CISA Practice Exam 56 — 20 Questions

Question 1

During a recent audit, the IT auditor found that the problem management process does not include a known error database (KEDB). Which of the following is the MOST significant risk associated with this finding?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increased time to resolve incidents. Without a known error database (KEDB), incident resolution relies on ad-hoc troubleshooting rather than leveraging documented root causes and workarounds. This directly increases the mean time to resolve (MTTR) incidents because support teams cannot quickly identify and apply previously identified fixes, leading to longer outages and reduced operational efficiency.

Answer

Higher likelihood of unauthorized changes

Answer

Increased backup failure rates

Answer

Inaccurate SLA reporting

Question 2

Order the steps for performing a disaster recovery test in the correct sequence.

Accepted Answer

1. Define objectives, 2. Prepare, 3. Execute, 4. Evaluate, 5. Update plan. The correct sequence for a disaster recovery test is to first define the objectives, then prepare the test environment and resources, execute the test, evaluate the results against the objectives, and finally update the disaster recovery plan based on findings. This order ensures a structured and effective testing process.

Answer

1. Prepare, 2. Define objectives, 3. Execute, 4. Evaluate, 5. Update plan

Answer

1. Define objectives, 2. Execute, 3. Prepare, 4. Evaluate, 5. Update plan

Answer

1. Define objectives, 2. Prepare, 3. Evaluate, 4. Execute, 5. Update plan

Question 3

An IS auditor is assessing the organization's compliance with privacy regulations regarding cross-border data transfers. Which TWO of the following are acceptable mechanisms to legitimize such transfers under the GDPR?

Accepted Answer

Binding corporate rules (BCRs) approved by a supervisory authority. Under GDPR, the two primary mechanisms for legitimizing cross-border data transfers are Binding Corporate Rules (BCRs) approved by a supervisory authority and Standard Contractual Clauses (SCCs) adopted by the European Commission. Adequacy decisions, while a valid basis for transfers to specific countries, are not a mechanism that organizations can directly implement; they are a determination by the European Commission. Encryption does not legitimize a transfer, and explicit consent alone is generally not considered sufficient as a transfer mechanism under GDPR.

Answer

Encryption of data prior to transfer

Answer

Adequacy decision by the European Commission for the recipient country

Answer

Explicit consent from the data subjects

Question 4

Which TWO of the following are effective controls to prevent unauthorized access to sensitive data in a database? (Choose two.)

Accepted Answer

Database activity monitoring (DAM). Options A (Database activity monitoring) and C (Database encryption at rest) are effective controls to prevent unauthorized access to sensitive data in a database. Database activity monitoring (DAM) detects and can block unauthorized queries in real-time. Database encryption at rest protects data even if the storage media is accessed without authorization. Option B (Strong password policy) is a general security control but does not prevent access if passwords are compromised or bypassed. Option D (Regular patch management) addresses vulnerabilities but does not directly prevent unauthorized access. Option E (Network segmentation) limits network-level access but does not protect against authorized users misusing access or credential theft.

Answer

Strong password policy

Answer

Regular patch management

Answer

Network segmentation

Question 5

Which THREE of the following are valid reasons for implementing a service level management process? (Select THREE.)

Accepted Answer

To monitor and report on service performance. Service level management ensures alignment with business needs, monitors performance, and provides a basis for improvement.

Answer

To ensure all IT staff are certified

Answer

To eliminate the need for IT support

Question 6

During a disaster recovery test, the team discovers that the backup server is unable to restore data because of incompatible software versions. Which TWO controls should have been implemented to prevent this?

Accepted Answer

Maintaining a configuration management database. A configuration management database (CMDB) is the correct control because it maintains a detailed record of software versions, patches, and configurations across all IT assets. By referencing the CMDB during disaster recovery planning, the team ensures that backup and restore environments are compatible, preventing version mismatch failures. Without this, the backup server may have outdated or incompatible software, as seen in the scenario.

Answer

Using cloud-based backup solutions

Answer

Implementing intrusion detection systems

Answer

Increasing the frequency of full backups

Question 7

An IT auditor is reviewing the asset management process for hardware lifecycle. Which two controls should the auditor verify to ensure secure disposition of decommissioned servers?

Accepted Answer

Secure sanitization of storage media. Secure sanitization of storage media (Option C) is critical because decommissioned servers often contain sensitive data that must be irrecoverably erased to prevent unauthorized access. A formal disposal policy with authorization (Option D) ensures that decommissioning follows a documented, approved process, including verification of sanitization and chain of custody. Together, these controls address both the technical and procedural aspects of secure disposition.

Answer

Hardware warranty tracking

Answer

Performance benchmarking

Answer

Asset tagging during procurement

Question 8

A security architect is designing a data classification schema for a multinational corporation. Which combination of factors is MOST critical for determining the classification level of a data asset?

