CISA Practice Exam 53 — 20 Questions

Question 1

An organization is implementing a new financial system. Which of the following is the MOST important control to ensure data integrity during the data migration phase?

Accepted Answer

Implementing reconciliation controls between source and target. Reconciliation controls between source and target systems are the most critical control for ensuring data integrity during migration because they provide a systematic method to verify that every record has been accurately transferred without loss, duplication, or corruption. This typically involves comparing record counts, hash totals, or checksums (e.g., using MD5 or SHA-256) between the legacy and new databases, and flagging any discrepancies for correction before the system goes live.

Answer

Conducting a post-implementation review

Answer

Encrypting data in transit

Answer

Performing user acceptance testing

Question 2

Refer to the exhibit. An auditor finds that users are able to reuse previous passwords easily. Which setting should be modified to address this weakness?

Accepted Answer

Increase the password history to 10. Increasing the password history setting (e.g., to 10) prevents users from reusing their most recent passwords by storing a specified number of previous password hashes. When a user attempts to change their password, the system compares the new password against the stored history and rejects it if it matches any of the remembered passwords. This directly addresses the weakness of easy password reuse.

Answer

Increase the minimum password age to 7 days

Answer

Enable password expiration notifications

Answer

Increase the maximum password age to 30 days

Question 3

An IS auditor is reviewing the incident response (IR) process. Which of the following is the BEST way to test the effectiveness of the IR plan?

Accepted Answer

Conducting a tabletop exercise. A tabletop exercise is the best way to test the effectiveness of an incident response plan because it simulates a realistic incident scenario and requires the IR team to walk through their roles, decisions, and communications in a facilitated discussion. This reveals gaps in the plan, unclear responsibilities, and coordination breakdowns without the risk or cost of a live simulation. It directly tests whether the plan works in practice, not just whether it exists on paper.

Answer

Checking the availability of forensic tools

Answer

Interviewing the IR team

Answer

Reviewing IR policies and procedures

Question 4

An IS auditor is reviewing the backup process for a critical database. Which TWO of the following are essential controls to ensure data recoverability?

Accepted Answer

Offsite storage of backup media.. Option B (offsite storage of backup media) is essential because it ensures that a viable copy of the data survives a site-level disaster such as fire, flood, or theft that destroys the primary data center, which is a core requirement for recoverability. Option C (regular restore testing of backups) is essential because backups are only proven recoverable when restores are actually performed and validated; untested backups may fail due to media errors, corrupted files, or incomplete jobs, so periodic restore drills confirm the recovery capability and RTO/RPO assumptions. Option A (automated job scheduling) improves reliability and consistency but is a convenience/efficiency control, not a guarantee of recoverability, since scheduled jobs can still fail silently. Option D (encryption of backup data) is a confidentiality control that protects data at rest or in transit but does nothing to ensure the data can be restored. Option E (a one-year retention period) is an arbitrary retention choice driven by business, legal, and regulatory requirements rather than a universal essential control for recoverability.

Answer

Automated job scheduling for backups.

Answer

Encryption of backup data.

Answer

Backup retention period of at least one year.

Question 5

Which testing type is performed by end-users to verify that the system meets their needs?

Accepted Answer

User acceptance testing. User acceptance testing (UAT) is the final phase of the testing lifecycle where actual end-users validate that the system fulfills their business requirements and is ready for production deployment. Unlike technical testing types, UAT focuses on real-world workflows, data accuracy, and usability to confirm the system meets the agreed-upon acceptance criteria.

Answer

Security testing

Answer

Integration testing

Answer

Unit testing

Question 6

An IS auditor is reviewing a change management process. Which TWO elements should be documented in a normal change request to ensure adequate governance? (Select TWO)

Accepted Answer

Test plan. A test plan (A) is correct because a normal change request must document how the change will be verified before implementation, including test cases, expected results, and acceptance criteria, which provides evidence that the change was validated and supports governance over change risk. A rollback plan (D) is correct because it defines the documented steps, triggers, and responsible parties for reverting the change if it fails or causes an incident, ensuring business continuity and recoverability are addressed before approval. Vendor contact information (B) is not a required element of a standard change request; it is only relevant for vendor-supported changes and is not part of the governance documentation for every change. The change requester's name (C) is typically captured as basic identification metadata, but it does not by itself ensure adequate governance of the change's risk and validation. Project budget remaining (E) relates to financial tracking and is not a required component of a change request's governance documentation.

