CISA Practice Exam 54 — 20 Questions

Question 1

An IS auditor is evaluating the vendor selection process for a new system. Which of the following is the most important factor to include in the contract?

Accepted Answer

Audit rights. Audit rights are critical for the organization to verify the vendor's controls and compliance, especially for outsourced systems.

Answer

Timeframe for delivery

Answer

Fixed price

Answer

Warranty period

Question 2

An organization has an availability requirement of 99.99% for its online transaction processing system. The system's MTBF is 720 hours. What is the maximum allowable MTTR to meet this requirement?

Accepted Answer

4.32 minutes. Availability = MTBF/(MTBF+MTTR). 0.9999 = 720/(720+MTTR) => MTTR = 720/0.9999 - 720 = 0.072 hours ≈ 4.32 minutes.

Answer

43.2 minutes

Answer

72 minutes

Answer

7.2 minutes

Question 3

Which TWO of the following are key considerations when managing software licenses in an organization? (Select TWO).

Accepted Answer

Implementing automated license optimization tools. Software Asset Management (SAM) ensures license compliance and cost optimization. Regular compliance audits prevent legal and financial penalties. License optimization helps avoid over-purchasing or under-licensing.

Answer

Storing all software installation media in a secure location

Answer

Maintaining a hardware inventory for asset tracking

Answer

Ensuring all software is patched to the latest version

Question 4

An organization uses a standard change model for low-risk, pre-approved changes. Which of the following is an example of a standard change?

Accepted Answer

Applying a routine security patch to the firewall. Standard changes are pre-approved, low-risk, and follow a defined procedure. Applying a routine security patch that has been tested and approved falls under this category.

Answer

Upgrading the core router to a new model

Answer

Changing the backup schedule from daily to weekly

Answer

Migrating the entire email system to the cloud

Question 5

During a business impact analysis (BIA), a department manager states that their process can be disrupted for up to 8 hours, but data loss cannot exceed 15 minutes. Which two metrics are defined by these statements?

Accepted Answer

Recovery time objective (RTO) and recovery point objective (RPO). The maximum downtime is the recovery time objective (RTO), and the maximum data loss is the recovery point objective (RPO).

Answer

Mean time to repair (MTTR) and mean time between failures (MTBF)

Answer

Service level objective (SLO) and service level agreement (SLA)

Answer

Maximum tolerable downtime (MTD) and working recovery time (WRT)

Question 6

An IS auditor is evaluating the capacity management process. The auditor notices that CPU utilization has been consistently above 90% for the past three months. The IT manager states that no proactive capacity planning has been performed. What is the primary risk?

Accepted Answer

Potential service degradation or unplanned outages.. Consistently high utilization without planning risks performance degradation and outages. The organization may not be able to handle peak loads.

Answer

Increased licensing costs for software.

Answer

Inability to meet backup windows.

Answer

Increased energy costs for cooling.

Question 7

In ITIL incident management, which severity level typically indicates a critical incident that severely impacts business operations and requires immediate resolution?

Accepted Answer

P1. P1 (Priority 1) incidents are the highest severity, requiring immediate attention.

Answer

P2

Answer

P3

Answer

P4

Question 8

Which of the following is the BEST indicator of the effectiveness of a security awareness program?

Accepted Answer

Reduction in the number of successful phishing attacks.. A decrease in successful phishing attacks demonstrates behavioral change.

Answer

Positive feedback from employees about the training.

Answer

Number of employees who completed the training.

Answer

Average test scores on post-training assessments.

Question 9

An organization is implementing a public key infrastructure (PKI) to issue digital certificates for internal applications. Which THREE of the following are essential elements of PKI governance that an IS auditor should review?

Accepted Answer

Certificate lifecycle management procedures (issuance, renewal, revocation).. PKI governance includes CA policies, certificate lifecycle management, and revocation mechanisms.

Answer

Key length and algorithm specifications.

Answer

Number of certificates issued per month.

Question 10

An organization has implemented a security awareness training program. Which of the following metrics would BEST indicate that the program is effective?

Accepted Answer

Reduction in the number of successful phishing attacks. A reduced number of successful phishing attacks indicates that employees are applying the training to recognize and avoid threats. The other metrics are useful but less direct indicators of behavioral change.

Answer

Percentage of employees who completed the training

Answer

Average score on post-training quiz

Answer

Number of reported phishing emails

Question 11

An organization has implemented a clean desk policy. Which of the following is the BEST audit procedure to verify compliance?

Accepted Answer

Conducting unannounced inspections of workstations. Surprise walkthroughs provide a realistic view of daily compliance, unlike scheduled inspections.

Answer

Reviewing security camera footage of office areas

Answer

Reviewing the policy document and employee acknowledgments

Answer

Interviewing employees about the policy

Question 12

An IS auditor is reviewing the physical access controls at a data center. Which TWO of the following are the MOST effective controls to prevent unauthorized tailgating?

