CISA Practice Exam 59 — 20 Questions

Question 1

Based on the exhibit, what is the MOST appropriate action for IT management?

Accepted Answer

Investigate the reasons for the shortfall and implement corrective actions.. The actual score (82%) is below the target (85%), so IT management should investigate the reasons for the shortfall and implement corrective actions to close the gap. Option B (ignoring the variance) is not acceptable because the performance is below target and not within the acceptable range. Option C (adjusting the target to 80%) is premature without first understanding the root cause. Option D (replacing the survey) is an overreaction without evidence that the measurement tool is flawed.

Answer

Ignore the variance as it is within acceptable range.

Answer

Adjust the target to 80% to match actual performance.

Answer

Replace the survey with a different measurement tool.

Question 2

An organization's IT service desk is the single point of contact for all incidents. The SLA for resolving P2 incidents is 8 hours. The auditor finds that the service desk frequently reassigns P2 incidents to second-level support without updating the incident record, causing delays in resolution. The average resolution time for P2 incidents is 10 hours. What is the primary control weakness?

Accepted Answer

Lack of automated escalation and tracking for incident reassignments.. The primary control weakness is the lack of automated escalation and tracking for incident reassignments. Without automated mechanisms (e.g., workflow triggers, timestamped reassignment logs, or integration with IT service management tools), the service desk can reassign P2 incidents to second-level support without updating the incident record, leading to untracked delays. This directly violates the SLA of 8 hours, as the average resolution time of 10 hours indicates that incidents are not being monitored or escalated properly, causing them to exceed the target.

Answer

Inadequate training of service desk staff.

Answer

SLA targets are too aggressive for P2 incidents.

Answer

Insufficient number of second-level support staff.

Question 3

An organization is implementing COBIT 2019 to improve IT governance. Which of the following is a key component of the governance system according to COBIT 2019?

Accepted Answer

Processes. COBIT 2019 defines seven components of a governance system: Processes, Organizational Structures, Principles, Policies and Frameworks, Culture, Ethics and Behavior, Information, Services, Infrastructure and Applications, and People, Skills and Competencies. Options A, C, and D are all valid components. Option B (Service level agreements) is not a component.

Answer

Service level agreements

Question 4

Arrange the steps to configure a firewall rule in the correct order.

Accepted Answer

Policy, then Specifics, then Action, then Application, then Testing. Firewall rule configuration begins with policy, then specifics, action, application, and testing.

Answer

Specifics, then Policy, then Action, then Application, then Testing

Answer

Policy, then Specifics, then Application, then Action, then Testing

Answer

Policy, then Action, then Specifics, then Application, then Testing

Question 5

An IT steering committee is evaluating a proposal to migrate critical applications to the cloud. Which factor is MOST important to ensure alignment with business strategy?

Accepted Answer

How the cloud migration supports the organization's strategic objectives. IT strategy alignment requires that IT investments directly support business goals, such as enabling new business capabilities.

Answer

The migration schedule and resource availability

Answer

The cloud provider's security certifications

Answer

Cost savings compared to on-premises solution

Question 6

A system has a Mean Time Between Failures (MTBF) of 500 hours and a Mean Time To Repair (MTTR) of 20 hours. What is the availability of the system?

Accepted Answer

96.15%. Availability is calculated as MTBF / (MTBF + MTTR). With MTBF = 500 hours and MTTR = 20 hours, availability = 500 / (500 + 20) = 500 / 520 ≈ 0.9615, or 96.15%. This formula measures the proportion of time the system is operational, directly reflecting its resilience and recoverability.

Answer

97.50%

Answer

92.00%

Answer

95.00%

Question 7

Based on the exhibit, the IS auditor is reviewing access to the payroll folder. Which of the following is the MOST significant finding?

Accepted Answer

Potential excessive privileges for user jdoe due to overlapping permissions. The most significant finding because user jdoe has overlapping permissions from multiple group memberships (e.g., HR_Managers and Payroll_Admin), which can result in unintended cumulative effective permissions. In Windows NTFS, effective permissions are the sum of all allowed permissions from each group, minus any explicit denies, so overlapping group memberships often grant more access than intended, violating the principle of least privilege.

