CISA Practice Test 49 — 15 Questions

Question 1

A company is migrating its customer database to a public cloud provider. Which of the following encryption strategies best protects data while minimizing performance impact on queries?

Accepted Answer

Use column-level encryption and tokenization for sensitive fields.. Column-level encryption and tokenization allow sensitive fields (e.g., SSNs, credit card numbers) to be protected while leaving non-sensitive columns unencrypted, preserving query performance on indexed and frequently queried data. Tokenization replaces sensitive values with non-sensitive placeholders, enabling joins and lookups without decryption overhead, and column-level encryption limits decryption to only the required fields per query.

Answer

Encrypt the entire database at rest using AES-256, and decrypt for each query.

Answer

Encrypt the database at the application layer before storage.

Answer

Rely on the cloud provider's default encryption for the storage.

Question 2

An organization outsources its IT help desk to a third-party vendor. Which clause is MOST important for the IS auditor to verify in the contract to ensure the organization can assess the vendor's controls?

Accepted Answer

Right-to-audit clause. A right-to-audit clause allows the organization to review the vendor's processes and controls, ensuring compliance with contractual and regulatory requirements.

Answer

Service level agreement (SLA) metrics

Answer

Subcontracting restrictions

Answer

Exit strategy provisions

Question 3

An organization plan to integrate a third-party payment gateway into its e-commerce platform. Which of the following is the MOST critical security control to implement before going live?

Accepted Answer

Perform a penetration test on the integration. A penetration test on the integration is the most critical control because it actively validates the security of the API endpoints, data flows, and authentication mechanisms between the e-commerce platform and the third-party gateway. Unlike passive controls like encryption or logging, a penetration test can uncover exploitable vulnerabilities such as injection flaws, broken authentication, or insecure direct object references that could lead to financial fraud or data breach before the system is exposed to live transactions.

Answer

Ensure all data is encrypted in transit and at rest

Answer

Implement detailed logging of payment transactions

Answer

Configure network firewalls to restrict traffic

Question 4

A company's security policy requires that all laptops have full disk encryption. During an audit, it is discovered that several laptops have encryption enabled but the recovery keys are stored on the local drive. What is the MOST significant risk?

Accepted Answer

Recovery keys can be used to bypass encryption.. Storing recovery keys on the local drive defeats the purpose of full disk encryption (FDE). If an attacker gains physical access to the laptop, they can simply boot an alternate OS or mount the drive and read the recovery key file, then use it to unlock the encrypted volume. This bypasses the encryption entirely, making the data vulnerable to unauthorized access despite encryption being enabled.

Answer

Performance degradation due to encryption overhead.

Answer

Unauthorized access to encrypted data.

Answer

Data corruption during encryption process.

Question 5

Which TWO of the following are physical security controls to prevent unauthorized access to a data center?

Accepted Answer

Mantrap. Mantraps and biometric readers are physical access controls. Fire suppression and UPS are environmental controls. Cable locks secure equipment but do not prevent entry to the data center.

Answer

Uninterruptible power supply

Answer

Cable locks

Answer

Fire suppression system

Question 6

Scenario: A healthcare organization is implementing a new electronic health records (EHR) system. The project has been delayed due to scope creep and resource constraints. The project sponsor is pressuring the project manager to accelerate the timeline by skipping user acceptance testing (UAT) and going live immediately. The organization has a governance policy that requires all IT projects to complete UAT before deployment. The project manager is concerned about quality and patient safety. Which of the following is the BEST course of action?

Accepted Answer

Adhere to the governance policy and escalate the risk to the steering committee for a decision.. The governance policy mandates UAT before deployment, and skipping it could compromise patient safety and data integrity in the EHR system. By escalating the risk to the steering committee, the project manager ensures that the decision is made at the appropriate governance level, balancing project pressures with compliance and quality. This approach aligns with the CISA domain of Governance and Management of IT, where adherence to policies and risk escalation are key controls.

Answer

Compromise by conducting a limited UAT on only critical functionalities.

Answer

Resign from the project due to ethical concerns.

Answer

Accept the sponsor's request and skip UAT to meet the deadline.

Question 7

Arrange the steps to implement a patch management process in the correct order.

Accepted Answer

1. Inventory, 2. Evaluation, 3. Testing, 4. Deployment, 5. Verification. Patch management starts with inventory, then evaluation, testing, deployment, and verification.

Answer

1. Evaluation, 2. Inventory, 3. Testing, 4. Deployment, 5. Verification

Answer

1. Inventory, 2. Testing, 3. Evaluation, 4. Deployment, 5. Verification

Answer

1. Inventory, 2. Evaluation, 3. Deployment, 4. Testing, 5. Verification

Question 8

An organization's IT department implemented a new change management process that requires all changes to be approved by a change advisory board (CAB). A critical security patch needs to be deployed within 2 hours to address an active zero-day vulnerability. The change request was submitted but the CAB is not scheduled to meet for another 24 hours. What is the BEST course of action?

