CISA Practice Test 9 — 10 Questions

Question 1

An IS auditor is reviewing the effectiveness of a control that requires dual approval for payments over $10,000. The auditor selects a sample of payments and independently verifies that two approvals were obtained. This audit procedure is:

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Re-performance. Re-performance involves the auditor independently executing the control to verify its effectiveness.

Answer

Inquiry

Answer

Observation

Answer

Inspection

Question 2

An IS auditor is reviewing a waterfall SDLC project that has completed the requirements phase. Which of the following is the greatest risk to the project?

Accepted Answer

A key business stakeholder did not sign off on the requirements.. In waterfall, requirements are defined upfront and changes are difficult. If a key stakeholder did not sign off, there is a risk that later phases will be based on incomplete or incorrect requirements.

Answer

The project manager left the company.

Answer

The development team is unfamiliar with the technology.

Answer

The design phase is behind schedule.

Question 3

A government agency has an IT governance framework that includes an IT strategy committee, an IT steering committee, and a project management office. Despite this, there is a lack of transparency regarding IT spending and resource allocation. The agency's annual audit found that several IT initiatives were not approved by the steering committee and were funded out of operational budgets. The CFO is frustrated because IT costs are unpredictable. The agency's chief information officer (CIO) reports to the CFO but the IT steering committee is chaired by the CIO. The auditor's best recommendation to improve governance is to:

Accepted Answer

Change the steering committee chair to a senior business executive independent of IT. Having an independent steering committee chair (e.g., a senior business executive) eliminates the conflict of interest where the CIO chairs the committee and can bypass governance. Option A (chargeback) addresses cost allocation but not the root cause of unauthorized spending. Option B (business case) is a good practice but can still be ignored if the committee chair is the CIO. Option D (policy) can be overridden or ignored without structural change in governance.

Answer

Establish a chargeback system to allocate IT costs to business units

Answer

Require all IT projects to submit a business case to the steering committee for approval

Answer

Implement a policy that prohibits funding IT projects from operational budgets without steering committee approval

Question 4

An IS auditor is reviewing the change management process for a critical financial application. Which of the following findings would be of GREATEST concern?

Accepted Answer

Emergency changes are implemented without subsequent CAB approval. Emergency changes bypassing CAB approval pose high risk as they may not undergo proper testing and review.

Answer

Standard changes are documented but not tracked individually

Answer

Change requests are logged in a spreadsheet instead of a dedicated system

Answer

The CAB meets only once per month

Question 5

Which TWO of the following are key controls that an IS auditor should expect to find in a well-managed system development life cycle (SDLC)?

Accepted Answer

Segregation of duties between development and testing.. Segregation of duties between development and testing is a key control because it ensures that code is independently verified before release, preventing developers from approving their own changes and reducing the risk of undetected defects or malicious code. In a well-managed SDLC, this separation enforces an independent testing phase, which is critical for maintaining code integrity and security.

Answer

Vendor due diligence reports.

Answer

Automated unit testing scripts.

Answer

Gantt chart for project scheduling.

Question 6

During an operational audit, the auditor wants to evaluate the efficiency of a data entry process. Which of the following audit procedures would be most appropriate?

Accepted Answer

Performing trend analysis on the number of transactions processed per hour. Analytical procedures, such as comparing processing times to benchmarks, can identify inefficiencies. Observation may show procedures but not efficiency quantitatively.

Answer

Inspecting system logs to verify user access

Answer

Observing data entry operators to identify procedural bottlenecks

Answer

Interviewing the data entry supervisor about error rates

Question 7

An IS auditor is reviewing the physical access controls at a data center. Which of the following is the MOST effective control to prevent tailgating?

Accepted Answer

Mantrap with two interlocking doors. A mantrap allows only one person to pass at a time, preventing unauthorized individuals from following an authorized person.

Answer

Biometric access controls

Answer

CCTV cameras at entrances

Answer

Security guards at the entrance

Question 8

An organization is developing a policy on acceptable use of company IT resources. Which of the following should be included to support effective governance?

Accepted Answer

Consequences of non-compliance. An acceptable use policy should clearly define what constitutes acceptable and unacceptable use, including consequences for violations. This supports governance by establishing rules and accountability.

Answer

Detailed technical configuration standards

Answer

Service level targets for IT support

Answer

Procedures for incident response

Question 9

A multinational corporation is implementing a global HR system. The project team decides to use a pilot implementation in one region before rolling out to others. What is the PRIMARY risk if the pilot region is not representative of the entire organization?

Accepted Answer

Issues relevant to other regions may remain undetected.. The primary risk of a non-representative pilot is that region-specific variations in regulatory, cultural, or technical infrastructure (e.g., data privacy laws like GDPR, local labor regulations, or network latency) will not be exercised. This means defects or integration failures that are unique to other regions remain hidden until full rollout, undermining the pilot's purpose as a risk-reduction mechanism. Option C directly captures this core risk of undetected issues.

Answer

The pilot team may become overly confident.

Answer

The pilot may run over budget due to unexpected challenges.

Answer

The implementation schedule will be delayed.

Question 10

Based on the exhibit, which of the following is the MOST likely result of the current firewall configuration?

Accepted Answer

Remote SSH connections are permitted from any IP address. The exhibit shows an access control list (ACL) that permits TCP traffic on port 22 (SSH) from any source IP address (0.0.0.0/0) to the destination IP address of the firewall's external interface. Since there is no source restriction, remote SSH connections are allowed from any IP address on the internet. This is a significant security risk because it exposes the firewall's management interface to brute-force attacks from the entire internet.

Answer

SSH access is restricted to the internal network

Answer

HTTPS traffic from the internal network is blocked

Answer

HTTPS traffic from the internet is allowed