CISA Practice Test 9 — 10 Questions

Question 1

During an audit of a public key infrastructure (PKI), the IS auditor finds that certificate revocation lists (CRLs) are only updated weekly. Which of the following is the MOST significant risk?

Accepted Answer

Revoked certificates may be accepted as valid. If CRLs are only updated weekly, revoked certificates may still be accepted as valid during the interval between revocation and CRL publication, allowing compromised or misused certificates to be trusted. This is the most significant risk because it undermines the revocation mechanism and can enable impersonation or man-in-the-middle attacks. Timely revocation is critical to PKI trust.

Answer

Certificate authorities may become unavailable

Answer

Increased network traffic due to large CRLs

Answer

Users may experience delays in certificate validation

Question 2

An IS auditor is reviewing the physical access controls at a data center. Which of the following is the MOST effective control to prevent tailgating?

Accepted Answer

Mantrap. A mantrap is a physical security control consisting of a small vestibule with two interlocking doors, where the first door must close and the person must be authenticated before the second door opens. This design physically prevents tailgating because only one person can occupy the space at a time, and unauthorized individuals cannot slip through behind an authorized person. It is the most effective preventive control specifically engineered to defeat tailgating.

Answer

Security guards at the entrance

Answer

CCTV cameras at the entrance

Answer

Biometric readers at all entrances

Question 3

An IS auditor is reviewing the vulnerability management program. The auditor notes that a critical vulnerability was identified in a production system six months ago and has not been patched due to a business impact assessment. Which of the following should the auditor examine NEXT?

Accepted Answer

Whether a formal risk acceptance and compensating controls are in place. When a critical vulnerability remains unpatched due to a business impact assessment, the auditor's next step is to verify whether a formal risk acceptance and compensating controls are in place, because unpatched critical vulnerabilities require documented management approval and mitigating measures. This ensures the organization has consciously accepted the risk with proper governance rather than leaving it unaddressed. The auditor must confirm that the decision was authorized, documented, and supported by controls that reduce the residual risk to an acceptable level.

Answer

The technical details of the vulnerability

Answer

The patch deployment schedule for the next quarter

Answer

The vendor's patch release notes

Question 4

Which THREE of the following are key metrics to include in a disaster recovery test report? (Select exactly 3.)

Accepted Answer

Amount of data lost (actual vs. RPO). Option A is correct because a DR test report must quantify actual data loss against the Recovery Point Objective (RPO), showing whether the achieved recovery point met the agreed tolerable data-loss threshold. Option C is correct because measuring the time taken to recover each critical system validates performance against the Recovery Time Objective (RTO) and identifies systems that exceeded acceptable downtime. Option E is correct because the percentage of successful restores demonstrates the reliability and integrity of backups and recovery procedures, exposing failed or partial restores that need remediation. Option B is not a standard DR test metric; cost per incident belongs to financial or business-impact analysis rather than recovery validation. Option D is also not a key DR metric, since headcount alone does not measure recovery effectiveness, speed, or data integrity.

Answer

Cost per incident

Answer

Number of personnel involved

Question 5

Which TWO of the following are key components of an IT governance framework? (Choose two.)

Accepted Answer

IT strategy. Option D (IT strategy) is correct because an IT governance framework must define how IT is aligned with and supports the organization's business objectives, and the IT strategy is the core document that establishes this direction, priorities, and value delivery. Option E (IT steering committee) is correct because governance requires a decision-making body with assigned authority and accountability; the IT steering committee provides oversight, prioritization, and resource-allocation decisions across IT initiatives. The remaining options do not belong: a network topology diagram (A) and a hardware inventory (C) are operational/technical artifacts describing infrastructure, not governance mechanisms, and help desk procedures (B) are tactical service-management documentation rather than a governance component.

Answer

Network topology diagram

Answer

Help desk procedures

Answer

Hardware inventory

Question 6

An IT steering committee is reviewing a proposed project to migrate critical applications to the cloud. Which of the following is the PRIMARY role of the IT steering committee in this decision?

Accepted Answer

To ensure the project aligns with business strategy. The IT steering committee ensures that IT investments align with business strategy. They are responsible for strategic alignment and approving major projects based on business value.

Answer

To perform the technical feasibility study

Answer

To select the cloud service provider

Answer

To manage the project budget and schedule

Question 7

During a build vs. buy analysis, the IS auditor observes that the organization decided to build a custom application because no vendor solution met all requirements. Which of the following risks should the auditor emphasize?

Accepted Answer

Increased time-to-market and development costs. When an organization chooses to build a custom application instead of buying a vendor solution, the primary risks shift from external dependencies to internal development challenges. Building custom software typically requires significant upfront investment in time, skilled personnel, and financial resources, and it often takes longer to deliver than implementing an existing product. Therefore, the auditor should emphasize increased time-to-market and development costs as the key risk in this scenario.

Answer

Lack of customization

Answer

Dependence on external support

Answer

Vendor lock-in

Question 8

An IT auditor is reviewing the policy hierarchy of an organization. Which of the following correctly describes the relationship between a policy and a procedure?

Accepted Answer

A policy defines the 'what' and 'why', while a procedure defines the 'how'.. A policy is a high-level statement of management intent that defines what must be done and why, establishing mandatory requirements and direction. A procedure is the detailed, step-by-step operational instruction that defines how to accomplish the policy's requirements. This 'what/why vs. how' distinction is the foundational relationship in any IT governance documentation hierarchy.

Answer

A policy is reviewed annually, while a procedure is reviewed every five years.

Answer

A policy is a detailed step-by-step instruction, while a procedure is a high-level statement.

Answer

A policy is a mandatory requirement, while a procedure is optional.

Question 9

An organization is considering acquiring a commercial off-the-shelf (COTS) ERP system. Which of the following risks is most effectively mitigated by including a contractual clause for audit rights?

Accepted Answer

Inadequate vendor security controls. A contractual clause for audit rights allows the organization to assess the vendor's security controls, ensuring they meet the organization's requirements and mitigating the risk of inadequate vendor security. This is critical because the organization relies on the vendor to protect its data, and without audit rights, it cannot verify the effectiveness of the vendor's controls. The other risks are not directly addressed by audit rights: incompatibility is a technical integration issue, vendor lock-in relates to data portability, and cost overruns stem from project management.

Answer

Incompatibility with existing infrastructure

Answer

Vendor lock-in due to proprietary data formats

Answer

Cost overruns from customization

Question 10

An information systems auditor is evaluating user accounts in an organization's Linux environment. The accounts have the following properties:
- The 'root' account has its password field set to '!!' (disabled).
- The 'admin' account has its password field set to '!' (locked) and UID 0.
- The 'test' account is a regular user with UID 1000.
Based on this information, which user account poses the HIGHEST security risk?

Accepted Answer

admin. The 'admin' account poses the highest security risk because, despite its password being locked (indicated by '!' in the shadow file), it has UID 0 (root privileges). A locked password prevents password-based login, but the account may still be accessible via SSH keys or other authentication methods, and its privileged status makes it a valuable target for privilege escalation attacks. In contrast, the 'root' account may be fully disabled, and the 'test' account is a standard user without elevated privileges.

Answer

root

Answer

test

Answer

None of the accounts are risky