CISA Practice Exam 55 — 20 Questions

Question 1

During the user acceptance testing (UAT) phase of a new financial application, the business users report that the system calculates interest incorrectly for certain loan types. The project manager wants to fix this quickly. Which of the following is the BEST course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Log the defect and perform impact analysis before approving a fix. In the UAT phase, any defect must be formally logged and subjected to impact analysis before a fix is approved. This ensures that the proposed change does not introduce new risks, break other functionality, or violate regulatory compliance—critical for a financial application handling interest calculations. Skipping this process could lead to cascading failures or audit findings.

Answer

Instruct the business to work around the issue until the next release

Answer

Authorize the development team to fix the bug immediately and re-deploy

Answer

Roll back to the previous version of the application

Question 2

Which of the following is the PRIMARY purpose of a service desk?

Accepted Answer

To provide a single point of contact for incidents and service requests. The service desk acts as a single point of contact for IT support.

Answer

To monitor network performance

Answer

To manage IT assets

Answer

To perform root cause analysis

Question 3

An IS auditor is assessing the risk of material misstatement in a financial system. The auditor determines that inherent risk is high, control risk is moderate, and detection risk is low. What is the overall audit risk?

Accepted Answer

Low. Audit risk is determined by inherent risk, control risk, and detection risk. The standard audit risk model is: Audit Risk = Inherent Risk × Control Risk × Detection Risk. With inherent risk high, control risk moderate, and detection risk low, the product is low (e.g., High × Moderate × Low = Low). This indicates a low overall audit risk because the auditor plans to perform sufficient substantive procedures to compensate for the high inherent and moderate control risks.

Answer

Moderate

Answer

High

Answer

Cannot be determined

Question 4

Which of the following is the PRIMARY purpose of a change advisory board (CAB) in the change management process?

Accepted Answer

To assess, prioritize, and authorize changes. The CAB is responsible for reviewing and approving changes, assessing risks, and ensuring proper planning and testing.

Answer

To approve all standard changes without review

Answer

To authorize emergency changes immediately

Answer

To develop technical solutions for change requests

Question 5

An organization is disposing of old servers. The IS auditor reviews the asset disposition process and finds that hard drives are being erased using a standard format command. What is the auditor's primary concern?

Accepted Answer

The data on the hard drives may still be recoverable.. Standard format commands do not securely erase data; data can still be recovered. Secure sanitization methods (e.g., degaussing, shredding) should be used.

Answer

The drives are not being tested for functionality.

Answer

The software licenses are not being transferred.

Answer

The servers are not being recycled for environmental compliance.

Question 6

During a disaster recovery test, the recovery time objective (RTO) for a critical application was not met. Which of the following is the MOST likely cause?

Accepted Answer

The standby server had insufficient storage capacity. Insufficient storage on the standby server delays data restoration, directly impacting RTO. Other options are good practices that would not cause failure.

Answer

The backup media was stored offsite

Answer

The network connectivity was tested beforehand

Answer

The recovery procedures were documented

Question 7

Which THREE of the following are common techniques for ensuring business resilience?

Accepted Answer

Insurance policies. Correct answers are A, B, and D: redundant hardware, regular data backups, and insurance policies. C and E are not resilience techniques; C is a risk analysis step, E is training which is supportive but not a core resilience technique.

Answer

Annual employee training

Answer

Single point of failure analysis

Question 8

A multinational corporation is designing its disaster recovery strategy to meet a recovery point objective (RPO) of 15 minutes for its critical database. Which replication method is MOST appropriate?

Accepted Answer

Synchronous replication with write-back caching. Synchronous replication with write-back caching provides near-zero data loss while managing performance impact. Asynchronous replication may have higher latency, daily backups exceed RPO, and hourly snapshots are insufficient.

Answer

Asynchronous replication over WAN

Answer

Daily incremental backups to tape

Answer

Periodic snapshot every hour

Question 9

An organization is implementing a business continuity plan (BCP) and needs to determine the maximum acceptable downtime for a critical system. Which metric should be defined FIRST?

