CISA Practice Exam 62 — 20 Questions

Question 1

An organization is implementing a data loss prevention (DLP) solution. Which of the following is the BEST approach to minimize false positives while ensuring sensitive data is protected?

Accepted Answer

Use contextual analysis including user roles and data classification.. Contextual analysis (Option C) is the best approach because it reduces false positives by considering user roles, data classification, and behavioral patterns, ensuring that only genuinely risky data transfers are flagged. Unlike static methods, this dynamic analysis adapts to the organization's data governance policies, allowing legitimate business communications to proceed while still protecting sensitive information.

Answer

Encrypt all outbound emails containing any attachment.

Answer

Deploy exact file matching against a database of known sensitive documents.

Answer

Apply keyword matching to all outbound emails.

Question 2

During system development, the project team discovers that the original requirements are incomplete. What is the BEST course of action?

Accepted Answer

Formally document the new requirements and follow the change management process. Formally documenting new requirements and following the change management process ensures that all changes are controlled, assessed for impact on scope, budget, and schedule, and approved by stakeholders. This aligns with the systems development lifecycle (SDLC) best practices and the ISACA standard for managing requirements changes, preventing scope creep and maintaining project integrity.

Answer

Inform the steering committee and continue as planned

Answer

Proceed with development and address changes during maintenance

Answer

Halt the project until all requirements are finalized

Question 3

A project manager is selecting a development methodology for a project with well-defined requirements and low uncertainty. Which methodology is most appropriate?

Accepted Answer

Waterfall. Waterfall is the most appropriate methodology for projects with well-defined requirements and low uncertainty because it follows a linear, sequential approach where each phase (requirements, design, implementation, verification, maintenance) must be completed before the next begins. This structure minimizes risk when requirements are stable and unlikely to change, ensuring thorough documentation and predictable outcomes. In contrast, iterative or adaptive methods would introduce unnecessary complexity and overhead for such a deterministic project.

Answer

Agile

Answer

Rapid Application Development (RAD)

Answer

Spiral

Question 4

Which of the following disaster recovery test types involves a full switch-over to the alternate site, resulting in actual disruption to normal operations?

Accepted Answer

Full interruption test. The full interruption test (also known as a cold-start test) involves an actual shutdown of primary systems and a complete switch-over to the alternate site, causing real disruption to normal operations. This validates the entire recovery capability under realistic conditions, including failover, data synchronization, and user reconnection, but carries the highest risk of data loss or extended downtime.

Answer

Simulation test

Answer

Parallel test

Answer

Tabletop test

Question 5

During an IT audit, the auditor discovers that the IT department has not conducted a business impact analysis (BIA) for three years. The organization's disaster recovery plan (DRP) is based on the previous BIA. The IT manager argues that the DRP is still valid because no major changes have occurred. What should the auditor recommend?

Accepted Answer

Recommend that a new BIA be conducted to validate and update the DRP.. A business impact analysis (BIA) is the foundation of a valid disaster recovery plan (DRP). Without a current BIA, the DRP may not reflect the organization's current critical processes, recovery time objectives (RTOs), or recovery point objectives (RPOs). Even if no major changes are perceived, subtle shifts in dependencies, resource availability, or regulatory requirements can render the DRP ineffective. Therefore, the auditor should recommend conducting a new BIA to validate and update the DRP.

Answer

Accept the IT manager's rationale and close the finding.

Answer

Recommend terminating the current DRP until the BIA is completed.

Answer

Recommend accepting the risk and documenting the decision.

Question 6

During a data migration from a legacy system to a new ERP, the following log entries were generated. Which TWO issues should the IS auditor flag as high risk?

Accepted Answer

Constraint violation due to missing parent records. A constraint violation due to missing parent records indicates a referential integrity failure. In a data migration, this means child records are being inserted without their corresponding parent records, which can cause orphaned data and application logic errors. This is a high-risk issue as it compromises data consistency and may require complex reconciliation or rollback.

Answer

Source system downtime

Answer

Rapid growth of rollback segment

Answer

Data type mismatch between source and target

Question 7

A project uses a waterfall model. After design, the team discovers that the requirements have changed significantly. What is the BEST action?

Accepted Answer

Update the requirements and proceed with the design revision. In a waterfall model, each phase must be completed before the next begins, but when requirements change significantly after design, the best action is to update the requirements and revise the design. This preserves the structured, sequential nature of the waterfall while ensuring the final product meets the new needs. Canceling or ignoring changes would waste resources, and switching methodologies mid-project introduces integration risks and process discontinuity.

