CISA Practice Questions 2 — 50 Questions

Question 1

Refer to the exhibit. The IAM policy is intended to allow only requests originating from account 123456789012 to perform any S3 actions. Why does the policy NOT achieve this objective?

Accepted Answer

The condition key 'aws:SourceAccount' only applies when the request is made from another account; it does not restrict access to resources owned by the same account.. The 'aws:SourceAccount' condition key is designed for use in resource-based policies (like S3 bucket policies) to prevent cross-account confusion of resources. It does not restrict access within the same account; it only validates the source account when the request originates from a different account. Since the policy is an IAM identity-based policy (attached to a user/role), the 'aws:SourceAccount' condition is not evaluated for same-account requests, so any principal in account 123456789012 can still perform S3 actions without being restricted by this condition.

Answer

The Resource element is set to "*", which allows all actions on all resources regardless of the condition.

Answer

The policy should include a Deny statement for all other accounts to be effective.

Answer

The Version element is incorrect and should be updated to the latest version.

Question 2

An organization has experienced several security incidents due to unauthorized changes to production systems. Which governance mechanism should be strengthened?

Accepted Answer

Change management process. A change management process ensures that all changes are authorized, tested, and approved, directly addressing unauthorized changes. Asset management, CMDB, and incident response are supportive but not the primary control.

Answer

IT asset management

Answer

Configuration management database

Answer

Incident response plan

Question 3

Refer to the exhibit. An auditor reviews the ACL and notes that it allows traffic from a specific host while blocking other IPs in the same subnet. What is the most likely security issue?

Accepted Answer

The ACL is misconfigured because the permit any at the end bypasses the deny.. The ACL has a 'permit any' statement at the end, which overrides the preceding 'deny' statements. In Cisco ACLs, packets are processed sequentially from top to bottom; once a match is found, no further rules are evaluated. Therefore, the 'deny' for the subnet is never reached, and all traffic (including from the blocked subnet) is permitted, defeating the intended restriction.

Answer

The ACL blocks all traffic from the subnet except the host, which is desired.

Answer

The ACL allows all traffic from the specific host, which is a risk.

Answer

The ACL should be reversed to deny first.

Question 4

A company is implementing a cloud-based identity and access management (IAM) system. Which of the following best describes the principle of least privilege in this context?

Accepted Answer

Permissions should be granted based on the user's role and need-to-know.. The principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions, based on their role and need-to-know. In a cloud-based IAM system, this is typically implemented through role-based access control (RBAC) or attribute-based access control (ABAC), ensuring minimal exposure to sensitive resources and reducing the attack surface.

Answer

Users should have administrative rights for troubleshooting.

Answer

Permissions should be revoked only when an employee leaves the company.

Answer

All users should have the same level of access for consistency.

Question 5

An IT steering committee is reviewing a proposal for a new customer relationship management (CRM) system. Which of the following BEST demonstrates that the proposal aligns with the organization's strategic goals?

Accepted Answer

The business case includes a clear link to the organization's five-year strategic plan.. A clear link to the organization's five-year strategic plan demonstrates that the proposal aligns with strategic goals. Option B is about the project manager's experience, which does not indicate strategic alignment. Option C describes a feature that may be beneficial but is not inherently tied to strategic goals. Option D is a cost-saving tactic, not evidence of strategic alignment.

Answer

The project manager has extensive experience with CRM implementations.

Answer

The proposed system includes advanced analytics capabilities.

Answer

The vendor offers discounted licensing for the first year.

Question 6

Which of the following is the MOST important objective of system testing?

Accepted Answer

Verify that the system meets specified requirements. System testing is a formal, structured process that validates the entire integrated system against its specified requirements. The primary goal is to confirm that the system behaves as defined in the functional and technical specifications, ensuring that all requirements are correctly implemented before user acceptance testing. While user satisfaction and defect removal are important, they are secondary to verifying requirement compliance, which is the core objective of system testing.

Answer

Confirm that end users are satisfied

Answer

Ensure the code is free of defects

Answer

Validate system performance under load

Question 7

Which TWO of the following are key elements of an effective incident response plan? (Select exactly 2.)

Accepted Answer

A clear escalation path with contact information. A clear escalation path (C) ensures incidents are reported to the right stakeholders for timely decision-making, while predefined communication templates (E) enable rapid and consistent notifications to internal and external parties. These are directly used during incident response. Post-incident reviews (A) are important but not a key element of the plan itself; software licenses (B) and hardware serial numbers (D) are asset management details, not incident response essentials.

