CISA Practice Exam 60 — 20 Questions

Question 1

Match each testing technique to its description.

Accepted Answer

Walkthrough: An informal meeting where the author presents code or design to peers for feedback.. Testing techniques vary in formality and purpose. Walkthroughs are informal, inspections are formal with checklists, desk checking is a self-review, and unit testing verifies individual components. Common confusions involve swapping walkthrough and inspection definitions.

Answer

Walkthrough: A formal peer review process using a predetermined checklist.

Answer

Inspection: An informal meeting where the author presents code or design to peers.

Question 2

An IS auditor is planning an audit of a financial system. The auditor identifies that the inherent risk is high due to the complexity of transactions, but control risk is low because of strong automated controls. Which component of audit risk will be MOST affected by the auditor's testing strategy?

Accepted Answer

Detection risk. Detection risk is the risk that audit procedures fail to detect material misstatements. With low control risk, the auditor may rely on controls and reduce substantive testing, affecting detection risk.

Answer

Inherent risk

Answer

Control risk

Answer

Audit risk

Question 3

You are an IS auditor reviewing the remote access configuration for a medium-sized enterprise. The company uses a VPN concentrator to allow employees to connect from home. The VPN is configured with IPsec using pre-shared keys (PSK) and requires no multi-factor authentication. Employees use company-issued laptops with full disk encryption. The VPN logs show that connections are coming from a wide range of IP addresses, including some from countries where the company has no business operations. The IT manager argues that the PSK is changed monthly and that full disk encryption mitigates any risk. However, during the audit, you find that the PSK is stored in a shared document on an internal file server accessible to all employees. Additionally, the VPN concentrator uses a single PSK for all users. Which of the following is the MOST critical finding?

Accepted Answer

The VPN uses a single pre-shared key for all users, increasing the risk of widespread compromise. The use of a single pre-shared key (PSK) for all VPN users is the most critical finding because it creates a single point of failure: if that key is compromised, an attacker can impersonate any authorized user and gain full network access. The fact that the PSK is stored in a shared document accessible to all employees dramatically increases the likelihood of exposure, and changing it monthly does not remediate the fundamental lack of user-level authentication. Without per-user credentials or multi-factor authentication, the VPN concentrator cannot distinguish between legitimate employees and an attacker who possesses the shared key.

Answer

The PSK is changed monthly, but the change interval is too long

Answer

Full disk encryption on laptops is not sufficient to protect VPN credentials

Answer

VPN connections from unexpected countries indicate possible unauthorized access

Question 4

A project team is using a prototyping approach for a new system. Which of the following is the BEST control to ensure the prototype accurately reflects user needs?

Accepted Answer

Involve users in each iteration and obtain formal sign-off.. In prototyping, iterative user involvement with formal sign-off at each iteration ensures that evolving requirements are captured and validated continuously. This control directly verifies that each prototype increment aligns with user needs before proceeding, reducing the risk of building a system that fails to meet expectations.

Answer

Conduct a post-implementation review.

Answer

Require the project sponsor to approve the final design.

Answer

Perform regression testing after each prototype iteration.

Question 5

Which THREE are commonly used techniques to protect sensitive data in a cloud environment? (Select exactly 3.)

Accepted Answer

Tokenization of sensitive fields.. Tokenization replaces sensitive data (e.g., credit card numbers) with a non-sensitive placeholder (token) that has no exploitable value. This technique is commonly used in cloud environments to reduce the scope of compliance (e.g., PCI DSS) because the token can be stored and processed without exposing the original sensitive value, even if the cloud storage is compromised.

Answer

Code obfuscation for application logic.

Answer

Network segmentation between tiers.

Question 6

A multinational corporation is deploying a new cloud-based collaboration platform for its 5,000 employees. The platform will store sensitive project data and intellectual property. The CISO mandates that all data must be encrypted at rest and in transit, and that access must be controlled via the company's identity provider (IdP) using SAML 2.0. During a pilot with the R&D department, the security team discovers that the platform's audit logs do not record failed login attempts from the IdP. The platform vendor states that the IdP is responsible for authentication, so the platform only logs successful assertions. The CISO is concerned about the lack of visibility into brute-force attacks. The company already has a SIEM that receives logs from the IdP and other sources. What is the BEST course of action?

