CISA Practice Exam 57 — 20 Questions

Question 1

An IS auditor is planning a compliance audit of a payment gateway that processes credit card transactions. The auditor needs to determine whether the control environment meets the requirements of the applicable payment card industry standard. Which of the following should be the auditor's PRIMARY basis for defining the audit criteria?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The requirements of the applicable payment card industry data security standard. A compliance audit measures the subject against authoritative criteria imposed by an external body. Because the payment gateway processes cardholder data, the applicable payment card industry data security standard supplies the mandatory requirements the auditor must test. Internal policies, professional judgment, and peer benchmarks inform the work but cannot establish compliance with the governing standard, so they cannot serve as the primary criteria for this engagement.

Answer

The organization's internal information security policy manual and procedures

Answer

A benchmark of security controls adopted by similar payment processors in the same region

Answer

The auditor's professional judgment of what constitutes adequate security for payment gateways

Question 2

During an audit of a data center, the IS auditor observes that visitors are escorted at all times but the visitor log is not reconciled to the badge access system. Which of the following BEST describes the audit concern?

Accepted Answer

Physical access controls are not operating effectively because the two records are not reconciled.. The audit concern is that the detective control of reconciling visitor logs with badge records is not operating, so unauthorized access could go undetected. Escorting alone is preventive and can fail. Both records have distinct value, and the absence of reconciliation is the control gap. The finding should be documented rather than closed or dismissed.

Answer

The badge access system is more reliable than the visitor log, so the log can be discarded.

Answer

Visitor logs are not required by any standard, so the finding should be closed.

Answer

The escort requirement is sufficient on its own, so no further action is needed.

Question 3

An IS auditor is reviewing problem management for a payment processor. Recurring incidents share the same root cause, but the problem record has remained open for eight months with no root cause identified because the vendor will not release diagnostic data. Change requests to apply a workaround have been raised and closed repeatedly. Which action should the IS auditor recommend FIRST?

Accepted Answer

Escalate the vendor relationship through contract governance to obtain the diagnostic data needed to determine root cause.. When root cause analysis is blocked by a vendor's refusal to supply diagnostic data, the controlling issue is contractual, not technical. The auditor should first recommend invoking contract governance and escalation to obtain the required information or a permanent fix. Reclassifying as a known error would misstate the record, blind changes without root cause are risky, and improving dashboard visibility does not remove the dependency that prevents resolution.

Answer

Implement a permanent change to the payment application to bypass the failing component.

Answer

Reclassify the recurring incidents as known errors and close the problem record to reflect the accepted risk.

Answer

Increase the priority of the problem record so that it appears on the operations dashboard for management visibility.

Question 4

An IS auditor is examining the job scheduling controls for an organization's nightly batch processing on a mainframe. The auditor finds that operators can modify job schedules, add ad hoc jobs, and override job dependencies without supervisory approval or logging. Which of the following is the MOST appropriate recommendation?

Accepted Answer

Restrict scheduling changes to a separate scheduler role and implement automated logging with supervisory approval for exceptions.. The finding shows that operators have excessive privileges over job scheduling without approval or logging, creating a segregation of duties and auditability gap. The most appropriate recommendation restricts scheduling modifications to a controlled role and enforces approval and automated logging for exceptions, which prevents unauthorized changes while preserving an immutable audit trail.

Answer

Implement a job scheduling tool that automatically reschedules failed jobs without operator intervention.

Answer

Require operators to document all schedule changes in a manual log reviewed monthly by the IT manager.

Answer

Increase the frequency of batch job monitoring by operations staff to detect unauthorized schedule changes.

Question 5

An IS auditor is assessing the capacity management process for a rapidly growing e-commerce platform. The auditor finds that capacity planning is based solely on historical CPU and memory utilization, with no forecasting of business growth or seasonal peak demand. During the most recent holiday season, the platform experienced severe performance degradation and a two-hour outage. Which of the following should the auditor identify as the PRIMARY weakness in the capacity management process?

Accepted Answer

Capacity planning does not incorporate business demand forecasts and seasonal workload projections.. Effective capacity management aligns IT resources with current and future business demand. Relying only on historical utilization ignores growth trends, marketing events, and seasonal peaks, which is precisely why the platform failed during the holiday season. The primary weakness is the absence of business demand forecasting and seasonal workload projection in the capacity planning process.

