CISA Practice Exam 57 — 20 Questions

Question 1

A company is replacing its legacy on-premises ERP system with a cloud-based SaaS solution. The project manager is concerned about data migration risks. Which of the following is the BEST approach to mitigate data integrity issues during migration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run parallel processing and compare outputs. Running parallel processing allows the legacy and new SaaS systems to operate simultaneously, enabling real-time comparison of outputs. This approach directly validates data integrity by detecting discrepancies during migration, not after, which is critical for ERP systems where transactional accuracy is paramount.

Answer

Perform data validation after migration

Answer

Use data transformation tools to convert formats

Answer

Implement data reconciliation reports post-migration

Question 2

Which TWO of the following are benefits of implementing an IT governance framework?

Accepted Answer

Improved risk management and mitigation. Implementing an IT governance framework, such as COBIT or ISO/IEC 38500, establishes structured policies, procedures, and controls that directly improve risk management and mitigation. By defining clear roles, accountability, and risk appetite, the framework ensures that risks are systematically identified, assessed, and treated, rather than being managed ad hoc. This aligns IT strategy with business objectives and embeds risk management into daily operations.

Answer

Reduction in IT staff headcount

Answer

Reduced IT operational costs

Answer

Elimination of all IT project failures

Question 3

During a business impact analysis (BIA), the IS auditor identifies that the maximum tolerable downtime (MTD) for an online payment system is 2 hours, and the recovery point objective (RPO) is 15 minutes. The current disaster recovery solution uses nightly backups (12-hour RPO) and can restore the system in 4 hours. Which risk is most critical?

Accepted Answer

Data loss exceeds the RPO.. The current solution has a 12-hour RPO (nightly backups), but the business requires an RPO of 15 minutes. This means up to 11 hours and 45 minutes of transaction data could be lost, far exceeding the acceptable data loss threshold. While the recovery time of 4 hours also exceeds the MTD of 2 hours, the most critical risk is data loss because the gap between the actual RPO and the required RPO is proportionally larger and directly impacts transaction integrity and financial reconciliation.

Answer

The backup frequency is not aligned with the RPO.

Answer

The disaster recovery plan has not been tested.

Answer

Recovery time exceeds the MTD.

Question 4

A medium-sized e-commerce company recently suffered a ransomware attack that encrypted critical databases. The IT team restored systems from backups, but the incident exposed a lack of clear roles and responsibilities for incident response. The board has asked the IT governance committee to review and improve the incident response governance. The committee notes that while there is an incident response policy, it is not regularly tested, and staff are unsure of their roles. The company also lacks a formal communication protocol for notifying stakeholders. What should the committee prioritize to strengthen governance over incident response?

Accepted Answer

Define and communicate clear roles and responsibilities for incident response, and establish accountability.. The root cause is a lack of clear roles, responsibilities, and accountability, which must be addressed first to strengthen governance. Option A is wrong because investing in technology alone does not fix governance gaps. Option B is wrong because outsourcing does not address internal governance deficiencies. Option D is wrong, while testing is valuable, it should follow role definition and communication.

Answer

Invest in advanced endpoint detection and response tools.

Answer

Outsource incident response to a managed security service provider.

Answer

Conduct a tabletop exercise to test the current plan.

Question 5

Refer to the exhibit. A developer is inserting a new employee record. What is the cause of this error?

Accepted Answer

The email 'john.doe@example.com' already exists in the table. The error message indicates a violation of a UNIQUE constraint on the 'email' column. The INSERT statement attempts to add 'john.doe@example.com', but that value already exists in the table. The database rejects the operation because the constraint ensures no duplicate email addresses are allowed.

Answer

The column 'email' does not exist

Answer

The table is full

Answer

The employee_id 101 already exists

Question 6

An IS auditor is reviewing the software asset management (SAM) process. The organization uses a mix of commercial off-the-shelf (COTS) and open-source software. The auditor finds that several servers are running end-of-life (EOL) operating systems that are no longer patched. Which TWO risks are most directly associated with this finding?

Accepted Answer

Increased risk of security breaches due to unpatched vulnerabilities.. End-of-life (EOL) operating systems no longer receive security patches from the vendor, leaving known vulnerabilities unmitigated. This directly increases the risk of security breaches because attackers can exploit these unpatched flaws. Additionally, many regulatory frameworks (e.g., PCI DSS, SOX) require timely patching of critical systems, so running EOL software constitutes non-compliance with those requirements.

Answer

Difficulty in integrating with newer systems.

Answer

Reduced performance due to outdated software.

Answer

Higher software licensing costs.

Question 7

A large financial institution is implementing a new core banking system to replace a legacy system. The project has been underway for 18 months and is behind schedule. User acceptance testing (UAT) has revealed significant data integrity issues, including missing customer records and incorrect interest calculations. The project manager, under pressure from senior management to meet a regulatory deadline, proposes going live with a promise to fix the issues in a post-implementation phase. The development team has been making ad hoc code changes directly in the test environment without version control or proper testing. Additionally, the IS auditor discovers that the business requirements were never formally signed off by the user community; only verbal approvals were obtained. The project has consumed 90% of the budget but only 60% of the functionality is tested. Which of the following is the BEST course of action for the IS auditor to recommend?

