CISA Practice Test 50 — 15 Questions

Question 1

A company is designing its backup strategy for a critical database that must be available 24/7. The database experiences high transaction volumes. Which backup method minimizes data loss while allowing continuous operations?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Online backup with transaction log backups. Online backup with transaction log backups (Option C) is correct because it allows the database to remain fully operational (24/7 availability) while capturing every committed transaction in the transaction log. In the event of a failure, you can restore the most recent full backup and then apply all subsequent transaction log backups to recover to the exact point of failure, minimizing data loss to only uncommitted transactions.

Answer

Offline full backup performed weekly

Answer

Differential backup performed daily

Answer

Full backup performed during low-usage periods

Question 2

An organization is implementing a new identity management system. Which THREE of the following are essential requirements for the system?

Accepted Answer

Segregation of duties enforcement.. Segregation of duties enforcement is essential because it ensures that no single user has excessive privileges that could lead to fraud or error. In an identity management system, this is implemented through role-based access control (RBAC) and access review workflows, preventing conflicts of interest by separating critical functions like user creation, approval, and access assignment.

Answer

Single sign-on capability.

Answer

Support for biometric authentication.

Question 3

Which TWO of the following are key activities in the system design phase of the SDLC?

Accepted Answer

Defining system architecture. Defining system architecture is a key activity in the system design phase because it establishes the high-level structure of the system, including hardware, software, network components, and their interactions. This blueprint guides subsequent detailed design and implementation, ensuring alignment with functional and non-functional requirements. Without a defined architecture, the system risks integration failures and scalability issues.

Answer

Writing unit tests

Answer

Performing user acceptance testing

Answer

Gathering business requirements

Question 4

Match each log type to its typical content.

Accepted Answer

Audit Log: Records user activities and changes for compliance.. Logs are essential for monitoring and forensics. Correct matches: Audit Log tracks user activities and compliance, Security Log tracks security events, System Log tracks OS events, Application Log tracks application events. Common confusions include mixing system events with audit logs and application errors with security logs.

Answer

Audit Log: Records system startup/shutdown events.

Answer

Security Log: Records application errors.

Question 5

Which THREE of the following are common risks associated with the prototyping methodology?

Accepted Answer

Lack of adequate documentation. Prototyping often prioritizes rapid iteration over formal documentation, leading to incomplete or outdated records of system specifications, design decisions, and user agreements. This lack of adequate documentation creates risks for maintenance, knowledge transfer, and auditability, as the final system may lack the necessary artifacts for ongoing support and compliance.

Answer

Incomplete requirements specification

Answer

User misunderstanding of prototype limitations

Question 6

Which TWO of the following are the MOST effective controls to prevent unauthorized access to a data center's server room? (Choose two.)

Accepted Answer

Mantrap entry. Mantrap entry (B) and biometric authentication (E) are the most effective preventive controls for unauthorized access to a server room. Mantraps prevent tailgating, and biometrics provide strong authentication. CCTV (C) is a detective control, visitor logbook (D) is an administrative control, and server rack locks (A) are secondary to room access controls.

Answer

Server rack locks

Answer

CCTV monitoring

Answer

Visitor logbook

Question 7

Which of the following is the PRIMARY purpose of conducting a privacy impact assessment (PIA) before implementing a new system that processes personal data?

Accepted Answer

To identify and mitigate privacy risks.. PIA aims to identify and mitigate privacy risks early in the project lifecycle.

Answer

To document data flows for audit purposes.

Answer

To obtain consent from data subjects.

Answer

To ensure compliance with data protection regulations.

Question 8

During an incident response exercise, the IT team discovers that the failover to the disaster recovery (DR) site failed because the DR site's storage area network (SAN) was not zoned correctly for the replicated data. Which of the following controls would BEST prevent this issue?

Accepted Answer

Conducting regular disaster recovery testing including full failover. Regular disaster recovery testing that includes a full failover is the only control that directly validates that the DR site's SAN zoning is correctly configured to accept replicated data. Without such testing, misconfigurations like incorrect zone sets or missing WWPN (World Wide Port Name) mappings in the SAN fabric remain undetected until an actual failover is attempted. This aligns with the CISA emphasis on testing recovery procedures to ensure business continuity.

Answer

Maintaining a configuration management database (CMDB)

Answer

Implementing a change management process for SAN configurations

Answer

Using automated replication monitoring tools

Question 9

Which TWO of the following are key controls for ensuring data privacy during system development?