Answer

Service level agreements with the hosting provider do not include availability penalties for peak periods.

Answer

The platform lacks automated horizontal scaling to handle sudden increases in transaction volume.

Answer

Performance monitoring tools do not collect sufficient granularity of CPU and memory metrics.

Question 6

An IS auditor is executing a compliance test of change management controls over a core banking application. The audit programme requires evidence that all production changes were approved before implementation. Which of the following techniques provides the MOST persuasive evidence for this test?

Accepted Answer

Inspecting the change tickets for documented approvals and comparing approval dates to deployment dates. Documentary evidence of approvals linked to deployment records directly addresses the control objective: approvals occurring before implementation. Comparing dates on the change tickets themselves allows the auditor to identify exceptions rather than relying on what people say or what policy intends. Interviews, policy review, and single-meeting observation each provide weaker or incomplete evidence for concluding on operating effectiveness across the change population.

Answer

Observing the change advisory board during one weekly meeting

Answer

Reviewing the change management policy approved by the IT steering committee

Answer

Interviewing the change manager about the approval workflow

Question 7

An IS auditor is conducting an audit of a payroll application and selects a statistical sample of 200 payment transactions from a population of 20,000. Testing reveals 12 transactions where the gross pay was calculated incorrectly due to a flawed overtime rule. Which of the following is the MOST appropriate interpretation of this result?

Accepted Answer

The error rate in the sample should be projected to the population and evaluated against the tolerable deviation rate. When testing attributes or compliance, the auditor projects the sample deviation rate to the population and compares it with the tolerable deviation rate established during planning. The finding of 12 deviations in 200 items yields a 6 percent rate that must be evaluated against that threshold, along with sampling risk, before determining whether the control can be relied upon.

Answer

The sample size should be increased until the number of exceptions falls within acceptable limits

Answer

The audit conclusion should be unqualified because 188 of 200 transactions were processed correctly

Answer

The 12 identified transactions should be corrected and the sample re-tested to confirm the control is now effective

Question 8

An IS auditor is reviewing an organization's disaster recovery plan (DRP) for its primary data center. The DRP specifies a reciprocal arrangement with a partner organization for backup processing. Which of the following is the MOST significant risk associated with this arrangement that the auditor should highlight?

Accepted Answer

The partner may not have sufficient capacity to handle the organization's workload during a simultaneous disaster.. A reciprocal disaster recovery arrangement depends on the partner's ability to provide processing capacity when needed. The most significant risk is that the partner may also be affected by the same disaster or may not have enough spare capacity to handle both organizations' workloads simultaneously. This can lead to failure of the DRP. Compatibility, legal enforceability, and security are important but secondary to the fundamental availability risk. The auditor should prioritize highlighting the capacity risk.

Answer

The partner may not have adequate security controls to protect the organization's data.

Answer

The partner may not have compatible hardware and software configurations.

Answer

The arrangement may not be legally enforceable without a formal contract.

Question 9

An IS auditor is reviewing the requirements definition phase of a new system development project. The business analyst has documented functional requirements but has not yet defined non-functional requirements. Which of the following is the MOST significant risk of proceeding to the design phase without non-functional requirements?

Accepted Answer

The system may not meet performance, security, and availability expectations.. Non-functional requirements specify criteria such as performance, security, and availability that are essential for system acceptance. Proceeding without them increases the likelihood that the system will fail to meet stakeholder expectations and may require costly rework. The auditor should verify that both functional and non-functional requirements are defined and approved before design begins.

Answer

The development team may not understand the business processes.

Answer

The project timeline may be extended due to rework.

Answer

The project budget may be exceeded.

Question 10

An IS auditor is planning an engagement and needs to obtain an understanding of the organization's IT environment to develop the audit programme. Which of the following techniques is MOST appropriate for this purpose?

Accepted Answer

Interviews with key IT personnel and review of system documentation.. During planning, the auditor must obtain sufficient knowledge of the area under review to identify risks and design the audit programme. Interviews with IT personnel and review of system documentation are efficient, appropriate techniques for building that understanding. Substantive testing, statistical sampling, and penetration testing are fieldwork or specialized procedures that occur after planning has established the scope and objectives.

