CISA Practice Exam 58 — 20 Questions

Question 1

An organization is implementing a new customer relationship management (CRM) system. The project manager proposes using a pilot conversion strategy, where the new system is implemented in one department first, then gradually rolled out to others. Which of the following is the PRIMARY benefit of this approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It allows for early detection of issues before full-scale rollout.. The primary benefit of a pilot conversion is risk mitigation. By implementing the system in a limited area first, the organization can uncover and address problems before they affect the entire enterprise. This approach allows for learning and adjustment, reducing the chance of a costly failure. It is particularly useful for complex systems where full-scale rollout carries high risk.

Answer

It ensures that all data is migrated at once.

Answer

It minimizes the overall project cost.

Answer

It eliminates the need for user training.

Question 2

An IS auditor has completed fieldwork for an audit of a data center's physical access controls and has documented several findings. Before drafting the final report, the auditor discusses the findings with the data center manager. Which of the following is the PRIMARY purpose of this discussion?

Accepted Answer

To validate the accuracy and completeness of the findings with the auditee. Before issuing the report, the auditor discusses findings with the auditee to confirm that the facts and evidence are accurate and complete. This validation protects against factual errors, allows management to provide clarifying information, and gives the auditee a chance to respond. It is not a negotiation to reduce evidence, exclude valid findings, or obtain remediation commitments, although management responses are captured for the report.

Answer

To obtain management's agreement on the corrective actions and target dates

Answer

To determine whether the findings should be excluded from the final report

Answer

To reduce the amount of evidence the auditor needs to gather for each finding

Question 3

An IS auditor is reviewing the IT service continuity plan for a regional bank. The plan identifies a recovery time objective of 6 hours for the core banking system and designates a warm site with pre-installed hardware but no replicated data. The plan states that data will be restored from nightly backups stored in an offsite vault. Which of the following is the MOST critical issue the auditor should raise?

Accepted Answer

The warm site lacks replicated data, so restoring from nightly backups may not meet the 6-hour recovery time objective.. The most critical issue is the inconsistency between the recovery strategy and the documented RTO. A warm site without replicated data requires rebuilding from backup media, a process that rarely completes within six hours and may also cause significant data loss. The auditor should raise this capability gap and recommend a strategy such as data replication or a hot site to meet the business requirement.

Answer

The recovery time objective of 6 hours should be increased to align with the capabilities of a warm site.

Answer

The offsite vault storing nightly backups may not provide adequate physical security for backup media.

Answer

Nightly backups do not provide a sufficiently low recovery point objective for a core banking system.

Question 4

An IS auditor is conducting an audit of a payroll application and needs to verify that user access rights match each employee's current job responsibilities. Which of the following is the MOST appropriate source of evidence for this test?

Accepted Answer

The payroll application's user access list and the human resources department's current job descriptions. Verifying that access rights match job responsibilities requires comparing what rights exist with what rights should exist. The application's user access list establishes actual entitlements, while HR's current job descriptions establish the authorized baseline. Agreement between these two independent records supports a conclusion on access appropriateness. Walkthroughs, failed login reports, and password settings each address different control objectives and cannot demonstrate role alignment.

Answer

The payroll application's password complexity configuration settings

Answer

A report of failed login attempts over the past quarter

Answer

A walkthrough of the payroll application with the system administrator

Question 5

An IS auditor is reviewing the IT operations team's use of system-generated alerts. The auditor finds that alerts are configured to notify the operations team via email, but there is no escalation path if an alert is not acknowledged within a specified time. Which of the following is the MOST significant risk?

Accepted Answer

Critical alerts may be overlooked, leading to unplanned downtime or service degradation.. The absence of an escalation path means that if the primary recipient does not acknowledge an alert, no one else is notified. For critical alerts, this can result in delayed response and unplanned downtime. The most significant risk is therefore that critical alerts may be overlooked, leading to service degradation. Other concerns like alert fatigue or email failures are plausible but secondary to the explicit control gap of missing escalation.

Answer

The alerting system may not be integrated with the incident management system, delaying ticket creation.

Answer

Email delivery failures may prevent alerts from reaching the operations team.

Answer

The operations team may become desensitized to alerts due to email overload, ignoring them altogether.

Question 6

An IS auditor is planning the use of computer-assisted audit techniques (CAATs) to test a large transaction population for duplicate payments. Which of the following is the MOST important consideration before relying on the CAAT results?

