CISA Practice Exam 51 — 20 Questions

Question 1

Which THREE of the following are components of a typical IT governance framework?

Accepted Answer

Strategic alignment of IT with business. Strategic alignment of IT with business is a core component of an IT governance framework because it ensures that IT initiatives directly support and enable the organization's business objectives and strategies. This alignment is achieved through mechanisms like balanced scorecards and IT steering committees, which prioritize IT investments based on business value. Without this component, IT may operate in a silo, leading to wasted resources and missed opportunities.

Answer

Network troubleshooting procedures

Answer

Vendor contract management

Question 2

An IS auditor is reviewing an organization's change management process. The auditor notes that all emergency changes are approved post-implementation by the change advisory board (CAB) within 48 hours. Which of the following is the auditor's BEST course of action?

Accepted Answer

Assess whether the emergency change policy includes proper justification and post-approval controls. The auditor's primary role is to assess the adequacy of controls. The emergency change process with post-approval within 48 hours is acceptable if the policy includes proper justification and post-approval controls. The auditor should evaluate whether these controls are in place rather than immediately escalating or recommending pre-approval, which may not be practical for emergencies. Option D is incorrect because pre-approval for emergency changes is not always feasible, and the current process may be adequate with proper controls.

Answer

Escalate the issue to senior management as a control weakness

Answer

Verify that all emergency changes are tested before implementation

Answer

Recommend that emergency changes be approved prior to implementation

Question 3

Which TWO of the following are examples of administrative controls for information security? (Choose two.)

Accepted Answer

Incident response policy. An incident response policy is a documented set of procedures that defines roles, responsibilities, and steps to be taken when a security incident occurs. This is an administrative control as it governs human behavior and organizational processes, not technology. It aligns with the CISA domain of Protection of Information Assets by establishing a framework for detecting, responding to, and recovering from security events.

Answer

Encryption of data at rest

Answer

Biometric access controls

Answer

Firewall configuration

Question 4

An IS auditor is performing a compliance audit of a data privacy regulation. Which of the following is the PRIMARY source of audit criteria?

Accepted Answer

The specific requirements of the regulation. In a compliance audit, the audit criteria are the standards, laws, regulations, or contractual requirements against which the auditor measures the organization's controls and practices. When auditing against a data privacy regulation, the specific requirements of that regulation are the authoritative source of criteria — they define what compliance actually means. Internal policies and best practices may be relevant context, but they cannot override or substitute for the regulatory requirements themselves.

Answer

Prior audit findings

Answer

Industry best practices

Answer

The organization's internal policies

Question 5

An IS auditor is reviewing capacity management practices. Which TWO indicators suggest that proactive capacity management is being performed effectively?

Accepted Answer

Monitoring resource utilization trends over time.. Option C is correct because proactive capacity management depends on continuously collecting and analyzing resource utilization metrics (CPU, memory, disk, network, I/O) over time to identify growth trends and forecast future demand before performance degrades. Option D is correct because configuring threshold alerts for CPU, memory, and disk usage enables early detection of approaching capacity limits, allowing remediation actions to be taken before service levels are impacted. Together, trend monitoring and threshold alerting are the hallmarks of a proactive, forecast-driven capacity management process. Option A is not correct because a BIA is a business continuity/disaster recovery activity that identifies critical processes and recovery requirements, not a capacity management indicator. Option B is not correct because reviewing backup logs addresses backup integrity and recoverability, which is unrelated to capacity planning. Option E is not correct because analyzing historical cost data supports IT financial management and budgeting, not the technical forecasting of resource capacity needs.

Answer

Conducting business impact analysis (BIA) annually.

Answer

Reviewing backup logs for errors.

Answer

Analyzing historical cost data for IT infrastructure.

Question 6

During a software asset management (SAM) audit, it is discovered that the organization is using software that has reached end-of-life. Which of the following is the MOST significant risk associated with this situation?

Accepted Answer

Lack of security patches. End-of-life software no longer receives security patches from the vendor, meaning any newly discovered vulnerabilities will remain unaddressed. This creates a direct and exploitable attack surface, making lack of security patches the most significant risk because it can lead to data breaches, system compromise, and regulatory non-compliance.

Answer

Incompatibility with new hardware

Answer

Increased maintenance costs

Answer

License compliance issues

Question 7

An IS auditor is assessing the effectiveness of access controls. Which TWO procedures provide the strongest evidence? (Select two.)

Accepted Answer

Re-performance of access provisioning using a test account. Re-performance of access provisioning using a test account (A) is correct because the auditor independently executes the provisioning process and directly verifies whether the system enforces the intended access rules, yielding first-hand evidence that is stronger than documentation or interviews. Inspection of access violation audit logs (B) is correct because these logs are system-generated records that reveal actual attempts to exceed authorized access and whether the controls detected and responded to them, providing objective evidence of control operation. Inquiry of the security administrator (C) is not sufficient because it relies on management's assertions rather than independent verification. Inspection of user access review documentation (D) shows that reviews were documented but does not confirm the underlying access rights are actually correct or enforced. Observation of access request processing (E) only reflects the process at the moment observed and may not represent normal or complete control operation.

