CISA Practice Test 49 — 15 Questions

Question 1

A financial institution is implementing a data classification policy. Which of the following is the most important factor in determining the classification level of a data asset?

Accepted Answer

The sensitivity and criticality to business operations. The classification level of a data asset is determined by its sensitivity and criticality to business operations because these factors directly drive the required confidentiality, integrity, and availability controls. For example, personally identifiable information (PII) or financial transaction records require higher classification due to regulatory mandates (e.g., GDPR, PCI DSS) and the potential for severe business impact if compromised. Cost, format, or location are secondary attributes that do not inherently define the risk profile or protection needs of the data.

Answer

The cost of acquiring the data

Answer

The format of the data (structured vs unstructured)

Answer

The storage location of the data

Question 2

A financial institution is deploying a data loss prevention (DLP) solution. Which of the following is the MOST important prerequisite to ensure the DLP can effectively detect sensitive data?

Accepted Answer

Performing a data classification exercise. A DLP solution detects sensitive data by matching content against predefined patterns or rules. Without a data classification exercise, the organization cannot define what constitutes 'sensitive data' (e.g., PII, PCI, IP), making the DLP blind to what it should monitor. Classification provides the taxonomy and metadata (e.g., labels, tags) that the DLP engine uses to trigger alerts or blocks, ensuring detection is both accurate and aligned with policy.

Answer

Configuring incident response procedures

Answer

Installing endpoint agents on all devices

Answer

Implementing network segmentation

Question 3

An organization is conducting a Business Impact Analysis (BIA). Which of the following metrics defines the maximum acceptable outage time for a critical business process?

Accepted Answer

Maximum Tolerable Downtime (MTD). Maximum Tolerable Downtime (MTD) defines the maximum acceptable outage time for a critical business process. It represents the total time a business can tolerate the unavailability of a process before unacceptable consequences occur. MTD is a key output of the BIA and sets the upper limit for recovery objectives.

Answer

Recovery Point Objective (RPO)

Answer

Recovery Time Objective (RTO)

Answer

Work Recovery Time (WRT)

Question 4

You are the IT audit manager for a multinational corporation. The company recently implemented a new enterprise resource planning (ERP) system using a phased rollout approach. The first phase (finance module) was deployed to three regional offices six months ago. During a post-implementation review, you discovered that the user acceptance testing (UAT) for the finance module was completed in only two days instead of the planned two weeks. The UAT was performed by a small group of power users selected by the project manager, and they reported no critical issues. However, after go-live, several finance staff in one region found that the system does not support a statutory reporting requirement specific to that country, which was not tested. The project manager argues that the requirement was never documented in the business requirements specification. The system has been live for six months, and the missing functionality requires a significant customization that will take three months and cost $200,000. Management is reluctant to fund the customization because the budget is exhausted. As the IT auditor, what is the BEST course of action?

Accepted Answer

Recommend that management implement a formal UAT process with representatives from all regions and include a checklist of statutory requirements for future rollouts. The root cause is a deficient UAT process, not just a missing requirement. A formal UAT process with representatives from all regions and a statutory requirements checklist would have caught the country-specific reporting need before go-live. As an IT auditor, recommending process improvements for future rollouts addresses the systemic control weakness, which is more effective than blaming individuals or accepting risk without remediation.

Answer

Report the project manager to senior management for failing to include the requirement

Answer

Recommend that the organization accept the risk and proceed without the customization

Answer

Advise the project manager to retroactively document the requirement and request a change order for the customization

Question 5

An organization is evaluating two vendors for a critical cloud-based ERP system. Which TWO contractual clauses are most important to include to ensure the organization can monitor vendor performance and security? (Select TWO)

Accepted Answer

Audit rights. It contractually grants the organization the ability to inspect, assess, and verify the vendor's security controls, processes, and compliance — for example through on-site audits, penetration test reports, or SOC 2 evidence — which is essential for ongoing security monitoring of a critical ERP system. Option D (Service level agreements (SLAs)) is correct because SLAs define measurable performance and availability commitments (e.g., uptime percentages, response and resolution times, penalties for misses), giving the organization the metrics and remedies needed to monitor vendor performance. Option A (Data ownership clause) is not correct here because it establishes who owns the data rather than providing a monitoring mechanism. Option B (Indemnification clause) is not correct because it allocates financial/legal liability after a loss rather than enabling performance or security oversight. Option E (Non-disclosure agreement (NDA)) is not correct because it protects confidentiality of shared information but does not by itself provide performance or security monitoring rights.

