CISA Practice Test 8 — 10 Questions

Question 1

An organization is implementing a change management process based on ITIL. Which THREE change types should be included in the policy?

Accepted Answer

Emergency change – requires immediate implementation to resolve a major incident.. ITIL defines an Emergency change as one that must be implemented as soon as possible—often to resolve a major incident or security vulnerability. This change type bypasses the normal CAB approval cycle and uses a dedicated Emergency CAB (ECAB) process to authorize and implement the fix rapidly while still maintaining control.

Answer

Planned change – scheduled during maintenance windows with no approval needed.

Answer

Major change – requires executive approval and a separate risk assessment.

Question 2

An organization is implementing a data classification policy and needs to assign ownership for sensitive data. Which of the following is the most appropriate role to assign as the data owner?

Accepted Answer

The head of the business unit that creates and uses the data. The data owner is the person or entity with ultimate accountability for a specific dataset, typically a senior business manager who understands the data's value, legal requirements, and usage context. In this scenario, the head of the business unit that creates and uses the data is best positioned to classify the data, authorize access, and ensure compliance with the data classification policy, as they have direct business responsibility for the data's lifecycle.

Answer

The chief information security officer (CISO)

Answer

The system administrator of the database

Answer

The legal counsel responsible for compliance

Question 3

An organization's backup strategy includes taking full backups weekly and transactional log backups every 15 minutes. The auditor wants to verify that backup encryption is implemented for offsite storage. Which control is most relevant?

Accepted Answer

Backup encryption at rest. Backup encryption at rest ensures that data stored offsite is protected from unauthorized access, which is a key control for offsite backups.

Answer

Backup compression

Answer

Offsite transport log

Answer

Backup verification logs

Question 4

A large financial institution is evaluating the effectiveness of its IT governance framework. The board has requested a review to ensure alignment with business objectives and regulatory requirements. Which of the following is the MOST important factor for the board to consider when assessing the IT governance framework?

Accepted Answer

The framework is integrated with enterprise governance and supports strategic objectives.. An effective IT governance framework must be integrated with enterprise governance to ensure alignment with business objectives and regulatory requirements. Option B is incorrect because incident response is an operational process, not a primary board-level governance consideration. Option C is incorrect because technical efficiency is a management concern, not a governance-level factor. Option D is incorrect because minimizing IT costs is a tactical objective that may conflict with strategic priorities.

Answer

The framework includes a detailed incident response plan.

Answer

The framework focuses on achieving high technical efficiency.

Answer

The framework minimizes overall IT costs.

Question 5

A company's availability monitoring shows that a critical application has an average MTBF of 720 hours and an average MTTR of 4 hours. What is the availability percentage?

Accepted Answer

99.45%. Availability = MTBF / (MTBF + MTTR) = 720 / (720 + 4) = 720 / 724 ≈ 0.994475, or 99.45%.

Answer

99.72%

Answer

99.17%

Answer

99.95%

Question 6

Refer to the exhibit. The IS auditor reviews the router's version output during an audit. What is the MOST significant finding?

Accepted Answer

The IOS version is outdated and may contain security vulnerabilities.. The most significant finding is that the IOS version is outdated and may contain security vulnerabilities. An outdated IOS version can have known exploits that compromise the router's security, which is a critical risk for the organization. While other options describe operational states, they do not present the same level of immediate security threat as running unsupported or vulnerable firmware.

Answer

The router was returned to ROM by power-on.

Answer

The router has been running for over two years without a reboot.

Answer

The system image is stored in flash memory.

Question 7

An organization's backup strategy includes full backups every Sunday and incremental backups on other days. On Wednesday, a failure occurs. Which backups are needed to restore the data?

Accepted Answer

Sunday's full backup and Monday through Wednesday incremental backups. To restore from incremental backups, you need the last full backup (Sunday) and all incremental backups from Monday through Wednesday.

Answer

Sunday's full backup only

Answer

Sunday's full backup and Wednesday's incremental backup

Answer

Wednesday's incremental backup only

Question 8

A multinational corporation is evaluating its IT governance structure. The board wants to ensure that IT investments are prioritized based on risk and value. Which framework component is MOST critical?

Accepted Answer

Portfolio management process. A portfolio management process systematically evaluates and prioritizes investments based on risk and value, aligning with board objectives. Steering committee provides oversight, but portfolio management is the mechanism for prioritization.

Answer

Service level agreements

Answer

Balanced scorecard

Answer

IT steering committee

Question 9

Which TWO of the following are key benefits of using a system development life cycle (SDLC) methodology? (Select exactly two.)

Accepted Answer

It provides a structured approach to system development. SDLC provides a structured approach to system development (Option A), ensuring that phases are followed and projects are managed systematically. It also ensures that user requirements are captured and validated through continuous user involvement (Option B). Option C is incorrect because SDLC does not prevent scope changes; it helps manage and control them. Option D is incorrect because security testing is an integral part of SDLC, not eliminated. Option E is incorrect because SDLC may involve additional upfront costs, though it reduces long-term rework costs.

Answer

It prevents any scope changes during development

Answer

It eliminates the need for security testing

Answer

It reduces the overall cost of development

Question 10

An IS auditor is reviewing backup procedures for a critical database. Which THREE are key considerations for ensuring backup reliability and recoverability?

Accepted Answer

Ensuring backup retention periods meet the recovery point objective (RPO).. Backup reliability requires regular testing (restore verification), secure offsite storage to protect against site disasters, and retention aligned with business recovery objectives. Encryption is important but not directly for reliability; compression may affect performance but not reliability.

Answer

Encrypting backup data to prevent unauthorized access.

Answer

Compressing backup data to reduce storage costs.