Answer

A schedule for post-incident reviews

Answer

A detailed inventory of software licenses

Answer

A list of all hardware serial numbers

Question 8

An IS auditor is reviewing the process for granting privileged access in a large organization. Which of the following findings should be of MOST concern?

Accepted Answer

Privileged access is granted without approval from the system owner. Privileged access requests must be properly authorized to prevent unauthorized elevation of privileges.

Answer

Privileged accounts are not monitored in real-time

Answer

Privileged access is reviewed quarterly

Answer

There is no segregation of duties for privileged users

Question 9

An IT auditor is reviewing the business continuity plan (BCP) for a financial services firm. The plan includes a hot site that is shared with another organization under a reciprocal agreement. Which of the following findings should be of MOST concern to the auditor?

Accepted Answer

The reciprocal agreement does not guarantee exclusive use of the hot site during a disaster. A reciprocal agreement for a shared hot site does not guarantee exclusive access during a disaster. If both organizations declare a disaster simultaneously, the site may become oversubscribed, leading to resource contention and potential failure of the BCP. This directly undermines the recovery capability, making it the most critical finding.

Answer

The hot site uses a different internet service provider than the primary site

Answer

The hot site has not been tested in the past 12 months

Answer

The hot site is located in the same seismic zone as the primary site

Question 10

During a system development project, the project manager notices that the actual cost is significantly higher than the planned cost at the 50% completion point. The earned value (EV) is $500,000, the actual cost (AC) is $600,000, and the planned value (PV) is $550,000. Which of the following is the MOST appropriate action?

Accepted Answer

Conduct a root cause analysis to identify the reasons for cost overrun. The project is over budget (EV $500K vs AC $600K) and behind schedule (EV $500K vs PV $550K). Before taking corrective action, the project manager must first perform a root cause analysis to understand why costs are exceeding planned values. This aligns with the CISA’s emphasis on identifying the underlying cause of variances before implementing changes to scope, budget, or schedule.

Answer

Request additional budget from senior management

Answer

Reduce the project scope to align with the budget

Answer

Crash the project schedule to make up for lost time

Question 11

An organization is transitioning from a waterfall to an agile development methodology. Which of the following is a key risk that the IS auditor should highlight?

Accepted Answer

Scope creep may increase without proper controls.. In agile development, iterative cycles and continuous feedback can lead to scope creep if changes are not managed through a disciplined backlog prioritization process. Unlike waterfall, where scope is fixed early, agile's flexibility requires robust controls (e.g., sprint boundaries, product owner authority) to prevent uncontrolled expansion. An IS auditor should highlight this risk because without proper governance, the project may exceed budget and timeline despite agile's adaptive nature.

Answer

User requirements may be incomplete at the start.

Answer

Testing is deferred until the end of the project.

Answer

Stakeholder involvement may decrease.

Question 12

Which THREE of the following are essential components of a data classification program?

Accepted Answer

Data retention and disposal schedules. Data retention and disposal schedules are essential to a data classification program because they define how long each classification level of data must be retained and the secure methods for its disposal (e.g., degaussing, cryptographic erasure, or physical shredding). This ensures that data is not kept beyond its useful life, reducing the risk of unauthorized access or legal non-compliance. Without these schedules, the classification program lacks the lifecycle management component necessary for operational security.

Answer

Regular vulnerability scanning

Answer

Implementation of database encryption

Question 13

A software development company uses a cloud-based source code repository (e.g., GitHub) to store proprietary code. The company has two-factor authentication (2FA) enabled for all accounts. A developer's personal computer was infected with malware that stole the developer's session cookies and local credentials. The attacker used the stolen session to access the code repository and exfiltrated the entire codebase. The company's security team reviews the incident and notes that the repository has audit logging, but the logs were not monitored in real time. The team wants to implement additional controls to prevent a similar incident. Which control would have been most effective in preventing the exfiltration?

Accepted Answer

Require access to the code repository only from company-managed IP addresses. Restricting access to the code repository to only company-managed IP addresses (e.g., via a VPN or a corporate NAT gateway) would have prevented the attacker from using the stolen session cookies from an external, non-corporate IP. Even though the attacker had valid session tokens, the repository's access control list (ACL) would have blocked the connection at the network layer, stopping the exfiltration before it could begin. This control addresses the root cause—unauthorized network origin—rather than relying on detection or session management alone.

Answer

Use a SIEM to alert on unusual access patterns in real time

Answer

Enforce code signing for all commits

Answer

Implement a shorter session timeout for the code repository

Question 14

Which TWO of the following are primary objectives of a business continuity plan (BCP)?