Accepted Answer

Encrypting stored data. Encrypting stored data (Option B) is a key control for ensuring data privacy because it renders the data unreadable without the correct decryption key, protecting it from unauthorized access even if the storage medium is compromised. This aligns with data-at-rest protection requirements under regulations like GDPR and PCI DSS, and is a fundamental security control during system development to prevent exposure of sensitive information.

Answer

Using real customer data for testing

Answer

Disabling audit logs during development

Answer

Allowing developers unlimited access to production data

Question 10

An organization is implementing a data retention policy for personally identifiable information (PII) to comply with GDPR. Which of the following is the MOST appropriate approach?

Accepted Answer

Define retention periods based on legal and business requirements and securely delete after. GDPR mandates that PII must not be kept longer than necessary for the purpose for which it was collected. Defining retention periods based on legal and business requirements ensures compliance with the storage limitation principle (Article 5(1)(e)), and secure deletion (e.g., using cryptographic erasure or overwriting with tools like shred on Linux) prevents unauthorized recovery. This approach balances regulatory compliance with operational needs.

Answer

Delete PII as soon as it is collected

Answer

Anonymize PII after a fixed period and retain indefinitely

Answer

Retain PII indefinitely for historical analysis

Question 11

A company is implementing a privileged access management (PAM) system. Which of the following is the MOST important control to prevent lateral movement after a privileged account is compromised?

Accepted Answer

Implement just-in-time (JIT) privilege elevation. Just-in-time (JIT) privilege elevation is the most important control to prevent lateral movement because it eliminates standing privileged access. By granting temporary, time-bound privileges only when needed, JIT reduces the attack surface and ensures that even if an attacker compromises a privileged account, they cannot use those credentials to move laterally to other systems after the access window expires. This directly addresses the root cause of lateral movement: persistent privileged credentials that can be reused across the network.

Answer

Enforce multi-factor authentication for all privileged accounts

Answer

Monitor and record all privileged sessions

Answer

Rotate passwords after each use

Question 12

An IS auditor is reviewing the logical access controls of an enterprise resource planning (ERP) system. The auditor finds that terminated employees' accounts are disabled but not deleted. What is the PRIMARY risk associated with this practice?

Accepted Answer

Disabled accounts could be re-enabled without proper authorization. The primary risk of disabling rather than deleting terminated employees' accounts is that a disabled account retains its existing privileges and can be re-enabled by an attacker or insider with sufficient access (e.g., a system administrator with compromised credentials). In an ERP system, this could allow unauthorized re-activation of accounts with elevated roles, bypassing the intended termination process and leading to data theft, fraud, or system compromise.

Answer

Segregation of duties controls may be compromised

Answer

System performance may degrade due to accumulation of disabled accounts

Answer

Audit trail completeness may be affected

Question 13

Refer to the exhibit. An auditor finds that users are able to reuse previous passwords easily. Which setting should be modified to address this weakness?

Accepted Answer

Increase the password history to 10. Increasing the password history setting (e.g., to 10) prevents users from reusing their most recent passwords by storing a specified number of previous password hashes. When a user attempts to change their password, the system compares the new password against the stored history and rejects it if it matches any of the remembered passwords. This directly addresses the weakness of easy password reuse.

Answer

Increase the minimum password age to 7 days

Answer

Enable password expiration notifications

Answer

Increase the maximum password age to 30 days

Question 14

A company uses a RAID 5 array for its file server. One disk fails, and the system continues to operate. However, during the rebuild process, a second disk fails. What is the likely consequence?

Accepted Answer

Data loss occurs. RAID 5 can tolerate a single disk failure. If a second disk fails during rebuild, the array is broken and data loss occurs.

Answer

Performance degrades but data remains intact

Answer

Data is still available from parity

Answer

The system automatically switches to a hot spare

Question 15

An IS auditor is assessing the vulnerability management program of a financial services company. The auditor reviews the latest vulnerability scan report and finds that several critical vulnerabilities have not been patched within the defined SLA of 30 days. The IT manager explains that patches could not be applied due to compatibility issues with legacy applications, and risk acceptance has been documented for some but not all. Which THREE of the following are the MOST appropriate audit findings?

Accepted Answer

Risk acceptance is not documented for all unpatched critical vulnerabilities. The auditor should identify that some vulnerabilities lack formal risk acceptance, that the SLA may need adjustment for legacy systems, and that scan reports may not accurately reflect the current status. While patch deployment is important, the immediate findings relate to documentation and SLA adequacy.

Answer

Vulnerability scan reports are not reviewed by management

Answer

Critical vulnerabilities are not being patched within the defined SLA