CISA Practice Exam 60 — 20 Questions

Question 1

An IS auditor is assessing how an organization classifies and handles its information assets. The auditor finds that a data classification policy exists but is inconsistently applied across business units. Which TWO of the following are the MOST important elements the auditor should verify are present to support effective data classification? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A documented mapping of classification levels to specific handling and protection requirements.. Effective classification depends on two foundational elements: an accountable owner for each information asset and a documented mapping from classification levels to specific handling requirements. Ownership drives consistent labeling and review, while the mapping translates labels into enforceable controls. Absent either element, business units interpret classification differently, which explains the inconsistency the auditor observed.

Answer

Use of a commercial data loss prevention tool to enforce labels.

Answer

Annual penetration testing of systems that store classified data.

Answer

A requirement that all data be stored in a single centralized repository.

Question 2

An IS auditor is examining how an organization classifies and handles its information assets. The auditor finds that the data classification policy defines four sensitivity levels and corresponding handling rules, but the asset inventory does not record a classification for most systems. Which of the following is the MOST likely consequence of this gap?

Accepted Answer

Handling rules cannot be consistently applied because protection requirements are not tied to specific assets.. A classification scheme only produces security value when each asset is labeled and the label drives the handling rules. Without classification recorded in the inventory, owners cannot determine which baseline applies, so encryption, access restrictions, and disposal methods are chosen inconsistently. The policy becomes documentation rather than an operating control, and the auditor cannot trace requirements to implementation.

Answer

The organization will be unable to calculate the depreciated book value of its IT assets.

Answer

Software license compliance reports will be incomplete because unclassified systems are excluded.

Answer

Network bandwidth planning will be inaccurate because traffic volumes per system are unknown.

Question 3

An IS auditor is reviewing the backup strategy for a transactional database that processes customer orders. The database is backed up nightly with full backups, and transaction log backups occur every 15 minutes. The recovery point objective (RPO) for the system is 5 minutes. Which of the following is the MOST significant finding the auditor should report?

Accepted Answer

The backup schedule cannot meet the stated recovery point objective.. The RPO defines the maximum tolerable data loss, and the transaction log interval determines how much committed data could be lost in a failure. With log backups every 15 minutes, the system can lose up to 15 minutes of transactions, which exceeds the 5-minute objective. The auditor should report this mismatch between configured backup frequency and the stated business requirement.

Answer

Nightly full backups consume excessive storage capacity.

Answer

Transaction log backups are not encrypted at rest.

Answer

Full backups should be performed weekly instead of nightly.

Question 4

An IS auditor is reviewing the physical security of a data center that houses production servers. During a walkthrough, the auditor observes that the main entrance uses a badge reader, but the door to the network operations center (NOC) is propped open with a chair. Which of the following is the MOST appropriate action for the auditor to take?

Accepted Answer

Document the observation as a finding because propping the door defeats the access control protecting the NOC.. The propped NOC door bypasses the badge-controlled entry and permits unauthenticated physical access to critical systems. The auditor's role is to document the condition, articulate the risk, and recommend remediation rather than to fix it personally or ignore it. Proposing an unrelated upgrade at the main entrance would not address the observed weakness, so reporting the finding with a targeted recommendation is the appropriate response.

Answer

Ignore the observation because the main entrance badge reader still controls access to the building.

Answer

Close the door personally and take no further action.

Answer

Recommend replacing the badge reader with a biometric scanner at the main entrance.

Question 5

An IS auditor is assessing the physical and environmental controls of a primary data center located in a region subject to seasonal flooding. Management has installed a raised floor, a water detection system, and a pre-action fire suppression system. Which TWO of the following findings would the auditor consider MOST significant? (Choose two.)

Accepted Answer

The generator and fuel storage are located in the basement level of the building.. In a flood-prone region, the dominant threats are water ingress and loss of standby power during the same event. Detection limited to the subfloor leaves overhead leaks unseen, and below-grade generators and fuel can be inundated precisely when they are needed. Both findings undermine continuity for the facility as a whole, whereas the suppression agent, floor rating, and badge access described are appropriate controls.

Answer

The raised floor tiles are rated for a uniform load capacity that exceeds the weight of the installed racks.

Answer

Access to the computer room is controlled by a badge reader with a documented visitor escort procedure.