Accepted Answer

Recovery Time Objective (RTO). RTO defines the maximum acceptable downtime; it is the foundational metric for recovery planning. RPO, MTTR, and SLA are defined later or are contractual.

Answer

Mean Time to Repair (MTTR)

Answer

Recovery Point Objective (RPO)

Answer

Service Level Agreement (SLA)

Question 10

Which TWO of the following are key components of an effective information security awareness program?

Accepted Answer

Mandatory training for all employees. Mandatory training for all employees ensures that every user understands their security responsibilities, recognizes threats like phishing, and follows organizational policies. This is a foundational element of an awareness program as defined by frameworks such as NIST SP 800-50, which emphasizes that awareness and training must be tailored to roles and delivered to all personnel. Without mandatory participation, coverage gaps leave the organization vulnerable to social engineering and policy violations.

Answer

Periodic review of security logs

Answer

Annual password change policy

Answer

Regular vulnerability scans

Question 11

Which of the following is a key principle of corporate governance of IT according to ISO/IEC 38500?

Accepted Answer

Responsibility. ISO/IEC 38500 defines six key principles for the corporate governance of IT: Responsibility, Strategy, Acquisition, Performance, Conformance, and Human Behaviour. The 'Responsibility' principle mandates that individuals and groups within the organization understand and accept their responsibilities for the supply of, and demand for, IT. This is the foundational governance principle because it establishes clear accountability, which is necessary for all other governance activities to function effectively.

Answer

Progress iteratively

Answer

Optimize and automate

Answer

Focus on value

Question 12

During an audit of a financial application, the IS auditor discovers that user access reviews are performed quarterly instead of monthly as required by policy. Which of the following is the BEST initial action for the auditor?

Accepted Answer

Determine if compensating controls mitigate the risk of less frequent reviews. The IS auditor's primary role is to assess risk, not to enforce policy blindly. Quarterly reviews may still be acceptable if compensating controls (e.g., automated provisioning/deprovisioning, real-time monitoring, or role-based access controls) effectively reduce the risk of unauthorized access between reviews. Determining the presence and effectiveness of such controls is the best initial action before deciding whether to report noncompliance.

Answer

Recommend that the policy be changed to allow quarterly reviews

Answer

Report the noncompliance with the policy as a finding immediately

Answer

Escalate the issue to senior management for immediate resolution

Question 13

A university is implementing a new student information system. The project team uses an iterative development approach. During user acceptance testing, students report that the online course registration portal crashes when more than 100 users register simultaneously. The development team identifies a database connection pooling issue and estimates a fix will take three weeks. The project deadline is in two weeks. The project manager suggests deploying the system as is and fixing the issue after go-live, as the crash is rare. The IS auditor is consulted. What should the auditor recommend?

Accepted Answer

Delay the go-live until the defect is fixed and user acceptance testing is passed.. Deploying a system with a known critical defect that fails under expected load conditions violates the principle of delivering a reliable and secure system. The database connection pooling issue causes the portal to crash under concurrent user load, which is a functional failure that directly impacts business operations. Delaying go-live ensures the defect is fixed and user acceptance testing (UAT) is fully passed, aligning with the IS auditor's responsibility to recommend risk mitigation over acceptance of a preventable failure.

Answer

Document the risk and proceed with the go-live, planning to fix later.

Answer

Deploy on time but restrict registration to fewer than 100 students per session.

Answer

Implement a temporary increase in server capacity to handle the load.

Question 14

An organization's IT strategy must be aligned with business strategy. Which of the following is the PRIMARY benefit of this alignment?

Accepted Answer

Increased value of IT investments to business objectives. When IT strategy is aligned with business strategy, every IT investment is directly tied to achieving specific business objectives, such as increasing revenue, improving customer experience, or enabling new business models. This alignment ensures that resources are allocated to projects that deliver measurable business value, rather than being spent on technology for its own sake. The primary benefit is therefore the increased value of IT investments to business objectives, as misalignment often leads to wasted expenditure on systems that do not support core business goals.

