CISA Practice Exam 59 — 20 Questions

Question 1

An IS auditor is reviewing a data center's environmental controls and observes that the fire suppression system uses water sprinklers in the main server room. The auditor learns that the sprinkler system was installed when the facility was a general office space. Management states that the sprinklers have never activated. Which of the following should the IS auditor recommend as the MOST appropriate control improvement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Replace the water sprinkler system with a clean agent or pre-action suppression system appropriate for IT equipment.. Water sprinklers are inappropriate for rooms housing energized IT equipment because discharge can destroy hardware and interrupt operations far beyond the fire itself. A clean agent or pre-action system provides suppression while minimizing collateral damage. Because management's justification rests only on the absence of prior activations, the auditor should recommend replacing the suppression method rather than merely inspecting or accepting it.

Answer

Document a formal exception accepting the water sprinkler system based on its clean activation history.

Answer

Increase the frequency of sprinkler head inspections to ensure they remain operational.

Answer

Install additional smoke detectors to provide earlier warning of a fire event.

Question 2

An IS auditor is reviewing the endpoint security controls of a hospital that permits clinicians to use personal laptops and tablets to access the electronic health record (EHR) system. The auditor finds that the organization issued written acceptable-use agreements, but devices are not inspected, and no enrollment process exists. Which of the following is the MOST significant risk arising from this situation?

Accepted Answer

Unmanaged devices may retain unencrypted copies of protected health information after a clinician leaves the organization.. The defining weakness is that personally owned devices are used for clinical work without enrollment, inspection, or technical controls. That means the organization cannot enforce encryption, remote wipe, or retention limits, so protected health information can persist on hardware it does not own or manage. Data remanence on unmanaged endpoints is the most consequential risk because it directly threatens confidentiality and creates reportable breach exposure.

Answer

Personal devices may introduce malware that spreads to the EHR application servers.

Answer

Clinicians may install unauthorized software that consumes excessive bandwidth on the hospital network.

Answer

The acceptable-use agreement may be unenforceable because it was not signed by a witness.

Question 3

An IS auditor is reviewing a biometric access control system used to protect a data center. The system uses fingerprint recognition and is configured so that any single enrolled user who fails three consecutive attempts is locked out and must be re-enrolled by security staff. Which of the following is the MOST significant security concern with this configuration?

Accepted Answer

The lockout and re-enrollment process creates a denial-of-service and administrative burden risk.. The configuration described makes repeated lockouts easy to trigger and requires security staff to re-enroll affected users, which can deny access to legitimate personnel and create an administrative bottleneck. That operational and availability exposure is more significant than general biometric tuning questions such as false acceptance rate, skin variability, or the absence of a second factor, none of which are uniquely highlighted by the configuration as described.

Answer

The system does not combine biometrics with a second authentication factor.

Answer

The false acceptance rate may be too high for a high-security environment.

Answer

Fingerprint biometrics can be affected by changes in the user's skin condition.

Question 4

An IS auditor is evaluating the network segmentation of a manufacturing company that separates its corporate network from the industrial control system (ICS) environment. The auditor finds that a firewall exists between the zones, but engineering workstations on the corporate network can reach programmable logic controllers directly over several open ports. Which TWO of the following findings should the auditor report as the MOST significant weaknesses? (Choose two.)

Accepted Answer

Multiple ports are open through the firewall between the corporate and ICS zones, expanding the attack surface.. Effective segmentation depends on preventing corporate systems from initiating sessions with control devices and on keeping the boundary rule set as narrow as operations allow. Direct reachability from engineering workstations to programmable logic controllers defeats the zone design, and a broad set of open ports gives attackers multiple paths into the ICS environment. Together these findings show that the firewall exists in name only and does not enforce the intended separation.

Answer

Engineering workstations are not running the same endpoint protection version as corporate desktops.

Answer

The firewall between the corporate and ICS zones does not perform deep packet inspection of industrial protocols.