Answer

The fire suppression system discharges a gaseous agent rather than water when activated.

Question 6

An IS auditor is reviewing the physical security of a data center. The auditor observes that the main entrance uses a proximity card reader, but the door to the server cage area is propped open with a box because the badge reader is malfunctioning. Staff state that the reader has been broken for two weeks and that a work order has been submitted. Which of the following should the IS auditor recommend FIRST?

Accepted Answer

Immediately secure the door and implement interim monitoring until the reader is repaired.. The propped door is an active physical access control failure exposing the server cage to unauthorized entry. The auditor should first ensure the exposure is contained through immediate securing of the door and interim compensating measures such as monitoring, then pursue repair and accountability. Reporting alone or focusing on discipline or repair scheduling does not protect the assets during the outage.

Answer

Recommend disciplinary action against the staff who propped the door open.

Answer

Escalate the outstanding work order to expedite the badge reader repair.

Answer

Document the finding in the audit report and await management's remediation plan.

Question 7

An IS auditor is reviewing the physical security controls at a data center that hosts the organization's core banking platform. During the walkthrough, the auditor notes that the mantrap entrance functions correctly, but the loading dock door is propped open for ventilation and the CCTV system records only the main corridor. Which TWO of the following findings should the auditor report as control weaknesses? (Choose two.)

Accepted Answer

CCTV coverage does not include the loading dock or other areas outside the main corridor.. The walkthrough produced two concrete observations that weaken physical security: the loading dock door is propped open, bypassing the perimeter, and CCTV covers only the main corridor, leaving other areas unmonitored. Both conditions create opportunities for unauthorized entry and undetected activity. The functioning mantrap is not a weakness, and the scenario provides no evidence about biometric authentication or visitor escort policies, so those cannot be reported as findings.

Answer

The organization has not implemented a formal visitor escort policy for the data center.

Answer

The data center does not use biometric authentication at the mantrap entrance.

Answer

The mantrap entrance allows only one person to enter at a time and slows authorized staff.

Question 8

An organization's security team proposes deploying a network-based intrusion prevention system (IPS) inline at the internet perimeter. Management asks the IS auditor to comment on the operational implications before approving the purchase. Which of the following should the auditor identify as the MOST significant operational risk of the inline placement?

Accepted Answer

A false positive or device failure could block legitimate business traffic and cause an outage.. Inline prevention changes the device from a passive observer into a component whose failure or misconfiguration directly affects service delivery. Every packet traverses it, so latency, throughput limits, and false positives translate into user-visible outages. The auditor should therefore focus on fail-open behavior, bypass paths, change control for signature updates, and a tuning period in detection mode before blocking is enabled.

Answer

The IPS will be unable to inspect encrypted traffic without additional decryption capability.

Answer

The IPS will not be able to correlate events with host-based logs from servers.

Answer

Signature updates will consume WAN bandwidth and degrade branch office performance.

Question 9

An IS auditor is assessing the security controls in a newly developed mobile banking application. The development team used the OWASP Mobile Application Security Verification Standard (MASVS) as a guide. Which of the following would be the MOST effective evidence that the application meets the standard's requirements for secure data storage?

Accepted Answer

A combination of static and dynamic analysis reports, plus a manual review of data storage locations, mapped to MASVS controls.. The most effective evidence is a combination of static and dynamic analysis with manual review, as it covers code and runtime aspects and ensures all storage locations are examined. This aligns with MASVS's requirement for thorough verification. Other options are partial or self-attested and do not provide the depth needed to confirm secure data storage fully.

Answer

A penetration test report showing no critical vulnerabilities in the application's data storage mechanisms.

Answer

A static application security testing (SAST) report that identifies all hardcoded secrets and insecure storage APIs.

Answer

A code review checklist signed off by the lead developer confirming that sensitive data is encrypted.

Question 10

An IS auditor is reviewing the post-implementation review (PIR) of a newly deployed human resources (HR) system. Which of the following should be the PRIMARY focus of the PIR?

Accepted Answer

Verifying that the system meets business requirements and delivers expected benefits.. A post-implementation review should primarily evaluate whether the system meets business requirements and delivers the expected benefits. This assessment helps organizations learn from the project and ensure the system is providing value. While cost, documentation, and resource release are relevant, they are secondary to the core goal of benefits realization.