Answer

Data ownership clause

Answer

Indemnification clause

Answer

Non-disclosure agreement (NDA)

Question 6

An IS auditor is evaluating the use of continuous auditing techniques. Which of the following is the most significant benefit of implementing continuous monitoring over traditional periodic audits?

Accepted Answer

Timely detection of control deficiencies. Continuous monitoring provides timely detection of control deficiencies, enabling faster remediation.

Answer

Reduced need for substantive testing

Answer

Elimination of control risk assessments

Answer

Automated generation of audit reports

Question 7

Which TWO of the following are primary objectives of capacity management? (Select exactly 2.)

Accepted Answer

To ensure adequate IT resources to meet current and future business demands. Option A is correct because capacity management's core purpose is to plan and provision IT resources (CPU, memory, storage, network bandwidth) so that they are sufficient for both present workloads and forecast future business demand. Option E is correct because capacity management also seeks to right-size and tune existing resources—through techniques like workload balancing, virtualization, and utilization monitoring—so that current infrastructure can efficiently absorb business growth without unnecessary over-provisioning. Options B, C, and D are not primary objectives: monitoring and reporting performance against SLAs belongs to service level management and performance monitoring, while minimizing total cost of ownership and procuring hardware/software at the lowest cost are financial and procurement goals rather than the capacity management objectives of matching supply to demand and optimizing resource use.

Answer

To monitor and report on system performance against SLAs

Answer

To minimize the total cost of ownership of IT resources

Answer

To procure hardware and software at the lowest possible cost

Question 8

An organization is implementing ITIL 4. Which TWO of the following are part of the four dimensions of service management? (Select TWO.)

Accepted Answer

Organizations and People. The ITIL 4 four dimensions of service management are Organizations and People, Information and Technology, Partners and Suppliers, and Value Streams and Processes. Option B (Organizations and People) is correct because it is one of these four dimensions, covering roles, responsibilities, culture, and competencies needed to deliver services. Option E (Information and Technology) is also correct because it addresses the information, knowledge, and technologies required for service management. Option A (Governance) is not one of the four dimensions; governance is a component of the ITIL 4 service management framework but not a dimension. Option C (Financial Management) is a service management practice, not a dimension. Option D (Service Level Management) is likewise a practice within ITIL 4, not one of the four dimensions.

Answer

Governance

Answer

Financial Management

Answer

Service Level Management

Question 9

An IT auditor is reviewing the capacity management process. Which TWO of the following are key activities that should be performed?

Accepted Answer

Monitoring resource utilization trends. Capacity management focuses on ensuring IT resources meet current and future demand, so option B (Monitoring resource utilization trends) is correct because tracking CPU, memory, storage, and network usage over time is the foundational activity that reveals whether capacity is adequate and where growth is heading. Option D (Setting threshold alerts for resource usage) is also correct because defining thresholds and alerts (for example, at 80% CPU or disk utilization) enables proactive notification before performance degrades, allowing timely scaling or remediation. Together, B and D represent the core capacity management cycle of measuring trends and acting on predefined limits. Option A (Performing daily backup verification) belongs to backup and recovery management, not capacity management. Option C (Reviewing incident response times) is a service-level or incident management metric, and option E (Conducting annual disaster recovery tests) is a business continuity and disaster recovery activity, neither of which addresses resource capacity planning.

Answer

Performing daily backup verification

Answer

Reviewing incident response times

Answer

Conducting annual disaster recovery tests

Question 10

Which TWO of the following are key elements of a change request document?

Accepted Answer

Justification. Option B (Justification) is correct because a change request must state the business or technical reason the change is needed, so the change advisory board (CAB) can assess its value and priority before approval. Option D (Rollback plan) is correct because every change request must document how to revert the change if it fails or causes an outage, which is essential for risk mitigation and restoring the configuration item to its prior baseline. A vendor contract (A) is a procurement/legal artifact, not a standard component of a change request. A project budget (C) relates to financial planning and cost control, not to the change management process itself. A user manual (E) is end-user documentation and has no role in defining or approving a change.

Answer

Vendor contract

Answer

Project budget

Answer

User manual

Question 11

In the audit follow-up phase, which TWO actions are essential? (Select two.)

Accepted Answer

Assess the effectiveness of the corrective actions. Option A is correct because the audit follow-up phase must evaluate whether the corrective actions taken actually resolved the root cause and reduced the risk to an acceptable level, not merely whether they were performed. Option E is correct because a core follow-up step is verifying that management has implemented the agreed-upon corrective actions within the committed timeframe, confirming the remediation is real and operational. Together, verification (E) establishes that the actions exist, while effectiveness assessment (A) establishes that they work, which are the two essential follow-up outcomes. Option B is wrong because expanding the original audit scope is a new engagement decision, not a required follow-up action. Option C is wrong because re-issuing the audit report is not standard follow-up practice; follow-up results are typically reported separately. Option D is wrong because updating next year's audit program is a planning activity, not an essential action of the follow-up phase itself.

