CISA Practice Exam 63 — 20 Questions

Question 1

A large financial institution has a well-defined IT governance framework with a clear organizational structure, policies, and processes. However, the internal audit department has identified that several IT projects are over budget and behind schedule. The project managers blame unclear requirements and scope creep. The IT governance committee meets monthly but reviews projects only at a high level. The auditor's best recommendation to improve project governance is to:

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Establish a project management office (PMO) to oversee project governance and reporting. Establishing a project management office (PMO) provides standardized project management practices, oversight, and controls to prevent scope creep and improve delivery. Option A is tactical and focuses on security, not project delivery. Option B changes meeting frequency but does not establish a dedicated project governance function. Option D mandates a tool but does not address underlying governance processes.

Answer

Increase the frequency of security reviews for all projects

Answer

Change the IT steering committee's meeting frequency to weekly with detailed reviews

Answer

Require all projects to use a specific project management software tool

Question 2

An organization has a disaster recovery plan that includes a hot site. During a full interruption test, the recovery team discovers that the hot site's network configuration is incompatible with the production environment. What is the most likely root cause?

Accepted Answer

The DR plan was not updated to reflect production changes.. The incompatibility suggests that the hot site was not properly configured to mirror production, possibly due to lack of change synchronization or testing.

Answer

The backup data was not encrypted.

Answer

The test was not conducted during business hours.

Answer

The hot site is too far from the primary site.

Question 3

Based on the exhibit, what is the most likely control weakness that allowed this condition?

Accepted Answer

Lack of individual accountability for privileged actions. The exhibit shows that multiple users are sharing a single privileged account (e.g., 'root' or 'admin') to perform administrative actions. Without unique user IDs for each administrator, it is impossible to map specific actions (e.g., a 'sudo' command or a configuration change) back to an individual. This lack of individual accountability is the core control weakness, as it violates the audit principle of non-repudiation and prevents effective forensic investigation.

Answer

Weak password complexity requirements

Answer

Failure to disable the default administrator account

Answer

Inadequate segregation of duties between IT and security teams

Question 4

During user acceptance testing (UAT) of a new financial system, users report that the system fails to enforce a segregation of duties rule where the same user should not be able to create a purchase order and approve it. The requirement was documented in the functional specifications. Which of the following is the MOST likely cause of this issue?

Accepted Answer

The system was not configured to enforce the control.. The segregation of duties (SoD) rule is a functional control that must be explicitly configured in the system's authorization or workflow engine. Since the requirement was documented in the functional specifications, the most likely cause is that the system was not configured to enforce the control, meaning the access control list (ACL) or role-based access control (RBAC) settings did not prevent the same user from both creating and approving a purchase order.

Answer

Performance testing was prioritized over functional testing.

Answer

The functional requirements were incomplete.

Answer

The requirements were ambiguous and misinterpreted by developers.

Question 5

An IS auditor is reviewing the incident management process. The organization has a policy that all security incidents must be reported within one hour. However, the average reporting time is four hours. Which is the BEST corrective action?

Accepted Answer

Provide additional training to staff. The root cause of the average reporting time exceeding the policy is likely a lack of awareness or skill in identifying and escalating incidents. Providing additional training directly addresses the human factor, improving staff ability to recognize security events and follow the one-hour reporting procedure, which is the most effective corrective action for a process gap.

Answer

Reduce the reporting time requirement

Answer

Increase penalties for non-compliance

Answer

Implement automated incident detection

Question 6

During data conversion from a legacy system to a new ERP, the project team decides to clean data during extraction but not during loading. What is the PRIMARY risk associated with this approach?

Accepted Answer

Data integrity issues may remain undetected in the target system.. Cleaning data only during extraction and not during loading means that any data quality issues introduced during the extraction process or that become apparent only after mapping to the target schema will not be caught. This creates a primary risk that data integrity issues—such as referential integrity violations, duplicate keys, or format mismatches—will remain undetected in the new ERP system, potentially corrupting business operations and reporting.