Answer

Ensuring that all project documentation is archived.

Answer

Comparing actual project costs to the approved budget.

Answer

Confirming that the project team has been released from their assignments.

Question 11

An IS auditor is reviewing a project to implement a new loan origination system. The project manager has produced a detailed work breakdown structure (WBS), a critical path schedule, and a resource-loaded plan. Which of the following should the auditor verify FIRST to assess whether the project schedule is realistic?

Accepted Answer

That the critical path includes all tasks with zero float and that resource constraints have been leveled against actual availability.. A realistic schedule requires correct logical dependencies and accurate resource assumptions. Zero-float tasks define the critical path, but if that path is built without leveling against actual staff availability, the projected end date is unreliable. Confirming that critical path tasks are sequenced properly and that resourcing reflects real capacity gives the auditor the strongest evidence about schedule feasibility before examining other project artifacts.

Answer

That the project sponsor has signed the project charter and that the budget has been approved by the finance committee.

Answer

That the WBS has been decomposed to at least three levels and that each work package has a unique identifier.

Answer

That all project risks have been entered into the risk register and assigned an owner with a mitigation plan.

Question 12

An IS auditor is reviewing the audit committee's oversight of the IT audit function. Which of the following is the MOST important factor for the auditor to consider when assessing the committee's effectiveness?

Accepted Answer

The committee's independence from management and its ability to challenge IT risk decisions.. The most important factor in assessing the audit committee's effectiveness in overseeing IT audit is its independence from management and its ability to challenge IT risk decisions. Independence ensures that the committee can objectively evaluate management's actions and the auditor's findings. The ability to challenge ensures that management is held accountable and that risks are adequately addressed. Other factors like meeting frequency, number of findings, or technical expertise are secondary to this core governance principle.

Answer

The number of IT audit findings reported to the committee.

Answer

The committee's technical expertise in IT systems.

Answer

The frequency of audit committee meetings.

Question 13

An IS auditor is reviewing a network access control list and finds that a rule permits traffic from any source to a database server on port 1521. Management states the rule is required for a legacy application. Which of the following is the MOST appropriate audit response?

Accepted Answer

Document the rule as a finding with a recommendation to restrict source addresses to the application servers.. The auditor should identify the exposure created by an unrestricted database access rule and communicate it with a practical recommendation. Restricting the source addresses maintains the legacy application's function while reducing risk. Auditors report and recommend; they do not implement changes or accept risks on management's behalf. Escalation should follow the normal reporting process.

Answer

Remove the rule immediately to eliminate the exposure.

Answer

Accept the rule because management has provided a documented business justification.

Answer

Escalate the matter directly to the board of directors without further analysis.

Question 14

An IS auditor is assessing the implementation of a new system that uses a relational database. The project team plans to migrate data from several legacy sources. Which TWO of the following controls are MOST important to include in the data conversion plan to help ensure the integrity of migrated data? (Choose two.)

Accepted Answer

Verification that referential integrity constraints are enabled and validated after the data load.. Data migration integrity depends on detecting missing or corrupted records and ensuring that relationships between tables remain valid. Reconciliation of counts and totals provides independent verification that all expected data arrived, while validated referential integrity constraints ensure that foreign key relationships are sound. Together, these detective and preventive controls give the auditor the strongest evidence that the conversion preserved data accuracy and completeness.

Answer

Confirmation that the legacy system is decommissioned immediately after the conversion cutover.

Answer

Use of a parallel test environment that mirrors production hardware and software configurations for the conversion rehearsal.

Answer

Approval of the data mapping document by the database administrator before the conversion begins.

Question 15

An IS auditor is reviewing the physical security controls at a data center. The auditor observes that entry to the data center requires a smart card and a PIN, and that the door is a single-leaf door with a standard lock. Which of the following is the MOST important physical security control that the auditor should recommend?

Accepted Answer

Implement a mantrap or double-door entry system to prevent tailgating.. The most important physical security control to recommend is a mantrap or double-door entry system to prevent tailgating. While the data center uses smart card and PIN for authentication, a single door allows multiple people to enter on one authentication. A mantrap ensures that each person is individually authenticated and prevents unauthorized individuals from following authorized personnel. This is a fundamental control for high-security areas like data centers.

Answer

Require employees to sign a logbook upon entry and exit.