Answer

Cancel the project and start over

Answer

Continue with original requirements as planned

Answer

Switch to an agile methodology for the remainder of the project

Question 8

An organization has implemented a database activity monitoring (DAM) solution. Which of the following are BEST practices for tuning the DAM to reduce false positives? (Choose TWO.)

Accepted Answer

Implement exclusions for routine maintenance activities. Implementing exclusions for routine maintenance activities (Option A) is a best practice because these activities often generate predictable database queries that are not indicative of security threats. By excluding them, the DAM solution avoids alerting on benign operations, thereby reducing false positives without compromising security coverage.

Answer

Enable alerts for all database queries

Answer

Increase the sensitivity of all detection rules

Answer

Review alerts in real-time only

Question 9

An organization has implemented a new IT service management (ITSM) tool. The IT manager wants to measure the effectiveness of incident management. Which metric is MOST appropriate?

Accepted Answer

Mean time to resolve (MTTR) incidents. Mean time to resolve (MTTR) is the most appropriate metric for measuring the effectiveness of incident management because it directly reflects how quickly the IT team can restore normal service operation after an incident. In ITIL-based ITSM tools, MTTR tracks the elapsed time from incident logging to resolution, providing a clear indicator of process efficiency and team responsiveness.

Answer

Percentage of incidents resolved on first call

Answer

Number of incidents reported per month

Answer

Percentage of system uptime

Question 10

Which TWO controls are most effective for protecting data at rest on a database server? (Choose two.)

Accepted Answer

Enforcing role-based access control (RBAC). Role-based access control (RBAC) restricts data access to authorized users based on their roles, directly preventing unauthorized viewing or modification of data at rest. Transparent data encryption (TDE) encrypts the database files at the storage level, ensuring that even if the physical media is stolen, the data remains unreadable without the encryption keys. Both controls address the core requirement of protecting data while it is stored on the database server.

Answer

Placing the database server behind a firewall

Answer

Enabling SSL/TLS for client connections

Answer

Using file-level encryption on the database files

Question 11

An IS auditor is assessing the controls in an agile development environment. What is the MOST effective way to verify that security testing is performed iteratively?

Accepted Answer

Reviewing the project's definition of done for each sprint. In agile development, security testing must be integrated into each sprint to ensure continuous validation. The 'definition of done' (DoD) is the team's checklist for completing a user story; if it explicitly includes security testing tasks (e.g., static analysis, dynamic scans, or penetration tests), then verifying the DoD proves that security testing was performed iteratively. Option D directly examines this artifact, providing objective evidence of iterative security testing.

Answer

Observing a daily standup meeting

Answer

Interviewing the product owner about security priorities

Answer

Examining the final security test report after release

Question 12

An organization is developing a business continuity strategy for its key customer-facing application. The BIA determined an RTO of 2 hours and an RPO of 30 minutes. Which TWO strategies are most appropriate to meet these objectives?

Accepted Answer

Implement a hot standby site. A hot standby site provides near-real-time failover, which supports a 2-hour RTO. Synchronous data replication ensures data loss is minimal, supporting a 30-minute RPO.

Answer

Adopt a manual workaround process

Answer

Store backup tape at an offsite location

Answer

Perform daily full backups to tape

Question 13

Which of the following types of audit evidence provides the highest level of assurance?

Accepted Answer

Re-performance of control procedures. Re-performance provides direct evidence that a control is operating effectively.

Answer

Inquiry of process owners

Answer

Observation of processes

Answer

Inspection of documents

Question 14

An organization is considering whether to build a custom application or purchase a commercial off-the-shelf (COTS) product. Which of the following factors is MOST important when deciding to build rather than buy?

Accepted Answer

Need for highly specialized functionality not available in the market. When an organization requires highly specialized functionality that is not available in any commercial off-the-shelf (COTS) product, building a custom application becomes the only viable option. COTS products are designed for broad market needs and often lack the unique features or compliance requirements that a custom solution can provide. This factor overrides cost, time, and maintenance considerations because no amount of configuration or customization of a COTS product can meet the specific functional gap.

Answer

Reduced need for ongoing maintenance

Answer

Faster time to market

Answer

Lower initial cost

Question 15

An IS auditor is reviewing an organization's change management process. The auditor notes that all emergency changes are approved post-implementation by the change advisory board (CAB) within 48 hours. Which of the following is the auditor's BEST course of action?

Accepted Answer

Assess whether the emergency change policy includes proper justification and post-approval controls. The auditor's primary role is to assess the adequacy of controls. The emergency change process with post-approval within 48 hours is acceptable if the policy includes proper justification and post-approval controls. The auditor should evaluate whether these controls are in place rather than immediately escalating or recommending pre-approval, which may not be practical for emergencies. Option D is incorrect because pre-approval for emergency changes is not always feasible, and the current process may be adequate with proper controls.