Accepted Answer

Verifying the completeness and accuracy of the data extracted from the source system. Before relying on CAAT output, the auditor must be satisfied that the data analysed is complete and accurate, typically by reconciling extract record counts and control totals to the source system. Only then can duplicate-payment exceptions be attributed to the population rather than to extraction errors. Licensing, approvals, and documentation support the work but do not validate the data itself.

Answer

Ensuring the CAAT scripts are documented in the permanent audit file

Answer

Obtaining management's written approval to run queries against production data

Answer

Confirming that the CAAT software is licensed to the audit organization

Question 7

An IS auditor is evaluating how an organization manages operating system patches on internet-facing web servers. The patch management procedure requires testing in a staging environment, approval by the change manager, and deployment within 30 days of release. The auditor finds that emergency patches for critical vulnerabilities are deployed directly to production within 24 hours without staging tests. Which of the following is the MOST appropriate conclusion?

Accepted Answer

The emergency process is acceptable if it includes documented authorization, a rollback plan, and post-deployment verification.. Emergency patching is a necessary capability when critical vulnerabilities on internet-facing systems could be exploited before a normal change cycle completes. The control objective is not to prohibit the bypass but to ensure it is governed: authorized by an accountable person, accompanied by a rollback plan, and verified after deployment. If those compensating controls are documented and evidenced, the emergency path is an acceptable risk-based exception to the standard patch procedure.

Answer

The staging environment should be eliminated so all patches follow the same emergency path.

Answer

The emergency process is a control weakness because it bypasses testing entirely.

Answer

The 30-day deployment window for routine patches is too long and should be shortened to 7 days.

Question 8

An IS auditor is reviewing an organization's IT operations incident management process. The auditor finds that incidents are categorized and prioritized, but there is no formal escalation procedure. Which TWO of the following are the MOST significant risks of not having an escalation procedure? (Choose two.)

Accepted Answer

Critical incidents may not be escalated to senior management in a timely manner, delaying decision-making.. A formal escalation procedure defines when and how incidents should be escalated to higher tiers of support or management. Without it, critical incidents may not receive timely attention from senior management, and support staff may lack clear criteria for involving higher-level resources. These two risks can lead to extended outages, poor decision-making, and increased business impact. The other options describe issues related to documentation, prioritization, or over-escalation, which are less directly caused by the absence of an escalation procedure.

Answer

The organization may incur unnecessary costs by over-escalating minor incidents to senior management.

Answer

Incidents may be resolved without proper documentation, leading to incomplete records.

Answer

Incidents may be incorrectly prioritized, leading to a focus on low-impact issues.

Question 9

An IS auditor is reviewing the requirements definition phase of a new system development project. The auditor finds that business users have provided functional requirements, but non-functional requirements are largely missing. Which TWO of the following are the MOST significant risks of proceeding without well-defined non-functional requirements? (Choose two.)

Accepted Answer

The system may lack necessary security controls.. Non-functional requirements cover critical aspects such as performance, scalability, security, and availability. Omitting them increases the risk that the system will fail to meet operational expectations and security needs. These failures can lead to system outages, data breaches, and user rejection, making them the most significant risks.

Answer

The development team may not understand the business processes.

Answer

The project may exceed its budget due to scope creep.

Answer

The system may be difficult to maintain due to lack of documentation.

Question 10

An organization is implementing a new human resources system. The IS auditor wants to determine whether the system will enforce segregation of duties (SoD) for sensitive transactions such as payroll changes and employee master data updates. Which of the following is the MOST appropriate source of evidence?

Accepted Answer

Review of the role design and access control configuration within the application, including conflicting role analysis.. Segregation of duties in an application is enforced through role design and access control settings. The auditor obtains the strongest evidence by examining how roles are defined, which permissions are assigned, and whether conflicting combinations are identified and blocked. Policy documents, interviews, and access request forms are all indirect and do not prove that the system itself prevents a single user from performing incompatible payroll and master data functions.

Answer

Interviews with HR managers to confirm that they monitor user activity and would detect any conflicting transactions.

Answer

Review of the user access request forms to confirm that each user's manager approved the requested access.

Answer

Inspection of the organization's written security policy that prohibits employees from performing conflicting duties.

