CISA Practice Questions 1 — 50 Questions

Question 1

An organization is implementing a new financial system and has completed user acceptance testing (UAT). The project manager reports that all critical defects have been fixed and retested, but several low-severity issues remain unresolved. What is the BEST course of action?

Accepted Answer

Document the unresolved defects as known issues in a risk acceptance form with a remediation plan, then proceed with go-live. Option A is correct because in a financial system implementation, low-severity issues that do not impair core financial processing or controls can be accepted as known risks. Documenting them with a remediation plan and proceeding with go-live aligns with ISACA’s guidance that UAT sign-off does not require zero defects, only that critical and high-severity defects are resolved. This approach balances business needs with risk management, avoiding unnecessary delays while ensuring accountability through formal risk acceptance.

Answer

Re-run all UAT test cases to ensure no regression occurs

Answer

Delay go-live until all defects are resolved

Answer

Obtain sign-off from business stakeholders acknowledging the risks and proceed with go-live

Question 2

An organization is implementing a data loss prevention (DLP) solution. Which TWO of the following are key considerations for effective DLP deployment?

Accepted Answer

Implementing DLP in monitoring mode initially to baseline traffic. Options A and B are correct. A: Classifying data based on sensitivity is fundamental to DLP policy creation. B: Starting with monitoring before blocking reduces false positives. C: DLP is not a replacement for user training; it is a technical control. D: DLP should be deployed in phases, not organization-wide at once. E: Encryption is separate; DLP can detect but not enforce encryption for all data.

Answer

Deploying DLP agents on all endpoints before defining policies

Answer

Encrypting all data at rest and in transit as a prerequisite

Answer

Replacing user security awareness training with automated DLP

Question 3

Based on the exhibit, which control is most likely missing to prevent this type of event?

Accepted Answer

Implementing account lockout after three failed attempts. The exhibit describes a brute-force attack against an SSH service, where an attacker repeatedly attempts to guess credentials. Implementing account lockout after three failed attempts is the most direct control to prevent this type of event, as it halts further login attempts after a threshold, stopping the attack in its tracks regardless of password strength or patching.

Answer

Applying the latest security patches to the SSH service

Answer

Disabling direct root login via SSH

Answer

Enforcing strong password complexity

Question 4

Arrange the steps to perform a risk assessment in the correct order.

Question 5

Order the steps for conducting an audit engagement from start to finish.

Question 6

Order the steps for responding to a security incident in the correct sequence.

Question 7

Arrange the steps to implement a password policy in the correct order.

Question 8

Order the steps for conducting a business impact analysis (BIA) in the correct sequence.

Question 9

Order the steps for performing a disaster recovery test in the correct sequence.

Question 10

Which of the following is the PRIMARY purpose of a data classification scheme?

Accepted Answer

To ensure appropriate security controls are applied based on data sensitivity. A data classification scheme assigns sensitivity labels (e.g., public, internal, confidential, restricted) to information assets. Its primary purpose is to ensure that appropriate security controls—such as access control lists, encryption strength, and monitoring—are applied proportionally to the data's sensitivity. Without classification, controls would be either insufficient for high-risk data or overly restrictive for low-risk data, undermining both security and operational efficiency.

Answer

To enable encryption of all sensitive data

Answer

To meet regulatory compliance requirements

Answer

To define data retention periods

Question 11

An IS auditor is reviewing the logical access controls of a system. Which of the following is the BEST evidence that access rights are appropriately assigned?

Accepted Answer

A recent user access review report signed by department managers. Option D is the best evidence because a user access review report signed by department managers provides documented confirmation that the assigned access rights have been explicitly verified and approved by the data owners. This is a detective control that directly validates the appropriateness of access assignments, whereas the other options are either preventive or detective controls that do not confirm the correctness of the rights themselves.

Answer

An audit log showing all successful and failed login attempts

Answer

A password policy requiring complex passwords

Answer

An access control matrix defining roles and permissions

Question 12

During an audit of a financial application, the IS auditor discovers that user access reviews are performed quarterly instead of monthly as required by policy. Which of the following is the BEST initial action for the auditor?

Accepted Answer

Determine if compensating controls mitigate the risk of less frequent reviews. The IS auditor's primary role is to assess risk, not to enforce policy blindly. Quarterly reviews may still be acceptable if compensating controls (e.g., automated provisioning/deprovisioning, real-time monitoring, or role-based access controls) effectively reduce the risk of unauthorized access between reviews. Determining the presence and effectiveness of such controls is the best initial action before deciding whether to report noncompliance.

Answer

Recommend that the policy be changed to allow quarterly reviews

Answer

Report the noncompliance with the policy as a finding immediately

Answer

Escalate the issue to senior management for immediate resolution

Question 13

During an IT audit, the auditor discovers that the IT department has not conducted a business impact analysis (BIA) for three years. The organization's disaster recovery plan (DRP) is based on the previous BIA. The IT manager argues that the DRP is still valid because no major changes have occurred. What should the auditor recommend?