Answer

Vendor contact information

Answer

Change requester's name

Answer

Project budget remaining

Question 7

A mid-sized company is implementing a new IT service management (ITSM) tool to improve incident management. The IT manager wants to ensure that the tool aligns with ITIL best practices. The company has a dedicated service desk team that handles about 200 incidents per week. The IT manager is considering whether to implement a self-service portal for users to submit incidents and check status, or to continue using email-based incident reporting. The service desk team is concerned that a self-service portal might reduce their direct interaction with users and potentially lead to less personalized support. However, the IT manager believes that a portal could improve efficiency and tracking. The company's IT governance framework requires that any major IT investment be approved by the steering committee and that there be a clear business case. The IT manager has prepared a business case but the steering committee wants to ensure that the solution is aligned with ITIL and that it addresses key incident management processes. Which of the following is the most appropriate next step for the IT manager?

Accepted Answer

Conduct a process review with stakeholders to define requirements based on ITIL guidelines before selecting a tool.. ITIL best practices emphasize that process design should precede tool selection. Conducting a process review with stakeholders ensures the self-service portal aligns with defined incident management workflows, such as categorization, prioritization, and escalation, before committing to a specific tool. This step also satisfies the IT governance requirement for a clear business case by validating requirements against ITIL guidelines.

Answer

Implement the self-service portal immediately to improve efficiency, then present the business case later.

Answer

Proceed with the self-service portal without further review because it is clearly beneficial.

Answer

Abandon the self-service portal idea and continue with email-based reporting.

Question 8

An IS auditor is reviewing the implementation of a new payroll system that was developed in-house. The project team followed a traditional waterfall SDLC. During the post-implementation review, the auditor found that the system was delivered on time and within budget, but several critical payroll calculations were incorrect, leading to employee underpayments. The root cause was traced to a misunderstanding of tax law changes that occurred during the requirements phase. Which of the following is the MOST likely control weakness that contributed to this issue?

Accepted Answer

Insufficient involvement of tax experts and business stakeholders in requirements definition and validation.. The payroll errors stemmed from a misunderstanding of tax law changes during requirements. The most likely control weakness is insufficient involvement of tax experts and business stakeholders in defining and validating requirements. Their participation ensures that requirements are accurate and complete. While UAT, change management, and segregation of duties are important, they do not directly prevent requirements misunderstandings. Thus, the correct answer is the lack of expert involvement in requirements.

Answer

Inadequate segregation of duties between developers and testers, allowing developers to test their own code.

Answer

Inadequate user acceptance testing (UAT) that did not include valid tax scenarios.

Answer

Lack of a formal change management process to handle tax law updates during development.

Question 9

A retail organization's board has approved an IT governance framework that delegates decision rights for infrastructure standards to a central architecture board, while reserving funding decisions above a threshold for the board's technology committee. Business units must comply with the standards but may request exceptions. Which of the following is the MOST important control for the IS auditor to verify when assessing the effectiveness of this framework?

Accepted Answer

Exception requests are documented, time-bound, and approved at a level commensurate with the risk of noncompliance.. Governance frameworks allocate decision rights, but their effectiveness is determined by how deviations are handled. Because business units can request exceptions to architecture standards, the exception process is where delegated authority is either preserved or eroded. Documented, time-bound exceptions approved at a risk-commensurate level preserve the architecture board's authority while allowing justified flexibility. Meeting cadence, satisfaction surveys, and budget review do not test whether standards are actually binding.

Answer

The architecture board meets at least quarterly and maintains minutes of its deliberations.

Answer

The board's technology committee reviews the IT capital budget at each scheduled meeting.

Answer

Business units are surveyed annually on their satisfaction with the standards and the exception process.

Question 10

An organization's IT department has recently implemented a new project management methodology. The IS auditor is reviewing the project portfolio and finds that projects are prioritized based on the personal preferences of the IT director rather than strategic alignment. Which of the following is the MOST significant risk arising from this practice?

Accepted Answer

Projects may not align with business strategy, leading to wasted resources and missed opportunities.. When IT projects are prioritized based on personal preferences instead of strategic alignment, the organization risks investing in initiatives that do not support its business goals. This can lead to wasted resources, missed market opportunities, and a failure to achieve expected benefits. The most significant risk is the misalignment between IT and business strategy, which directly impacts the organization's ability to create value and remain competitive.

Answer

The IT director may become overburdened with decision-making, causing project delays.

Answer

The organization may fail to comply with regulatory requirements for project documentation.

Answer

Project managers may lack clear direction, resulting in scope creep and budget overruns.

