CISA Practice Exam 52 — 20 Questions

Question 1

An IS auditor is reviewing an organization's logical access control processes. Which of the following is the primary purpose of conducting regular user access recertifications?

Accepted Answer

To verify that users' access rights remain appropriate for their roles. The primary purpose of user access recertification is to verify that each user's access rights remain appropriate for their current role and responsibilities (B). It is a detective governance control that catches privilege creep, role changes, and orphaned entitlements that accumulate over time. While recertification can surface inactive accounts, that is a byproduct rather than the primary objective; the core intent is validating the ongoing business need for access.

Answer

To identify inactive user accounts

Answer

To ensure compliance with password policies

Answer

To enforce segregation of duties

Question 2

An organization is considering outsourcing its IT infrastructure management. Which of the following is the MOST important factor to include in the service level agreement (SLA)?

Accepted Answer

Definition of key performance indicators (KPIs) and reporting frequency.. The most important element of an SLA for outsourced IT infrastructure is a clear definition of KPIs and the frequency of reporting against them, because KPIs are the measurable criteria that determine whether the vendor is meeting the agreed service levels. Without well-defined KPIs and reporting, the SLA cannot be enforced, performance cannot be objectively assessed, and remedies (including penalties) have no basis. This is the foundation on which all other SLA provisions rest.

Answer

List of hardware and software to be managed.

Answer

Staffing levels and qualifications of vendor personnel.

Answer

Price reduction clauses for non-compliance.

Question 3

Which TWO are primary objectives of an identity and access management (IAM) program? (Select exactly 2.)

Accepted Answer

Ensuring appropriate access to resources.. Option A, ensuring appropriate access to resources, is a core IAM objective because IAM governs who (identity) can access which resources (applications, data, systems) and under what conditions, typically through authentication, authorization, and provisioning/deprovisioning processes. Option B, enforcing the least privilege principle, is also a primary IAM objective since IAM implements least privilege by granting users only the minimum rights needed for their roles, often via role-based access control (RBAC), access reviews, and just-in-time elevation. The other options do not belong: C (encrypting data at rest and in transit) is a data protection/cryptography control, D (patching software vulnerabilities) is vulnerability and patch management, and E (monitoring network traffic for anomalies) is network security monitoring/IDS/IPS, none of which are primary IAM objectives.

Answer

Encrypting data at rest and in transit.

Answer

Patching software vulnerabilities.

Answer

Monitoring network traffic for anomalies.

Question 4

An organization is transitioning from a waterfall to an agile development methodology. Which of the following is a key risk that the IS auditor should highlight?

Accepted Answer

Scope creep may increase without proper controls.. In agile development, iterative cycles and continuous feedback can lead to scope creep if changes are not managed through a disciplined backlog prioritization process. Unlike waterfall, where scope is fixed early, agile's flexibility requires robust controls (e.g., sprint boundaries, product owner authority) to prevent uncontrolled expansion. An IS auditor should highlight this risk because without proper governance, the project may exceed budget and timeline despite agile's adaptive nature.

Answer

User requirements may be incomplete at the start.

Answer

Testing is deferred until the end of the project.

Answer

Stakeholder involvement may decrease.

Question 5

Which of the following is the PRIMARY purpose of a service desk?

Accepted Answer

To provide a single point of contact for incidents and service requests. The service desk acts as a single point of contact for IT support.

Answer

To monitor network performance

Answer

To manage IT assets

Answer

To perform root cause analysis

Question 6

An organization's mobile device management (MDM) policy requires that all corporate data on employee-owned smartphones be protected. Which control best ensures that corporate data can be remotely wiped without affecting personal data?

Accepted Answer

Implementing a containerization solution that separates work and personal profiles. Containerization (also known as dual-persona or sandboxing) creates a separate, encrypted container on the device for corporate apps and data. This allows the MDM to issue a selective wipe command that destroys only the container and its contents, leaving the user's personal apps, photos, and settings untouched. Without containerization, a remote wipe would typically erase the entire device, including all personal data.

Answer

Disabling the ability to copy/paste between corporate and personal apps

Answer

Requiring a strong password and biometric authentication

Answer

Enforcing a full device encryption policy

Question 7

Which of the following is a permanent file item in an IS audit working paper?

Accepted Answer

Organizational chart of the IT department. The organizational chart of the IT department is a permanent file item because it documents the entity's structure and is retained across multiple audit engagements. Permanent files contain information of continuing relevance, such as organizational charts, accounting manuals, and long-term contracts. Current year's audit program and findings are current file items, and confirmation letters are also current file evidence.

Answer

Confirmation letters from vendors

Answer

Current year's audit program

Answer

List of audit findings for the current year

Question 8

Which of the following is the BEST indicator that an organization's incident management process is effective?