Question 11

An IS auditor is assessing the capacity management process for a cloud-based enterprise resource planning (ERP) system. The organization has experienced performance degradation during peak periods, and the cloud provider's auto-scaling features are not fully utilized. Which of the following should the auditor recommend FIRST?

Accepted Answer

Implement monitoring tools to track resource utilization and performance metrics.. Effective capacity management begins with understanding current resource utilization and performance. The organization has auto-scaling capabilities but is not using them fully, and performance issues exist. Before making changes, the auditor should recommend implementing monitoring to collect data on resource usage, peak times, and bottlenecks. This data will inform whether to adjust auto-scaling policies, increase baseline capacity, or optimize the application. Monitoring is the essential first step to ensure that subsequent actions are targeted and effective.

Answer

Configure auto-scaling policies based on historical peak usage patterns.

Answer

Conduct a performance test to simulate peak loads and identify bottlenecks.

Answer

Increase the baseline capacity of the cloud infrastructure to handle peak loads.

Question 12

An IS auditor is reviewing a system development project that uses a commercial software package customized with vendor-supplied extension points. The project team has documented customizations in a separate repository but has not maintained a traceability matrix linking business requirements to configuration items. Which of the following is the GREATEST risk arising from this situation?

Accepted Answer

Future upgrades may fail or require extensive rework because the impact of vendor changes on customizations cannot be reliably assessed.. A traceability matrix connects business requirements to the configuration items and customizations that satisfy them. Without it, the organization cannot determine which customizations are affected by a vendor upgrade or patch. That uncertainty forces expensive manual analysis, delays security updates, and raises the likelihood of production failures. While testing gaps and budget overruns matter, the enduring operational risk of unmanageable upgrades is the most severe consequence for a customized commercial package.

Answer

The project may exceed its budget because customization effort cannot be accurately estimated for future phases.

Answer

Developers may introduce unauthorized changes because the separate customization repository is not integrated with the change management system.

Answer

User acceptance testing may be incomplete because test cases cannot be traced back to the original business requirements.

Question 13

An IS auditor is assessing the audit risk for an engagement covering a core banking application. The auditor determines that inherent risk is high because the application processes high-value transactions in real time. The auditor also concludes that control risk is low because strong automated controls and segregation of duties are in place and have been tested. Which of the following BEST describes the appropriate response to this assessment?

Accepted Answer

Rely on the tested controls and reduce the extent of substantive procedures accordingly. The audit risk model links inherent risk, control risk, and detection risk to overall audit risk. With strong, tested controls, control risk is assessed as low, which permits the auditor to rely on those controls and reduce the extent of substantive procedures. High inherent risk is already factored into the assessment and does not by itself justify expanding substantive testing, nor should detection risk be fixed independently of the other components.

Answer

Increase the extent of substantive testing because inherent risk is high

Answer

Reduce reliance on controls and perform more detailed transaction testing

Answer

Set detection risk at a low level regardless of the control assessment

Question 14

An IS auditor is reviewing an organization's incident management process after a ransomware attack encrypted several file servers. Which TWO of the following should the auditor verify as part of assessing the effectiveness of the incident response? (Choose two.)

Accepted Answer

Whether backups were isolated from the production network and restoration was successfully tested. Assessing incident response effectiveness requires evidence that the organization could detect and contain the attack, communicate appropriately, and recover its data. Backup isolation and tested restoration, along with adherence to the response plan for detection, containment, and communication, directly demonstrate those capabilities. The other items address preventive metrics or financial matters that do not measure response performance.

Answer

Whether the organization's antivirus signatures were updated on the same day as the attack

Answer

Whether the ransom demand was paid and whether the payment was properly authorized

Answer

Whether the organization's cyber insurance policy premium was paid before the incident occurred

Question 15

An IS auditor is evaluating how an organization detects unauthorized changes to the configuration of its internet-facing web servers. The organization runs a file integrity monitoring tool that hashes critical configuration files hourly and alerts on any hash mismatch. Which of the following is the MOST important factor in determining whether this control provides effective detection?

Accepted Answer

Alerts generated by the tool are routed to a monitored queue that is reviewed and acted upon.. Detection controls create value only when their alerts are reviewed and acted upon. A file integrity monitoring tool can hash files perfectly and still provide no protection if mismatches are logged to an unmonitored queue. Routing alerts to a staffed queue with defined response procedures connects detection to action, making it the most important factor. Algorithm strength, polling frequency, and baseline placement matter, but each is secondary to whether someone responds to the alert.

