CISA Practice Exam 61 — 20 Questions

Question 1

During an IT audit, the auditor finds that a system administrator has local administrator rights on multiple production servers and uses a shared service account for routine maintenance. What is the PRIMARY risk associated with this practice?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Audit trails cannot attribute actions to a specific individual. Using a shared service account prevents attribution of actions to a specific individual, which is the primary risk from an audit perspective as it compromises accountability. Option B is not primarily a risk; password management is secondary. Option C is a possible operational risk but not primary. Option D is a risk but not the primary one; the main issue is lack of individual accountability.

Answer

Password changes become more difficult to manage

Answer

The administrator may accidentally delete critical files

Answer

The shared account may be used by unauthorized personnel

Question 2

An organization is evaluating its business continuity plan (BCP) for a critical application with a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour. The current backup strategy involves daily full backups and hourly transaction log backups. Which of the following is the MOST significant risk?

Accepted Answer

The backup media is stored in the same building as the primary system. Storing backup media in the same building as the primary system creates a single point of failure. A disaster that destroys the primary site would also destroy the backups, making recovery impossible and violating both the RTO and RPO. In contrast, options B, C, and D represent operational gaps that can be addressed through process improvements, but none pose as fundamental a threat to the recoverability of the application as the lack of off-site storage.

Answer

The recovery process requires manual intervention to apply logs

Answer

The backups are not tested regularly

Answer

The hourly logs cover only the last 24 hours

Question 3

Which of the following is the PRIMARY purpose of a business impact analysis (BIA) in business continuity planning?

Accepted Answer

To determine the criticality of business processes and their recovery requirements. A business impact analysis (BIA) is conducted to assess the criticality of business processes and identify their recovery requirements, such as recovery time objectives (RTO) and recovery point objectives (RPO). This information guides subsequent continuity planning activities. Option B (emergency contacts) is typically part of an emergency response plan, not the BIA. Option C (identifying resources for recovery) and Option D (technical recovery procedures) are steps that follow the BIA once the priorities are established.

Answer

To create a list of emergency contacts

Answer

To identify the resources required for recovery

Answer

To document the technical recovery procedures

Question 4

An IS auditor is evaluating the effectiveness of a backup strategy for a critical database. Which TWO of the following are essential controls to ensure data recoverability?

Accepted Answer

Storing backups offsite. Regular restoration tests verify that backups are recoverable, and offsite storage ensures availability after a site disaster. Encryption, labeling, and capacity are security or operational considerations but not essential for recoverability.

Answer

Encrypting backup tapes

Answer

Labeling tapes with dates

Answer

Using high-capacity media

Question 5

Which TWO of the following are primary objectives of capacity management? (Select exactly 2.)

Accepted Answer

To ensure adequate IT resources to meet current and future business demands. The primary objectives of capacity management are to ensure adequate IT resources to meet current and future business demands (option A) and to optimize the use of existing resources to support business growth (option E). Option B is about monitoring performance against SLAs, which is part of performance management, not a primary objective of capacity management. Option C is about minimizing TCO, which is broader and not specifically capacity management. Option D is about procurement cost, which relates to financial management.

Answer

To monitor and report on system performance against SLAs

Answer

To minimize the total cost of ownership of IT resources

Answer

To procure hardware and software at the lowest possible cost

Question 6

A small e-commerce company uses a cloud-based e-commerce platform with automatic scaling. The company's business continuity plan relies on the cloud provider's promise of 99.99% uptime. During a regional outage affecting the cloud provider's primary availability zone, the company's website became unavailable for 2 hours, resulting in lost sales. The IT manager wants to improve resilience. Which of the following is the BEST action?

Accepted Answer

Implement a multi-cloud strategy with active-active deployment.. Implementing a multi-cloud strategy with active-active deployment (Option D) is the best action because it ensures that if one cloud provider experiences a regional outage, the application can continue operating from another provider, thus avoiding single points of failure. Option A (secondary on-premises server) would require significant investment and may not integrate seamlessly with the cloud platform; it also does not address the root cause of relying on a single provider. Option B (increasing reserved capacity) helps with scaling but does not protect against provider outages. Option C (negotiating a higher SLA) may provide financial compensation but does not prevent downtime.

Answer

Maintain a secondary on-premises server for failover.

Answer

Increase the reserved capacity in the cloud to handle spikes.

Answer

Negotiate a higher service-level agreement (SLA) with the provider.

Question 7

An organization is evaluating its business continuity plan (BCP) to ensure alignment with the IT disaster recovery plan. Which TWO of the following are critical elements that should be included in the BCP to support effective business resilience?

Accepted Answer

Procedures for manual operations during system unavailability.. The correct answers are B and D. Procedures for manual operations during system unavailability (B) ensure that critical business processes can continue when IT systems are down, which is a core BCP element. Contact information for key stakeholders and emergency response teams (D) is essential for coordination during a disruption. Option A (list of IT applications with recovery priorities) is more typical of an IT disaster recovery plan. Option C (inventory of hardware and software licenses) is an asset management detail, not a critical BCP component. Option E (restoring network connectivity) is a technical procedure, more aligned with IT recovery.