Answer

The ICS network uses the same directory services as the corporate network for authentication.

Question 5

An IS auditor is reviewing an organization's data loss prevention (DLP) deployment. The auditor finds that the DLP solution is configured to monitor outbound email traffic at the network gateway, but endpoint agents are not installed on any workstations. Management states that this configuration is sufficient because all sensitive data leaves through email. Which of the following is the MOST significant risk arising from this configuration?

Accepted Answer

Sensitive data could be copied to removable media or transmitted through unmonitored channels that never traverse the email gateway.. A DLP solution that only monitors the email gateway has a fundamental coverage gap: any data leaving through endpoints—USB drives, printing, cloud sync, or non-email network protocols—is invisible. Management's assumption that all sensitive data leaves via email is unverified and likely incorrect, so the auditor should flag the absence of endpoint agents as the most significant risk to the control objective.

Answer

Email encryption will prevent the DLP solution from identifying sensitive content in outbound messages.

Answer

The DLP solution will generate an excessive number of false positives because it cannot correlate with endpoint activity.

Answer

Sensitive data could be exfiltrated through encrypted webmail sessions that the network gateway cannot inspect.

Question 6

An IS auditor is evaluating the security of an organization's wireless network. The organization uses WPA3-Enterprise with 802.1X authentication. The auditor discovers that the RADIUS server is configured to accept EAP-TLS certificates but does not validate the certificate revocation status. Which of the following is the MOST likely consequence of this configuration?

Accepted Answer

An attacker with a revoked certificate could still authenticate to the wireless network.. The lack of certificate revocation validation means the RADIUS server will accept revoked certificates, allowing devices or users whose certificates have been revoked to authenticate. This defeats a key control of PKI-based authentication, as revocation is how compromised or expired credentials are invalidated. The most likely consequence is unauthorized network access by a revoked certificate holder.

Answer

Wireless traffic could be decrypted by an attacker because the session key is not properly generated.

Answer

Clients would be unable to connect because the server would reject all certificates without revocation information.

Answer

The RADIUS server could be susceptible to a denial-of-service attack due to certificate validation overhead.

Question 7

An IS auditor is evaluating the security of an organization's wireless network. The organization uses WPA3-Enterprise with 802.1X authentication against a RADIUS server. The auditor discovers that the RADIUS server is configured to accept EAP-MD5 as an authentication method for legacy devices. Which of the following is the MOST significant security concern with this configuration?

Accepted Answer

EAP-MD5 does not support mutual authentication, allowing a rogue access point to capture user credentials.. EAP-MD5 is a legacy EAP method that authenticates only the client to the server, not the server to the client. Without mutual authentication, an attacker can deploy a rogue access point to impersonate the legitimate network, capture the client's MD5-hashed credentials, and crack them offline. Enabling EAP-MD5 on a RADIUS server for WPA3-Enterprise therefore introduces a serious credential theft vector.

Answer

EAP-MD5 requires the use of a public key infrastructure (PKI) that the organization may not have deployed.

Answer

EAP-MD5 is incompatible with WPA3-Enterprise and will cause the wireless network to fall back to WPA2.

Answer

EAP-MD5 transmits credentials in cleartext, exposing them to eavesdropping on the wireless medium.

Question 8

An IS auditor is reviewing the access control list (ACL) on a router that connects the corporate network to the internet. The auditor notices that the ACL permits inbound traffic on port 3389 (RDP) from any source IP address to a specific internal server. Which of the following is the MOST appropriate recommendation?

Accepted Answer

Restrict inbound RDP access to specific trusted IP addresses or require VPN access.. The most appropriate recommendation is to restrict inbound RDP access to specific trusted IP addresses or require VPN access. This directly reduces the exposure of the RDP service to potential attackers. While other measures like NLA or account lockout can add defense in depth, they do not address the fundamental issue of allowing RDP from any source. Restricting access is a preventive control that aligns with least privilege and reduces the attack surface.