Accepted Answer

The percentage of recurring incidents is decreasing over time. The best indicator of an effective incident management process is a decreasing percentage of recurring incidents over time, because it demonstrates that root cause analysis is being performed and corrective actions are preventing repeat occurrences. This is a lagging indicator of process maturity — it shows the organization is learning from incidents, not just resolving them quickly. Metrics like MTTR or logging speed measure efficiency, not effectiveness.

Answer

The average time to resolve incidents is under 1 hour

Answer

The number of incidents reported per month is increasing

Answer

All incidents are logged within 10 minutes of detection

Question 9

An organization experiences a ransomware attack that encrypts critical files. Which of the following is the BEST recovery strategy to minimize data loss?

Accepted Answer

Restore from offline backups taken before the attack. Restoring from offline backups taken before the attack ensures that the recovered data is clean and free from encryption, as the ransomware cannot modify backups that are not connected to the network. This strategy minimizes data loss by reverting to the most recent known-good state without relying on potentially compromised or incomplete system restore points.

Answer

Disconnect the network and rebuild systems from scratch

Answer

Pay the ransom to decrypt files

Answer

Use system restore points on the same network

Question 10

An auditor is reviewing IT asset management processes. The auditor finds that several servers running an older operating system are still in production, even though the vendor has ended support. What is the primary risk associated with this finding?

Accepted Answer

Lack of vendor support and security patches. Unsupported software no longer receives security patches, making the systems vulnerable to exploitation.

Answer

Non-compliance with software licensing

Answer

Incompatibility with new hardware

Answer

Increased licensing costs

Question 11

During a review of firewall rule sets, an IS auditor identifies a rule that allows 'any-any' traffic from an internal subnet to the DMZ. The rule was implemented six months ago based on a business request that has since been completed. The firewall administrator explains that the rule was kept for convenience. Which of the following is the BEST audit recommendation?

Accepted Answer

Remove the rule immediately and verify no impact. The rule is overly permissive, no longer justified by business need, and poses an unnecessary risk. The best recommendation is to remove the rule immediately and verify no impact, as it aligns with the principle of least privilege and reduces the attack surface.

Answer

Conduct a penetration test to assess the risk

Answer

Document the rule with a risk acceptance signed by management

Answer

Modify the rule to allow only specific ports and protocols

Question 12

Which TWO of the following are indicators of poor project governance that an IS auditor should identify?

Accepted Answer

Scope changes are frequently requested and approved verbally.. Option A is correct because approving scope changes verbally indicates a lack of formal change control procedures, which is a hallmark of poor project governance; without documented approval, scope creep and accountability issues arise. Option B is correct because inconsistent progress reports lacking key metrics (e.g., earned value, schedule variance, milestone completion) mean the project lacks reliable monitoring and oversight, preventing stakeholders from making informed decisions. Option C is not an indicator of poor governance because agile methodology is a legitimate, structured project management approach when properly governed. Option D is not an indicator of poor governance because weekly status meetings are a normal and often beneficial communication practice. Option E is not an indicator of poor governance because reallocating budget across phases can be a legitimate, approved response to changing project needs when done through proper change control.

Answer

Project team uses an agile methodology.

Answer

Project status meetings are held weekly.

Answer

The project budget is reallocated across phases.

Question 13

An IS auditor is reviewing the firewall rule base. Which of the following findings would be of MOST concern?

Accepted Answer

A rule that allows any service from the Internet to the internal network. A rule that allows any service from the Internet to the internal network is the most concerning because it effectively bypasses the firewall's purpose, permitting unrestricted inbound access to internal systems. This exposes the entire internal network to external threats, including malware, unauthorized access, and exploitation of any vulnerable service. Such a rule violates the principle of least privilege and is a critical misconfiguration that auditors flag as a severe control weakness.

Answer

A rule that has not been reviewed for 18 months

Answer

A rule that permits traffic from a specific IP to a database server on port 1433

Answer

A rule that allows any source IP to access a critical server on port 443

Question 14

A company is developing a mobile application that processes credit card payments. During the testing phase, which of the following types of testing is MOST critical to ensure security?

Accepted Answer

Penetration testing.. Penetration testing is the most critical testing type for a mobile application processing credit card payments because it simulates real-world attacks to identify exploitable vulnerabilities in the payment data flow, authentication mechanisms, and API endpoints. This directly addresses PCI DSS requirements for security testing of cardholder data environments, unlike other testing types that focus on functionality or user experience.

Answer

Interface testing.

Answer

Usability testing.

Answer

Regression testing.

Question 15

During an audit of physical security, the IS auditor observes that employees frequently leave confidential documents on their desks overnight. Which TWO controls should the auditor recommend?