Answer

The legacy system performance may degrade.

Answer

The project may exceed its budget due to rework.

Answer

The conversion process will be significantly slower.

Question 7

An IS auditor is evaluating a system development project that uses an outsourced team. The contract allows the vendor to reuse some of the developed code in other projects. What is the auditor's PRIMARY concern?

Accepted Answer

The organization may lose control of intellectual property.. The contract clause allowing the vendor to reuse developed code in other projects directly transfers ownership or licensing rights of the intellectual property (IP) to the vendor. This means the organization may lose exclusive control over the code, potentially allowing competitors to access proprietary logic or algorithms. The IS auditor's primary concern is safeguarding the organization's IP assets, as this loss can have long-term strategic and competitive implications.

Answer

The vendor might not deliver on time.

Answer

The vendor may not maintain the code after the project ends.

Answer

The vendor may use substandard development practices.

Question 8

Which THREE of the following are best practices for managing system testing in an IS development project?

Accepted Answer

Create test data that mirrors production data.. Creating test data that mirrors production data is a best practice because it ensures that the test environment closely reflects real-world data volumes, distributions, and edge cases. This approach helps uncover defects that might only appear under production-like data conditions, such as performance bottlenecks, data integrity issues, or boundary value errors. It also validates that the system handles the actual data formats and constraints it will encounter in production.

Answer

Perform testing in a environment identical to production.

Answer

Developers should test their own code thoroughly.

Question 9

When implementing a commercial off-the-shelf (COTS) system, what is the MOST important factor?

Accepted Answer

Alignment with business processes with minimal modification. When implementing a commercial off-the-shelf (COTS) system, the most important factor is alignment with business processes with minimal modification. COTS systems are designed to provide standardized functionality; extensive customization undermines the core benefits of reduced cost, faster deployment, and easier vendor support. Modifying the COTS codebase creates a 'forked' version that complicates patch management, increases testing overhead, and risks incompatibility with future vendor updates, directly contradicting the acquisition rationale.

Answer

Customization to fit all requirements

Answer

Lowest total cost

Answer

Vendor reputation

Question 10

A financial institution is required by regulators to demonstrate that IT controls are effective. Which of the following provides the BEST evidence?

Accepted Answer

Service organization control (SOC) reports. Service organization control (SOC) reports are independent audits of control effectiveness, highly regarded by regulators. Internal audit reports are valuable but may lack independence; risk register and balanced scorecard are not direct evidence of control effectiveness.

Answer

IT balanced scorecard

Answer

Internal audit reports

Answer

IT risk register

Question 11

Which TWO of the following are types of audit evidence recognized in IS audit practice?

Accepted Answer

Observation. Observation and re-performance are both types of evidence; inquiry is also a type, but the question asks for TWO. The correct pair is observation and re-performance.

Answer

Assumption

Answer

Conjecture

Answer

Hypothesis

Question 12

Refer to the exhibit. An auditor reviews the security log of a sensitive server. Which of the following is the MOST suspicious event?

Accepted Answer

The remote interactive logon from IP 192.168.10.50 using NTLM. The most suspicious because it indicates a remote interactive logon (Logon Type 10) from IP 192.168.10.50 using NTLM authentication. Remote interactive logons from unfamiliar IP addresses, especially when using older protocols like NTLM, may indicate an unauthorized remote desktop (RDP) attempt. Option A (Negotiate package) is standard for domain authentication; Option B (logoff) is a normal event; Option D shows a logon from a known workstation (WS-FINANCE) on a different subnet, which is less suspicious than an unknown remote IP.

Answer

The use of Negotiate authentication package

Answer

The logoff event at 23:45:12

Answer

The logon from workstation WS-FINANCE at 10.0.0.15

Question 13

An IS auditor is evaluating the controls over program changes. Which TWO of the following are essential controls?

Accepted Answer

Management authorization for the change. Management authorization (A) is essential because it ensures that only approved changes are implemented, preventing unauthorized modifications that could introduce security vulnerabilities or operational disruptions. A documented change request (B) provides an audit trail and formal record of what was changed, why, and by whom, which is critical for accountability and traceability in the change management process.

