CISA Practice Exam 51 — 20 Questions

Question 1

Which TWO are primary objectives of an identity and access management (IAM) program? (Select exactly 2.)

Accepted Answer

Ensuring appropriate access to resources.. The primary objective of an IAM program is to ensure that the right individuals have access to the appropriate resources at the right time for the right reasons. This is achieved through authentication, authorization, and access control mechanisms such as Role-Based Access Control (RBAC) or Attribute-Based Access Control (ABAC). Without this, the organization cannot enforce security policies or maintain audit trails.

Answer

Encrypting data at rest and in transit.

Answer

Patching software vulnerabilities.

Answer

Monitoring network traffic for anomalies.

Question 2

An organization wants to ensure that its backup tapes are protected from unauthorized access. Which of the following is the MOST effective control?

Accepted Answer

Encryption of the backup data. Encryption protects data confidentiality even if physical security is breached. Physical locks, access controls, and offsite storage are important but do not protect against all threats like theft during transit.

Answer

Physical locks on the tape library

Answer

Access control lists on the backup server

Answer

Offsite storage of tapes

Question 3

An IS auditor is performing a compliance audit of a data privacy regulation. Which of the following is the PRIMARY source of audit criteria?

Accepted Answer

The specific requirements of the regulation. For a compliance audit, the criteria are the specific requirements of the regulation or law that the organization must adhere to.

Answer

Prior audit findings

Answer

Industry best practices

Answer

The organization's internal policies

Question 4

An IT auditor is evaluating the change management process for a financial trading system. Which of the following is the BEST indicator of a mature change management process?

Accepted Answer

All changes are logged and require automated approval workflows. A mature change management process requires that all changes be formally logged and subjected to automated approval workflows. This ensures traceability, segregation of duties, and auditability, which are critical for a financial trading system where unauthorized or untracked changes could lead to financial loss or regulatory non-compliance.

Answer

Changes are documented after deployment

Answer

Developers can deploy changes directly to production if urgent

Answer

Changes are approved verbally by the IT manager

Question 5

Refer to the exhibit. Which of the following is the most significant risk associated with the backup policy for critical data?

Accepted Answer

Retention period is insufficient to meet regulatory requirements. The backup policy shows a retention period of only 30 days, which is insufficient to meet common regulatory requirements such as GDPR, HIPAA, or SOX that often mandate retention of critical data for months or years. Without adequate retention, the organization risks non-compliance, legal penalties, and inability to produce historical records during audits or litigation.

Answer

Offsite backup storage is not configured

Answer

Backup frequency is too low to meet recovery point objectives

Answer

Encryption is not enabled for backup data

Question 6

An IS auditor is reviewing the access recertification process for a financial institution. The process requires users and their managers to confirm access rights quarterly. During the review, the auditor finds that recertifications are consistently completed late, with an average delay of 45 days. Additionally, terminated employees' access is not always removed promptly, and there are no compensating controls. Which of the following is the MOST significant risk arising from these findings?

Accepted Answer

Higher probability of unauthorized access to sensitive information. The greatest risk from delayed access recertification and late removal of terminated employees is that unauthorized users may retain access, leading to potential data breaches or fraudulent activities. While audit trails and policy violations are concerns, the primary risk is unauthorized access.

Answer

Increased likelihood of audit findings for non-compliance with internal policies

Answer

Difficulty in tracking user access history

Answer

Potential loss of audit trails for access changes

Question 7

What is the primary control weakness in this IAM policy?

Accepted Answer

Over-privileged access. The IAM policy grants broad permissions (e.g., `"Effect": "Allow", "Action": "*", "Resource": "*"`) without scoping to specific actions or resources, violating the principle of least privilege. This over-privileged access allows any authenticated principal to perform any operation (including destructive actions like `iam:DeleteRole` or `s3:DeleteBucket`) across all resources, creating a severe security risk. The primary weakness is the lack of fine-grained access control, not the absence of encryption, MFA, or logging.

Answer

No encryption requirement

Answer

MFA not required

Answer

Lack of logging

Question 8

An organization uses continuous auditing techniques to monitor transactions. The IS auditor is evaluating the effectiveness of these techniques. Which of the following is the PRIMARY benefit of continuous auditing over traditional periodic auditing?

Accepted Answer

Early detection of anomalies and potential fraud. Continuous auditing enables real-time or near-real-time monitoring of transactions, allowing the IS auditor to detect anomalies and potential fraud as they occur. This is the primary benefit because it shifts the audit function from retrospective review to proactive identification, which is critical for timely risk mitigation.

Answer

Reduced cost of audit resources

Answer

More timely identification of control weaknesses

Answer

Increased sample size for transaction testing

Question 9

An organization's mobile device management (MDM) policy requires that all corporate data on employee-owned smartphones be protected. Which control best ensures that corporate data can be remotely wiped without affecting personal data?