Answer

Internal_Audit group has Read access to payroll data

Answer

User asmith has only Read access to payroll

Answer

HR_Managers group has Full Control over payroll

Question 8

A company has been developing a custom inventory management system using Scrum. In the current sprint, the team discovered that the integration module with the legacy ERP system has severe performance issues: under peak load, transactions time out and fail. The product owner is concerned because the release is scheduled in two weeks. The development team estimates that a proper fix will take three weeks. A similar issue occurred in a previous sprint and was temporarily resolved by reducing the number of concurrent transactions, which lowered performance but kept the system operational. The stakeholders are anxious about the deadline because the legacy ERP will be retired shortly after the planned go-live. What is the BEST action for the team to take?

Accepted Answer

Delay the release by one week to complete the proper fix (three weeks total). Delaying the release by one week allows the team to implement a proper, permanent fix for the ERP integration module's performance issue, which is critical given that the legacy ERP will be retired shortly after go-live. A temporary workaround would risk system instability and transaction failures under peak load, potentially causing data loss or corruption during the transition. The three-week estimate for a proper fix addresses the root cause, ensuring the system can handle peak loads reliably before the legacy system is decommissioned.

Answer

Reduce the scope of the release to exclude the ERP integration feature entirely

Answer

Add two additional developers to the team to complete the fix within the original two-week timeline

Answer

Apply the same workaround for the go-live and plan a permanent fix in a later release

Question 9

A company is integrating a third-party payment gateway into its e-commerce platform. Which of the following is the MOST important security control to implement?

Accepted Answer

Validate all input from the payment gateway. Input validation from the payment gateway is the most critical security control. The payment gateway returns data (e.g., transaction status, amount, token) that is consumed by the e-commerce platform. Without strict validation, an attacker could inject malicious payloads (e.g., SQL injection, XSS) via manipulated gateway responses, leading to data breaches or unauthorized transactions. This control directly prevents injection attacks at the integration boundary.

Answer

Implement role-based access control

Answer

Log all transactions

Answer

Encrypt all data with SSL

Question 10

An IS auditor is assessing the effectiveness of an organization's IT governance framework. Which THREE of the following are key indicators of a mature governance process?

Accepted Answer

Defined roles and responsibilities for IT decisions. Defined roles and responsibilities for IT decisions (Option A) are a key indicator of a mature IT governance process because they establish clear accountability and authority, aligning with frameworks like COBIT 5. This ensures that decision-making rights are assigned to specific roles (e.g., IT steering committee, CIO, business process owners), reducing ambiguity and enabling effective oversight. Without such definition, governance lacks the structural foundation needed for consistent and auditable decision-making.

Answer

Annual IT budget approval by senior management

Answer

Outsourcing of all IT operations

Question 11

An IS auditor is reviewing a system development project and notices that user acceptance testing (UAT) is being conducted in the production environment due to lack of a separate test environment. What is the primary risk?

Accepted Answer

Security breaches due to unauthorized access. Conducting UAT in production exposes sensitive production data and live systems to test scripts and users who may not have proper authorization, creating a direct path for security breaches. Production environments typically have broader access controls and audit trails that are not designed to isolate test activities, increasing the risk of unauthorized data exposure or modification. This violates the principle of segregation of duties and can lead to compliance issues with standards like PCI DSS or HIPAA.

Answer

System availability issues

Answer

Performance degradation

Answer

Data integrity violations

Question 12

The exhibit shows a log entry from a domain controller. The IS auditor is investigating account lockout issues. What is the MOST likely cause of this event?

Accepted Answer

Multiple failed authentication attempts from the backup server. The log entry shows a failed authentication attempt from the backup server's IP address (10.0.0.15) using the service account 'svc_backup'. The event ID 4625 indicates an account logon failure, and the 'Failure Reason' field explicitly states 'Unknown user name or bad password'. Since the account name is correct, the most likely cause is multiple failed authentication attempts (e.g., due to a stale or incorrect password cached in the backup software) leading to account lockout, not a single event.

Answer

The service account password has expired

Answer

The service account does not exist

Answer

The service account has been disabled by an administrator

Question 13

An organization has decentralized IT management with each business unit making its own technology decisions. Which of the following is the BEST way to maintain enterprise-wide governance?

Accepted Answer

Establish an enterprise architecture review board with representatives from all business units.. An enterprise architecture review board with representatives from all business units ensures alignment with enterprise-wide standards and governance while respecting decentralized decision-making. Option A is too prescriptive and may not fit all units. Option B centralizes approval, which undermines decentralization. Option C addresses budgeting, not governance of IT decisions.

Answer

Deploy a single enterprise resource planning (ERP) system across all units.

Answer

Require all IT projects to be approved by the corporate IT department.

Answer

Create a central IT budget that allocates funds to business units.

