CISA Practice Exam 58 — 20 Questions

Question 1

An organization is implementing a new IT governance framework. Which of the following is the BEST approach to ensure alignment between IT strategy and business goals?

Accepted Answer

Establish an IT steering committee with business representation. An IT steering committee with both IT and business leaders ensures continuous strategic alignment by involving business stakeholders in IT decision-making. Option A is incorrect because aligning the IT budget with a previous year's business plan uses outdated information and does not guarantee alignment with current goals. Option B is incorrect because annual IT strategy reviews independent of business cycles create a disconnect between IT and business priorities. Option D is incorrect because delegating IT strategy solely to the CIO without business input can lead to misalignment with organizational objectives.

Answer

Align IT budget with the previous year's business plan

Answer

Conduct annual IT strategy reviews independent of business cycles

Answer

Delegate IT strategy to the CIO without business input

Question 2

An organization has a policy requiring all employees to complete annual information security awareness training. Which of the following is the BEST way to verify compliance with this policy?

Accepted Answer

Review training completion records from the learning management system. Reviewing training completion records directly confirms that employees have completed the required annual information security awareness training. Option A (phishing simulation tests) evaluates susceptibility to phishing but does not verify training completion. Option B (surveying satisfaction) measures perception, not compliance. Option C (interviewing HR about content) does not provide evidence of individual completion.

Answer

Conduct phishing simulation tests

Answer

Survey employees about their satisfaction with training

Answer

Interview HR about training content

Question 3

An IS auditor is reviewing the balanced scorecard for IT. Which of the following metrics BEST aligns with the 'customer perspective'?

Accepted Answer

Average system uptime for critical applications. Average system uptime for critical applications directly measures IT service availability from the customer's perspective. In the balanced scorecard framework, the customer perspective focuses on how end users experience IT services. The other options align with different perspectives: B (under budget) is financial, C (change requests on time) is internal processes, and D (ITIL certification) is learning and growth.

Answer

Percentage of IT projects under budget

Answer

Number of change requests completed on time

Answer

Percentage of staff with ITIL certification

Question 4

A financial institution operates a critical payment processing system that must maintain 99.999% availability. The system is deployed across two data centers in active-active mode with load balancing. During a routine maintenance window, a network misconfiguration caused all traffic to be directed to one data center, which then became overloaded and crashed, resulting in 30 minutes of downtime. The incident response team wants to prevent recurrence. Which of the following is the BEST action?

Accepted Answer

Configure health checks on the load balancers to detect and isolate unhealthy nodes.. Configuring health checks on load balancers would have detected the overloaded data center and isolated it, preventing the crash and downtime. Option B is administrative and does not prevent the technical root cause. Option C is costly and does not prevent misconfiguration. Option D describes a reactive measure that does not address the immediate traffic redirection issue.

Answer

Schedule all maintenance during non-peak hours only.

Answer

Increase the capacity of each data center to handle full traffic load.

Answer

Implement automatic failover to the backup data center when a threshold is exceeded.

Question 5

A financial services company is migrating its core banking system to a public cloud to improve scalability and reduce costs. The project is high-risk due to regulatory compliance requirements (e.g., data residency, audit trails). The IT governance committee has reviewed the project plan and finds that the risk assessment is incomplete – it does not address the potential impact of a cloud provider outage on critical transactions. The committee must approve the project or request changes. The project manager argues that the cloud provider's SLA guarantees 99.99% uptime and that additional controls would delay the project. What should the governance committee do?

Accepted Answer

Request a revised risk assessment that includes contingency plans for provider outages.. The governance committee's role is to ensure that all significant risks are identified and mitigated before approval. The risk assessment is incomplete as it does not address the impact of a cloud provider outage on critical transactions. Requiring a revised risk assessment that includes contingency plans for provider outages is a proper governance response. Option A is wrong because it preemptively rejects the project without considering updated risk information. Option C is wrong because the SLA does not eliminate the need for contingency planning or address other compliance risks. Option D is wrong because a pilot for non-critical systems does not resolve the missing risk assessment for the core banking migration.

Answer

Reject the project and require the system to remain on-premises.

Answer

Approve the project based on the provider's strong SLA.

Answer

Approve a pilot migration for non-critical systems first.

Question 6

An IS auditor is reviewing the privileged access management (PAM) process. Which TWO of the following are the MOST effective controls to prevent misuse of privileged accounts?

Accepted Answer

Session recording and monitoring of privileged activities. Session recording and monitoring (A) allows audit and review of all actions, deterring misuse. Just-in-time (JIT) privileged access (B) grants temporary permissions only when needed, reducing the attack surface. Quarterly review (C) is detective, not preventive. Generic accounts assigned to multiple users (D) increase risk of unauthorized use and lack accountability. Shared passwords for emergency access (E) also reduce accountability and can be misused.

Answer

Quarterly review of privileged account access

Answer

Assignment of generic administrative accounts to multiple users

Answer

Use of shared passwords for emergency access

Question 7

An IS auditor is reviewing a post-implementation review of a new payroll system. Which TWO findings should most concern the auditor? (Select two.)

