CISA Practice Test 5 — 10 Questions

Question 1

A company is implementing a new customer relationship management (CRM) system. The project team is currently defining user roles and permissions. Which of the following is the PRIMARY reason to enforce segregation of duties (SoD) within the CRM?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

To reduce the risk of fraud and errors. Segregation of duties (SoD) in a CRM system is primarily enforced to prevent a single user from having conflicting capabilities, such as creating a customer record and also approving credit limits or processing refunds. Without SoD, an employee could both initiate and approve a fraudulent transaction, directly increasing the risk of fraud and undetected errors. While SoD can indirectly support data accuracy and compliance, the primary control objective is risk reduction through separation of conflicting functions.

Answer

To ensure data accuracy and completeness

Answer

To comply with regulatory requirements

Answer

To improve system performance and efficiency

Question 2

An organization has outsourced its IT help desk to a third-party provider. Which of the following is the MOST critical control to ensure service quality?

Accepted Answer

Service level agreement (SLA) with key performance indicators. A Service Level Agreement (SLA) with key performance indicators (KPIs) is the most critical control because it defines measurable targets (e.g., average speed to answer, first-call resolution rate, ticket closure time) and establishes contractual remedies for non-compliance. Without an SLA, the organization has no enforceable mechanism to hold the provider accountable for service quality, making it the foundational control for outsourced IT help desk governance.

Answer

Regular background checks on provider employees

Answer

Access to provider's incident management system

Answer

Monthly meetings with provider management

Question 3

During an incident response, the IT team isolates a compromised system from the network. Which of the following is the primary purpose of this action?

Accepted Answer

To prevent further damage and contain the incident.. Isolating a compromised system from the network (e.g., by disconnecting the Ethernet cable, disabling the switch port, or applying a host-based firewall rule to drop all traffic) immediately stops the system from communicating with other hosts. This containment action prevents the attacker from moving laterally, exfiltrating data, or deploying additional malware, thereby limiting the blast radius and stopping ongoing damage.

Answer

To preserve evidence for forensic analysis.

Answer

To allow the system to be patched offline.

Answer

To comply with regulatory requirements.

Question 4

During a post-implementation review of a new customer relationship management (CRM) system, the IS auditor finds that the system is processing transactions slower than anticipated. What is the BEST initial course of action for the auditor?

Accepted Answer

Compare actual performance to the performance criteria in the business case. The auditor's best initial action is to compare actual system performance against the performance criteria defined in the business case. This establishes whether the slowdown represents a genuine deviation from expected outcomes and provides an objective basis for further investigation. Without this comparison, any recommendation or escalation would lack context and could be premature.

Answer

Recommend immediate performance tuning to resolve the issue

Answer

Report the issue to senior management immediately

Answer

Conduct a load test to identify bottlenecks

Question 5

A university is implementing a new student information system. The project team uses an iterative development approach. During user acceptance testing, students report that the online course registration portal crashes when more than 100 users register simultaneously. The development team identifies a database connection pooling issue and estimates a fix will take three weeks. The project deadline is in two weeks. The project manager suggests deploying the system as is and fixing the issue after go-live, as the crash is rare. The IS auditor is consulted. What should the auditor recommend?

Accepted Answer

Delay the go-live until the defect is fixed and user acceptance testing is passed.. Deploying a system with a known critical defect that fails under expected load conditions violates the principle of delivering a reliable and secure system. The database connection pooling issue causes the portal to crash under concurrent user load, which is a functional failure that directly impacts business operations. Delaying go-live ensures the defect is fixed and user acceptance testing (UAT) is fully passed, aligning with the IS auditor's responsibility to recommend risk mitigation over acceptance of a preventable failure.

Answer

Document the risk and proceed with the go-live, planning to fix later.

Answer

Deploy on time but restrict registration to fewer than 100 students per session.

Answer

Implement a temporary increase in server capacity to handle the load.

Question 6

An organization is developing a new customer portal. The development team wants to use an agile methodology. Which of the following is a key benefit of using agile for this project?

Accepted Answer

Continuous stakeholder feedback is incorporated. Agile methodologies emphasize iterative development with continuous stakeholder feedback, which is critical for a customer portal where user needs evolve. This ensures the final product aligns with actual requirements, reducing rework and increasing satisfaction. Option A directly captures this core benefit.

Answer

Detailed requirements are defined upfront

Answer

Documentation is minimized to save time

Answer

The entire system is delivered at once

Question 7

An IS auditor is reviewing a contract with a vendor for a new financial system. Which of the following clauses is MOST critical to ensure auditability?

Accepted Answer

Right to audit the vendor's operations and controls. The right-to-audit clause is the most critical for ensuring auditability because it contractually grants the organization and its auditors the ability to examine the vendor's controls, records, and operations. Without this clause, the organization cannot independently verify that the vendor meets security, compliance, and operational requirements, regardless of other contractual protections.

Answer

Penalties for non-performance

Answer

Service level agreements (SLAs) for system uptime

Answer

Data ownership and confidentiality provisions

Question 8

An organization's backup strategy includes taking full backups weekly and transactional log backups every 15 minutes. The auditor wants to verify that backup encryption is implemented for offsite storage. Which control is most relevant?

Accepted Answer

Backup encryption at rest. Backup encryption at rest ensures that data stored offsite is protected from unauthorized access, which is a key control for offsite backups.

Answer

Backup compression

Answer

Offsite transport log

Answer

Backup verification logs

Question 9

Which TWO of the following are key objectives of a post-implementation review of a new system?

Accepted Answer

Identify lessons learned for future projects. Option C is correct because a post-implementation review (PIR) is fundamentally a lessons-learned exercise: it captures what went well and what did not during the project so that future projects can avoid repeating mistakes and replicate successes. Option E is correct because the PIR's primary purpose is to confirm that the delivered system actually satisfies the business and user requirements defined in the original scope, often through user feedback and acceptance criteria verification. Options A, B, and D, while potentially useful activities, are not key objectives of a PIR: updating the disaster recovery plan is a separate operational/BCP task, budget variance assessment is typically part of project closure or earned value management, and vendor performance evaluation is usually handled through contract management or procurement reviews.

Answer

Update the disaster recovery plan

Answer

Assess the project budget variance

Answer

Evaluate vendor performance

Question 10

A multinational corporation operates in a highly regulated industry. The IT governance framework includes a risk appetite statement approved by the board. Recently, the company suffered a significant data breach due to an unpatched vulnerability that had been identified three months earlier. The IT audit found that the vulnerability was reported to the IT department but was not prioritized for remediation because it was deemed low risk by the IT operations team. The incident response plan was not activated because the breach was not initially detected. The board wants to strengthen governance to prevent recurrence. The most effective course of action for the auditor to recommend is:

Accepted Answer

Establishing a formal vulnerability management policy that requires risk-based prioritization in accordance with the risk appetite and escalation to the IT risk committee for decisions outside tolerance. The root cause is a governance failure: the IT operations team made a risk-acceptance decision that exceeded its authority, without a formal process tying vulnerability prioritization to the board-approved risk appetite. A vulnerability management policy that mandates risk-based prioritization aligned with the risk appetite and requires escalation to the IT risk committee when findings fall outside tolerance directly addresses this governance gap. This is the most effective recommendation because it fixes the decision-making framework, not just the symptom.

Answer

Deploying an intrusion detection system to identify breaches sooner

Answer

Disciplining the IT operations team for not escalating the vulnerability

Answer

Implementing a more robust patch management system with automated patching