CISA Practice Test 5 — 10 Questions

Question 1

Refer to the exhibit. Which of the following statements is TRUE regarding this S3 bucket policy?

Accepted Answer

Anonymous read access is allowed only over HTTPS. The S3 bucket policy includes a condition `aws:SecureTransport` set to `true`, which explicitly denies any request that is not made over HTTPS. The `Effect: Allow` on the `Principal: "*"` grants anonymous read access, but the `Condition` block ensures that only HTTPS requests are permitted, making anonymous read access allowed only over HTTPS.

Answer

The bucket is fully public for all actions

Answer

Write access is allowed over HTTP

Answer

Only authenticated users can access objects

Question 2

During an IT audit, the auditor observes that mandatory vacation policies are not enforced for IT staff with access to financial systems. What is the PRIMARY risk associated with this finding?

Accepted Answer

Increased risk of undetected fraud. Mandatory vacation policies force the periodic removal of an employee's access, which allows detection of irregularities or fraudulent activities that require the employee's continued presence to conceal. Without enforcement, a malicious insider could perpetrate fraud (e.g., creating ghost vendors, altering payment records) and cover it up by maintaining daily control over transactions. This directly increases the risk that fraudulent actions will go undetected over extended periods.

Answer

Increased likelihood of system downtime

Answer

Inadequate segregation of duties

Answer

Non-compliance with licensing agreements

Question 3

An IS auditor is evaluating the effectiveness of an organization's change management process. Which of the following is the most important control to verify during the audit?

Accepted Answer

A segregation of duties exists between development and production.. Segregation of duties between development and production environments ensures that code cannot be directly moved from development to production without independent review and testing. This control prevents unauthorized or untested code from affecting live systems, which is a fundamental principle of change management. Without this separation, a developer could introduce malicious or defective code directly into production, bypassing all quality and security checks.

Answer

All changes are approved by the IT manager.

Answer

Emergency changes are documented after implementation.

Answer

Change requests are prioritized by business impact.

Question 4

During an audit, the IS auditor discovers that the audit log for a critical server is overwritten every 24 hours. The auditor wants to ensure logs are preserved for a longer period. Which of the following recommendations is most appropriate?

Accepted Answer

Configure the server to archive logs to a centralized log management system. The most appropriate recommendation is to configure the server to archive logs to a centralized log management system. This ensures logs are preserved beyond the 24-hour overwrite window by sending them to a separate, persistent storage location, which also supports security monitoring, forensics, and compliance requirements. Centralized logging (e.g., using syslog, SIEM, or a dedicated log collector) provides redundancy, integrity checks, and long-term retention without relying on the local server's limited storage.

Answer

Implement a manual backup of logs daily

Answer

Reduce the logging level to minimize data

Answer

Increase the log size to retain more data

Question 5

A multinational corporation is deploying a data loss prevention (DLP) solution across its network. The DLP system must be configured to prevent the exfiltration of personally identifiable information (PII) while minimizing false positives. Which approach is most effective?

Accepted Answer

Use regex patterns for PII combined with context-aware policies (e.g., user role, destination domain). Using regex patterns for PII combined with context-aware policies (e.g., user role, destination domain) allows the DLP system to accurately detect sensitive data while minimizing false positives. Option A is too simplistic; keyword-based blocking can cause high false positives. Option B relies on user training and self-reporting, which is not a technical DLP control and is ineffective. Option C (encryption) protects data at rest and in transit but does not prevent exfiltration; it is not a DLP method.

Answer

Block all outbound email containing keywords such as 'SSN' or 'credit card'

Answer

Require all users to complete annual data handling training and rely on self-reporting

Answer

Implement full disk encryption on all endpoints and encrypt all outbound traffic

Question 6

An IS auditor is reviewing the logical access controls of a financial application. Which of the following is the BEST way to verify that user access rights are appropriate?

Accepted Answer

Compare the user access rights with the job descriptions and responsibilities.. Comparing user access rights directly against job descriptions and responsibilities is the most effective method to verify that access is appropriate based on the principle of least privilege. This approach ensures that each user's permissions align with their actual job functions, which is the core objective of a logical access control review. Interviewing or reviewing lists alone does not validate the appropriateness of access against business roles.

Answer

Interview the IT security manager about the access control process.

Answer

Review the access control list for each user.

Answer

Re-perform a sample of transactions to detect unauthorized access.

Question 7

An IS auditor is preparing the audit report. According to ISACA standards, which of the following should be included in the final audit report?

Accepted Answer

Findings, recommendations, and management action plans. The final audit report should include findings, recommendations, and management's action plans to provide a complete picture and enable follow-up.

Answer

Only the audit findings

Answer

Only the recommendations

Answer

The audit program and procedures

Question 8

An IS auditor is reviewing a change management process. Which TWO elements should be documented in a normal change request to ensure adequate governance? (Select TWO)

Accepted Answer

Test plan. A change request should include a test plan to verify the change works as intended and a rollback plan to revert if the change fails. These are critical for risk management and governance.

Answer

Vendor contact information

Answer

Change requester's name

Answer

Project budget remaining

Question 9

An IS auditor is reviewing a vulnerability scan report and finds that a critical vulnerability on a web server has been open for 90 days beyond the remediation SLA. The system owner states that the vulnerability cannot be patched because it would break a legacy application. What should the auditor recommend?

Accepted Answer

Require the system owner to sign a risk acceptance form. The appropriate action is to formally accept the risk through a documented risk acceptance process, with sign-off from management. This ensures accountability and awareness. The other options are either premature or inappropriate.

Answer

Escalate the issue to the board of directors

Answer

Implement compensating controls and close the finding

Answer

Recommend decommissioning the web server

Question 10

An IS auditor is evaluating the change management process. Which of the following is the BEST indicator that emergency changes are being properly controlled?

Accepted Answer

Emergency changes are documented with a justification and promptly reviewed after implementation. Emergency changes require a documented rationale and timely post-implementation review to ensure proper authorization and minimal risk.

Answer

Emergency changes are approved by the change manager within 24 hours

Answer

Emergency changes are tested in a production-like environment before implementation

Answer

Emergency changes require approval from the CAB before implementation