Accepted Answer

Recommend halting the go-live until the business requirements are formally signed off and UAT is completed successfully with all critical defects resolved.. The project lacks formal sign-off on business requirements, has unresolved critical data integrity issues, and has been making uncontrolled code changes without version control. Going live under these conditions would violate ISACA's IS acquisition and implementation standards, which require that all critical defects be resolved and UAT be successfully completed before production deployment. The regulatory deadline does not justify bypassing these fundamental controls, as post-implementation fixes cannot guarantee data integrity and could lead to regulatory penalties.

Answer

Allow the go-live with a formal post-implementation support plan and a dedicated team to address defects.

Answer

Suggest a phased go-live, releasing the tested modules to production while continuing development on the remaining modules.

Answer

Escalate the issues to the board of directors and recommend immediate termination of the project.

Question 8

Based on the exhibit, what is the default retention period for data?

Accepted Answer

365 days. The JSON exhibit shows a default retention period of 365 days. Option B is incorrect; 30 days is the extension applied only to the Legal role, not the default. Option C is incorrect as the policy explicitly specifies a default period. Option D is incorrect because 365 days, not 30 days, is the default retention period.

Answer

30 days for Legal role only

Answer

The policy does not specify a default period

Answer

30 days

Question 9

An IS auditor is evaluating the reliability of audit evidence. Which TWO of the following are characteristics of reliable audit evidence?

Accepted Answer

Independent source. Audit evidence from an independent source is considered more reliable because it is obtained from a third party outside the audited entity, reducing the risk of bias or manipulation. For example, a system-generated log from a SIEM tool is more reliable than a manually created spreadsheet from the IT department. Independence directly supports the objectivity and verifiability of the evidence.

Answer

Complex

Answer

Relevant

Answer

Large quantity

Question 10

An IS auditor is evaluating the effectiveness of an organization's information security awareness program. Which of the following is the BEST indicator of program effectiveness?

Accepted Answer

Trend in security incidents attributed to human error. The best indicator because it directly measures the program's outcome: a reduction in security incidents caused by human error. While training completion, policy acknowledgment, and quiz scores measure activity or knowledge, they do not confirm that employees have changed their behavior. A downward trend in human-error-related incidents provides empirical evidence that the awareness program is effectively influencing employee actions in real-world scenarios.

Answer

Percentage of employees who completed the training

Answer

Number of employees who acknowledged the security policy

Answer

Average score on the post-training quiz

Question 11

A healthcare organization must comply with HIPAA regulations regarding patient data privacy. The IT department has implemented technical controls, but the compliance officer discovers that some employees are sharing passwords. What is the BEST governance response?

Accepted Answer

Enforce the existing policy through disciplinary actions and additional training.. The best governance response is to enforce the existing policy through disciplinary actions and additional training (option B). This addresses the root cause of non-compliance—employee behavior—by reinforcing the policy and educating staff. Option A (implementing MFA) is a technical control that may reduce password sharing but does not address the governance aspect; it could be a supporting measure but not the primary governance response. Option C (reporting to regulatory authority) is premature because password sharing does not necessarily constitute a data breach; there is no evidence of actual exposure. Option D (revising the password policy to require more complex passwords) does not prevent sharing and may even increase it if passwords are harder to remember. Therefore, governance should focus on policy enforcement and training.

Answer

Implement multi-factor authentication to prevent password sharing.

Answer

Report the incident to the regulatory authority as a data breach.

Answer

Revise the password policy to require more complex passwords.

Question 12

Match each type of access control to its definition.

Accepted Answer

Discretionary Access Control (DAC): Access decisions are based on the identity of the user and the rules defined by the data owner.. The correct matches are: DAC = owner-defined rules, MAC = system-enforced labels, RBAC = role assignments, ABAC = attribute policies. Common confusions include swapping MAC and DAC definitions.

Answer

Discretionary Access Control (DAC): Access is based on security labels assigned by the system administrator.

Answer

Mandatory Access Control (MAC): Access decisions are made by the data owner.

Question 13

Which THREE of the following are key considerations when selecting a software development methodology for a project?

Accepted Answer

Regulatory compliance requirements. Regulatory compliance requirements (Option B) are a key consideration because the chosen methodology must support necessary audit trails, documentation, and control frameworks (e.g., SOX, HIPAA, PCI DSS). A methodology like Waterfall provides rigid phase-gate documentation, while Agile may require adaptation (e.g., SAFe) to satisfy compliance evidence demands. Failure to align methodology with regulatory needs can lead to non-compliance findings during a CISA audit.

Answer

Availability of project management software

Answer

Programming language preferences

Question 14

Which of the following is the PRIMARY benefit of using a hardware security module (HSM) for key management?