Accepted Answer

Recommend that a new BIA be conducted to validate and update the DRP.. A business impact analysis (BIA) is the foundation of a valid disaster recovery plan (DRP). Without a current BIA, the DRP may not reflect the organization's current critical processes, recovery time objectives (RTOs), or recovery point objectives (RPOs). Even if no major changes are perceived, subtle shifts in dependencies, resource availability, or regulatory requirements can render the DRP ineffective. Therefore, the auditor should recommend conducting a new BIA to validate and update the DRP.

Answer

Accept the IT manager's rationale and close the finding.

Answer

Recommend terminating the current DRP until the BIA is completed.

Answer

Recommend accepting the risk and documenting the decision.

Question 14

Which TWO of the following are the MOST effective controls to prevent unauthorized changes to production data?

Accepted Answer

Requiring change management approval for all production changes. Requiring change management approval for all production changes is a preventive control that ensures every modification to production data is formally authorized, reviewed, and documented before implementation. This directly prevents unauthorized changes by enforcing a gatekeeping process where only approved changes proceed, reducing the risk of data integrity breaches. Without this control, even with other safeguards, an attacker or insider could bypass technical controls by simply requesting a change through official channels.

Answer

Implementing audit logging of all data changes

Answer

Encrypting production data at rest

Answer

Using automated testing for all code changes

Question 15

Based on the exhibit, the IS auditor is reviewing access to the payroll folder. Which of the following is the MOST significant finding?

Accepted Answer

Potential excessive privileges for user jdoe due to overlapping permissions. Option D is the most significant finding because user jdoe has overlapping permissions from multiple group memberships (e.g., HR_Managers and Payroll_Admin), which can result in unintended cumulative effective permissions. In Windows NTFS, effective permissions are the sum of all allowed permissions from each group, minus any explicit denies, so overlapping group memberships often grant more access than intended, violating the principle of least privilege.

Answer

Internal_Audit group has Read access to payroll data

Answer

User asmith has only Read access to payroll

Answer

HR_Managers group has Full Control over payroll

Question 16

Which THREE of the following are key elements that should be included in a risk assessment report for information systems?

Accepted Answer

Identification of critical assets and their vulnerabilities. A is correct because a risk assessment report must identify critical assets and their vulnerabilities to establish the scope and basis for risk analysis. Without this, the report cannot prioritize which systems require immediate attention or justify subsequent control recommendations.

Answer

List of all vendors and their contract terms

Answer

Detailed budget for implementing security controls

Question 17

Which TWO of the following are key benefits of using a system development life cycle (SDLC) methodology? (Select exactly two.)

Accepted Answer

It provides a structured approach to system development. Options A and C are correct. A: SDLC provides structure and phases. C: SDLC includes user involvement. B is wrong because SDLC does not guarantee reduced cost; it may increase upfront cost. D is wrong because SDLC is not primarily for security testing. E is wrong because SDLC may not eliminate scope creep, but helps manage it.

Answer

It prevents any scope changes during development

Answer

It eliminates the need for security testing

Answer

It reduces the overall cost of development

Question 18

A company is designing its backup strategy for a critical database that must be available 24/7. The database experiences high transaction volumes. Which backup method minimizes data loss while allowing continuous operations?

Accepted Answer

Online backup with transaction log backups. Online backup with transaction log backups (Option C) is correct because it allows the database to remain fully operational (24/7 availability) while capturing every committed transaction in the transaction log. In the event of a failure, you can restore the most recent full backup and then apply all subsequent transaction log backups to recover to the exact point of failure, minimizing data loss to only uncommitted transactions.

Answer

Offline full backup performed weekly

Answer

Differential backup performed daily

Answer

Full backup performed during low-usage periods

Question 19

During an incident response exercise, the IT team discovers that the failover to the disaster recovery (DR) site failed because the DR site's storage area network (SAN) was not zoned correctly for the replicated data. Which of the following controls would BEST prevent this issue?

Accepted Answer

Conducting regular disaster recovery testing including full failover. Option D is correct because regular disaster recovery testing that includes a full failover is the only control that directly validates that the DR site's SAN zoning is correctly configured to accept replicated data. Without such testing, misconfigurations like incorrect zone sets or missing WWPN (World Wide Port Name) mappings in the SAN fabric remain undetected until an actual failover is attempted. This aligns with the CISA emphasis on testing recovery procedures to ensure business continuity.

Answer

Maintaining a configuration management database (CMDB)

Answer

Implementing a change management process for SAN configurations

Answer

Using automated replication monitoring tools

Question 20

An IT auditor is reviewing the business continuity plan (BCP) for a financial services firm. The plan includes a hot site that is shared with another organization under a reciprocal agreement. Which of the following findings should be of MOST concern to the auditor?

Accepted Answer

The reciprocal agreement does not guarantee exclusive use of the hot site during a disaster. Option C is correct because a reciprocal agreement for a shared hot site does not guarantee exclusive access during a disaster. If both organizations declare a disaster simultaneously, the site may become oversubscribed, leading to resource contention and potential failure of the BCP. This directly undermines the recovery capability, making it the most critical finding.

Answer

The hot site uses a different internet service provider than the primary site

Answer

The hot site has not been tested in the past 12 months

Answer

The hot site is located in the same seismic zone as the primary site