Answer

Implement account lockout policies to prevent brute-force attacks.

Answer

Change the default RDP port to a non-standard port to obscure the service.

Answer

Enable Network Level Authentication (NLA) on the RDP server.

Question 9

An IS auditor is evaluating a data loss prevention (DLP) deployment intended to stop sensitive customer records from leaving a bank's network. Management wants assurance that the solution is operating effectively. Which TWO of the following are the MOST important factors for the auditor to assess? (Choose two.)

Accepted Answer

Whether alerts generated by the DLP solution are investigated and resolved through a defined incident process.. To judge whether DLP stops sensitive records from leaving, the auditor must confirm the rules reflect the bank's data classifications and workflows, and that generated alerts are investigated and resolved through a defined incident process. These two factors together establish that the control both detects the right events and triggers action. Platform patching, endpoint encryption, and vendor certifications address adjacent concerns but not the operational effectiveness of the DLP control itself.

Answer

Whether the DLP solution supports encryption of data at rest on endpoint devices.

Answer

Whether the DLP vendor is certified to an internationally recognized quality management standard.

Answer

Whether the DLP server's operating system has the latest vendor-recommended patch level.

Question 10

An IS auditor is reviewing an organization's security monitoring architecture. The organization uses a SIEM to collect logs from servers, firewalls, and applications. Management reports that the SIEM is functioning as designed and alerts are generated. Which of the following findings would be of MOST concern to the auditor?

Accepted Answer

Log retention is set to 30 days, and the organization's incident response procedure requires investigating events up to 90 days old.. A monitoring system is only as useful as the evidence it retains. When the configured retention period is shorter than the period the incident response process requires for investigation, the organization cannot reconstruct events that are discovered late. This misalignment between a technical setting and a documented requirement directly impairs detection follow-up and forensic analysis, making it the finding that most threatens the effectiveness of security monitoring.

Answer

Log sources use different time zone settings and the SIEM normalizes timestamps at ingestion.

Answer

The SIEM is deployed on-premises rather than as a cloud-hosted service.

Answer

The SIEM generates more alerts than the security team can review in a shift.

Question 11

An IS auditor is reviewing an organization's implementation of a security information and event management (SIEM) system. The auditor wants to assess whether the SIEM is effectively supporting incident detection and response. Which TWO of the following are the MOST important factors for the auditor to evaluate? (Choose two.)

Accepted Answer

The completeness of log sources and the timeliness of log ingestion from critical systems.. The effectiveness of a SIEM for incident detection and response hinges on two operational pillars: comprehensive, timely log ingestion from critical systems, and well-tuned correlation rules supported by defined investigation and escalation procedures. Without complete and timely data, detection is blind; without tuning and response processes, alerts are noise. Storage capacity, vendor reputation, and physical security are secondary considerations for this specific audit objective.

Answer

The brand reputation of the SIEM vendor and the number of industry awards it has received.

Answer

The physical security of the SIEM server room and the biometric access controls at the data center.

Answer

The total storage capacity of the SIEM and the compression ratio of archived logs.

Question 12

An IS auditor is reviewing the network segmentation of a retail company's cardholder data environment (CDE). The auditor finds that the CDE and the corporate user VLAN are separated by a firewall, but the same flat Layer 2 domain spans both segments, and no internal segmentation firewall exists between the CDE web tier and the CDE database tier. Which of the following findings should the auditor report as the GREATEST risk?

Accepted Answer

The CDE and corporate VLAN share a flat Layer 2 domain, allowing lateral movement without passing through the firewall.. The critical issue is that the CDE and corporate network share a flat Layer 2 domain, so hosts can communicate via ARP and MAC-level traffic without traversing the firewall. This silently defeats the intended segmentation and enables lateral movement from a compromised corporate workstation into the cardholder data environment. Eliminating the shared broadcast domain and forcing all inter-segment traffic through the firewall restores the control the organization believes is operating.