Answer

A list of all critical IT applications with their recovery priorities.

Answer

A complete inventory of hardware and software licenses.

Answer

Detailed step-by-step procedures for restoring network connectivity.

Question 8

During a third-party software vendor audit, the IS auditor discovers that the vendor uses a common shared database for multiple clients and relies on application-level access controls. Which of the following is the GREATEST concern?

Accepted Answer

Data from different clients may be commingled and accessible.. The greatest concern is that the vendor uses a common shared database for multiple clients and relies solely on application-level access controls. If there is a vulnerability or misconfiguration in the application, it could allow unauthorized access to data from other clients, leading to data commingling and exposure. This poses a significant risk to data confidentiality and could violate contractual or regulatory requirements. In contrast, the other options (encryption at rest, penetration testing frequency, and segregation of duties) are important but secondary to the immediate risk of data leakage due to shared database architecture.

Answer

The database does not encrypt data at rest.

Answer

The vendor does not perform regular penetration testing.

Answer

The vendor lacks segregation of duties among administrators.

Question 9

Which TWO of the following are key objectives of a post-implementation review of a new system?

Accepted Answer

Identify lessons learned for future projects. A key objective of a post-implementation review (PIR) is to capture lessons learned from the project, which helps improve future system development and acquisition processes. This involves documenting what went well, what went wrong, and how processes can be refined, directly supporting continuous improvement in IT governance and project management.

Answer

Update the disaster recovery plan

Answer

Assess the project budget variance

Answer

Evaluate vendor performance

Question 10

An information systems auditor is evaluating user accounts in an organization's Linux environment. The accounts have the following properties:
- The 'root' account has its password field set to '!!' (disabled).
- The 'admin' account has its password field set to '!' (locked) and UID 0.
- The 'test' account is a regular user with UID 1000.
Based on this information, which user account poses the HIGHEST security risk?

Accepted Answer

admin. The 'admin' account poses the highest security risk because, despite its password being locked (indicated by '!' in the shadow file), it has UID 0 (root privileges). A locked password prevents password-based login, but the account may still be accessible via SSH keys or other authentication methods, and its privileged status makes it a valuable target for privilege escalation attacks. In contrast, the 'root' account may be fully disabled, and the 'test' account is a standard user without elevated privileges.

Answer

root

Answer

test

Answer

None of the accounts are risky

Question 11

An IS auditor is reviewing the change management process for a financial institution. The auditor finds that emergency changes bypass normal approval but are documented and reviewed within 48 hours. Which of the following is the BEST recommendation?

Accepted Answer

Implement a risk classification for changes and apply controls accordingly.. Implementing a risk classification for changes allows the organization to apply appropriate controls based on the change's impact and urgency. Emergency changes inherently require speed, but a risk-based approach ensures that high-risk emergency changes receive more stringent controls (e.g., mandatory peer review) while low-risk changes can proceed with lighter oversight. This balances security with operational agility, which is critical in a financial institution where system availability and data integrity are paramount.

Answer

Require a second administrator to approve during the emergency.

Answer

Increase the frequency of post-implementation reviews to every 24 hours.

Answer

Require all emergency changes to be approved by the change advisory board (CAB) before implementation.

Question 12

A multinational corporation is adopting a hybrid cloud strategy. The IT governance board must decide on a framework to ensure alignment with business objectives and regulatory compliance. Which framework is MOST appropriate?

Accepted Answer

COBIT 2019. COBIT 2019 is the most appropriate framework because it is specifically designed for IT governance, providing a comprehensive set of controls and processes to align IT with business objectives and ensure regulatory compliance. In a hybrid cloud strategy, COBIT 2019's focus on governance objectives, stakeholder needs, and risk management directly addresses the board's need for oversight across on-premises and cloud environments, unlike frameworks that target service management, security, or project management.

Answer

ITIL 4 Service Value System

Answer

ISO/IEC 27001 Information Security Management

Answer

PMBOK Guide

Question 13

During a spiral SDLC project, the project team has completed a risk analysis and created a prototype. What is the most likely next step in the spiral model?

Accepted Answer

Develop the next level of the product based on the risk analysis. In the spiral model, each iteration begins with identifying objectives, evaluating alternatives, and resolving risks through risk analysis. After completing risk analysis and building a prototype, the next step is to develop the next level of the product, incorporating the risk analysis findings to refine requirements and design. This ensures that high-risk areas are addressed incrementally before proceeding to subsequent phases.

Answer

Deploy the system to production

Answer

Obtain formal sign-off from the business owner on requirements

Answer

Conduct user acceptance testing (UAT)

Question 14

Which of the following is the BEST indicator that an organization's data security governance is effective?

Accepted Answer

Audit findings show compliance with data protection policies.. Audit findings showing compliance with data protection policies directly indicate that governance controls are working. Option A is incorrect because incident count is a lagging indicator. Option B is incorrect because training alone does not ensure compliance. Option D is incorrect because key count is not a measure of effectiveness.

