CISA Practice Test 7 — 10 Questions

Question 1

An organization is deploying a major system upgrade. The change request has been approved by CAB, but the deployment plan does not include a rollback procedure. As an IS auditor, what should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Delay the deployment until a rollback plan is created and tested. A rollback plan is a mandatory component of any production change because it provides the mechanism to restore the prior known-good state if the deployment fails or causes outages. Without a tested rollback procedure, the organization has no controlled recovery path, exposing it to extended downtime and data integrity risk. As an IS auditor, the correct recommendation is to delay deployment until a rollback plan is created and tested, regardless of CAB approval.

Answer

Perform the deployment during off-peak hours to minimize impact

Answer

Document the decision to skip rollback in the change record

Answer

Proceed with deployment as CAB approval is sufficient

Question 2

Which TWO of the following are BEST indicators that a system development project is at risk of failure?

Accepted Answer

Frequent scope changes. Frequent scope changes (A) are a classic early warning sign of project failure because uncontrolled scope creep invalidates baselines, disrupts design and testing, and causes cost and schedule overruns. An unrealistic schedule (D) is also a strong risk indicator, since compressing effort below what the work actually requires forces shortcuts in analysis, coding, and testing, leading to defects and missed milestones. In contrast, clear communication (B), robust testing (C), and high team morale (E) are all positive project health indicators that reduce risk rather than signal failure.

Answer

Clear communication

Answer

Robust testing

Answer

High team morale

Question 3

A retail company is merging with a competitor. The IT departments of both organizations have different IT governance structures: Company A uses a centralized model with strict change management, while Company B uses a decentralized model with autonomous business unit IT. The CIO has been tasked with integrating the IT functions post-merger. The board expects cost synergies and improved service levels. The integration team is facing resistance from Company B's business heads who fear loss of agility. The CIO needs to propose a governance model for the merged entity. Which approach would BEST meet the board's expectations while addressing resistance?

Accepted Answer

Implement a phased integration with a transitional governance structure that includes representatives from both sides.. A phased integration with a transitional governance structure that includes representatives from both sides allows the merged entity to gradually converge governance models, manage change and resistance, and work toward cost synergies and improved service levels without immediately disrupting business operations. Option A is incorrect because keeping both models separate permanently fails to achieve the desired integration and synergies. Option B is incorrect because fully adopting the decentralized model may not deliver the cost synergies and centralized control expected by the board. Option C is incorrect because immediately imposing a centralized model would likely cause strong resistance from Company B's business heads and disrupt agility, undermining the merger's success.

Answer

Keep both models separate and allow business units to choose their preferred model.

Answer

Adopt Company B's decentralized model to preserve agility.

Answer

Immediately impose Company A's centralized model across the merged entity.

Question 4

Which IT sourcing model involves using an external provider to manage some IT functions while retaining others in-house?

Accepted Answer

Co-sourcing. Co-sourcing is a hybrid model where certain IT functions are outsourced and others are kept in-house.

Answer

Cloud services

Answer

Insourcing

Answer

Outsourcing

Question 5

An organization is evaluating its business continuity plan (BCP) to ensure alignment with the IT disaster recovery plan. Which TWO of the following are critical elements that should be included in the BCP to support effective business resilience?

Accepted Answer

Procedures for manual operations during system unavailability.. Option B is correct because a BCP must define manual workaround procedures (e.g., paper-based processing, offline approvals) so that essential business functions can continue while IT systems are unavailable, directly supporting business resilience during a disaster. Option D is correct because the BCP must include up-to-date contact information for key stakeholders, business unit owners, and emergency response teams so that activation, escalation, and coordination can occur quickly when an incident strikes. Option A is not the best fit because application recovery priorities belong primarily to the IT disaster recovery plan, which the BCP aligns with rather than duplicates. Option C is not a critical BCP element; a hardware and software license inventory is an asset management concern and does not by itself ensure continuity of business operations. Option E is also not appropriate because detailed network restoration procedures are technical DR runbooks, not business continuity content.

Answer

A list of all critical IT applications with their recovery priorities.

Answer

A complete inventory of hardware and software licenses.

Answer

Detailed step-by-step procedures for restoring network connectivity.

Question 6

During an ERP implementation, the project team decides to customize the software to align with existing business processes. Which of the following risks is MOST likely to increase as a result of extensive customization?

Accepted Answer

Higher costs for future upgrades. Extensive customization of an ERP system typically involves modifying the core code or configuration beyond standard parameters. This creates a custom code base that diverges from the vendor's standard release, making future upgrades significantly more complex and costly because each upgrade requires re-applying and testing all customizations against the new version, often requiring specialized skills and extensive regression testing.

Answer

Increased vendor lock-in

Answer

Simpler data migration

Answer

Reduced user acceptance

Question 7

An IT policy exception is requested to allow a legacy system that cannot be patched to remain in operation. What is the BEST way to manage this exception?

Accepted Answer

Approve with compensating controls and a sunset date. The best way to manage a policy exception for an unpatachable legacy system is to approve it conditionally — with compensating controls that reduce the residual risk and a sunset date that forces eventual decommissioning or replacement. This aligns with ISACA's risk management guidance: exceptions should be time-bound, risk-assessed, and mitigated, never open-ended. Compensating controls (e.g., network segmentation, enhanced monitoring, virtual patching) address the risk that patching would normally cover.

Answer

Reject the request and force the system to be patched

Answer

Escalate to the board for decision

Answer

Approve the exception indefinitely to avoid disruption

Question 8

An organization has the storage bucket policy shown. Which of the following is the MOST likely intent of this policy?

Accepted Answer

Prevent deletion of objects from the bucket over unencrypted connections.. The bucket policy uses a condition that denies the storage.objects.delete permission when the request is not over HTTPS (i.e., when secure transport is false), which specifically blocks object deletion over unencrypted connections while still allowing deletion over HTTPS. This is a targeted control to prevent accidental or malicious deletion on plaintext channels without disabling deletion entirely. The intent is therefore to prevent deletion of objects over unencrypted connections.

Answer

Prevent all deletion of objects from the bucket.

Answer

Prevent access to the bucket over HTTP.

Answer

Allow deletion only over HTTPS.

Question 9

An auditor is reviewing IT policy compliance and finds that a critical policy was last updated three years ago. The organization has undergone significant changes. What is the auditor's PRIMARY concern?

Accepted Answer

The policy may not be aligned with current business objectives. The primary concern with a policy that has not been updated for three years amid significant organizational change is that it may no longer align with current business objectives, risks, and operating environment. Policy relevance is the root issue; awareness, approval, and enforcement are downstream symptoms that may or may not exist. An outdated policy can direct behavior toward obsolete goals and create compliance gaps.

Answer

Employees may not be aware of the policy

Answer

The policy may not have been approved by management

Answer

The policy may not be enforced

Question 10

An organization is deciding between building a custom application and purchasing a commercial off-the-shelf (COTS) product. The primary factor favoring the build option is:

Accepted Answer

Greater control over features. Building a custom application allows for tailored functionality that meets unique business requirements, which is a key advantage over COTS.

Answer

Faster time to market

Answer

Lower initial cost

Answer

Reduced vendor dependency