Answer

The tool uses a well-known cryptographic hash algorithm such as SHA-256.

Answer

The baseline of approved file hashes is stored on the same server being monitored.

Answer

The tool hashes files every hour rather than in real time.

Question 16

An organization is acquiring a new software package. The IS auditor is asked to review the contract with the vendor. Which of the following clauses is MOST important to ensure the organization can continue to use the software even if the vendor goes out of business?

Accepted Answer

Software escrow agreement.. A software escrow agreement is designed to protect the customer by providing access to source code and documentation if the vendor cannot fulfill its obligations, such as bankruptcy or acquisition. This enables the organization to maintain, modify, and continue using the software, ensuring business continuity. It is the key contractual safeguard against vendor failure.

Answer

Acceptance testing criteria.

Answer

Service level agreement (SLA) with performance metrics.

Answer

Indemnification clause.

Question 17

An IS auditor is reviewing a post-implementation review (PIR) of a new CRM system. The auditor finds that the project was completed on time and within budget, but the business case benefits have not been realized. Which of the following is the MOST likely cause?

Accepted Answer

The project team focused on technical delivery rather than business outcomes.. When a project is delivered on time and within budget but benefits are not realized, the root cause is often that the project was managed as a technical exercise rather than a business change initiative. Without explicit focus on benefit realization, user adoption, and process alignment, the system may not deliver the expected value.

Answer

The PIR was conducted too early to measure benefits.

Answer

The system was delivered with more features than required, leading to complexity.

Answer

The budget was insufficient to cover change management activities.

Question 18

An IS auditor is reviewing an organization's network segmentation design. The organization states that its cardholder data environment is isolated from the corporate network. During testing, the auditor discovers that a management VLAN can reach both environments and that the firewall permits administrative protocols from the management VLAN to any host. Which of the following is the auditor's BEST conclusion?

Accepted Answer

Segmentation is ineffective because the management VLAN provides a path that bypasses the intended isolation.. Segmentation depends on preventing any path between environments that should not communicate. A management VLAN with administrative protocol access to any host in both the cardholder data environment and the corporate network creates exactly such a path, so the isolation claim fails. Encryption, internal origin, and presumed trust of administrative traffic do not remove the reachability that allows lateral movement, and the auditor should report the design as ineffective.

Answer

Segmentation is effective because administrative traffic is trusted and exempt from segmentation controls.

Answer

The finding is not significant because the management VLAN is internal to the organization.

Answer

The finding is acceptable if management traffic is encrypted with strong ciphers.

Question 19

An IS auditor is examining how a retail bank protects stored cardholder data. The bank encrypts the primary account number in its customer database using AES-256, but the auditor learns that the encryption keys are stored in a configuration file on the same database server, readable by the database administrator account. Which of the following is the MOST appropriate conclusion?

Accepted Answer

The encryption is ineffective for protecting confidentiality because the key is exposed wherever the data is exposed.. Strong encryption depends on keeping the key outside the reach of anyone who can access the ciphertext. When the key file sits on the database server and is readable by the database administrator, the separation of duties that gives encryption its value disappears, and a single compromised account yields both data and key. The auditor should conclude that confidentiality protection is defeated and recommend a dedicated key-management capability such as a hardware security module.

Answer

The finding is acceptable provided the database administrator's activity is logged and reviewed monthly.

Answer

The bank should migrate the keys to a hardware security module but may continue storing them with the database until the migration completes.

Answer

The encryption remains effective because AES-256 is computationally infeasible to break by brute force.

Question 20

An IS auditor is reviewing how a retail company protects stored payment card data. The company states it encrypts card numbers using AES-256, but the auditor finds that the database encryption keys are stored in a plaintext configuration file on the same application server as the encrypted data. Which of the following is the auditor's PRIMARY concern?

Accepted Answer

Storing the key with the encrypted data on the same server defeats the protection the encryption is meant to provide.. Encryption only reduces risk if the key is protected independently of the ciphertext and the host that processes it. A plaintext key file on the same application server means a single compromise exposes both data and key, nullifying the protection. Proper key management places keys in a dedicated key management system or hardware security module with strict access controls, separation from data, and documented lifecycle procedures.

Answer

Cardholder data should be tokenized instead of encrypted.

Answer

AES-256 is insufficient for protecting cardholder data at rest.

Answer

The encryption keys are not rotated frequently enough.