Accepted Answer

Conduct security awareness training. Option B (Conduct security awareness training) is correct because the root cause of documents being left out overnight is employee behavior, and awareness training directly educates staff on their security responsibilities, the risks of leaving confidential information exposed, and proper handling and storage procedures. Option C (Implement a clean desk policy) is correct because it establishes a formal, enforceable requirement that all sensitive documents be secured or locked away at the end of the workday, directly addressing the observed weakness and providing a basis for audits and disciplinary action. Option A (Deploy additional CCTV cameras) is not appropriate because cameras only provide detective/monitoring capability and do not prevent employees from leaving documents on desks. Option D (Implement a visitor management system) does not belong because the issue involves employees, not visitors, and visitor control does not address internal document handling. Option E (Install motion detectors) is not relevant because motion detection is an intrusion-detection control for after-hours physical access, not a control over how employees handle confidential documents.

Answer

Deploy additional CCTV cameras

Answer

Implement a visitor management system

Answer

Install motion detectors

Question 16

Which TWO of the following are recommended practices for aligning IT strategy with business goals, according to COBIT 2019?

Accepted Answer

Adopting a governance framework that covers all IT-related activities and stakeholder needs. Option C is correct because COBIT 2019's governance system is explicitly built on a governance framework that spans the whole enterprise—covering all IT-related activities through the governance and management objectives and addressing the needs of internal and external stakeholders, which is exactly what aligning IT strategy with business goals requires. Option D is correct because COBIT 2019's BA (Build, Acquire and Implement) and APO (Align, Plan and Organise) domains, particularly APO05 Managed Portfolio, call for managing IT investments as a portfolio prioritised by business value and strategic contribution, directly tying IT spending to business goals. Option A is not marked correct because continuous monitoring of operational metrics is a performance/operations practice rather than a strategic alignment practice in COBIT 2019. Option B is not marked correct because, while steering committees are useful, COBIT 2019 does not prescribe monthly IT steering committee meetings as a recommended alignment practice. Option E is not marked correct because COBIT 2019 is methodology-agnostic and does not mandate agile for all IT projects as a means of strategic alignment.

Answer

Implementing a continuous monitoring system for IT operational metrics

Answer

Conducting monthly IT steering committee meetings to review project status

Answer

Using agile development methodologies for all IT projects

Question 17

An IS auditor is planning an audit of a decentralized organization with multiple business units. The auditor wants to use a risk-based approach. Which of the following is the MOST appropriate factor to prioritize audit coverage?

Accepted Answer

The results of a risk assessment evaluating inherent risk and control effectiveness.. A risk-based audit approach prioritizes coverage based on the likelihood and impact of risk, which is precisely what a risk assessment evaluating inherent risk and control effectiveness produces. Inherent risk reflects the susceptibility of a process or unit to error or fraud before controls, while control effectiveness indicates how much of that risk is mitigated. Combining these two factors lets the auditor direct limited audit resources to the areas of greatest residual risk, which is the defining principle of risk-based auditing.

Answer

The geographical location of each business unit.

Answer

The budget allocated to each business unit for IT.

Answer

The number of employees in each business unit.

Question 18

An organization processes personal data of EU residents and has implemented pseudonymisation as a privacy control. The IS auditor is reviewing the effectiveness of this control in meeting GDPR requirements. Which of the following is the MOST important limitation of pseudonymisation?

Accepted Answer

Pseudonymised data is still considered personal data under GDPR. Under GDPR Article 4(5), pseudonymisation is a technique where personal data can no longer be attributed to a specific data subject without additional information kept separately. However, because re-identification remains possible with that additional information, pseudonymised data is still legally considered personal data under GDPR, meaning data subject rights, breach notification, and other obligations continue to apply. This is the most important limitation an IS auditor must recognize when assessing the control's effectiveness.

Answer

Pseudonymisation eliminates the need for data subject rights

Answer

Pseudonymisation is not recognized by GDPR

Answer

Pseudonymisation cannot be applied to structured data

Question 19

What is the PRIMARY purpose of a post-implementation review?

Accepted Answer

To assess whether expected benefits were achieved. The primary purpose of a post-implementation review (PIR) is to determine whether the system or project has delivered the expected business benefits, such as improved efficiency, cost savings, or enhanced functionality. This aligns with the IS auditor's focus on value realization and governance, ensuring that the investment achieved its intended objectives before the project is formally closed.

Answer

To close the project budget and finalize costs

Answer

To evaluate the performance of the project team

Answer

To document lessons learned for future projects

Question 20

Which testing phase is MOST effective for validating that the system meets business needs?

Accepted Answer

User acceptance testing. User acceptance testing (UAT) is the final phase of testing where actual end-users validate the system against real-world business requirements and workflows. It confirms that the system meets the agreed-upon business needs, functional specifications, and operational criteria before production deployment. Unlike technical testing phases, UAT focuses on business process alignment and user satisfaction.

Answer

Regression testing

Answer

Unit testing

Answer

Integration testing