CISA Practice Exam 53 — 20 Questions

Question 1

Which THREE of the following are key performance indicators (KPIs) commonly used to measure IT performance? (Select THREE.)

Accepted Answer

System availability percentage. Common IT KPIs include system availability, help desk resolution time, and security incident count.

Answer

IT budget as percentage of revenue

Answer

Number of IT employees

Question 2

An IT balanced scorecard for a retail company shows that the percentage of IT projects delivered on time has decreased from 85% to 70%. Which perspective of the balanced scorecard is MOST directly affected?

Accepted Answer

Internal Process. The internal process perspective focuses on operational efficiency and project delivery metrics.

Answer

Learning and Growth

Answer

Financial

Answer

Customer

Question 3

Which policy hierarchy document provides detailed steps for performing a specific task, such as resetting a user password?

Accepted Answer

Work instruction. A work instruction is the most detailed document in the policy hierarchy, providing step-by-step guidance.

Answer

Guideline

Answer

Policy

Answer

Standard

Question 4

Which THREE of the following are components of the ITIL 4 service value system? (Select THREE)

Accepted Answer

Continual improvement. ITIL 4's service value system includes the service value chain, guiding principles, governance, practices, and continual improvement. The service value chain, guiding principles, and continual improvement are key components. Service level agreements are outputs, not components of the system. The four dimensions are part of the service value system but are not listed as components; they are dimensions. The question asks for three, and the correct ones are: service value chain, guiding principles, and continual improvement.

Answer

Four dimensions of service management

Answer

Service level agreements

Question 5

Which of the following is a key component of an IT balanced scorecard from the 'internal process' perspective?

Accepted Answer

System availability percentage. The internal process perspective focuses on operational efficiency and effectiveness, such as system availability.

Answer

Customer satisfaction score

Answer

Employee satisfaction

Answer

IT budget variance

Question 6

An IS auditor is reviewing an emergency change that was implemented to fix a critical security vulnerability. Which of the following post-implementation controls is MOST important to ensure the change was properly managed?

Accepted Answer

A post-implementation review was performed by the Change Advisory Board (CAB). Emergency changes bypass normal CAB approval, so it is critical to document the change and have it retrospectively reviewed by the CAB to ensure proper governance.

Answer

The change request included a rollback plan

Answer

The change was tested in a production-like environment before deployment

Answer

The change was documented and approved by the change manager after implementation

Question 7

An organization is deciding between developing a custom application and purchasing a commercial off-the-shelf (COTS) product. The project manager favors a COTS solution because it offers faster deployment. Which of the following is the MOST important consideration for the IS auditor to evaluate in this build vs. buy decision?

Accepted Answer

The degree of vendor dependency and ability to customize. Vendor dependency is a critical risk in COTS acquisitions. The organization may become reliant on the vendor for updates, support, and customizations, which can affect long-term flexibility and costs.

Answer

Availability of skilled developers to maintain the custom solution

Answer

User training requirements for the new system

Answer

Total cost of ownership including maintenance and licensing

Question 8

During an SDLC audit, the IS auditor finds that security requirements were not formally documented during the requirements phase. Which of the following is the BEST recommendation to mitigate the associated risk?

Accepted Answer

Include security requirements in the design phase and obtain sign-off. Security requirements should be defined early to ensure controls are designed in, not bolted on. The best practice is to include security requirements in the requirements phase and have them reviewed by security experts.

Answer

Perform a penetration test after go-live

Answer

Conduct a vulnerability scan after deployment to identify security gaps

Answer

Implement a firewall and intrusion detection system

Question 9

An organization outsources its data center operations to a third-party provider. Which of the following is the MOST important clause to include in the contract to ensure the organization can verify the provider's controls?

Accepted Answer

Right-to-audit clause. A right-to-audit clause allows the organization or its auditor to review the provider's controls.

Answer

Exit strategy

Answer

Service level agreement (SLA)

Answer

Vendor concentration risk clause

Question 10

An organization is deciding between building a custom application and purchasing a commercial off-the-shelf (COTS) product. The primary factor favoring the build option is:

Accepted Answer

Greater control over features. Building a custom application allows for tailored functionality that meets unique business requirements, which is a key advantage over COTS.