Answer

The corporate VLAN should be moved into the CDE so that all traffic is inspected by the same firewall policy.

Answer

The firewall separating the CDE and corporate VLAN is a single point of failure and should be deployed in a high-availability pair.

Answer

The absence of an internal segmentation firewall between the web tier and the database tier is the greatest risk.

Question 13

An IS auditor is evaluating a wireless network deployed in a corporate headquarters. The auditor discovers that the network uses WPA2-Enterprise with 802.1X authentication, but the RADIUS server accepts any client presenting a valid domain user account, including accounts belonging to recently terminated employees that have not yet been disabled. Which of the following is the GREATEST risk arising from this configuration?

Accepted Answer

Former employees with still-valid accounts could authenticate to the internal network and access resources.. The finding is that authentication succeeds for accounts belonging to terminated employees, meaning the RADIUS server does not enforce timely deprovisioning. Because 802.1X grants network access on successful authentication, a former employee can re-enter the internal network using valid credentials. The primary risk is unauthorized internal access through a logical access control failure, not encryption weakness or rogue devices.

Answer

Rogue access points could be introduced without detection by the wireless intrusion prevention system.

Answer

Wireless traffic could be decrypted by anyone monitoring the radio frequency spectrum.

Answer

Attackers could capture and crack the pre-shared key used for wireless encryption.

Question 14

An IS auditor is reviewing an organization's backup and recovery procedures for a critical database. The backup policy states that full backups are performed weekly and transaction log backups every 15 minutes. The recovery point objective (RPO) for the database is 5 minutes. Which of the following is the MOST appropriate recommendation?

Accepted Answer

Increase the frequency of transaction log backups to meet the 5-minute RPO.. The RPO of 5 minutes means the organization can tolerate losing at most 5 minutes of data. Transaction log backups every 15 minutes create a potential 15-minute data loss window, exceeding the RPO. The auditor should recommend increasing the frequency of transaction log backups to 5 minutes or less to meet the stated recovery objective.

Answer

Implement database mirroring to provide a real-time copy and eliminate the need for transaction log backups.

Answer

Document the current backup schedule as an accepted risk because the RPO is only a guideline.

Answer

Perform full backups more frequently, such as daily, to reduce the potential data loss.

Question 15

An IS auditor is reviewing the physical security controls at a data center that hosts the organization's primary transaction processing systems. The auditor observes that the data center uses a single-factor proximity card reader at the main entrance, the server room door is propped open during a vendor maintenance visit, and CCTV cameras record continuously but recordings are retained for only seven days. Which of the following should the auditor identify as the MOST significant control weakness?

Accepted Answer

The server room door was propped open during the vendor visit, defeating the access control boundary.. The propped server room door during a vendor visit is an active failure of the physical access control boundary protecting the transaction processing systems. While single-factor entry, short CCTV retention, and lack of biometrics are all valid observations, none of them currently allows uncontrolled access to the most sensitive area. The auditor should prioritize the real-time breach and require escorted vendor procedures and door alarms.

Answer

The main entrance uses a single-factor proximity card reader instead of multifactor authentication.

Answer

CCTV recordings are retained for only seven days rather than the organization's 90-day standard.

Answer

The data center lacks biometric authentication at the server room entrance.

Question 16

An IS auditor is reviewing the physical security controls at a data center. The auditor observes that the data center has a single entrance with a biometric scanner, but the door is propped open by a cleaning cart while the cleaning staff works inside. Which of the following is the MOST appropriate action for the auditor to take?

Accepted Answer

Document the observation as a finding because the propped door defeats the access control and allows unauthorized entry.. A propped door completely bypasses the biometric access control, creating a path for unauthorized entry. The auditor should document this as a finding because it represents a failure of the physical access control objective. The appropriate recommendation would be to implement compensating controls such as door alarms, mantrap entrances, or strict policy enforcement to prevent doors from being held open.

Answer

Ignore the observation because the cleaning staff are authorized personnel who have undergone background checks.