Answer

Inquiry of the security administrator

Answer

Inspection of user access review documentation

Answer

Observation of access request processing

Question 8

An organization is implementing a custom ERP system. During user acceptance testing (UAT), critical bugs are found that affect core financial processing. The project sponsor suggests deploying the system on schedule and fixing bugs after go-live. What is the BEST course of action?

Accepted Answer

Delay go-live until all critical bugs are resolved and UAT is successfully completed. Deploying an ERP system with unresolved critical bugs in core financial processing violates the fundamental principle of system integrity and accuracy. UAT must be successfully completed to validate that the system meets business requirements and processes financial transactions correctly; going live with known critical defects introduces unacceptable risk of financial misstatement, regulatory non-compliance, and data corruption. Delaying go-live ensures that all critical bugs are resolved and retested, preserving the reliability of financial data and audit trails.

Answer

Go live as planned and fix bugs post-implementation

Answer

Accept the bugs with documented risk acceptance from management

Answer

Go live but include a rollback plan and deploy fixes immediately

Question 9

An organization is developing a business continuity strategy for its key customer-facing application. The BIA determined an RTO of 2 hours and an RPO of 30 minutes. Which TWO strategies are most appropriate to meet these objectives?

Accepted Answer

Implement a hot standby site. Option A (hot standby site) is correct because a hot standby keeps a fully operational, continuously synchronized environment ready to take over immediately, so the 2-hour RTO can be met with minimal failover time. Option D (synchronous data replication to a secondary site) is correct because synchronous replication commits writes to the secondary site before acknowledging them, giving an RPO of effectively zero, which is well within the required 30-minute RPO. Option B (manual workaround process) is not appropriate because manual procedures typically introduce delays and human error that cannot reliably satisfy a 2-hour RTO. Option C (offsite tape storage) does not belong because retrieving and restoring tapes takes far longer than 2 hours and cannot meet a 30-minute RPO. Option E (daily full backups to tape) is unsuitable because a 24-hour backup interval yields an RPO of up to 24 hours, far exceeding the 30-minute requirement.

Answer

Adopt a manual workaround process

Answer

Store backup tape at an offsite location

Answer

Perform daily full backups to tape

Question 10

A business continuity plan (BCP) includes a tabletop exercise once a year. An IS auditor finds that the exercise only involves IT staff. Which of the following is the BEST recommendation?

Accepted Answer

Invite business process owners to participate in future exercises. The best recommendation is to invite business process owners to participate in future exercises because BCP is a business-wide initiative, not just IT. Their involvement ensures that business impact, recovery priorities, and cross-functional dependencies are properly tested. This addresses the auditor's finding that the exercise only involves IT staff.

Answer

Perform a failover test of the production environment

Answer

Increase the frequency of IT-only exercises

Answer

Include a data restoration test in the exercise

Question 11

During an audit of patch management, the IS auditor notes that several critical patches have not been applied within the defined SLA. Which of the following is the BEST approach to evaluate the risk acceptance of these unpatched vulnerabilities?

Accepted Answer

Review the risk acceptance documentation approved by the system owner and CISO.. The question asks how to evaluate the risk acceptance of unpatched vulnerabilities. Risk acceptance is a formal management decision that must be documented and approved by the appropriate authorities—typically the system owner and the CISO. Reviewing this documentation provides direct evidence that the organization has consciously accepted the risk, which is exactly what the auditor needs to evaluate. Computing a risk score or recommending patching does not address whether the risk has been formally accepted.

Answer

Compute the aggregate risk score using a vulnerability management tool.

Answer

Recommend immediate application of all missing patches.

Answer

Verify that the patches are not applicable to the environment.

Question 12

An organization is implementing a data loss prevention (DLP) solution. Which of the following is the BEST approach to minimize false positives while ensuring sensitive data is protected?

Accepted Answer

Use contextual analysis including user roles and data classification.. Contextual analysis (Option C) is the best approach because it reduces false positives by considering user roles, data classification, and behavioral patterns, ensuring that only genuinely risky data transfers are flagged. Unlike static methods, this dynamic analysis adapts to the organization's data governance policies, allowing legitimate business communications to proceed while still protecting sensitive information.

Answer

Encrypt all outbound emails containing any attachment.

Answer

Deploy exact file matching against a database of known sensitive documents.

Answer

Apply keyword matching to all outbound emails.

Question 13

An organization is evaluating a vendor for a custom application development. The vendor states they are assessed at CMMI Level 2 (Managed). Which of the following best describes the implication of this rating?

