Accepted Answer

Issue a non-compliance notice and require a remediation plan. The vendor is contractually obligated to resolve P1 incidents within 2 hours, and the audit shows an average of 3 hours — a clear SLA breach. The auditor's role is to report the gap and recommend corrective action, not to unilaterally terminate or rewrite the contract. Issuing a non-compliance notice with a required remediation plan is the standard governance response that preserves the business relationship while enforcing accountability.

Answer

Terminate the contract immediately

Answer

Renegotiate the SLA to 3 hours

Answer

Accept the performance as within acceptable variance

Question 7

During a problem management meeting, the team identifies a recurring issue causing multiple incidents. The root cause is known, but a permanent fix is not yet available. Which of the following is the BEST approach to manage this situation until a permanent fix is implemented?

Accepted Answer

Document the known error and implement a workaround. In ITIL-based problem management, when a root cause is known but a permanent fix is unavailable, the known error should be documented in the Known Error Database (KEDB) and a workaround should be implemented to reduce incident impact and restore service. This aligns with the problem management process of controlling the error until a permanent solution (e.g., a patch or change) is deployed, ensuring operational continuity and minimizing recurrence of incidents.

Answer

Escalate the problem to senior management

Answer

Reclassify the problem as an incident

Answer

Close the problem record and wait for the fix

Question 8

An organization has implemented a security awareness training program. Which of the following metrics would BEST indicate that the program is effective?

Accepted Answer

Reduction in the number of successful phishing attacks. A reduced number of successful phishing attacks indicates that employees are applying the training to recognize and avoid threats. The other metrics are useful but less direct indicators of behavioral change.

Answer

Percentage of employees who completed the training

Answer

Average score on post-training quiz

Answer

Number of reported phishing emails

Question 9

An organization is selecting a vendor for a new procurement system. Which of the following is the MOST important factor to include in the contract?

Accepted Answer

Right to audit the vendor's security controls. The right to audit the vendor's security controls is the most important factor because it provides the organization with the ability to verify that the vendor is complying with security requirements and contractual obligations. Without this right, the organization has no assurance that its data is protected, especially when the vendor handles sensitive information. This is a critical governance and risk management control.

Answer

A clause limiting vendor liability

Answer

Fixed price for the entire contract term

Answer

Detailed service level agreements (SLAs)

Question 10

An organization is adopting a decentralized IT structure to better meet the needs of its business units. Which of the following is a potential risk of this approach?

Accepted Answer

Increased duplication of IT resources and inconsistent standards. Decentralized IT structures push decision-making authority and resources down to individual business units, which naturally leads to each unit acquiring its own hardware, software, and support staff. This fragmentation creates redundant systems and divergent technical standards across the organization, increasing cost and complexity. The correct answer captures this classic trade-off: while decentralization improves responsiveness, it sacrifices economies of scale and standardization.

Answer

Slower response to business unit needs

Answer

Higher initial setup costs for central services

Answer

Reduced alignment with corporate strategy

Question 11

An organization has implemented a clean desk policy. Which of the following is the BEST audit procedure to verify compliance?

Accepted Answer

Conducting unannounced inspections of workstations. Surprise walkthroughs provide a realistic view of daily compliance, unlike scheduled inspections.

Answer

Reviewing security camera footage of office areas

Answer

Reviewing the policy document and employee acknowledgments

Answer

Interviewing employees about the policy

Question 12

A company's backup policy requires that backup tapes be stored offsite for at least one year. During an audit, the auditor finds that the offsite storage facility is not access-controlled and backup tapes are not encrypted. Which of the following is the auditor's BEST recommendation?

Accepted Answer

Encrypt all backup tapes before sending them offsite. The core issue is that backup tapes contain sensitive data and are stored in an uncontrolled environment. Encrypting the tapes before transport ensures that even if the physical security of the offsite facility is compromised, the data remains confidential. This directly addresses the risk of unauthorized access to the data, which is the primary concern, and is a cost-effective, immediate control that does not disrupt operations.

Answer

Negotiate a new contract with a different offsite storage provider

Answer

Move the tapes back to the primary site until the offsite facility is secured

Answer

Implement a check-in/check-out log for the offsite facility

Question 13

A medium-sized financial services firm recently suffered a ransomware attack that encrypted critical servers and backups. The recovery process took three weeks because the backup tapes were stored in the same building (which was also infected) and the backup software had a vulnerability that allowed the ransomware to delete old backups. The firm's BCP did not account for simultaneous loss of primary and secondary data. As the IS auditor, you are asked to recommend the most effective improvement to the backup strategy to prevent recurrence and improve resilience. Which of the following actions should the firm implement?

Accepted Answer

Implement immutable backups and store them offsite or in a separate air-gapped environment. Immutable backups prevent modification or deletion by ransomware, even if the backup software or administrative credentials are compromised. Storing them offsite or in an air-gapped environment ensures that a simultaneous physical or logical attack cannot destroy both primary and secondary data, directly addressing the root cause of the three-week recovery delay.

Answer

Increase the frequency of full backups to daily

Answer

Conduct quarterly tabletop exercises to test recovery procedures

Answer

Move all backups to a cloud storage provider with default settings

Question 14

A large financial institution is implementing a new core banking system to replace a legacy system. The project has been underway for 18 months and is behind schedule. User acceptance testing (UAT) has revealed significant data integrity issues, including missing customer records and incorrect interest calculations. The project manager, under pressure from senior management to meet a regulatory deadline, proposes going live with a promise to fix the issues in a post-implementation phase. The development team has been making ad hoc code changes directly in the test environment without version control or proper testing. Additionally, the IS auditor discovers that the business requirements were never formally signed off by the user community; only verbal approvals were obtained. The project has consumed 90% of the budget but only 60% of the functionality is tested. Which of the following is the BEST course of action for the IS auditor to recommend?

Accepted Answer

Recommend halting the go-live until the business requirements are formally signed off and UAT is completed successfully with all critical defects resolved.. The project lacks formal sign-off on business requirements, has unresolved critical data integrity issues, and has been making uncontrolled code changes without version control. Going live under these conditions would violate ISACA's IS acquisition and implementation standards, which require that all critical defects be resolved and UAT be successfully completed before production deployment. The regulatory deadline does not justify bypassing these fundamental controls, as post-implementation fixes cannot guarantee data integrity and could lead to regulatory penalties.

Answer

Allow the go-live with a formal post-implementation support plan and a dedicated team to address defects.

Answer

Suggest a phased go-live, releasing the tested modules to production while continuing development on the remaining modules.

Answer

Escalate the issues to the board of directors and recommend immediate termination of the project.

Question 15

A security auditor discovers that a server has been compromised due to an unpatched vulnerability. Which of the following would have most effectively prevented this incident?

Accepted Answer

Implementing a vulnerability management program with regular patching.. A vulnerability management program with regular patching directly addresses the root cause of the compromise: the unpatched vulnerability. By systematically identifying, prioritizing, and applying security patches, the organization eliminates the known weakness that the attacker exploited. This proactive measure prevents the initial compromise, whereas other controls only detect or limit the attack after the vulnerability is exploited.

Answer

Enabling firewall rules to limit access.

Answer

Installing a host-based intrusion detection system (HIDS).

Answer

Using strong passwords on the server.