Answer

Faster time to market

Answer

Lower initial cost

Answer

Reduced vendor dependency

Question 11

Which of the following is a key control in the deployment phase of the SDLC?

Accepted Answer

Rollback plan. A rollback plan ensures that if deployment fails, the system can be restored to a known good state.

Answer

Threat modeling

Answer

User acceptance testing

Answer

Code review

Question 12

An organization is implementing a large ERP system. The project team plans to migrate legacy data to the new system. Which of the following is the MOST significant risk associated with data migration?

Accepted Answer

Inaccurate data mapping between legacy and new systems. Data migration often involves mapping old data to new structures. Inaccurate mapping can lead to data corruption or loss, which is a critical risk.

Answer

Insufficient training of end users

Answer

Lack of executive sponsorship

Answer

Inadequate segregation of duties in the new system

Question 13

During a post-implementation review of a new financial system, the IS auditor finds that user acceptance testing (UAT) was completed with only 60% of test cases passed. Which of the following is the MOST significant risk?

Accepted Answer

The system may not fully meet business requirements, leading to user workarounds. Low UAT pass rate indicates unresolved defects or unmet user requirements, leading to user dissatisfaction and potential workarounds that compromise controls.

Answer

The system deployment was delayed

Answer

The system performance is below expectations

Answer

The project was not completed within the planned budget

Question 14

An organization is implementing a new ERP system and is concerned about segregation of duties (SoD) conflicts. What is the BEST approach to address this during the implementation?

Accepted Answer

Configure role-based access controls with SoD rules in the system. Configuring SoD rules within the ERP system helps enforce segregation and prevent conflicts during operations.

Answer

Assign all administrative rights to a single user for efficiency

Answer

Rely on manual compensating controls after go-live

Answer

Document SoD conflicts for future resolution

Question 15

An IS auditor is reviewing a backup strategy that includes daily full backups and weekly offsite storage. The recovery time objective (RTO) for a critical application is 4 hours. Which of the following findings would be of GREATEST concern?

Accepted Answer

Backup tapes are stored offsite and retrieved only once per month. If the backup media are stored offsite without a local copy, the time to retrieve and restore may exceed the RTO.

Answer

Backup logs are reviewed weekly

Answer

Incremental backups are not performed between full backups

Answer

Backups are encrypted with AES-256

Question 16

An IS auditor is assessing an ERP implementation. Which of the following control concerns is MOST likely to arise from segregation of duties conflicts?

Accepted Answer

Unauthorized transactions or fraud. ERP systems often combine roles that were separate in legacy systems, increasing risk of fraud.

Answer

Data migration errors

Answer

Inadequate system performance

Answer

Integration complexity

Question 17

Which of the following is an example of a detective control in the SDLC testing phase?

Accepted Answer

Penetration testing. Dynamic application security testing (DAST) is a detective control that identifies vulnerabilities in a running application.

Answer

Security awareness training

Answer

Threat modeling

Answer

Code review

Question 18

Which of the following is the BEST control to ensure that user acceptance testing (UAT) is effective?

Accepted Answer

UAT testers are from the business and use realistic data. UAT should be performed by actual end users using real data to validate business requirements.

Answer

UAT scripts are written by developers

Answer

UAT is performed after deployment

Answer

UAT is conducted by the quality assurance team

Question 19

During which phase of the SDLC should security requirements be formally documented and approved by the business owner?

Accepted Answer

Requirements phase. Security requirements must be identified and approved early to ensure proper controls are built into the system. The requirements phase is the appropriate stage for this.

Answer

Design phase

Answer

Testing phase

Answer

Development phase

Question 20

Which type of change in ITIL requires approval from the Change Advisory Board (CAB) before implementation?

Accepted Answer

Normal change. Normal changes are those that are not pre-approved or emergency. They require assessment and approval by the CAB to evaluate risks and impacts.

Answer

Emergency change

Answer

Standard change

Answer

All changes