Answer

Replace the standard lock with a biometric lock for all employees.

Answer

Install security cameras inside the data center to monitor activity.

Question 16

An IS auditor is assessing how an organization classifies and handles its information assets. The auditor finds that a data classification policy exists but is inconsistently applied across business units. Which TWO of the following are the MOST important elements the auditor should verify are present to support effective data classification? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Whether the EDR agents are configured to update their detection signatures and behavioral models automatically.. EDR reduces malicious code risk by detecting known and unknown threats through signatures and behavioral analysis. That capability degrades rapidly if the agent's detection logic is stale. Automatic updates keep both signature databases and behavioral models current, allowing the agent to recognize new variants and techniques. Configuration and response integration matter, but without current detection logic the agent cannot identify the threats it is deployed to stop, so update configuration is the most important factor.

Answer

Whether the EDR agents are installed on servers in addition to workstations.

Answer

Whether the EDR vendor has a large market share among similar organizations.

Answer

Whether the EDR console is hosted in the same data center as the workstations it monitors.

Question 17

An IS auditor is reviewing the implementation of a new payroll system. The project team has decided to use a pilot conversion approach. Which TWO of the following are the MOST significant advantages of this approach? (Choose two.)

Accepted Answer

It allows for testing the system in a live environment with a subset of users before full rollout.. Pilot conversion offers two key advantages: it enables live testing with a subset of users, allowing real-world validation and issue identification, and it facilitates incremental learning so that the implementation process can be refined before full deployment. These benefits reduce risk and improve the chances of a smooth organization-wide rollout.

Answer

It minimizes the need for user training because only a few users are affected initially.

Answer

It provides a fallback option to revert to the old system if the pilot fails.

Answer

It eliminates the need for parallel testing with the old system.

Question 18

An IS auditor is reviewing the IT governance of a financial services firm. The auditor discovers that the IT steering committee has approved a major core banking system upgrade, but the project lacks a formal business case and no post-implementation review is planned. Which of the following is the MOST significant risk arising from this situation?

Accepted Answer

IT resources may be misallocated to projects that do not support business strategy.. The most significant risk is that without a formal business case, the project's alignment with business strategy and expected benefits are not established, and without a post-implementation review, there is no accountability for realizing those benefits. This can lead to misallocation of IT resources and failure to deliver value, which is a fundamental governance concern. Other risks, such as budget overruns or technical failures, are secondary to the strategic misalignment.

Answer

The IT steering committee may not have the authority to approve such a project.

Answer

The project may exceed its budget without proper justification.

Answer

The project may fail to meet technical specifications.

Question 19

A hospital's IT department has implemented a new electronic health record (EHR) system. The IS auditor is reviewing the IT governance over the project and finds that the project sponsor is the CIO, who also chairs the IT steering committee that approved the project. Which of the following is the MOST significant governance risk?

Accepted Answer

Lack of segregation of duties between project sponsorship and project approval.. The most significant governance risk is the lack of segregation of duties between project sponsorship and project approval. When the CIO sponsors the project and also chairs the committee that approves it, independent oversight is compromised. This can lead to inadequate challenge, biased decision-making, and insufficient risk assessment. Proper governance requires that project approval be made by a body that can objectively evaluate the project's merits and risks, separate from those advocating for it.

Answer

The project sponsor should be a clinical leader rather than the CIO.

Answer

The IT steering committee may not have the authority to approve large projects.

Answer

The CIO may not have sufficient technical knowledge to sponsor an EHR project.

Question 20

An IS auditor is reviewing the problem management process. The auditor finds that problem tickets are often closed without identifying the root cause, and incidents continue to recur. Which of the following is the MOST likely consequence of this practice?

Accepted Answer

Increased number of incidents and reduced service availability.. Problem management aims to identify and resolve root causes to prevent incident recurrence. When problems are closed without root cause analysis, the underlying issues remain, causing the same incidents to happen again. This directly increases the number of incidents and reduces service availability. Other consequences, such as higher change costs or service desk workload, are secondary effects. The auditor should recognize that ineffective problem management leads to chronic operational instability.

Answer

Higher change management costs due to emergency changes.

Answer

Decreased effectiveness of the service desk due to increased workload.

Answer

Noncompliance with regulatory requirements for incident reporting.