Answer

Penetration testing of the organization's external network perimeter.

Answer

Substantive testing of transaction details in the general ledger.

Answer

Statistical sampling of user access records to project error rates.

Question 11

An IS auditor is reviewing the tape backup process for a mid-sized organization. Backups run nightly and complete successfully, and tapes are stored in a fireproof safe in the same data center as the servers. Which of the following is the MOST significant finding?

Accepted Answer

No offsite copy of the backup media is maintained.. Backup media must be stored separately from the systems they protect so that a single disaster cannot destroy both. Keeping the only copies in the same data center as the production servers concentrates availability risk and can make recovery impossible after a facility-wide event. An offsite or geographically separate copy, whether physical or replicated, is the control that ensures the organization can actually restore operations.

Answer

The fireproof safe has not been certified to a specific rating.

Answer

Backups are performed nightly rather than continuously.

Answer

Backup tapes are not encrypted before being placed in the safe.

Question 12

An IS auditor is reviewing the problem management process after a series of recurring production outages. The auditor finds that incidents are resolved quickly but the same underlying faults reappear. Which TWO activities should the auditor expect to find in an effective problem management process? (Choose two.)

Accepted Answer

A known error database that records diagnosed root causes and workarounds for reuse.. Effective problem management identifies the underlying cause of recurring incidents and prevents recurrence. Root cause analysis with corrective actions tracked to closure delivers the permanent fix, while a known error database preserves diagnosed causes and workarounds so recurrences are handled consistently and diagnostic effort is not repeated. Incident escalation, automatic closure, and volume reporting support operations but do not eliminate the root causes.

Answer

Weekly reporting of incident volumes by category to the service desk manager.

Answer

Escalation of every incident to senior management within one hour of detection.

Answer

Automatic closure of incidents once the affected service is restored to users.

Question 13

An IS auditor is evaluating the reliability of audit evidence obtained from an IT system. Which TWO of the following factors most directly affect the reliability of the evidence? (Choose two.)

Accepted Answer

The effectiveness of the controls over the evidence's completeness and accuracy.. The reliability of audit evidence is directly influenced by the independence of the evidence provider and the effectiveness of controls over its completeness and accuracy. Independent sources are less likely to be biased, and strong controls ensure the evidence is accurate and complete. Auditor qualifications, cost, and format do not directly affect the inherent reliability of the evidence, although they may influence the auditor's evaluation or selection of evidence.

Answer

The format in which the evidence is presented (e.g., paper vs. electronic).

Answer

The cost of obtaining the evidence.

Answer

The qualifications of the IS auditor performing the review.

Question 14

An IS auditor is planning an audit of a cloud-hosted application and needs to determine whether the cloud provider's controls are adequate. The provider offers a SOC 2 Type II report. Which of the following should the auditor do FIRST?

Accepted Answer

Review the report's scope, period, and the service auditor's opinion to determine its relevance to the audit objectives.. The auditor should first evaluate whether the SOC 2 Type II report is relevant and reliable by examining its scope, period, and opinion. This determines whether the report can be used as evidence or whether additional procedures are needed. Bridge letters and independent testing are secondary considerations. Uncritical acceptance is not acceptable under audit standards.

Answer

Request a bridge letter to cover the gap between the report period and the current date.

Answer

Accept the SOC 2 Type II report as sufficient evidence without further review.

Answer

Perform independent penetration testing of the cloud provider's environment.

Question 15

An IS auditor is planning an audit of a cloud service provider's controls over data backup and recovery. The auditor needs to obtain evidence about the provider's backup procedures and restoration testing. Which of the following is the MOST appropriate source of evidence?

Accepted Answer

A service organization control (SOC) 2 Type II report obtained from the provider.. When auditing a cloud service provider, the auditor often relies on independent third-party attestation reports. A SOC 2 Type II report provides an independent assessment of the design and operating effectiveness of controls, including backup and recovery, over a specified period. It is more reliable than marketing materials, contractual SLAs, or verbal assurances, which do not provide evidence of actual control performance.

Answer

The provider's marketing brochure describing its backup and recovery capabilities.

Answer

The provider's service level agreement (SLA) specifying recovery time objectives.

Answer

A verbal confirmation from the provider's account manager that backups are performed daily.