Answer

Faster adoption of new technologies

Answer

Enhanced security posture

Answer

Reduced IT operational costs

Question 15

Which THREE of the following are key elements that should be included in a risk assessment report for information systems?

Accepted Answer

Identification of critical assets and their vulnerabilities. A is correct because a risk assessment report must identify critical assets and their vulnerabilities to establish the scope and basis for risk analysis. Without this, the report cannot prioritize which systems require immediate attention or justify subsequent control recommendations.

Answer

List of all vendors and their contract terms

Answer

Detailed budget for implementing security controls

Question 16

Which TWO of the following are common risks in the procurement of custom-developed software?

Accepted Answer

Lack of documentation. Lack of documentation (C) is a common risk in custom-developed software because without comprehensive technical and user documentation, the organization faces challenges in maintenance, troubleshooting, and knowledge transfer. This risk is especially acute when the original developers leave, leaving the system opaque and difficult to support. Proper documentation is essential for ongoing operations, audits, and future enhancements.

Answer

Poor user acceptance

Answer

Excessive customization

Answer

Inadequate service level agreements

Question 17

An IS auditor is reviewing capacity management practices. Which TWO indicators suggest that proactive capacity management is being performed effectively?

Accepted Answer

Monitoring resource utilization trends over time.. Effective proactive capacity management includes monitoring trends to forecast future needs and setting threshold alerts to trigger action before capacity issues occur. Analyzing historical costs is financial, not capacity; reviewing backup logs is operational; conducting BIA is for BCP.

Answer

Conducting business impact analysis (BIA) annually.

Answer

Reviewing backup logs for errors.

Answer

Analyzing historical cost data for IT infrastructure.

Question 18

An organization has implemented a business continuity plan (BCP) and disaster recovery plan (DRP). During a recent full interruption test, the IT team discovered that the recovery time objective (RTO) for a critical application was not met. What is the MOST likely reason for this failure?

Accepted Answer

The alternate site did not have adequate processing capacity to handle the workload.. The most likely reason the RTO was not met is that the alternate site lacked sufficient processing capacity to handle the workload. RTO measures the time to restore service availability; if the failover site cannot support the required compute, memory, or I/O throughput, restoration will be delayed or fail outright. This is a common capacity planning failure in DR testing, where the alternate site is sized for minimal operations but not for the full production load.

Answer

The recovery point objective (RPO) was set too low, causing data loss.

Answer

The backup data was not encrypted, leading to corruption during restoration.

Answer

The tabletop exercise was not conducted before the full interruption test.

Question 19

After a security incident, an organization discovers that an employee accessed sensitive files without authorization. Which of the following is the most effective preventive control to reduce the risk of such unauthorized access?

Accepted Answer

Conducting regular access reviews and recertification.. Regular access reviews and recertification (Option C) are the most effective preventive control because they ensure that user permissions are periodically validated against current job roles and business needs. By systematically revoking excessive or outdated entitlements, this process directly reduces the attack surface for unauthorized access, addressing the root cause of privilege creep rather than merely detecting or deterring misuse.

Answer

Deploying a data loss prevention (DLP) solution.

Answer

Implementing background checks on all employees.

Answer

Enforcing strong password policies.

Question 20

An organization is implementing a new cloud-based HR system. The project sponsor wants to skip regular project status meetings to speed up delivery. Which THREE of the following are the MOST significant risks of eliminating these meetings?

Accepted Answer

Stakeholders may be unaware of critical project issues.. Eliminating regular project status meetings removes a key communication channel for escalating critical project issues to stakeholders. Without these meetings, stakeholders may not receive timely updates on security vulnerabilities, integration failures, or compliance gaps in the cloud-based HR system, leading to delayed remediation and potential data breaches.

Answer

Security requirements may be overlooked.

Answer

Budget overruns may go unnoticed until the end.