Accepted Answer

Implementing a containerization solution that separates work and personal profiles. Containerization (also known as dual-persona or sandboxing) creates a separate, encrypted container on the device for corporate apps and data. This allows the MDM to issue a selective wipe command that destroys only the container and its contents, leaving the user's personal apps, photos, and settings untouched. Without containerization, a remote wipe would typically erase the entire device, including all personal data.

Answer

Disabling the ability to copy/paste between corporate and personal apps

Answer

Requiring a strong password and biometric authentication

Answer

Enforcing a full device encryption policy

Question 10

An IS auditor is testing a control that requires two approvals for purchase orders over $10,000. The auditor selects a sample of 50 purchase orders from the population of 500. Using statistical sampling, the auditor finds 2 deviations. The tolerable deviation rate is 5%. What should the auditor conclude?

Accepted Answer

The control is effective as the sample deviation rate is below the tolerable rate.. The sample deviation rate of 4% (2 out of 50) is below the tolerable deviation rate of 5%. Therefore, the control is considered effective based on the sample evidence. The auditor does not need to increase the sample size unless the deviation rate is close to the tolerable rate or other risk factors exist. In this case, the control can be relied upon as designed.

Answer

The auditor should increase the sample size to reduce sampling risk.

Answer

The control is ineffective because deviations were found.

Answer

The auditor should conclude that the control is ineffective and report a deficiency.

Question 11

An organization wants to ensure that data is not retained longer than necessary. Which of the following is the BEST control to implement?

Accepted Answer

Define and enforce data retention schedules. Defining and enforcing data retention schedules directly addresses the requirement to not retain data longer than necessary by specifying precise timeframes for data deletion or archival. This control ensures compliance with legal, regulatory, and business needs by automating the lifecycle management of data, such as through expiration policies in object storage (e.g., S3 Lifecycle rules) or database TTL (time-to-live) settings. Without such schedules, data may persist indefinitely, increasing storage costs and regulatory risk.

Answer

Encrypt all data at rest

Answer

Implement a backup retention policy

Answer

Use role-based access controls

Question 12

An auditor is reviewing IT asset management processes. The auditor finds that several servers running an older operating system are still in production, even though the vendor has ended support. What is the primary risk associated with this finding?

Accepted Answer

Lack of vendor support and security patches. Unsupported software no longer receives security patches, making the systems vulnerable to exploitation.

Answer

Non-compliance with software licensing

Answer

Incompatibility with new hardware

Answer

Increased licensing costs

Question 13

Which TWO of the following are typically included in the fieldwork phase of an IS audit? (Select two.)

Accepted Answer

Testing controls. Fieldwork involves executing audit procedures; walkthroughs and testing controls are part of fieldwork.

Answer

Defining audit scope

Answer

Developing the audit program

Answer

Issuing the draft report

Question 14

An IS auditor is selecting audit procedures to test controls over user access. Which of the following is an example of a re-performance procedure?

Accepted Answer

Independently creating a test user account and verifying access rights. Re-performance involves the auditor independently performing a control to verify its effectiveness. For access controls, independently adding a test user and verifying access rights is a re-performance.

Answer

Observing the security administrator adding a user

Answer

Reviewing the access control policy document

Answer

Interviewing the security administrator about the process

Question 15

Which TWO of the following are components of audit risk in IS auditing?

Accepted Answer

Detection risk. Audit risk consists of inherent risk, control risk, and detection risk. The question asks for TWO; inherent and detection are correct.

Answer

Financial risk

Answer

Business risk

Answer

Operational risk

Question 16

Which THREE of the following are characteristics of a SMART recommendation? (Select three.)

Accepted Answer

Measurable. SMART stands for Specific, Measurable, Achievable, Relevant, Time-bound.

Answer

General

Answer

Subjective

Question 17

Which type of audit evidence involves the auditor independently performing a control procedure to verify its effectiveness?

Accepted Answer

Re-performance. Re-performance is when the auditor independently executes a control to confirm it operates as intended.

Answer

Inspection

Answer

Observation

Answer

Inquiry

Question 18

Which TWO of the following are components of audit risk in the ISACA risk model? (Select TWO.)

Accepted Answer

Inherent risk. Audit risk = Inherent risk × Control risk × Detection risk. Inherent risk and detection risk are components; control risk is also a component, but the question asks for two; correct ones are inherent and detection.

Answer

Engagement risk

Answer

Sampling risk

Answer

Business risk

Question 19

Which of the following is a key difference between internal and external auditors?

Accepted Answer

External auditors are more independent than internal auditors. External auditors are independent third parties, while internal auditors are employees of the organization.

Answer

Internal auditors are required for regulatory compliance

Answer

Internal auditors focus only on financial controls

Answer

External auditors have deeper organizational knowledge

Question 20

An IS auditor is evaluating the design of controls over a new financial system. Which of the following is the BEST approach to assess control design?

Accepted Answer

Review system documentation and conduct walkthroughs. Reviewing system documentation and conducting walkthroughs allows the auditor to understand the intended design and compare it to actual implementation.

Answer

Use analytical procedures to identify anomalies

Answer

Perform detailed testing of transactions

Answer

Interview management and review policies