CISA Practice Test 8 — 10 Questions

Question 1

A company's backup policy requires that backup tapes be stored offsite for at least one year. During an audit, the auditor finds that the offsite storage facility is not access-controlled and backup tapes are not encrypted. Which of the following is the auditor's BEST recommendation?

Accepted Answer

Encrypt all backup tapes before sending them offsite. The core issue is that backup tapes contain sensitive data and are stored in an uncontrolled environment. Encrypting the tapes before transport ensures that even if the physical security of the offsite facility is compromised, the data remains confidential. This directly addresses the risk of unauthorized access to the data, which is the primary concern, and is a cost-effective, immediate control that does not disrupt operations.

Answer

Negotiate a new contract with a different offsite storage provider

Answer

Move the tapes back to the primary site until the offsite facility is secured

Answer

Implement a check-in/check-out log for the offsite facility

Question 2

Based on the exhibit, what is the MOST likely compliance issue requiring immediate remediation?

Accepted Answer

Backup media lacks encryption.. The exhibit shows backup tapes stored in an unsecured cabinet without any indication of encryption. Since backup media often contains sensitive data, the lack of encryption exposes the organization to data breaches if the media is lost or stolen. This is a direct violation of data protection requirements and requires immediate remediation.

Answer

Access is not properly restricted.

Answer

Compliance checks are not being performed.

Answer

Retention period is too short.

Question 3

An organization has configured HSRP as shown. During a failover test, the primary router (G0/1) is shut down, but the DR site router does not become active. What is the MOST likely reason?

Accepted Answer

The HSRP group numbers on the two interfaces do not match. HSRP requires that both routers participating in the same virtual IP address use the same group number to form a single HSRP group. If the group numbers on the two interfaces do not match, each router will form its own separate HSRP group, and neither will recognize the other as a peer. Consequently, when the primary router fails, the DR router does not assume the active role because it is not part of the same HSRP group.

Answer

The default route on the primary router points to the wrong next-hop

Answer

The preempt command is missing on the DR router

Answer

The OSPF routing protocol is not redistributing the default route

Question 4

A large enterprise recently experienced a data breach due to an insider threat. The IT governance committee is reviewing the incident and considering measures to prevent recurrence. Which of the following is the BEST course of action to address the root cause?

Accepted Answer

Implement a privileged access management (PAM) solution to control and monitor elevated access.. A privileged access management (PAM) solution directly addresses the root cause of an insider threat by controlling, monitoring, and auditing elevated access rights. Since the breach was caused by an insider, limiting and tracking privileged accounts prevents unauthorized or excessive use of administrative credentials, which is the most effective preventive measure against recurrence.

Answer

Increase logging and auditing of all user activities.

Answer

Deploy a security information and event management (SIEM) tool.

Answer

Terminate the employment of the insider who caused the breach.

Question 5

A company's IT governance policy requires that all critical systems have a documented business continuity plan (BCP). During an audit, an IT auditor finds that the BCP for a critical financial system has not been updated in three years. Which of the following is the BEST recommendation?

Accepted Answer

Update the BCP to reflect current processes and conduct a test.. Option B is correct because IT governance policies require that BCPs remain current to reflect actual operational processes. An outdated BCP (three years stale) may contain obsolete recovery procedures, contact information, or dependencies, rendering it ineffective during a real incident. Updating the BCP and then testing it validates that the documented steps align with the current system architecture and can be executed successfully, which is a core requirement of the BCP lifecycle per ISACA guidelines.

Answer

Archive the outdated BCP and develop a new one from scratch.

Answer

Accept the risk because the system has been stable.

Answer

Implement a new system with built-in redundancy.

Question 6

Which TWO of the following are benefits of implementing an IT governance framework?

Accepted Answer

Improved risk management and mitigation. Implementing an IT governance framework, such as COBIT or ISO/IEC 38500, establishes structured policies, procedures, and controls that directly improve risk management and mitigation. By defining clear roles, accountability, and risk appetite, the framework ensures that risks are systematically identified, assessed, and treated, rather than being managed ad hoc. This aligns IT strategy with business objectives and embeds risk management into daily operations.

Answer

Reduction in IT staff headcount

Answer

Reduced IT operational costs

Answer

Elimination of all IT project failures

Question 7

Which of the following is the PRIMARY purpose of an IT governance framework?

Accepted Answer

To ensure IT aligns with and supports business strategy. The primary purpose of an IT governance framework is to ensure that IT investments, strategies, and operations are aligned with and support the overall business strategy, enabling the organization to achieve its goals. This alignment is achieved through mechanisms such as strategic planning, portfolio management, and performance measurement, which are core to frameworks like COBIT 2019. Without this alignment, IT may operate in isolation, leading to wasted resources and missed business opportunities.

Answer

To ensure compliance with laws and regulations

Answer

To protect IT assets from cyber threats

Answer

To reduce IT operational costs

Question 8

Which TWO of the following are key responsibilities of an IT steering committee?

Accepted Answer

Monitoring IT performance and value delivery. The IT steering committee is a senior-level governance body responsible for aligning IT strategy with business objectives. Monitoring IT performance and value delivery (A) is a key responsibility because the committee must ensure that IT investments generate the expected business benefits and that service levels meet agreed targets. Prioritizing IT projects and allocating resources (D) is also a core duty, as the committee decides which initiatives receive funding and staffing based on strategic importance and risk, rather than operational urgency.

Answer

Managing day-to-day IT operations

Answer

Writing and testing application code

Answer

Conducting IT audit engagements

Question 9

A multinational corporation is adopting a hybrid cloud strategy. The IT governance board must decide on a framework to ensure alignment with business objectives and regulatory compliance. Which framework is MOST appropriate?

Accepted Answer

COBIT 2019. COBIT 2019 is the most appropriate framework because it is specifically designed for IT governance, providing a comprehensive set of controls and processes to align IT with business objectives and ensure regulatory compliance. In a hybrid cloud strategy, COBIT 2019's focus on governance objectives, stakeholder needs, and risk management directly addresses the board's need for oversight across on-premises and cloud environments, unlike frameworks that target service management, security, or project management.

Answer

ITIL 4 Service Value System

Answer

ISO/IEC 27001 Information Security Management

Answer

PMBOK Guide

Question 10

An organization's IT strategy must be aligned with business strategy. Which of the following is the PRIMARY benefit of this alignment?

Accepted Answer

Increased value of IT investments to business objectives. When IT strategy is aligned with business strategy, every IT investment is directly tied to achieving specific business objectives, such as increasing revenue, improving customer experience, or enabling new business models. This alignment ensures that resources are allocated to projects that deliver measurable business value, rather than being spent on technology for its own sake. The primary benefit is therefore the increased value of IT investments to business objectives, as misalignment often leads to wasted expenditure on systems that do not support core business goals.

Answer

Faster adoption of new technologies

Answer

Enhanced security posture

Answer

Reduced IT operational costs