Accepted Answer

User acceptance testing did not include all payroll scenarios.. Inaccurate pay calculations (E) directly impact financial accuracy and employee trust, posing a high risk. User acceptance testing that did not cover all payroll scenarios (B) indicates that the system may have undiscovered defects, leading to potential operational failures and control weaknesses.

Answer

The project was completed 10% over budget.

Answer

The vendor's implementation team was helpful.

Answer

The system's response time is slower than expected.

Question 8

During a software asset management (SAM) audit, it is discovered that the organization is using software that has reached end-of-life. Which of the following is the MOST significant risk associated with this situation?

Accepted Answer

Lack of security patches. End-of-life software no longer receives security patches from the vendor, meaning any newly discovered vulnerabilities will remain unaddressed. This creates a direct and exploitable attack surface, making lack of security patches the most significant risk because it can lead to data breaches, system compromise, and regulatory non-compliance.

Answer

Incompatibility with new hardware

Answer

Increased maintenance costs

Answer

License compliance issues

Question 9

During a change management audit, an IS auditor finds that a critical system change was approved by the change manager without a CAB meeting. The change was categorized as a standard change. Which of the following should the auditor do FIRST?

Accepted Answer

Determine if the change was correctly classified as standard. The auditor's first step must be to verify whether the change was correctly classified as a standard change, because standard changes are pre-approved and do not require a CAB meeting. If the classification is correct, the process was followed; if not, the lack of CAB approval is a control failure. This aligns with ITIL best practices, where standard changes are low-risk, pre-authorized changes with a defined procedure, and the auditor must confirm the classification before escalating or recommending action.

Answer

Report a lack of segregation of duties

Answer

Recommend immediate rollback of the change

Answer

Escalate to senior management

Question 10

Which TWO of the following are examples of detective controls? (Choose two.)

Accepted Answer

Regular review of security incident logs.. Regular review of security incident logs (B) and intrusion detection system (IDS) alerts (C) are detective controls that identify events after they occur.

Answer

Firewall rules that block unauthorized traffic.

Answer

Encryption of sensitive data at rest.

Answer

Access control lists (ACLs) on network devices.

Question 11

An IS auditor is reviewing change management for a financial application. Which TWO of the following findings would most likely indicate a control weakness?

Accepted Answer

Regression testing is not performed for minor changes.. Regression testing ensures that code changes do not introduce new defects into existing functionality. Skipping regression testing for minor changes is a control weakness because even small modifications can have unintended side effects in a financial application where accuracy and reliability are critical. Without regression testing, the organization risks undetected errors that could lead to financial misstatements or system instability.

Answer

Normal changes are tested in a development environment before production.

Answer

The change advisory board meets weekly to review all changes.

Answer

All changes are documented in a change log.

Question 12

Which THREE of the following are key metrics to include in a disaster recovery test report? (Select exactly 3.)

Accepted Answer

Amount of data lost (actual vs. RPO). The amount of data lost (actual vs. RPO) directly measures whether the recovery process met the Recovery Point Objective. This metric validates the effectiveness of backup frequency and replication lag, which is critical for determining if the DR plan preserved data integrity within acceptable loss limits.

Answer

Cost per incident

Answer

Number of personnel involved

Question 13

An organization is selecting a vendor for a new enterprise resource planning (ERP) system. Which of the following is the MOST critical factor in the vendor selection process?

Accepted Answer

Clearly define business requirements before issuing the request for proposal (RFP).. Clearly defining business requirements before issuing the RFP is the most critical factor because it ensures that the ERP system will align with the organization's operational needs, processes, and data flows. Without a precise requirements definition, the RFP will lack the necessary evaluation criteria, leading to mismatched vendor proposals, scope creep, and potential project failure. This step directly impacts the success of the acquisition, as it forms the foundation for all subsequent vendor evaluation and contract negotiations.

Answer

Negotiate service level agreements (SLAs) in the contract.

Answer

Check vendor references for similar projects.

Answer

Evaluate vendor financial stability.

Question 14

An organization is planning to replace its legacy accounting system with a commercial off-the-shelf (COTS) software package. Which of the following is the PRIMARY risk of using a COTS solution?

Accepted Answer

The software may not fully align with the organization's business processes. The primary risk of a COTS solution is that it is designed for a broad market and may not fully align with the organization's specific business processes. This misalignment can force the organization to change its workflows or perform costly customizations, which can negate the benefits of a packaged solution and introduce project delays or failures.

Answer

The total cost of ownership is likely to be higher than custom development

Answer

The software may have inherent security vulnerabilities

Answer

Vendor support may be discontinued after a few years

Question 15

A healthcare organization has implemented a data classification policy with three levels: Public, Internal, and Restricted. The IT department recently received a report of a potential data breach. An internal auditor discovered that a database containing Protected Health Information (PHI) classified as Restricted was accessible via a web application that did not enforce encryption in transit. The web application uses HTTPS, but the auditor found that the connection was downgraded to HTTP due to a misconfiguration in the load balancer. Additionally, the database logs show that an external IP address queried the database for thousands of patient records over a two-hour period. The database was configured to allow only specific internal application servers, but the firewall rule was incorrectly set to allow connections from any IP address. The security team needs to determine the most effective immediate action to prevent further unauthorized access and protect the data. Which course of action should the security team take FIRST?

