CISA Practice Exam 64 — 20 Questions

Question 1

Which TWO of the following are primary objectives of the audit planning phase? (Select TWO.)

Accepted Answer

Identify and assess risks relevant to the audit. During the audit planning phase, the primary objectives are to define the audit scope and objectives (Option E) and to identify and assess risks relevant to the audit (Option B). This sets the foundation for the entire audit engagement, ensuring resources are focused on high-risk areas and that the audit is aligned with organizational goals. Detailed procedures are developed later, and testing controls or issuing reports occur in subsequent phases.

Answer

Develop detailed audit procedures

Answer

Test the effectiveness of internal controls

Answer

Issue the final audit report

Question 2

Which THREE of the following are commonly recognized benefits of implementing a formal IT service management (ITSM) framework such as ITIL?

Accepted Answer

Better alignment between IT services and business needs. A formal ITSM framework like ITIL explicitly focuses on aligning IT service delivery with business objectives through defined processes like service strategy and service design. This alignment ensures that IT investments and operations directly support business outcomes, such as improving customer satisfaction or enabling new revenue streams, rather than operating in a silo.

Answer

Guaranteed zero downtime for critical services

Answer

Elimination of the need for external IT audits

Question 3

An organization uses a chargeback model for IT services. What is the PRIMARY benefit of this approach?

Accepted Answer

Increases business unit accountability for IT spending. The primary benefit of a chargeback model is that it increases business unit accountability for IT spending. By directly allocating IT costs to the consuming departments based on actual usage (e.g., compute hours, storage GB, network bandwidth), business units are incentivized to optimize their consumption and make cost-conscious decisions. This aligns IT expenditure with business value and promotes transparency, rather than treating IT as a sunk cost.

Answer

Simplifies IT budgeting

Answer

Reduces total IT costs

Answer

Improves IT service quality

Question 4

During an audit, the IS auditor finds that the business continuity plan (BCP) was last updated two years ago and does not include new cloud-based applications. The organization has not conducted a BCP test in 18 months. What should the auditor recommend FIRST?

Accepted Answer

Perform a risk assessment to prioritize changes. Before updating the BCP or scheduling tests, the IS auditor must ensure that a current risk assessment is performed to identify and prioritize the impact of changes—such as the introduction of cloud-based applications—on business continuity. Without a risk assessment, updates or tests may address the wrong threats or miss critical dependencies, violating the principle that BCP updates should be risk-driven. This aligns with ISACA's guidance that risk assessment is the foundation for BCP maintenance and testing frequency.

Answer

Obtain management approval for BCP updates

Answer

Immediately schedule a full-scale test

Answer

Update the BCP to include cloud applications

Question 5

In a DevOps environment, which practice BEST supports auditability?

Accepted Answer

Automated logging of all code changes. Automated logging of all code changes (D) best supports auditability in a DevOps environment because it provides an immutable, timestamped record of every change made to the codebase, including who made the change, what was changed, and when. This aligns with the principle of continuous audit, where every deployment artifact is traceable through the CI/CD pipeline, enabling compliance with standards like SOC 2 or ISO 27001. Unlike manual processes, automated logging ensures no change goes unrecorded, which is critical for forensic analysis and regulatory audits.

Answer

Use of configuration management tools

Answer

Manual approval gates

Answer

Separate development and production environments

Question 6

An IS auditor is reviewing problem management processes. Which TWO of the following are key outputs of effective problem management? (Select two.)

Accepted Answer

Known error database. A known error database (KEDB) is a key output of effective problem management because it records known errors and their workarounds, enabling faster incident resolution and preventing recurrence. The KEDB is populated from root cause analysis findings and is used to link incidents to known problems, supporting ITIL-based problem management processes.

Answer

Incident resolution times

Answer

Change requests

Answer

Service level reports

Question 7

An organization is developing a custom application. The project manager reports that the development team has implemented 80% of the features but only 50% of the budget is used. What is the MOST significant risk from an IS audit perspective?

Accepted Answer

The project may exceed the total budget due to scope growth.. The project has consumed only 50% of the budget while delivering 80% of the features, indicating a high probability of scope growth or feature creep. From an IS audit perspective, this imbalance suggests that additional features may be added without corresponding budget increases, leading to total budget overrun. The risk is that the remaining 20% of features will require more than the remaining 50% of the budget, especially if testing and deployment costs are underestimated.

Answer

The project may be completed ahead of schedule.