Accepted Answer

Mantrap with interlocking doors.. Mantraps and turnstiles are designed to prevent tailgating by allowing only one person per entry.

Answer

CCTV cameras at entry points.

Answer

Security guards checking badges.

Answer

Biometric authentication.

Question 13

An IS auditor is reviewing the logical access controls for a critical database. Which of the following findings should be considered the HIGHEST risk?

Accepted Answer

The default 'sa' account is enabled with the default password.. Default passwords are a well-known vulnerability that can be easily exploited.

Answer

Database administrators share a common user ID for maintenance tasks.

Answer

Access rights are reviewed on an annual basis.

Answer

The database has not undergone a vulnerability scan in six months.

Question 14

An organization has a clean desk policy. Which of the following is the BEST audit procedure to test compliance with this policy?

Accepted Answer

Conduct unannounced walkthroughs of work areas.. Direct observation provides the most reliable evidence of compliance.

Answer

Interview employees about their understanding of the policy.

Answer

Review security awareness training records.

Answer

Review incident reports related to lost documents.

Question 15

An IS auditor is assessing audit risk for a payroll system. The inherent risk is assessed as moderate, control risk as high due to weak segregation of duties, and detection risk is set at low because of extensive substantive testing. What is the impact on overall audit risk?

Accepted Answer

Moderate to high. Audit risk = inherent risk × control risk × detection risk. With high control risk and low detection risk, audit risk is moderate to high.

Answer

Cannot be determined without more information

Answer

Low because detection risk is low

Answer

Very low because all risks are low

Question 16

An organization has a policy that requires all employees to undergo annual security awareness training. This is an example of which type of document in the policy hierarchy?

Accepted Answer

Standard. The requirement that all employees undergo annual security awareness training is a mandatory directive. In the policy hierarchy, a policy is a high-level statement, while standards translate policies into specific mandatory requirements. This requirement is not a step-by-step procedure but a compulsory condition, making it a standard.

Answer

Work instruction

Answer

Guideline

Answer

Procedure

Question 17

An organization's business continuity plan (BCP) includes alternate facilities that can be operational within 24 hours. The maximum tolerable downtime (MTD) for a critical process is 12 hours. What is the most significant gap?

Accepted Answer

The alternate facility cannot be activated within the required MTD.. The alternate facility recovery time (24 hours) exceeds the MTD (12 hours), meaning the process would fail its recovery requirement.

Answer

The BCP does not include customer communication procedures.

Answer

The BCP does not address data backup procedures.

Answer

The recovery time objective (RTO) for the process is not defined.

Question 18

Which of the following best describes audit risk in the context of an IS audit?

Accepted Answer

Risk that the auditor will issue an incorrect opinion.. Audit risk is defined as the risk that the auditor will issue an incorrect opinion (option C). Option B represents the audit risk model (Inherent risk × Control risk × Detection risk), which is a formula for assessing audit risk, not the definition itself. Therefore, C is the best description.

Answer

Risk that a material misstatement exists.

Answer

Inherent risk × Control risk × Detection risk

Answer

Risk that controls will not prevent or detect errors.

Question 19

A multinational corporation is implementing a new enterprise resource planning (ERP) system across multiple regions. The project uses a phased roll-out. After the first phase in Asia, the system experiences intermittent synchronization errors between the central database and regional servers. The IT team suspects network latency but cannot reproduce the issue consistently. The project sponsor wants to proceed with the next phase in Europe to avoid further delays. The IS auditor is performing a post-implementation review. What is the MOST appropriate recommendation?

Accepted Answer

Conduct a thorough root cause analysis of the synchronization issue before any further roll-out.. The intermittent synchronization errors indicate a potential data integrity or consistency issue that must be fully understood before expanding the system's footprint. Proceeding without root cause analysis risks propagating the defect to the European phase, which could lead to widespread data corruption, increased remediation costs, and regulatory non-compliance. A thorough root cause analysis (e.g., examining network latency, transaction log replication, or database conflict resolution) is essential to ensure the ERP's distributed architecture is reliable.

Answer

Proceed with the European roll-out and monitor for similar issues.

Answer

Switch to a different ERP vendor that offers better cloud capabilities.

Answer

Document the synchronization error as a known issue and accept the operational risk.

Question 20

A small business wants to protect customer data collected through its e-commerce website. Which control is most appropriate for protecting the data at rest and in transit?

Accepted Answer

Use encryption for data at rest and in transit.. Encryption is the only control that directly protects the confidentiality and integrity of data both at rest (e.g., AES-256 for database files) and in transit (e.g., TLS 1.3 for HTTPS). It renders data unreadable without the proper decryption key, ensuring that even if storage media or network traffic is intercepted, the customer data remains secure.

Answer

Implement a network firewall to block unauthorized access.

Answer

Perform regular backups of the database to ensure data availability.

Answer

Deploy an intrusion detection system (IDS) to monitor for threats.