Answer

Number of security incidents.

Answer

Percentage of employees trained.

Answer

Number of encryption keys managed.

Question 15

A company is implementing a new customer relationship management (CRM) system. The project team is currently defining user roles and permissions. Which of the following is the PRIMARY reason to enforce segregation of duties (SoD) within the CRM?

Accepted Answer

To reduce the risk of fraud and errors. Segregation of duties (SoD) in a CRM system is primarily enforced to prevent a single user from having conflicting capabilities, such as creating a customer record and also approving credit limits or processing refunds. Without SoD, an employee could both initiate and approve a fraudulent transaction, directly increasing the risk of fraud and undetected errors. While SoD can indirectly support data accuracy and compliance, the primary control objective is risk reduction through separation of conflicting functions.

Answer

To ensure data accuracy and completeness

Answer

To comply with regulatory requirements

Answer

To improve system performance and efficiency

Question 16

During the design phase of a waterfall project, the development team discovers that a key security requirement was omitted from the functional specification. The design has already been partially completed based on the flawed specification. What is the MOST appropriate action?

Accepted Answer

Halt design activities and revisit the requirements phase to add the security requirement. In a waterfall methodology, each phase must be completed before moving to the next. Discovering a missing requirement during design means the requirements phase is incomplete. The proper action is to halt design and revisit the requirements phase to add the omitted security requirement, ensuring it is properly integrated from the start. Option A is wrong because deferring a security requirement to a future release violates the project's security objectives and could introduce risk. Option B is wrong because continuing design and hoping to incorporate the requirement during testing undermines the structured phase-gate approach and may lead to rework. Option C is wrong because the requirement was omitted, not a scope change; change requests are for modifications after baselines, but the baseline was never properly established for this requirement.

Answer

Proceed with design and add the requirement as an enhancement in the next release

Answer

Continue design and incorporate the security requirement during testing

Answer

Implement the security requirement as a change request through the formal change control process

Question 17

Order the steps for responding to a security incident in the correct sequence.

Accepted Answer

Detection, then Containment, then Eradication/Recovery, then Review, then Improvement. Incident response follows: detection, containment, eradication/recovery, review, and improvement.

Answer

Containment, then Detection, then Eradication/Recovery, then Review, then Improvement

Answer

Detection, then Eradication/Recovery, then Containment, then Review, then Improvement

Answer

Detection, then Containment, then Review, then Eradication/Recovery, then Improvement

Question 18

Refer to the exhibit. An IS auditor is reviewing the architecture. Which of the following is the MOST critical security weakness?

Accepted Answer

Application servers can initiate outbound internet connections.. Allowing application servers to initiate outbound connections to the internet is a common attack vector (e.g., for command and control, data exfiltration). In a secure architecture, application servers should only communicate with necessary internal services, and outbound internet access should be restricted. Option B (TLS between tiers) is a security best practice, not a weakness. Option C (centralized logging) enhances monitoring and is not a weakness. Option D (lack of encryption on database) is not necessarily the most critical compared to the risk of outbound internet access from application servers.

Answer

The use of TLS between tiers.

Answer

Centralized logging to a SIEM.

Answer

Lack of encryption on the database server.

Question 19

A healthcare organization is required to comply with HIPAA regulations for data backup and disaster recovery. They operate a primary data center and a colocation facility for disaster recovery. The current backup strategy involves nightly full backups to tape, which are stored off-site monthly. The recovery time for the electronic health record (EHR) system is estimated at 8 hours, but the RTO required by the business is 2 hours. Additionally, the RPO requirement is 15 minutes. The IT manager proposes implementing a continuous data protection (CDP) solution. However, the CFO is concerned about the cost. Which of the following is the BEST argument to justify the CDP investment?

Accepted Answer

CDP can achieve an RPO of seconds and significantly reduce recovery time.. CDP provides near-zero RPO and can significantly reduce recovery time, directly meeting the RTO and RPO requirements. Option B is false because HIPAA does not mandate CDP. Option C is misleading; CDP does not necessarily reduce IT staff, as it may require continuous monitoring and management. Option D is false because CDP still requires off-site storage or replication for disaster recovery.

Answer

CDP is required by HIPAA for all healthcare systems.

Answer

CDP will reduce the need for IT staff to perform backups.

Answer

CDP eliminates the need for any off-site storage, reducing costs.

Question 20

A company is implementing a new ERP system. The project team plans to use a parallel conversion strategy. What is the PRIMARY advantage of this approach?

Accepted Answer

Risk mitigation by allowing fallback to the old system.. The primary advantage of a parallel conversion strategy is risk mitigation. By running the new ERP system alongside the old system for a period, the organization can validate the new system's functionality and data integrity while retaining the ability to immediately fall back to the legacy system if critical failures occur. This approach ensures business continuity and reduces the impact of unforeseen issues during the transition.

Answer

Immediate realization of benefits from the new system.

Answer

Lower total cost due to reduced training requirements.

Answer

Faster implementation compared to phased approach.