Accepted Answer

It provides tamper-resistant storage for encryption keys.. The primary benefit of a hardware security module (HSM) is that it provides tamper-resistant, physically secured storage for encryption keys. HSMs are designed to protect keys from extraction or modification, even if an attacker gains physical access to the device, which is critical for maintaining the confidentiality and integrity of cryptographic operations. This aligns with the core purpose of an HSM: to safeguard the root of trust in a key management infrastructure.

Answer

It reduces the cost of key management.

Answer

It improves encryption speed.

Answer

It simplifies key distribution.

Question 15

An organization is implementing a COTS application. The project team plans to heavily customize the application to meet unique business processes. Which of the following is the most significant risk?

Accepted Answer

Difficulties in applying future vendor upgrades. Heavy customization of a COTS application often leads to significant difficulties when applying future vendor upgrades, because custom code may not be compatible with new versions. This is the most direct and significant risk among the options. Vendor lock-in (A) is a concern but typically less immediate than upgrade issues. Incompatibility with future releases (B) is a symptom or consequence of upgrade difficulties, not the primary risk itself. High implementation cost (D) is a separate concern and not as critical as the long-term maintainability issue posed by upgrade difficulties.

Answer

Vendor lock-in

Answer

Incompatibility with future releases

Answer

High implementation cost

Question 16

An organization is replacing its legacy customer relationship management (CRM) system. Which of the following is the MOST important control to ensure data integrity during the data conversion process?

Accepted Answer

Perform reconciliation of total record counts and key field sums before and after conversion.. Performing reconciliation of total record counts and key field sums before and after conversion is a direct control to verify that data is accurately transferred without loss or corruption. This ensures data integrity. Option B, implementing encryption for data in transit, is important for security but does not directly address data integrity during conversion. Option C, conducting user acceptance testing, focuses on functionality and user requirements, not on the accuracy of the converted data. Option D, ensuring data mapping documents are approved, is a governance control but does not provide verification of actual data integrity during the conversion process.

Answer

Implement encryption for data in transit during migration.

Answer

Conduct user acceptance testing on the new system.

Answer

Ensure data mapping documents are approved by business owners.

Question 17

Which TWO of the following are benefits of establishing an IT steering committee?

Accepted Answer

Enhanced prioritization of IT investments. Options B and C are correct because an IT steering committee provides strategic alignment and prioritization of IT initiatives, ensuring they align with business goals. Option A is not a benefit; operational efficiency is a management responsibility, not a committee function. Option D is incorrect; establishing a steering committee may add governance overhead rather than reduce management overhead. Option E is not a primary benefit; technical decisions are typically delegated to IT management.

Answer

Improved operational efficiency of IT systems

Answer

Reduction of management overhead

Answer

Direct control over technical IT decisions

Question 18

Which THREE of the following are responsibilities of the board of directors regarding IT governance? (Choose three.)

Accepted Answer

Setting IT risk appetite. Options B, C, and E are correct because setting IT risk appetite, reviewing IT performance, and approving IT strategy are board-level responsibilities under IT governance. Option A is incorrect as designing network security architecture is an operational task typically handled by management or technical staff. Option D is incorrect because implementing IT controls is also a management function, not a board responsibility.

Answer

Designing network security architecture

Answer

Implementing IT controls

Question 19

An organization is developing its IT strategy to align with the overall business strategy. The business strategy emphasizes rapid market expansion through digital products. Which of the following IT strategies would BEST support this business goal?

Accepted Answer

Adopt agile development methods and scalable cloud infrastructure.. Rapid market expansion through digital products requires agility, speed, and scalability. Agile development methods enable iterative, fast delivery of features, while cloud infrastructure provides elastic resources to scale quickly. Option A is wrong because excessive standardization can hinder innovation and slow down time-to-market. Option C is wrong because outsourcing to a low-cost provider may prioritize cost over speed and quality, which is not suitable for rapid expansion. Option D is wrong because minimizing IT investment would deprive the organization of the necessary resources to develop and scale digital products.

Answer

Standardize all IT systems to reduce complexity.

Answer

Outsource all IT operations to a low-cost provider.

Answer

Minimize IT investment to preserve capital for business growth.

Question 20

A company is considering restructuring its IT department from a centralized to a decentralized model to give business units more autonomy. What is a PRIMARY governance risk associated with this move?

Accepted Answer

Inconsistent IT policies and security controls across business units.. The primary governance risk when moving from a centralized to a decentralized IT model is the potential for inconsistent IT policies and security controls across business units (Option D). Decentralization gives business units autonomy, which can lead to differences in how IT policies are interpreted and applied, increasing the risk of security gaps and non-compliance. Option A (difficulty in managing vendor contracts) is a valid operational concern but not a primary governance risk. Option B (reduced innovation) is unlikely, as decentralization often fosters innovation. Option C (increased cost overruns) can occur but is typically a financial risk rather than a governance risk.

Answer

Difficulty in managing vendor contracts due to decentralization.

Answer

Reduced innovation due to lack of central coordination.

Answer

Increased risk of project cost overruns.