Answer

The application may not meet user requirements.

Answer

The remaining budget may be insufficient for testing and deployment.

Question 8

An IS auditor is reviewing the availability management process. The auditor calculates that the mean time between failures (MTBF) is 200 hours and the mean time to repair (MTTR) is 20 hours. What is the availability percentage?

Accepted Answer

90.91%. Availability = MTBF / (MTBF + MTTR) = 200 / 220 ≈ 0.9091, or 90.91%.

Answer

99.00%

Answer

95.00%

Answer

80.00%

Question 9

A company is updating its business continuity plan (BCP). Which THREE of the following should be included as key components?

Accepted Answer

List of critical staff and contact information. A BCP must include a current list of critical staff and their contact information to enable rapid activation of the plan and coordination during a disruption. Without this, key personnel cannot be reached, delaying response and recovery efforts.

Answer

Detailed network topology diagrams

Answer

Vendor contracts for equipment replacement

Question 10

Which THREE of the following are components of a typical IT governance framework?

Accepted Answer

Strategic alignment of IT with business. Strategic alignment of IT with business is a core component of an IT governance framework because it ensures that IT initiatives directly support and enable the organization's business objectives and strategies. This alignment is achieved through mechanisms like balanced scorecards and IT steering committees, which prioritize IT investments based on business value. Without this component, IT may operate in a silo, leading to wasted resources and missed opportunities.

Answer

Network troubleshooting procedures

Answer

Vendor contract management

Question 11

You are the IT governance lead at a multinational corporation with a complex IT environment spanning multiple business units. The company has recently experienced a series of minor security incidents where unauthorized access was gained through unused user accounts that were not disabled after employees left the organization. Additionally, there have been delays in provisioning access for new hires, leading to productivity losses. The IT department currently uses a manual process for access management, with each business unit maintaining its own user lists. The company has a policy that requires access reviews every quarter, but these are often missed or performed superficially. The CIO has asked you to recommend a solution that addresses these issues while ensuring compliance with regulations such as GDPR and SOX. Which of the following is the BEST course of action?

Accepted Answer

Implement an identity governance and administration (IGA) tool that automates user provisioning and de-provisioning, integrates with HR systems, and enforces access reviews.. Implementing an Identity Governance and Administration (IGA) tool directly addresses the root causes: manual, decentralized access management and lack of automated de-provisioning. IGA integrates with HR systems (e.g., Workday, SAP SuccessFactors) to trigger automatic account creation for new hires and immediate deactivation upon termination, eliminating orphaned accounts. It also enforces scheduled, auditable access reviews with certification workflows, ensuring compliance with GDPR (right to erasure, data minimization) and SOX (segregation of duties, access controls). This automated approach resolves both the security incidents from unused accounts and the productivity losses from delayed provisioning.

Answer

Require each business unit to submit monthly reports of active users to IT, which will then manually disable accounts not on the list.

Answer

Develop a new policy that mandates quarterly access reviews and disciplinary action for non-compliance.

Answer

Increase the frequency of access reviews to monthly and assign a dedicated team to perform them.

Question 12

An IT auditor is reviewing the release management process. Which of the following is the MOST important control to ensure that new releases do not negatively impact production systems?

Accepted Answer

Testing in a pre-production environment. Testing in a pre-production environment is essential to identify issues before deployment.

Answer

Rollback plan

Answer

Communication to users

Answer

Approval from the change advisory board

Question 13

An organization is implementing a new CRM system using an agile methodology. The IS auditor wants to assess whether security requirements are being addressed. What is the best evidence for the auditor to review?

Accepted Answer

The product backlog. The product backlog contains user stories, including security-related stories. Reviewing them shows whether security requirements are explicitly included.

Answer

The security policy

Answer

The sprint retrospective minutes

Answer

The system architecture document

Question 14

An IS auditor is reviewing the disaster recovery plan (DRP) for an e-commerce company that generates 90% of its revenue online. The DRP states that the recovery time objective (RTO) for the transactional database is 4 hours, and the recovery point objective (RPO) is 1 hour. The current backup strategy includes nightly full backups and hourly transaction log backups stored on a local disk array. The backups are then copied to a remote datacenter via a WAN link with an average transfer speed of 10 Mbps. The database size is 500 GB. The auditor calculates that the time to transfer the full backup over the WAN is approximately 12 hours. The organization's management is confident that the DRP is adequate because they have never had to invoke it. What is the auditor's MOST critical finding?