Accepted Answer

Maintain regulatory compliance during disruptions. A primary objective of a BCP is to ensure that the organization can continue to meet legal and regulatory obligations during a disruption. This includes maintaining required data protection, reporting, and operational standards as mandated by regulations such as GDPR, HIPAA, or SOX, even when normal operations are impaired.

Answer

Replace the disaster recovery plan

Answer

Minimize financial loss

Answer

Guarantee 100% system uptime

Question 15

An organization is adopting an agile development methodology for a new financial application. During a sprint review, the product owner expresses concern that the system does not enforce segregation of duties (SoD). The development team argues that SoD will be addressed in a future sprint. As the IS auditor, what is the BEST recommendation?

Accepted Answer

Insist that SoD be implemented in the next sprint.. In agile development, security and compliance requirements like segregation of duties (SoD) must be addressed as early as possible, especially for a financial application where regulatory compliance is critical. Delaying SoD to a future sprint introduces significant risk and violates the principle of 'secure by design.' The IS auditor's best recommendation is to insist that SoD be implemented in the next sprint, ensuring that the control is prioritized and integrated into the development lifecycle without waiting for an indefinite future iteration.

Answer

Suggest that the product owner accept the residual risk.

Answer

Accept the team's plan and document the risk.

Answer

Require immediate implementation of SoD in this sprint.

Question 16

An IS auditor is reviewing the organization's incident management process. Which THREE of the following are essential components of an effective incident response plan?

Accepted Answer

Defined roles and responsibilities for the incident response team. An effective IR plan must include clear roles, communication procedures, and criteria for escalation and severity classification to ensure timely and coordinated response.

Answer

A list of all employees and their contact information

Answer

A detailed technical guide for each software application

Question 17

A company plans to implement a commercial off-the-shelf (COTS) application and requires significant customization to match its unique business processes. The vendor advises against extensive customization because it may complicate future upgrades. What is the BEST course of action?

Accepted Answer

Avoid customization and re-engineer business processes to match the COTS application. The best course of action is to avoid customization and re-engineer business processes to match the COTS application. This approach preserves the integrity of the vendor's standard codebase, ensuring that future upgrades and patches can be applied with minimal friction. Extensive customization creates a fork from the vendor's baseline, leading to costly regression testing, potential security gaps, and upgrade incompatibilities that undermine the long-term value of the COTS investment.

Answer

Use the vendor's customization module to minimize upgrade risks

Answer

Customize but maintain detailed documentation for upgrade impact analysis

Answer

Proceed with extensive customization to meet business needs

Question 18

Which TWO of the following are considered essential components of an information security policy framework? (Choose two.)

Accepted Answer

Data classification policy. A data classification policy is essential because it defines how information assets are categorized based on sensitivity and criticality (e.g., public, internal, confidential, restricted). This classification directly drives the selection and enforcement of appropriate security controls, such as encryption standards (e.g., AES-256 for confidential data) and access control mechanisms (e.g., role-based access control). Without it, security measures cannot be consistently applied across the organization, leading to gaps in protection.

Answer

Business continuity plan

Answer

Incident response plan

Answer

Network architecture diagram

Question 19

A financial institution is deploying a data loss prevention (DLP) solution. Which of the following is the MOST important prerequisite to ensure the DLP can effectively detect sensitive data?

Accepted Answer

Performing a data classification exercise. A DLP solution detects sensitive data by matching content against predefined patterns or rules. Without a data classification exercise, the organization cannot define what constitutes 'sensitive data' (e.g., PII, PCI, IP), making the DLP blind to what it should monitor. Classification provides the taxonomy and metadata (e.g., labels, tags) that the DLP engine uses to trigger alerts or blocks, ensuring detection is both accurate and aligned with policy.

Answer

Configuring incident response procedures

Answer

Installing endpoint agents on all devices

Answer

Implementing network segmentation

Question 20

An organization is implementing a data loss prevention (DLP) solution. Which of the following is the BEST approach to reduce false positives during initial deployment?

Accepted Answer

Deploy in monitor-only mode and analyze alerts for a period. Deploying a DLP solution in monitor-only mode allows the organization to observe what data is being transmitted and generate alerts without blocking any traffic. This enables security teams to analyze the alerts against actual business workflows, fine-tune policies, and eliminate false positives before moving to an active enforcement mode. It is a best practice for initial deployment to avoid disrupting legitimate business operations.

Answer

Use default policies without modification

Answer

Limit scope to one department to minimize noise

Answer

Block all sensitive data transmissions immediately