CISA Practice Test 6 — 10 Questions

Question 1

An IT department uses a balanced scorecard (BSC) to measure performance. The financial perspective shows that IT costs are within budget, but customer satisfaction scores are declining. The learning and growth perspective indicates low employee engagement. Which action should the IT governance committee prioritize?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Invest in training and development programs for IT staff.. The BSC's learning and growth perspective is the foundational driver of the other three perspectives — low employee engagement directly undermines process quality, customer satisfaction, and ultimately financial outcomes. Since customer satisfaction is already declining and the root cause traces to employee engagement, the governance committee should prioritize investing in training and development to fix the upstream cause. This aligns with the BSC's cause-and-effect logic where learning and growth improvements cascade into customer and financial results.

Answer

Reduce IT costs further to reallocate savings to customer service.

Answer

Increase the IT budget to hire more staff.

Answer

Outsource customer-facing IT support to a third party.

Question 2

An organization is implementing a software asset management (SAM) program. Which of the following is the PRIMARY benefit of SAM?

Accepted Answer

Ensuring compliance with software licensing agreements. The primary benefit of a software asset management (SAM) program is ensuring compliance with software licensing agreements, which mitigates legal, financial, and reputational risk from unlicensed or over-deployed software. SAM provides visibility into what software is installed, where, and under what license terms, enabling accurate reconciliation of entitlements versus deployments. While SAM can yield cost savings, compliance is the primary driver because non-compliance carries legal penalties and audit exposure.

Answer

Reducing hardware costs

Answer

Automating patch management

Answer

Improving network performance

Question 3

An IS auditor is evaluating the incident response (IR) plan. Which of the following is the BEST indicator that the plan is effective?

Accepted Answer

Lessons learned from tabletop exercises are incorporated into the plan. The best indicator of an IR plan's effectiveness is that lessons learned from tabletop exercises are incorporated into the plan. Tabletop exercises simulate real-world incidents, revealing gaps in procedures, communication, and decision-making. When findings from these exercises are fed back into the plan, it demonstrates a continuous improvement cycle—meaning the plan is not just a static document but a living, tested capability. This directly evidences that the plan works in practice and evolves to address weaknesses, which is the essence of effectiveness.

Answer

The plan is approved by senior management

Answer

The plan is updated annually

Answer

The plan includes contact information for key stakeholders

Question 4

A multinational corporation is replacing its legacy on-premises customer relationship management (CRM) system with a new cloud-based CRM solution. The project involves migrating data from the old system, customizing the new system to match business processes, and integrating with an existing enterprise resource planning (ERP) system. The project has a tight deadline of six months. During the planning phase, the project team decides to use a waterfall methodology because the requirements are well-defined. However, three months into the project, the business users request significant changes to the customer data fields, which were not originally specified. The project manager is concerned that accommodating these changes will delay the project. The integration with the ERP system is also proving more complex than anticipated, with data mapping errors causing delays. The go-live date is fixed due to the end-of-support for the legacy system. What is the BEST course of action for the project manager?

Accepted Answer

Conduct a formal change impact assessment and prioritize the changes; implement only critical ones for go-live. It follows the structured change management process required in a waterfall project with a fixed deadline. By conducting a formal change impact assessment, the project manager can objectively evaluate the cost, schedule, and resource implications of the requested changes. Prioritizing only critical changes for go-live ensures that the core CRM functionality is delivered on time, while non-critical enhancements can be deferred to a post-implementation phase. This approach balances the need to meet the legacy system's end-of-support deadline with accommodating essential business requirements.

Answer

Inform the business users that no changes can be made due to the fixed deadline

Answer

Delay the go-live date to accommodate all changes and integration issues

Answer

Switch to an agile methodology for the remaining three months

Question 5

An organization is selecting a disaster recovery (DR) site. The primary data center is located in a region prone to earthquakes. The DR site should be at a sufficient distance to avoid the same disaster. Which type of alternate site provides the best balance of cost and recovery time for a medium-sized organization?

Accepted Answer

Warm site. A warm site is partially configured with some hardware, software, and data synchronization, offering a balance between cost and recovery time. For a medium-sized organization, it provides faster recovery than a cold site while being significantly less expensive than a hot site, making it suitable for a region prone to earthquakes where the DR site must be geographically distant.

Answer

Hot site

Answer

Mobile site

Answer

Cold site

Question 6

Which TWO of the following are benefits of using a version control system in software development?

Accepted Answer

Rollback to previous versions. Version control systems (e.g., Git, SVN) allow developers to revert code to a previous commit or tag, enabling recovery from bugs or regressions. This rollback capability is a core feature that preserves the history of the codebase and supports safe experimentation.

Answer

Generate test cases

Answer

Eliminate all bugs

Answer

Automate deployment

Question 7

An organization outsources its data center operations to a third-party vendor. The contract includes a right-to-audit clause. During a scheduled audit, the vendor refuses to provide access to logs from a subcontractor managing network security. What is the IS auditor's best course of action?

Accepted Answer

Escalate the issue to the vendor management team to enforce the contractual right.. The right-to-audit clause in the contract gives the organization legal authority to examine all relevant records, including those from subcontractors. Escalating to the vendor management team is the correct first step because they can enforce the contractual obligation without prematurely escalating to termination. This preserves the business relationship while asserting the organization's audit rights over the entire outsourced environment, including subcontracted network security operations.

Answer

Accept the vendor's refusal to avoid conflict.

Answer

Request the vendor to include a clause in its subcontractor agreement allowing audits.

Answer

Report the refusal to senior management and recommend terminating the contract.

Question 8

During which phase of the SDLC should security requirements be formally documented and approved?

Accepted Answer

Requirements phase. Security requirements must be formally documented and approved during the Requirements phase of the SDLC because this is when functional and non-functional needs, including security controls, are defined before any design or coding begins. Integrating security at this stage ensures that confidentiality, integrity, and availability requirements are captured in the system specification, preventing costly rework later. The Requirements phase is the earliest point where stakeholders can review and approve security constraints, such as encryption standards or access control policies, aligning them with business objectives.

Answer

Design phase

Answer

Development phase

Answer

Testing phase

Question 9

During a post-implementation review of a system, an IS auditor finds that the actual transaction processing time is 30% slower than projected. What should the auditor recommend FIRST?

Accepted Answer

Conduct a performance analysis to identify bottlenecks. Conducting a performance analysis to identify bottlenecks is the correct first step because the auditor must determine the root cause of the 30% slowdown before recommending any remediation. Jumping to hardware upgrades or system rejection without diagnosis is premature and may waste resources or disrupt operations unnecessarily. ISACA audit principles emphasize evidence-based recommendations grounded in root cause analysis.

Answer

Upgrade the server hardware immediately

Answer

Reject the system and revert to the legacy system

Answer

Adjust user expectations to match actual performance

Question 10

An organization is implementing a new financial system using the waterfall SDLC model. Which of the following is the MOST critical control to ensure that business requirements are met?

Accepted Answer

Formal user acceptance testing (UAT) sign-off. In a waterfall SDLC, formal user acceptance testing (UAT) sign-off is the definitive control that confirms the delivered system satisfies the documented business requirements before go-live. UAT is performed by business users against requirements-based test scenarios, so their formal sign-off provides auditable evidence that the system meets business needs. This is the last gate where business stakeholders validate fitness for purpose.

Answer

Automated unit testing results

Answer

Code reviews by the development team

Answer

Detailed technical design documents