Accepted Answer

The RTO of 4 hours is not achievable given the backup transfer time.. The DRP states an RTO of 4 hours for the transactional database, but the full backup transfer time over the 10 Mbps WAN link is approximately 12 hours. Since the backup must be restored before the database can be made available, the RTO cannot be met. This is the most critical finding because it directly invalidates a core recovery objective, regardless of whether the plan has been tested.

Answer

The DRP has never been tested, so its feasibility is unknown.

Answer

The backup strategy does not include encryption for data in transit.

Answer

The RPO of 1 hour is not achievable because transaction logs are only taken hourly.

Question 15

An IS auditor is evaluating the privacy controls of an e-commerce company that collects and processes personal data from customers in multiple jurisdictions, including the European Union (GDPR). The company has a data inventory but has not conducted a privacy impact assessment (PIA) for a new customer analytics platform that processes sensitive data. Which THREE of the following are the MOST critical deficiencies that the auditor should report?

Accepted Answer

Lack of a privacy impact assessment (PIA) for the new platform. Under GDPR, a PIA is required for high-risk processing. Cross-border transfers without safeguards violate GDPR. Consent management is also a key requirement. Data minimization is a principle, but not necessarily a critical deficiency without context.

Answer

Inadequate data minimization practices in the platform design

Answer

Lack of an up-to-date privacy notice on the website

Question 16

An organization uses a third-party vendor for application support. The vendor has subcontracted some support activities to another firm (fourth party). The contract with the vendor requires the vendor to ensure fourth-party compliance, but there is no direct oversight. What is the IS auditor's primary recommendation?

Accepted Answer

Include a right-to-audit clause for all subcontractors in the contract.. The primary recommendation is to include a right-to-audit clause for all subcontractors in the contract. This ensures the organization retains direct oversight and contractual leverage over fourth-party risks, as relying solely on the vendor's assurance without audit rights creates a blind spot in the supply chain. Without such a clause, the organization cannot independently verify the fourth party's compliance with security controls, which is critical for maintaining business resilience.

Answer

Perform a vulnerability assessment on the fourth party.

Answer

Terminate the contract with the vendor.

Answer

Require the vendor to provide evidence of fourth-party compliance.

Question 17

Which THREE of the following are characteristics of SMART recommendations in an audit report? (Select three.)

Accepted Answer

Measurable. SMART stands for Specific, Measurable, Achievable, Relevant, Time-bound. Vague and rigid are not desirable.

Answer

Vague

Answer

Rigid

Question 18

During an audit, an IS auditor finds that the organization uses a cloud-based identity provider (IdP) for single sign-on (SSO) but does not enforce multi-factor authentication (MFA) for all users. Which of the following is the BEST recommendation to reduce risk?

Accepted Answer

Enforce MFA for all users accessing any application. Enforcing MFA for all users accessing any application is the best recommendation because it directly addresses the lack of a second authentication factor, which is the primary control to mitigate credential theft and unauthorized access. In a cloud-based IdP SSO environment, a single compromised password grants access to all integrated applications, so MFA must be applied universally to protect the entire trust boundary, not just external-facing apps. This aligns with NIST SP 800-63B and zero-trust principles, ensuring that every authentication request is verified with something the user knows and something they have.

Answer

Require MFA only for external-facing applications

Answer

Disable SSO and require separate passwords for each application

Answer

Reduce session timeout to 15 minutes

Question 19

During system development, which testing phase is performed by developers to verify that individual program units function correctly?

Accepted Answer

Unit testing. Unit testing is the phase where developers test individual program units or modules in isolation to verify they function correctly according to their design specifications. This is the lowest level of testing and is typically performed using stubs and drivers to simulate interfaces with other components.

Answer

Integration testing

Answer

User acceptance testing

Answer

System testing

Question 20

An IS auditor is reviewing the vendor management program for a critical outsourced service. The vendor has recently been acquired by another company. Which TWO factors should the auditor be most concerned about regarding the acquisition?

Accepted Answer

The vendor's new owner may have different security standards.. A change in vendor ownership can affect the contractual relationship and service delivery. The auditor should focus on whether the contract allows assignment (without consent) and whether the new owner's financial stability poses a risk.

Answer

The vendor's new owner may increase prices.

Answer

The vendor's new owner may have a different organizational culture.

Answer

The vendor's new owner may lay off key personnel.