Answer

Automated deployment scripts

Answer

Regression testing of all changes

Answer

Post-change review by independent party

Question 14

An IT department uses a balanced scorecard to measure performance. Which metric would BEST reflect the 'customer perspective'?

Accepted Answer

User satisfaction survey results. The customer perspective focuses on user satisfaction and service responsiveness. Option A is incorrect as training hours relate to learning and growth perspective. Option B is incorrect as system uptime is an internal process metric. Option D is incorrect as project completion rate is an internal efficiency metric.

Answer

Training hours per employee

Answer

System uptime percentage

Answer

Project completion rate

Question 15

Which THREE of the following are typical phases in the system development life cycle (SDLC)?

Accepted Answer

Implementation.. Implementation is a standard phase in the SDLC where the designed system is built, coded, and deployed into the production environment. This phase follows design and precedes testing and maintenance, ensuring the solution is operational and meets the specified requirements.

Answer

Unit testing.

Answer

Patch management.

Question 16

An IT manager is reviewing the service level agreements (SLAs) for a cloud-based email service. The SLA guarantees 99.9% uptime per month. The service experienced an outage of 45 minutes in a 30-day month. Did the service meet the SLA?

Accepted Answer

No, because the allowed downtime for 99.9% uptime is approximately 43 minutes.. The SLA guarantees 99.9% uptime per month. For a 30-day month (43,200 minutes), 99.9% uptime allows only 0.1% downtime, which is 43.2 minutes. The actual outage of 45 minutes exceeds this threshold, so the SLA was not met. Option D correctly identifies the allowed downtime as approximately 43 minutes.

Answer

Yes, because 45 minutes is within 0.1% of the total time.

Answer

Yes, because the SLA is calculated per day, not per month.

Answer

No, because any downtime exceeding 30 minutes is a violation.

Question 17

During the feasibility study for a new inventory system, the project team identifies that the expected benefits are significantly lower than the initial estimates. What is the MOST appropriate action for the IS auditor to recommend?

Accepted Answer

Re-evaluate the feasibility study and update the business case.. When expected benefits fall significantly below initial estimates, the IS auditor should recommend re-evaluating the feasibility study and updating the business case. This ensures that the project's justification is based on current, accurate data before proceeding, which is a key control in the systems development lifecycle (SDLC) to prevent investment in a project that may no longer deliver adequate value.

Answer

Proceed with the project as planned, focusing on cost reduction.

Answer

Cancel the project immediately and document lessons learned.

Answer

Continue with the project but postpone the benefits realization.

Question 18

An organization is implementing a disaster recovery plan. The DR team wants to test the plan with minimal risk and without impacting production operations. Which type of test is most appropriate?

Accepted Answer

Walkthrough. A walkthrough test involves reviewing the plan step by step in a meeting, with no actual failover or impact on production, making it low-risk.

Answer

Full interruption test

Answer

Simulation

Answer

Parallel test

Question 19

During an audit, an IS auditor finds that a system administrator has not taken mandatory vacation in three years. Which control is most likely being violated?

Accepted Answer

Mandatory vacation policy. Mandatory vacation is a fraud detection control that helps uncover irregularities when an employee is away.

Answer

Access control

Answer

Separation of duties

Answer

Job rotation

Question 20

Refer to the exhibit. A cloud load balancer uses this JSON configuration. A request arrives from source IP 10.0.1.100 to port 80. Which backend pool will receive the request?

Accepted Answer

The request is dropped. The JSON configuration defines a rule that forwards traffic matching source IP 10.0.1.0/24 and destination port 443 to backend-pool-1. The request from 10.0.1.100 to port 80 does not match the port 443 condition, so the rule is not applied. Since no other rule matches and the load balancer's default action is to drop traffic, the request is dropped.

Answer

backend-pool-1

Answer

The request is sent to both pools

Answer

backend-pool-2