Answer

Expand the scope of the original audit

Answer

Re-issue the audit report

Answer

Update the audit program for next year

Question 12

A large enterprise is implementing a backup strategy for a critical database that requires an RTO of 2 hours and an RPO of 15 minutes. The database is 2 TB in size. Which backup method would BEST meet these requirements while minimizing storage costs?

Accepted Answer

Weekly full backups with transactional log backups every 15 minutes. Weekly full backups with transactional log backups every 15 minutes meets the RPO of 15 minutes because logs capture all transactions since the last log backup, and meets the RTO of 2 hours because restoring the full backup plus applying log backups can be completed within that window. It minimizes storage costs compared to daily fulls or CDP because full backups are infrequent and logs are small and incremental.

Answer

Daily full backups

Answer

Continuous data protection (CDP) replicating to a remote site

Answer

A daily full backup and a differential backup every 4 hours

Question 13

An organization is implementing a new IT service management system based on ITIL 4. Which TWO of the following are guiding principles of ITIL 4?

Accepted Answer

Focus on value. Option A, 'Focus on value,' is correct because it is one of the seven ITIL 4 guiding principles, directing that every activity and decision should map directly or indirectly to value for stakeholders. Option E, 'Start where you are,' is also correct as an ITIL 4 guiding principle, meaning organizations should not discard existing services, processes, or tools but build on what already works. The other options are not guiding principles: 'Responsibility, strategy, acquisition' and 'Align, plan, organize' are governance/management-practice or organizational constructs, and 'Evaluate, direct, monitor' is the set of governance activities from ISO/IEC 38500, not an ITIL 4 guiding principle.

Answer

Responsibility, strategy, acquisition

Answer

Evaluate, direct, monitor

Answer

Align, plan, organize

Question 14

An IS auditor is reviewing physical security controls at a data center. The data center hosts critical servers and uses a badge access system with PINs, CCTV cameras, and a mantrap entry. The auditor observes that employees sometimes hold the door open for others without badging. Which TWO of the following are the MOST effective controls to address this tailgating risk?

Accepted Answer

Conducting security awareness training on tailgating risks. Option A is correct because security awareness training directly targets the human behavior observed—employees deliberately holding the door for unbadged individuals—by educating staff on tailgating risks and reinforcing the policy that every person must badge individually, which is the root cause of the failure. Option E is correct because upgrading the existing mantrap to biometric authentication enforces one-person-at-a-time entry tied to an immutable physical characteristic, making it technically infeasible to piggyback through on another person's credentials and providing a preventive rather than detective control. Option B does not belong because longer or more complex PINs only strengthen the credential itself and do nothing to stop an unauthorized person from walking through a door held open by an authenticated employee. Option C does not belong because adding access points increases the number of entry portals and thus potentially widens the attack surface rather than preventing piggybacking. Option D does not belong because additional CCTV cameras are a detective control that only records the tailgating after the fact and does not prevent unauthorized entry.

Answer

Requiring longer and more complex PINs

Answer

Installing additional access points

Answer

Increasing the number of CCTV cameras

Question 15

An organization is implementing a new payroll system using an agile methodology. Which TWO of the following are the MOST important controls for the IS auditor to assess?

Accepted Answer

The product backlog is prioritized and includes security requirements. Option D is correct because in agile development the product backlog is the authoritative, prioritized list of work items, and the IS auditor must verify that security requirements (e.g., access controls, encryption, audit logging for payroll data) are explicitly captured and prioritized there rather than deferred, since payroll systems handle sensitive PII and financial data. Option E is correct because sprint reviews are the key agile ceremony where stakeholders inspect the working increment and provide feedback, giving the auditor evidence of governance, stakeholder accountability, and that delivered functionality meets requirements. Option A is not the most important control in agile, where working software and lightweight documentation are favored over comprehensive design documentation. Option B is not the most important control because a formal change control board is characteristic of waterfall governance, whereas agile relies on backlog refinement and sprint-level change management. Option C is not the most important control because agile deliberately avoids a detailed upfront project plan with all tasks defined in advance, favoring iterative planning.

Answer

Comprehensive documentation of all design decisions

Answer

A formal change control board to approve all changes

Answer

A detailed project plan with all tasks upfront