Accepted Answer

Enable detailed logging on the IdP for all authentication attempts and forward those logs to the SIEM for monitoring. The IdP is the authoritative source for authentication events in a SAML 2.0 federated identity model. The cloud platform only receives and logs successful SAML assertions, so it cannot log failed login attempts. Enabling detailed logging on the IdP for all authentication attempts (successes and failures) and forwarding those logs to the SIEM provides the necessary visibility into brute-force attacks without changing the platform or architecture.

Answer

Replace the cloud platform with one that provides built-in authentication logging

Answer

Configure the cloud platform to require re-authentication for every session and log all authentication events locally

Answer

Implement a stricter password policy for the IdP to reduce the risk of brute-force attacks

Question 7

Refer to the exhibit. An IT operator receives this error message from an automated backup job. What is the MOST likely cause of this failure?

Accepted Answer

The LUN presenting the virtual disk is not zoned or masked to the backup server. The error indicates that the backup server cannot access the virtual disk, which is typically a LUN masking or zoning issue. Option A is plausible but the message specifically points to storage access; Option B is not indicated; Option C is possible but less direct.

Answer

The FinanceDB database is corrupted

Answer

The network link between servers is down

Answer

The backup server's disk is full

Question 8

You are the lead IT auditor for a multinational corporation that recently completed a merger with another company. During the post-merger integration audit, you discover that the acquired company's legacy HR system contains sensitive personal data of 20,000 employees and has been directly accessible from the internet for the last 18 months. The system runs on an unsupported operating system (Windows Server 2008) and uses a custom-built application with no logging enabled. The acquired company's IT manager argues that the server is isolated behind a firewall and has never been compromised. However, your review of firewall logs shows numerous connection attempts from unknown IP addresses. The integration team plans to decommission this system in three months. You need to determine the appropriate audit response. Which of the following should you do NEXT?

Accepted Answer

Issue an urgent audit report to senior management highlighting the risk and recommending immediate isolation or remediation. The severity of the risk—exposed sensitive data on an unsupported system with active external connection attempts—requires immediate escalation to senior management. Waiting (B) or adding compensating controls (D) without management approval could delay critical action. Forensic analysis (A) may be warranted but should be directed by management after the risk is reported.

Answer

Conduct a forensic analysis of the server to determine if a breach has occurred

Answer

Wait for the decommissioning timeline and monitor the server logs for any signs of breach

Answer

Propose a compensating control, such as requiring VPN access to the server

Question 9

Which type of disaster recovery test involves a full switch-over from the primary site to the alternate site, resulting in actual disruption of normal operations?

Accepted Answer

Full interruption test. A full interruption test (also called full-scale test) involves actual failover, shutting down primary operations and running completely from the alternate site.

Answer

Tabletop test

Answer

Parallel test

Answer

Simulation test

Question 10

During an audit of incident management processes, the IS auditor reviews past incident reports and conducts interviews. The organization recently experienced a ransomware attack that encrypted critical systems. The incident response team was able to contain the attack but struggled with forensic collection due to lack of pre-defined procedures. Which TWO of the following should the auditor recommend as the HIGHEST priority improvements?

Accepted Answer

Conducting tabletop exercises with the incident response team. Developing forensic procedures ensures proper evidence collection, and regular tabletop exercises improve team readiness. While backup restoration and malware analysis are important, the highest priority is to address the identified gaps in forensics and preparedness.

Answer

Acquiring advanced malware analysis tools

Answer

Implementing a more frequent backup schedule

Answer

Establishing a formal chain of custody process

Question 11

Refer to the exhibit. Which of the following services is accessible from the internet to host 10.1.1.100?

Accepted Answer

HTTPS and SSH. The exhibit shows an access control list (ACL) permitting TCP ports 443 (HTTPS) and 22 (SSH) from any source to host 10.1.1.100. Since the ACL is applied inbound on the internet-facing interface, only HTTPS and SSH traffic are allowed through to that host. Therefore, option C is correct.

Answer

HTTP only

Answer

Telnet only

Answer

FTP only

Question 12

An administrator sees the above error after a failed backup job. What is the MOST likely cause?

Accepted Answer

The network share \BACKUPSRV\DBBackups\DB01\ is offline or unreachable. The error message indicates that the backup destination path \BACKUPSRV\DBBackups\DB01\ is inaccessible. This is most commonly caused by the network share being offline, unreachable due to network issues, or the target server being down. Without connectivity to the UNC path, the backup job cannot proceed, even if permissions and disk space are adequate.

Answer

The backup service account does not have write permissions to the destination

Answer

The SQL Server backup client is not installed

Answer

The backup destination disk is full

Question 13

During an audit of an organization's change management process, the IS auditor selects a sample of 50 change requests from a population of 500. The auditor finds that 3 of the 50 did not have proper approval. What is the estimated error rate in the population?