Accepted Answer

Correct the firewall rule to restrict database access to only the application servers.. The firewall rule is the root cause of the unauthorized access — it allowed connections from any IP address, directly enabling the external attacker to query the database. Correcting this rule immediately cuts off all external access to the database, stopping the ongoing breach at the network layer. This is the most effective immediate action because it addresses the misconfiguration that allowed the attack to succeed, regardless of the encryption or web application issues.

Answer

Redesign the network architecture to place the database in a separate subnet.

Answer

Block the external IP address at the network perimeter.

Answer

Apply a security patch to the web application to enforce HTTPS.

Question 16

An e-commerce company stores customer payment card data in a tokenized database. The tokenization system replaces credit card numbers with tokens, and the actual card numbers are stored in a separate, highly restricted vault. The company is audited for Payment Card Industry Data Security Standard (PCI DSS) compliance. During the audit, it is discovered that the tokenization system sometimes fails due to high load, causing the application to fall back to storing actual card numbers temporarily. This fallback mechanism was not documented or approved. The company also uses the same encryption key for the vault as for other non-sensitive data. The auditor identifies several non-compliances. Which of the following should the company prioritize to remediate?

Accepted Answer

Remove the fallback mechanism and ensure the tokenization system has appropriate redundancy. The highest priority is to remove the fallback mechanism (option B) because it directly exposes actual cardholder data when tokenization fails, violating PCI DSS requirement 3.4 to render stored cardholder data unreadable. While using a separate encryption key for the vault (option C) is important, the fallback mechanism represents an immediate and undocumented data exposure risk. Therefore, eliminating this fallback and ensuring redundancy in the tokenization system should be the priority.

Answer

Replace the tokenization system with end-to-end encryption

Answer

Use a separate encryption key for the vault

Answer

Increase the capacity of the tokenization server to handle peak loads

Question 17

An organization is selecting a disaster recovery (DR) site. The primary data center is located in a region prone to earthquakes. The DR site should be at a sufficient distance to avoid the same disaster. Which type of alternate site provides the best balance of cost and recovery time for a medium-sized organization?

Accepted Answer

Warm site. A warm site is partially configured with some hardware, software, and data synchronization, offering a balance between cost and recovery time. For a medium-sized organization, it provides faster recovery than a cold site while being significantly less expensive than a hot site, making it suitable for a region prone to earthquakes where the DR site must be geographically distant.

Answer

Hot site

Answer

Mobile site

Answer

Cold site

Question 18

Match each security control to its category.

Accepted Answer

Firewall: Prevents unauthorized network access by filtering traffic.. Firewalls are preventive controls that block unauthorized access, IDS are detective controls that monitor and alert, and data backups are corrective controls that restore data after loss. The distractors swap these definitions.

Answer

Firewall: Monitors network traffic for suspicious activity and alerts.

Answer

Intrusion Detection System (IDS): Restores lost or corrupted data from copies.

Answer

Data Backup: Prevents unauthorized network access by filtering traffic.

Question 19

A financial services company is developing a new customer-facing web application for account management. The project is using a waterfall methodology. The initial requirements were gathered six months ago, and the coding phase is nearly complete. The business sponsor now requests a new feature that allows customers to view transaction receipts online. The project manager is concerned that this change will delay the project by two months and exceed the budget. The sponsor insists that the feature is critical for customer satisfaction and that the project must adapt. The development team estimates it will take 200 hours to implement. The steering committee is divided. As an IS auditor, what would be the BEST recommendation to resolve this?

Accepted Answer

Formally submit a change request, assess the impact on cost and schedule, and obtain approval from the change control board before proceeding.. In a waterfall methodology, changes after the coding phase require a formal change control process to assess impact on cost, schedule, and scope. The correct answer is A because submitting a change request to the change control board (CCB) ensures that the 200-hour effort, two-month delay, and budget overrun are evaluated against business priorities, maintaining project governance and auditability. This aligns with ISACA’s guidance on managing scope creep in systems development.

Answer

Terminate the current project and launch a new project incorporating the new feature.

Answer

Advise the sponsor to postpone the feature until the next release and continue as planned.

Answer

Instruct the development team to implement the feature immediately to satisfy the sponsor.

Question 20

Which of the following is the PRIMARY purpose of an IT governance framework?

Accepted Answer

To ensure IT aligns with and supports business strategy. The primary purpose of an IT governance framework is to ensure that IT investments, strategies, and operations are aligned with and support the overall business strategy, enabling the organization to achieve its goals. This alignment is achieved through mechanisms such as strategic planning, portfolio management, and performance measurement, which are core to frameworks like COBIT 2019. Without this alignment, IT may operate in isolation, leading to wasted resources and missed business opportunities.

Answer

To ensure compliance with laws and regulations

Answer

To protect IT assets from cyber threats

Answer

To reduce IT operational costs