Question 16

An IS auditor is assessing an organization's IT governance implementation. The auditor finds that IT policies are outdated, roles and responsibilities are unclear, and there is no regular reporting on IT performance to the board. Which TWO of the following are the MOST critical actions to improve IT governance? (Choose two.)

Accepted Answer

Implement regular IT performance reporting to the board and executive management.. The most critical actions are to establish a formal governance framework and implement regular reporting. These address the root causes: lack of structure and lack of oversight. A framework clarifies roles and responsibilities, while reporting ensures accountability and informed decision-making. Other actions, such as updating policies or training, are supportive but not sufficient alone.

Answer

Increase the IT budget to allow for more staff training.

Answer

Update all IT policies annually to ensure they reflect current technology.

Answer

Conduct an annual IT risk assessment to identify vulnerabilities.

Question 17

An IS auditor is examining how a hospital enforces least privilege for its electronic health record (EHR) system. During walkthroughs, the auditor observes that nurses can access the billing module and that no formal process exists to request, approve, or periodically recertify role assignments. Which of the following is the MOST appropriate recommendation?

Accepted Answer

Implement role-based access control (RBAC) with documented request, approval, and periodic recertification of role assignments.. The observation describes excessive entitlements combined with no formal role lifecycle, which is a least-privilege and access governance failure. Role-based access control aligns permissions to job duties, and documented request, approval, and periodic recertification provide the accountability and review evidence the auditor expects. Detective monitoring, user acknowledgments, and stronger authentication do not correct or govern the underlying entitlements.

Answer

Enable database activity monitoring (DAM) to alert on any nurse queries against billing tables.

Answer

Deploy multifactor authentication (MFA) for all EHR logins by clinical staff.

Answer

Require nurses to sign an acceptable use policy (AUP) acknowledging that billing data is confidential.

Question 18

An IS auditor is performing a risk assessment to prioritize audit engagements for the annual audit plan. Which TWO of the following factors should the auditor consider when evaluating inherent risk? (Choose two.)

Accepted Answer

The level of management experience and turnover in the business unit.. Inherent risk is assessed before considering controls and reflects conditions that make errors or failures more likely or impactful. Technology complexity, transaction volume, management experience, and turnover are classic inherent risk factors identified in ISACA guidance. Control effectiveness belongs to residual risk, while prior finding closures and audit budget are planning considerations that do not describe the inherent risk of the process itself.

Answer

The effectiveness of the controls currently in place over the process.

Answer

The audit budget allocated to the engagement by the audit committee.

Answer

The number of audit findings closed in the previous audit cycle.

Question 19

During an audit of a bank's online transaction processing system, the IS auditor discovers that batch totals are reconciled only at the end of each business day, while individual transactions are posted to customer accounts in real time. Which of the following is the GREATEST risk arising from this control design?

Accepted Answer

Individual transactions may be posted incorrectly without detection until the reconciliation is performed. Real-time posting combined with only end-of-day reconciliation leaves the entire business day exposed to incorrect or unauthorized individual postings. The reconciliation verifies batch totals but cannot retroactively prevent customer accounts from being affected. The primary risk is therefore the window during which erroneous transactions remain undetected and potentially cause financial or reputational harm.

Answer

The daily reconciliation may not complete within the batch window, delaying the next day's processing

Answer

Batch totals may not include transactions processed through channels outside the main system

Answer

The audit trail for individual transactions may be overwritten before the reconciliation is performed

Question 20

An IS auditor is designing test procedures for an audit of an organization's network perimeter. The auditor plans to use computer-assisted audit techniques (CAATs) to analyze firewall log data covering six months. Which TWO of the following are the MOST important considerations when using CAATs in this engagement? (Choose two.)

Accepted Answer

Security and confidentiality controls over the extracted log data and the CAAT environment. When CAATs are used, the auditor must first establish that the data being analyzed is complete and accurate, because flawed input guarantees flawed conclusions about firewall activity over six months. Equally important, extracted logs and the analysis environment must be secured so the audit does not introduce confidentiality or integrity risks. Appliance brand, team experience, and license cost affect logistics but not the fundamental reliability or safety of the CAAT results.

Answer

The brand and model of the firewall appliance generating the logs

Answer

Whether the audit team has prior experience auditing firewall rules

Answer

The cost of the CAAT software license compared to manual testing