Accepted Answer

6%. The estimated error rate is calculated by dividing the number of errors found in the sample (3) by the sample size (50), yielding 6%. This is a point estimate of the population error rate, assuming the sample is representative. The auditor would then use statistical sampling techniques to determine a confidence interval for the true population error rate.

Answer

3%

Answer

10%

Answer

5%

Question 14

An organization outsources its data center operations to a third-party vendor. The contract includes a right-to-audit clause. During a scheduled audit, the vendor refuses to provide access to logs from a subcontractor managing network security. What is the IS auditor's best course of action?

Accepted Answer

Escalate the issue to the vendor management team to enforce the contractual right.. The right-to-audit clause in the contract gives the organization legal authority to examine all relevant records, including those from subcontractors. Escalating to the vendor management team is the correct first step because they can enforce the contractual obligation without prematurely escalating to termination. This preserves the business relationship while asserting the organization's audit rights over the entire outsourced environment, including subcontracted network security operations.

Answer

Accept the vendor's refusal to avoid conflict.

Answer

Request the vendor to include a clause in its subcontractor agreement allowing audits.

Answer

Report the refusal to senior management and recommend terminating the contract.

Question 15

Refer to the exhibit. An auditor reviews the log shipping configuration for a critical database. Based on the information provided, what is the MOST significant finding?

Accepted Answer

The current latency of 18 minutes exceeds the 15-minute log shipping interval. The current latency of 18 minutes exceeds the 15-minute log shipping interval, indicating that the secondary server is falling behind the primary. This violates the defined recovery point objective (RPO) and could lead to data loss if a failover occurs. Option B is about the alert threshold, which is a secondary concern; the immediate issue is the latency exceeding the interval. Option C is unrelated to the finding. Option D confuses backup time with log shipping latency.

Answer

The alert threshold of 30 minutes is too high

Answer

The secondary server is not being used for reporting

Answer

The last backup was created at 06:00, but it is now later in the day

Question 16

After issuing the final audit report, the IS auditor should perform follow-up procedures. What is the PRIMARY purpose of follow-up?

Accepted Answer

To verify that corrective actions have been implemented effectively. Follow-up ensures that management has taken corrective actions to address the findings and that the risks have been mitigated.

Answer

To update the permanent audit file

Answer

To close the audit engagement

Answer

To identify new risks for the next audit

Question 17

During a post-implementation review of a new HR system, the auditor finds that the system's disaster recovery plan (DRP) was not tested before go-live. Which of the following is the BEST recommendation?

Accepted Answer

Conduct a DRP test immediately and document results. The DRP must be tested to ensure the system can be recovered in a disaster. Conducting a test immediately (Option C) is the best recommendation because it directly addresses the untested state of the DRP and allows for corrective actions before a real incident occurs. Option A (accepting risk) is inappropriate for a critical HR system. Option B (backup procedure) addresses only one component of DR, not the entire plan. Option D (scheduling within six months) leaves the system unprotected unnecessarily and is less proactive than immediate testing.

Answer

Accept the risk because the system is new

Answer

Implement a backup procedure for the system

Answer

Schedule a DRP test within the next six months

Question 18

Which TWO of the following are examples of administrative controls for information security?

Accepted Answer

Access control policy. Access control policy is an administrative control because it defines the rules, roles, and responsibilities for granting or restricting access to information assets. It is a documented directive that governs user behavior and management processes, not a technical mechanism. Administrative controls are management-level safeguards, such as policies, procedures, and training, that guide the implementation of technical and physical controls.

Answer

Intrusion detection system

Answer

Firewall configuration

Answer

Encryption algorithms

Question 19

An organization is adopting ITIL 4 to improve its service management practices. Which guiding principle emphasizes understanding how different components work together to deliver value?

Accepted Answer

Think and work holistically. The ITIL 4 guiding principle 'Think and work holistically' emphasizes considering the entire service value system and how all components interact.

Answer

Start where you are

Answer

Keep it simple and practical

Answer

Focus on value

Question 20

An organization is adopting ITIL 4 for service management. Which guiding principle emphasizes starting from existing processes rather than building from scratch?

Accepted Answer

Start where you are. ITIL 4's guiding principle 'Start where you are' encourages leveraging existing capabilities and processes before making changes.

Answer

Progress iteratively

Answer

Focus on value

Answer

Optimize and automate