Answer

Recommend replacing the biometric scanner with a more robust access control system.

Answer

Report the issue to the cleaning supervisor and consider the matter resolved.

Question 17

An IS auditor is evaluating how an organization disposes of decommissioned hard drives that previously stored customer financial records. Management states that drives are physically destroyed by a third-party vendor, but no certificates of destruction are retained and the vendor's personnel perform the destruction at the organization's loading dock without supervision. Which of the following is the MOST important control weakness?

Accepted Answer

Destruction is performed without supervision and no certificates of destruction are retained to evidence the disposal.. When a third party destroys media containing customer financial records, the organization remains accountable for the confidentiality of that data. Unsupervised destruction at the loading dock allows drives to be diverted or inadequately destroyed, and the absence of certificates means the organization cannot prove disposal occurred. The auditor should report the lack of supervision and destruction evidence as the most important weakness because it removes both physical control and auditability.

Answer

Physical destruction is less secure than software-based overwriting of the drives.

Answer

The third-party vendor has not been assessed for financial stability.

Answer

Drives should be degaussed before being released to the vendor.

Question 18

An IS auditor is examining how an organization classifies and handles its data. The auditor finds that the data classification policy defines four tiers but does not specify retention periods, handling procedures, or labeling requirements for each tier. Management states that employees use their judgment when handling sensitive information. Which of the following is the MOST appropriate recommendation?

Accepted Answer

Require management to define retention periods, handling procedures, and labeling requirements for each classification tier.. A data classification policy is only effective when each tier carries explicit retention, handling, and labeling requirements. The organization's policy defines tiers but leaves their treatment to employee judgment, which produces inconsistent protection and no auditable standard. The auditor should recommend that management complete the policy by specifying these requirements per tier, creating the foundation for consistent handling and subsequent enforcement through technical controls.

Answer

Implement automated data loss prevention (DLP) tools to enforce handling rules across all endpoints.

Answer

Reduce the number of classification tiers to two to simplify employee decision-making.

Answer

Conduct mandatory security awareness training so employees can better judge how to handle sensitive data.

Question 19

During a review of a data center, an IS auditor observes that backup tapes containing customer records are transported nightly by a courier to an offsite vault. The tapes are placed in sealed containers, but the auditor learns that the courier contract does not require background checks for drivers and that no encryption is applied to the tape contents. Which of the following should the auditor recommend as the MOST effective compensating control?

Accepted Answer

Implement encryption of the backup data before it is written to tape.. The exposure is that unencrypted media leaves the controlled environment in the hands of personnel who have not been screened. Because the confidentiality risk travels with the data, the durable fix is to make the data unreadable to anyone who gains possession of the tape. Encryption at the source neutralizes the threat regardless of courier behavior, while insurance, counting, and dual custody only address custody or recovery.

Answer

Require two-person integrity for the nightly tape handover at the loading dock.

Answer

Increase the frequency of tape inventory counts at both the data center and the offsite vault.

Answer

Require the courier to provide a certificate of insurance covering the value of the tapes in transit.

Question 20

An IS auditor is reviewing the logical access controls of a legacy payroll application that authenticates users directly against its own internal user table rather than the corporate directory. Management states that this was a deliberate design choice by the vendor. Which of the following is the MOST significant audit concern with this arrangement?

Accepted Answer

Password policy enforcement may be inconsistent with the corporate standard and orphaned accounts may persist.. A locally maintained user table sits outside the corporate directory, so provisioning, modification, and timely revocation depend on manual processes that frequently fail. The result is inconsistent password standards and accounts that survive termination or role change. Auditors should focus on whether identity lifecycle controls still cover the application, since that determines whether access remains authorized, least-privileged, and auditable over time.

Answer

The application's database may not be able to support concurrent user sessions at peak payroll processing times.

Answer

Users may need to remember an additional password, which could increase help desk call volume.

Answer

Vendor support for the authentication module may lapse if the application is not upgraded to the current release.