Answer

Escalate the issue to senior management as a control weakness

Answer

Verify that all emergency changes are tested before implementation

Answer

Recommend that emergency changes be approved prior to implementation

Question 16

You are an information security manager for a global financial services company. The organization maintains a hybrid infrastructure with critical customer data stored on an on-premises Oracle database server (DB-SRV-01) and in an AWS S3 bucket (customer-data-prod). At 10:00 AM, the security operations center (SOC) alerts you to an anomalous outbound data transfer from DB-SRV-01 to an unknown IP address in a high-risk country. The transfer started at 9:45 AM and involves 500 MB of data, likely including personally identifiable information (PII). The SOC has already quarantined the server's network egress by blocking all outbound traffic from DB-SRV-01, but the server remains connected to the internal production network. Meanwhile, a separate analysis indicates that the S3 bucket has been accessed via an IAM key that was stolen from a compromised developer workstation three days ago. The key has not been rotated. The incident response team is preparing to act. The primary objective is to protect information assets and minimize data exposure. Given this scenario, which of the following actions should the team take FIRST?

Accepted Answer

Isolate DB-SRV-01 from the internal network by disconnecting its network cable or disabling the virtual switch port.. The immediate priority is containment. Isolating DB-SRV-01 from the internal network prevents the attacker from moving laterally to other systems and stops further data exfiltration. Quarantining outbound traffic alone is insufficient as the server still has internal connectivity. Option A is incorrect because restoring from a backup would destroy forensic evidence and does not address the compromised IAM key for the S3 bucket. Option B is incorrect because notifying the data protection authority is a legal obligation that should follow containment and preservation of evidence. Option C is incorrect because patching the server does not address the active compromise and could also destroy evidence.

Answer

Restore DB-SRV-01 from a clean backup taken before the incident and change the IAM keys for the S3 bucket.

Answer

Notify the appropriate data protection authority within the required 72-hour timeframe.

Answer

Patch the Oracle database server to the latest version to close any known vulnerabilities.

Question 17

Refer to the exhibit. A CISA is reviewing this S3 bucket policy. What is the PRIMARY security concern?

Accepted Answer

The bucket is configured for public read access. The bucket policy explicitly grants `s3:GetObject` to `Principal: "*"` with `Effect: "Allow"`, which means any unauthenticated user on the internet can read objects in the bucket. This is a classic misconfiguration that leads to public read access, exposing sensitive data. While encryption and versioning are important security controls, the immediate and most severe risk is unauthorized data disclosure via public read.

Answer

Encryption is not enforced on the bucket

Answer

The policy allows unauthorized write access

Answer

Versioning is not enabled on the bucket

Question 18

Which backup method copies all data that has changed since the last full backup, regardless of subsequent incremental backups, and is often used to reduce restore time?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of any incremental backups taken in between. This approach reduces restore time because only the last full backup and the most recent differential backup are needed, unlike incremental backups which require the full backup plus every subsequent incremental in sequence.

Answer

Full backup

Answer

Incremental backup

Answer

Mirror backup

Question 19

During a problem management meeting, the team identifies a recurring issue causing multiple incidents. The root cause is known, but a permanent fix is not yet available. Which of the following is the BEST approach to manage this situation until a permanent fix is implemented?

Accepted Answer

Document the known error and implement a workaround. In ITIL-based problem management, when a root cause is known but a permanent fix is unavailable, the known error should be documented in the Known Error Database (KEDB) and a workaround should be implemented to reduce incident impact and restore service. This aligns with the problem management process of controlling the error until a permanent solution (e.g., a patch or change) is deployed, ensuring operational continuity and minimizing recurrence of incidents.

Answer

Escalate the problem to senior management

Answer

Reclassify the problem as an incident

Answer

Close the problem record and wait for the fix

Question 20

Based on the exhibit, which metric would be LEAST relevant to the 'Customer' perspective?

Accepted Answer

System Uptime Percentage. (System Uptime Percentage) is the least relevant to the Customer perspective because system uptime is an operational metric that primarily supports the Internal Process perspective (e.g., reliability and availability). In contrast, the other options directly measure customer satisfaction and engagement: Number of New Features (customer-driven innovation), Satisfaction Survey Score (direct feedback), and Complaint Resolution Time (service responsiveness). While uptime may indirectly affect customer satisfaction, it is not a direct measure of the customer perspective as defined by balanced scorecard frameworks.

Answer

Number of New Features Delivered

Answer

Satisfaction Survey Score

Answer

Complaint Resolution Time