Accepted Answer

Legal, regulatory, and business impact if disclosed.. The classification level of a data asset is primarily determined by the potential harm that could result from its unauthorized disclosure, modification, or loss. Legal, regulatory, and business impact factors—such as compliance with GDPR, HIPAA, or PCI DSS—directly dictate the required confidentiality, integrity, and availability controls. Without assessing these impacts, any classification scheme would be arbitrary and fail to align with organizational risk tolerance.

Answer

Data volume and storage location.

Answer

Data format and encryption status.

Answer

Data creation date and last access time.

Question 9

An organization has defined an RTO of 4 hours for its critical financial system. During a disaster recovery test, the system was recovered in 3.5 hours, but data loss was 30 minutes. Which metric is most directly addressed by the recovery time?

Accepted Answer

RTO. The Recovery Time Objective (RTO) defines the maximum acceptable downtime for a system after a disaster. Since the organization's RTO is 4 hours and the system was recovered in 3.5 hours, the recovery time directly satisfies the RTO metric. The 30 minutes of data loss is irrelevant to RTO; it pertains to the Recovery Point Objective (RPO).

Answer

RPO

Answer

MTBF

Answer

MTTR

Question 10

An IS auditor is reviewing the physical access controls at a data center. Which of the following is the MOST effective control to prevent tailgating?

Accepted Answer

Mantrap entry system. A mantrap is a small room with two sets of interlocking doors, designed to prevent tailgating by allowing only one person to enter at a time. CCTV, badge access, and visitor logs are supportive but do not directly prevent tailgating.

Answer

Badge access system with PIN

Answer

Visitor sign-in log

Answer

CCTV surveillance at entrances

Question 11

Which TWO of the following are key components of an IT governance framework?

Accepted Answer

Strategic alignment. Strategic alignment (B) is a key component of an IT governance framework because it ensures that IT strategies, investments, and operations are directly linked to business goals and objectives. This alignment is achieved through mechanisms such as balanced scorecards, IT steering committees, and portfolio management, which translate business strategy into IT priorities. Without strategic alignment, IT may operate in a silo, leading to wasted resources and missed opportunities for business value.

Answer

Resource management

Answer

Performance measurement

Answer

Risk management

Question 12

A medium-sized manufacturing company has recently deployed an ERP system to integrate its financial, supply chain, and HR processes. The IT department is small (5 staff) and reports to the CFO. The company has no formal IT governance committee; IT decisions are made by the CFO and CEO informally. During a recent audit, it was found that several critical security patches for the ERP system have not been applied, and there are no documented procedures for change management. The IT manager states that patches are applied when time permits, and changes are discussed via email. The CFO argues that the ERP is running fine and the audit findings are low risk. The IS auditor needs to recommend a course of action to improve IT governance. Which of the following is the MOST appropriate initial step?

Accepted Answer

Recommend the formation of an IT steering committee comprising key business stakeholders to oversee IT strategy, risk, and resource allocation. The root cause is the absence of any formal governance structure. Establishing an IT steering committee with key business stakeholders (e.g., from finance, supply chain, HR) provides oversight, ensures that IT decisions align with business strategy, and creates a forum for prioritizing risks such as missing patches. This addresses the governance gap holistically. Option A is not appropriate because outsourcing does not fix the lack of internal governance and is an extreme measure. Option C focuses only on patching, not on the underlying governance deficiency. Option D is an operational quick fix that bypasses the need for sustainable governance processes.

Answer

Elevate the issue to the board of directors with a recommendation to outsource IT management

Answer

Develop a comprehensive patch management policy and present it to the CFO for approval

Answer

Insist that the IT manager immediately apply all missing patches within one week

Question 13

During a post-implementation review of a system, an IS auditor finds that the actual transaction processing time is 30% slower than projected. What should the auditor recommend FIRST?

Accepted Answer

Conduct a performance analysis to identify bottlenecks. The root cause should be identified before recommending specific actions. Performance testing or analysis will reveal the cause.

Answer

Upgrade the server hardware immediately

Answer

Reject the system and revert to the legacy system

Answer

Adjust user expectations to match actual performance

Question 14

An organization uses automated job scheduling with dependency management. A critical nightly batch job failed because a prerequisite job did not complete successfully. The job scheduler automatically attempted to rerun the failed job three times, each time failing due to the same dependency. The operations team was not alerted until the next morning. What control should the auditor recommend to improve this process?

Accepted Answer

Implement real-time alerts for job failures and dependency issues.. The core issue is the lack of timely notification, not the number of retries or the dependency logic itself. The job scheduler correctly identified the dependency failure and attempted reruns, but the operations team remained unaware until the next morning. Implementing real-time alerts for job failures and dependency issues (Option B) ensures that the operations team can intervene immediately, rather than discovering the problem hours later during a manual check.