Question 14

An organization is developing a mobile app that will handle personal health information (PHI). The security team mandates that data must be encrypted both in transit and at rest. Which of the following implementation strategies BEST ensures compliance?

Accepted Answer

Implement TLS for data in transit and AES-256 encryption for data at rest. It uses TLS (the modern, secure successor to SSL) to encrypt data in transit, ensuring confidentiality and integrity during network communication, and AES-256, a strong symmetric encryption standard, to encrypt data at rest. This combination directly satisfies the mandate for encryption both in transit and at rest, as TLS protects against eavesdropping and tampering on the wire, while AES-256 protects stored PHI from unauthorized access if the device is lost or compromised.

Answer

Use HTTPS for all network communication and store data in plaintext

Answer

Use SSL and encrypt all data with a simple XOR cipher

Answer

Rely on platform-level encryption provided by the mobile OS

Question 15

Which THREE of the following are common risks associated with outsourcing software development?

Accepted Answer

Quality issues due to lack of oversight. Outsourcing software development often results in quality issues due to the client's limited visibility into the vendor's development processes, testing rigor, and adherence to coding standards. Without direct oversight, defects may go undetected until later stages, increasing rework costs and project delays.

Answer

Faster time to market

Answer

Increased internal control

Question 16

An organization is using a spiral model for a high-risk project. The IS auditor wants to ensure that risk assessment is performed at each iteration. Which of the following is the BEST evidence that this control is effective?

Accepted Answer

Each spiral iteration includes a risk analysis document. In the spiral model, each cycle includes risk analysis; documented risk assessments in iteration artifacts demonstrate this.

Answer

The project schedule shows spiral iterations

Answer

The project manager has a risk management plan

Answer

The system has passed user acceptance testing

Question 17

During an audit of a cloud service provider, the IS auditor finds that the provider's datacenter access logs show multiple successful logins by an employee during non-business hours over several weeks. The employee works in the sales department. What should the auditor do first?

Accepted Answer

Discuss with the employee's supervisor to verify if access was authorized.. The IS auditor's first priority is to gather evidence and understand the context before taking action. The employee's sales role and non-business hours access may be legitimate (e.g., supporting a client in a different time zone). Discussing with the supervisor is a standard audit procedure to verify authorization, aligning with ISACA's audit evidence collection and due professional care.

Answer

Recommend disabling the employee's access immediately.

Answer

Review the access rights policy and compare with actual access.

Answer

Report the finding immediately to senior management.

Question 18

During an ERP implementation, the project team decides to customize the software to align with existing business processes. Which of the following risks is MOST likely to increase as a result of extensive customization?

Accepted Answer

Higher costs for future upgrades. Extensive customization of an ERP system typically involves modifying the core code or configuration beyond standard parameters. This creates a custom code base that diverges from the vendor's standard release, making future upgrades significantly more complex and costly because each upgrade requires re-applying and testing all customizations against the new version, often requiring specialized skills and extensive regression testing.

Answer

Increased vendor lock-in

Answer

Simpler data migration

Answer

Reduced user acceptance

Question 19

A small manufacturing company decides to acquire an off-the-shelf inventory management system. The purchasing manager selects a vendor based solely on the lowest price, ignoring the vendor's financial stability and support history. After purchase, the vendor declares bankruptcy, leaving the company without support. The system has a critical bug that halts inventory tracking. The IT manager considers hiring a consultant to fix the bug. As an IS auditor, what should the auditor's PRIMARY concern be?

Accepted Answer

The vendor selection process lacked due diligence.. The primary concern for an IS auditor is that the vendor selection process lacked due diligence, as this directly violates the principle of proper acquisition governance. By selecting a vendor based solely on lowest price without evaluating financial stability and support history, the company exposed itself to significant operational risk, which materialized when the vendor declared bankruptcy. This oversight is a root cause failure in the information systems acquisition and implementation process, making it the most critical audit finding.

Answer

There is no backup system for inventory management.

Answer

The company may have legal recourse against the vendor.

Answer

The critical bug disrupts inventory tracking.

Question 20

Which type of disaster recovery test involves actually switching over to the alternate site and processing live transactions, but does not require the primary site to be shut down?

Accepted Answer

Parallel test. Parallel testing is the correct answer because it involves processing live transactions at the alternate site while the primary site remains fully operational. This allows validation of the disaster recovery (DR) systems without risking a service outage, as both sites run concurrently and results are compared for consistency. Unlike a full interruption test, the primary site is not shut down, ensuring business continuity during the test.

Answer

Simulation test

Answer

Full interruption test

Answer

Tabletop test