Accepted Answer

The vendor's projects have a basic project management process that is planned and executed.. CMMI Level 2 (Managed) indicates that the vendor has established basic project management processes to plan, execute, monitor, and control projects. This means projects are managed according to documented plans, with defined requirements, project planning, and configuration management, but processes are not yet standardized across the organization. Option D correctly captures this foundational level of process maturity.

Answer

The vendor's processes are defined and tailored from organization-wide standards.

Answer

The vendor's processes are continuously improved through quantitative feedback.

Answer

The vendor has a quantitatively managed process with statistical control.

Question 14

A company is outsourcing software development. What is the IS auditor's PRIMARY concern?

Accepted Answer

Protection of intellectual property and data. Protection of intellectual property and data is the primary concern for an IS auditor when outsourcing software development because it represents the highest risk to the organization. While vendor methodology, financial stability, and SLA compliance are important, they are secondary to ensuring that sensitive data and proprietary information are safeguarded against unauthorized access or disclosure.

Answer

The vendor's development methodology

Answer

The vendor's financial stability

Answer

Compliance with service level agreements

Question 15

An IS auditor is evaluating the vendor selection process for a new system. Which of the following is the most important factor to include in the contract?

Accepted Answer

Audit rights. Audit rights are critical for the organization to verify the vendor's controls and compliance, especially for outsourced systems.

Answer

Timeframe for delivery

Answer

Fixed price

Answer

Warranty period

Question 16

During a post-implementation review of a new payroll system, the IS auditor identifies several outstanding issues. Which TWO issues should be considered most critical to address immediately? (Select TWO)

Accepted Answer

The system's tax calculation module produced incorrect results for a subset of employees. Option B is critical because incorrect tax calculations in a payroll system directly violate legal and regulatory compliance requirements, can result in penalties from tax authorities, and harm employee trust through inaccurate pay and withholding. Option D is critical because unauthorized overtime payments from a configuration error represent a direct financial loss and indicate a control failure in the payroll processing logic that could recur and compound if not remediated immediately. In contrast, option A (5% performance degradation) is a performance/efficiency concern that does not affect data integrity or compliance and can be tuned later. Option C (incomplete training) is a people/process issue that, while important, does not by itself cause incorrect or unauthorized transactions. Option E (unfinalized user manual) is a documentation gap with no immediate financial, legal, or control impact.

Answer

The system is running 5% slower than expected

Answer

Some employees have not completed training

Answer

The user manual is not yet finalized

Question 17

A company is designing its backup strategy for a critical database that must be available 24/7. The database experiences high transaction volumes. Which backup method minimizes data loss while allowing continuous operations?

Accepted Answer

Online backup with transaction log backups. Online backup with transaction log backups (Option C) is correct because it allows the database to remain fully operational (24/7 availability) while capturing every committed transaction in the transaction log. In the event of a failure, you can restore the most recent full backup and then apply all subsequent transaction log backups to recover to the exact point of failure, minimizing data loss to only uncommitted transactions.

Answer

Offline full backup performed weekly

Answer

Differential backup performed daily

Answer

Full backup performed during low-usage periods

Question 18

During an incident, the IT team identifies that a critical patch was not applied due to an expired software maintenance contract. Which of the following is the BEST long-term remediation?

Accepted Answer

Implement a vulnerability management program. The root cause is not the expired contract itself but the absence of a systematic process to identify, prioritize, and remediate vulnerabilities before they are exploited. A vulnerability management program provides ongoing identification, classification, remediation, and verification of vulnerabilities across all assets, ensuring patches are applied regardless of contract status. Renewing the contract or applying the patch addresses only the immediate symptom, while isolation is a containment tactic. Thus, implementing a vulnerability management program is the best long-term remediation.

Answer

Renew the maintenance contract

Answer

Apply the patch immediately

Answer

Isolate the affected system

Question 19

An IS auditor is reviewing a post-implementation review report for a new ERP system. Which of the following findings would be of greatest concern to the auditor?

Accepted Answer

Several segregation of duties conflicts were identified and not resolved.. Unresolved segregation of duties (SoD) conflicts in an ERP system pose a significant risk of fraud, unauthorized transactions, and financial misstatement. SoD is a fundamental internal control that prevents any single individual from having control over all aspects of a transaction. Unresolved conflicts indicate a control deficiency that could lead to material misstatement and is of greatest concern to an IS auditor.

Answer

The implementation took three months longer than planned.

Answer

The project exceeded the budget by 15%.

Answer

User acceptance testing (UAT) was completed with only 80% test coverage.

Question 20

Which of the following is the best example of audit evidence obtained through re-performance?

Accepted Answer

Recalculating the total of a control report to verify accuracy. Re-performance involves the auditor independently executing the same procedure or control that was originally performed by the auditee. Recalculating the total of a control report to verify accuracy is a classic example of re-performance, as the auditor independently computes the total to confirm it matches the report.

Answer

Reviewing log files for unauthorized access attempts

Answer

Interviewing the system administrator about backup procedures

Answer

Observing employees as they process transactions