Question 11

An IS auditor is conducting an audit of a hospital's electronic health record system. During fieldwork, the auditor discovers that several database administrators have the ability to modify patient records directly in the production database without leaving an audit trail. The auditor wants to gather sufficient appropriate evidence to determine whether this is a widespread issue. Which of the following is the MOST appropriate action?

Accepted Answer

Use audit software to examine database user access rights and review system logs for evidence of direct modifications.. The auditor needs evidence about the actual access rights and logging behavior across all database administrators. Using audit software to examine user rights and review logs directly tests the control environment and provides reliable, population-wide evidence. Inquiry and inspection of documents are indirect and cannot confirm the technical capability or the absence of audit trails, while a single observation lacks coverage.

Answer

Review the database administrators' job descriptions to determine if their roles include direct data modification responsibilities.

Answer

Interview the IT manager to confirm whether the database administrators have been authorized to modify records directly.

Answer

Observe a database administrator performing a routine update to confirm whether an audit trail is generated.

Question 12

An IS auditor is reviewing the backup and restoration controls for a hospital's electronic health record (EHR) system, which runs on a relational database with a recovery point objective (RPO) of 15 minutes. The database administrator performs a full backup every Sunday at 01:00, differential backups nightly at 01:00, and transaction log backups every 15 minutes. During testing, the auditor observes that a restore of the database to a point in time at 14:07 on Wednesday completed successfully but took 9 hours, exceeding the stated maximum tolerable downtime (MTD) of 4 hours. Which TWO conclusions should the auditor draw from this observation? (Choose two.)

Accepted Answer

The recovery process should be re-engineered or supplemented so that restoration can be completed within the MTD.. The backup frequency meets the RPO, but the restore duration violates the MTD, revealing a gap between backup adequacy and actual recoverability. The auditor must recognize that a successful restore is not sufficient if it cannot be completed within the business tolerance. The appropriate conclusions are that the RPO is satisfied and that the recovery process must be improved to meet the MTD.

Answer

The transaction log backups should be replaced with hourly full backups to reduce the total restore time.

Answer

The differential backup strategy is the root cause of the lengthy restore because differential backups must be applied in sequence.

Answer

The restore should be considered a failure of the backup integrity controls because the elapsed time exceeded the MTD.

Question 13

During a business impact analysis (BIA), a department manager states that their process can be disrupted for up to 8 hours, but data loss cannot exceed 15 minutes. Which two metrics are defined by these statements?

Accepted Answer

Recovery time objective (RTO) and recovery point objective (RPO). The maximum downtime is the recovery time objective (RTO), and the maximum data loss is the recovery point objective (RPO).

Answer

Mean time to repair (MTTR) and mean time between failures (MTBF)

Answer

Service level objective (SLO) and service level agreement (SLA)

Answer

Maximum tolerable downtime (MTD) and working recovery time (WRT)

Question 14

Which of the following is the PRIMARY purpose of conducting a privacy impact assessment (PIA)?

Accepted Answer

To identify privacy risks and recommend mitigations. The PRIMARY purpose of a Privacy Impact Assessment (PIA) is to systematically identify and assess privacy risks associated with a project, system, or process, and to recommend mitigation measures. It is a proactive risk management tool that helps organizations understand how personal information is collected, used, shared, and retained, and to address potential privacy harms before they occur. While compliance with laws and documenting processing activities are outcomes or components, the core objective is risk identification and mitigation.

Answer

To document the data processing activities

Answer

To obtain consent from data subjects

Answer

To ensure compliance with data protection laws

Question 15

An IS auditor is reviewing the ITIL incident management process. Which THREE are the correct priority levels and their typical definitions?

Accepted Answer

P1: Critical impact, immediate response required.. Option A is correct because P1 is the highest priority level in ITIL incident management, reserved for critical impact incidents (e.g., major outages affecting the whole organization) that demand immediate response and often major incident procedures. Option D is correct because P2 represents high-impact incidents requiring an urgent response, typically affecting a significant user group or critical business function but not as catastrophically as P1. Option E is correct because P3 denotes moderate impact incidents handled with a standard response time under normal service desk workflows. Option B is incorrect because P4 is the lowest priority (low impact, minor issue), not a critical-impact level requiring senior management escalation. Option C is incorrect because P2 is not defined as low impact resolved within normal service hours; that description better fits P4 or P3, whereas P2 requires urgent attention.

Answer

P4: Critical impact, requires escalation to senior management.

Answer

P2: Low impact, can be resolved within normal service hours.

Question 16

An IS auditor is reviewing the physical access controls at a data center. Which TWO of the following are the MOST effective controls to prevent unauthorized tailgating?