Accepted Answer

Use the emergency change process to obtain expedited approval from a designated CAB member.. It aligns with the ITIL-based emergency change process, which allows for expedited approval from a designated CAB member or emergency authority when a critical security patch must be deployed within hours to mitigate an active zero-day vulnerability. This ensures the change is authorized without waiting for the full CAB meeting, maintaining security while preserving governance and audit trails.

Answer

Deploy the patch and inform the CAB after the fact during the next meeting.

Answer

Wait for the next scheduled CAB meeting to approve the change.

Answer

Deploy the patch immediately without any approval as it is a critical security fix.

Question 9

During a business impact analysis (BIA), which of the following is the MOST important metric to identify for each critical business process?

Accepted Answer

Maximum Tolerable Downtime (MTD). Maximum Tolerable Downtime (MTD) defines the maximum acceptable downtime before severe impact.

Answer

Recovery Point Objective (RPO)

Answer

Work Recovery Time (WRT)

Answer

Recovery Time Objective (RTO)

Question 10

A financial services organization recently experienced a data breach where customer financial records were exfiltrated. The investigation reveals that an attacker gained access through a compromised privileged account belonging to a database administrator. The attacker used valid credentials to log into the database server and then exported a large volume of data using native database tools. The security team notes that the organization has multi-factor authentication (MFA) enabled for all remote access, but the database server was accessed from an internal IP address. The organization also has a data loss prevention (DLP) system, but it did not alert on the export because the traffic was encrypted. The database activity monitoring (DAM) system did log the export, but alerts were not reviewed due to high volume and many false positives. Which of the following would have been most effective in preventing this breach?

Accepted Answer

Implementing a privileged access management (PAM) solution that requires approval for elevated actions and records sessions. The breach occurred because a privileged database administrator account was compromised, and the attacker used native database tools to export data from an internal IP address, bypassing MFA. A privileged access management (PAM) solution would have required approval for elevated actions (e.g., exporting large volumes of data) and recorded the session, providing both preventive control (approval workflow) and detective control (session recording) to stop or immediately detect the abuse of valid credentials. This directly addresses the root cause—compromised privileged credentials—rather than relying on network or alerting controls that were circumvented.

Answer

Deploying a DLP solution that can inspect encrypted traffic via SSL interception

Answer

Segmenting the database server onto a separate network with strict firewall rules

Answer

Improving the database activity monitoring (DAM) alerting to reduce false positives

Question 11

What is the PRIMARY purpose of a post-implementation review?

Accepted Answer

To assess whether expected benefits were achieved. The primary purpose of a post-implementation review (PIR) is to determine whether the system or project has delivered the expected business benefits, such as improved efficiency, cost savings, or enhanced functionality. This aligns with the IS auditor's focus on value realization and governance, ensuring that the investment achieved its intended objectives before the project is formally closed.

Answer

To close the project budget and finalize costs

Answer

To evaluate the performance of the project team

Answer

To document lessons learned for future projects

Question 12

Which of the following is the PRIMARY purpose of a data classification scheme?

Accepted Answer

To ensure appropriate security controls are applied based on data sensitivity. A data classification scheme assigns sensitivity labels (e.g., public, internal, confidential, restricted) to information assets. Its primary purpose is to ensure that appropriate security controls—such as access control lists, encryption strength, and monitoring—are applied proportionally to the data's sensitivity. Without classification, controls would be either insufficient for high-risk data or overly restrictive for low-risk data, undermining both security and operational efficiency.

Answer

To enable encryption of all sensitive data

Answer

To meet regulatory compliance requirements

Answer

To define data retention periods

Question 13

During a security audit, which rule poses the greatest risk?

Accepted Answer

Rule 30. Rule 30 is the correct answer because it allows SSH access from any source (0.0.0.0/0) without restriction. In a security audit, an ACL entry that permits SSH from any IP address poses the greatest risk as it exposes the management interface to potential brute-force attacks and unauthorized access, violating the principle of least privilege.

Answer

Rule 20

Answer

None of the rules pose a risk

Answer

Rule 10

Question 14

During the system development life cycle (SDLC), which THREE of the following are recognized benefits of involving internal audit early in the process?

Accepted Answer

Lower cost of implementing controls due to early design changes.. Involving internal audit early in the SDLC allows control requirements to be identified and designed into the system from the start, avoiding costly retrofits. Implementing controls during the design phase is significantly cheaper than adding them after development or deployment, as changes to code, architecture, or configuration are less disruptive and require less rework.

Answer

Reduced need for future independent audits.

Answer

Reduction in the number of system tests required.

Question 15

Which testing phase is MOST effective for validating that the system meets business needs?

Accepted Answer

User acceptance testing. User acceptance testing (UAT) is the final phase of testing where actual end-users validate the system against real-world business requirements and workflows. It confirms that the system meets the agreed-upon business needs, functional specifications, and operational criteria before production deployment. Unlike technical testing phases, UAT focuses on business process alignment and user satisfaction.

Answer

Regression testing

Answer

Unit testing

Answer

Integration testing