Answer

Increase the number of automatic rerun attempts.

Answer

Remove dependency management for critical jobs.

Answer

Schedule all critical jobs to run sequentially without dependencies.

Question 15

During a change management review, an IS auditor discovers that a recent database upgrade was implemented without prior approval from the Change Advisory Board (CAB) because it was classified as a 'standard change.' However, the change involved migrating to a new database version that required application code modifications. What should concern the auditor most?

Accepted Answer

The change was implemented without CAB approval.. The core issue is that the change was misclassified as a 'standard change' to bypass CAB approval, but it required application code modifications, which means it was not pre-authorized and should have been treated as a normal or emergency change. Standard changes are low-risk, pre-approved, and typically involve no application code changes (e.g., applying a routine patch to a database that does not alter the schema or API). By bypassing CAB review, the organization lost the opportunity to assess risks, dependencies, and rollback procedures, which is a critical control failure in change management.

Answer

The change did not include a backout plan.

Answer

The change was implemented during business hours.

Answer

The change was implemented without testing.

Question 16

A financial institution is evaluating its IT governance structure. Which of the following roles is BEST suited to ensure independent oversight of IT investments?

Accepted Answer

IT Audit Committee. The IT Audit Committee is the correct answer because it provides independent oversight of IT investments by operating outside of management's direct reporting structure. Unlike the CIO, PMO director, or CISO, who are all part of management and may have vested interests in project approvals or resource allocation, the IT Audit Committee reports to the board of directors and ensures that IT investments align with enterprise strategy, risk appetite, and regulatory requirements without bias.

Answer

Chief Information Officer (CIO)

Answer

Project Management Office (PMO) director

Answer

Chief Information Security Officer (CISO)

Question 17

An IS auditor is reviewing the system development life cycle (SDLC) methodology. Which phase should include the development of detailed test plans?

Accepted Answer

System design.. Detailed test plans should be developed during the system design phase because this is when the system's architecture, interfaces, and data flows are fully specified. Creating test plans at this stage ensures that tests are aligned with the design specifications and can validate that the implemented system meets the intended technical requirements, rather than waiting until after coding.

Answer

Requirements definition.

Answer

Coding and unit testing.

Answer

User acceptance testing.

Question 18

An IS auditor is reviewing a change management process. A developer made an emergency change directly to production without following the standard change approval process. The change was later documented as a normal change. Which control weakness is MOST indicated by this scenario?

Accepted Answer

Inadequate segregation of duties between development and production environments. The developer bypassed the standard change approval process by making an emergency change directly to production, then retroactively documenting it as a normal change. This directly violates the principle of segregation of duties (SoD), as the same individual who implemented the change also controlled the documentation and approval trail, eliminating independent oversight. In a properly segregated environment, developers should not have direct write access to production systems without a separate change authorization and deployment step.

Answer

Absence of a rollback plan for emergency changes

Answer

Insufficient testing of emergency changes before deployment

Answer

Lack of a formal change documentation policy

Question 19

A large enterprise recently experienced a data breach due to an insider threat. The IT governance committee is reviewing the incident and considering measures to prevent recurrence. Which of the following is the BEST course of action to address the root cause?

Accepted Answer

Implement a privileged access management (PAM) solution to control and monitor elevated access.. A privileged access management (PAM) solution directly addresses the root cause of an insider threat by controlling, monitoring, and auditing elevated access rights. Since the breach was caused by an insider, limiting and tracking privileged accounts prevents unauthorized or excessive use of administrative credentials, which is the most effective preventive measure against recurrence.

Answer

Increase logging and auditing of all user activities.

Answer

Deploy a security information and event management (SIEM) tool.

Answer

Terminate the employment of the insider who caused the breach.

Question 20

A government agency is developing a case management system for law enforcement. The project follows an agile approach, releasing iterations every two weeks. During a sprint demo, users discover that the system does not redact personally identifiable information (PII) in documents shared with external parties, violating privacy laws. The development team says they planned to add redaction in a future sprint. The product owner wants to prioritize PII redaction immediately. The project manager is concerned that this will disrupt the release schedule. The IS auditor is assessing the project's risk management. Which of the following is the BEST recommendation?

Accepted Answer

Re-estimate the sprint and include PII redaction as a top priority, adjusting the schedule accordingly.. It aligns with agile risk management principles: when a critical compliance vulnerability (PII exposure) is discovered, the highest-priority user story must be re-estimated and inserted into the current sprint backlog, even if it means adjusting the release schedule. The IS auditor’s focus is on ensuring that the risk is actively mitigated, not deferred, and re-prioritization is the standard agile response to newly identified high-severity risks.

Answer

Implement network-level restrictions to prevent external sharing.

Answer

Provide users with training on manual redaction as a workaround.

Answer

Document the risk and accept the compliance exposure until the planned sprint.