Accepted Answer

Mantrap with interlocking doors.. Option C, a mantrap with interlocking doors, is correct because it creates a controlled vestibule where the first door must close and the person must be authenticated before the second door opens, physically preventing a second individual from following through. Option D, turnstiles that allow only one person per authentication, is correct because the physical barrier permits exactly one authenticated entry at a time, so a tailgater cannot pass without their own valid credential. Option A, CCTV cameras, is only a detective control that records events after the fact and does not stop tailgating. Option B, security guards checking badges, is a deterrent and detective measure but is subject to human error, distraction, and social-engineering bypass. Option E, biometric authentication, verifies the identity of the person authenticating but does not by itself prevent a second person from walking through the opened door behind them.

Answer

CCTV cameras at entry points.

Answer

Security guards checking badges.

Answer

Biometric authentication.

Question 17

An IS auditor is reviewing the physical security controls for a data center. The auditor observes that the data center has a raised floor, a fire suppression system, and biometric access controls. The auditor also notes that the data center is located in a region prone to flooding. Which of the following controls is MOST important to mitigate the risk of flooding?

Accepted Answer

Elevating the data center floor above the expected flood level.. Elevating the data center floor above the expected flood level is the most important control because it prevents floodwater from reaching critical equipment. It is a preventive measure that directly addresses the flood risk, whereas other options like sensors or pumps are detective or mitigating. In flood-prone areas, physical elevation is a fundamental design consideration for data center resilience.

Answer

A sump pump system in the basement.

Answer

Water detection sensors under the raised floor.

Answer

A fire suppression system that also removes water.

Question 18

An IS auditor is examining how a financial services firm enforces data loss prevention (DLP) for outbound email. The firm uses a network DLP appliance that inspects SMTP traffic and blocks messages containing unencrypted account numbers. The auditor discovers that employees can bypass the appliance by using a personal webmail account over HTTPS. Which of the following should the auditor recommend FIRST?

Accepted Answer

Block access to personal webmail and other unauthorized exfiltration channels at the web gateway, then extend DLP coverage to those channels.. The DLP appliance only inspects SMTP, so employees who use personal webmail over HTTPS bypass it entirely. The most effective first step is to block unauthorized exfiltration channels at the web gateway and extend DLP coverage so the control cannot be trivially circumvented. Closing the unmonitored path addresses the root cause, whereas tuning detection patterns or relying on policy alone leaves the bypass intact.

Answer

Require employees to sign an acceptable use policy acknowledging that personal webmail use is prohibited.

Answer

Increase the sensitivity of the DLP appliance's pattern matching so it detects account numbers in more formats.

Answer

Deploy TLS inspection at the perimeter so the DLP appliance can examine HTTPS sessions to webmail providers.

Question 19

An IS auditor is examining how a data center protects its backup tapes while they are transported to an offsite vault. Management states that tapes are encrypted at rest using AES-256. Which of the following is the MOST important control the auditor should verify to protect the tapes during transit?

Accepted Answer

A chain-of-custody log with tamper-evident seals and dual custody is maintained for each shipment.. Because transport places media outside the controlled data center, the auditor should focus on physical custody controls. A documented chain of custody with tamper-evident seals and dual custody provides accountability and detects unauthorized access or substitution. Encryption protects confidentiality of data on the tape, but it does not prevent loss of the media or a denial of recovery capability, so custody controls are the most important complement.

Answer

The offsite vault maintains a temperature and humidity-controlled environment.

Answer

The encryption keys are stored in a hardware security module (HSM) at the primary data center.

Answer

Backup jobs are scheduled outside business hours to reduce contention with production systems.

Question 20

An IS auditor is reviewing an organization's data loss prevention (DLP) strategy. The organization has implemented a network DLP solution but has not yet deployed endpoint DLP. Which TWO of the following are the MOST significant risks of relying solely on network DLP? (Choose two.)

Accepted Answer

Data copied to removable media such as USB drives may not be detected.. The two most significant risks of relying solely on network DLP are that data copied to removable media may not be detected and that encrypted data traversing the network may not be inspected. Network DLP monitors data in motion across network boundaries but lacks visibility into endpoint actions like USB copying and often cannot decrypt traffic without interception. Endpoint DLP complements network DLP by monitoring data at the endpoint, closing these gaps.

Answer

Network DLP does not provide visibility into data stored on file servers.

Answer

Network DLP cannot prevent data leakage via email attachments.

Answer

Network DLP cannot monitor traffic between internal network segments.