CISA Hard Questions — 25 Difficult Questions

Question 1

Which THREE of the following are key considerations when selecting a software development methodology for a project?

Accepted Answer

Regulatory compliance requirements. Regulatory compliance requirements (Option B) are a key consideration because the chosen methodology must support necessary audit trails, documentation, and control frameworks (e.g., SOX, HIPAA, PCI DSS). A methodology like Waterfall provides rigid phase-gate documentation, while Agile may require adaptation (e.g., SAFe) to satisfy compliance evidence demands. Failure to align methodology with regulatory needs can lead to non-compliance findings during a CISA audit.

Answer

Availability of project management software

Answer

Programming language preferences

Question 2

Which THREE of the following are responsibilities of the board of directors regarding IT governance? (Choose three.)

Accepted Answer

Approving the IT strategy. Option B is correct because the board of directors is responsible for approving the organization's IT strategy, ensuring it aligns with business objectives and long-term goals. Option C is correct because reviewing and approving IT policies is a core governance duty that sets the direction and boundaries for how IT is managed and controlled. Option E is correct because the board must ensure that IT risks are managed within acceptable levels, which is a fundamental element of IT governance and risk oversight. Option A is incorrect because implementing IT security controls is an operational/management responsibility, typically carried out by IT staff, not the board. Option D is incorrect because monitoring daily IT operations is an operational task performed by IT management and staff, not a board-level governance responsibility.

Answer

Implementing IT security controls

Answer

Monitoring daily IT operations

Question 3

An IS auditor is evaluating how an organization manages its backup and restoration process for a critical financial application. The backup job completes successfully each night and writes to a tape library. Management states that recovery capability has been proven because the backup job reports success. Which audit procedure would BEST test whether the backups are actually restorable?

Accepted Answer

Perform a periodic test restoration of selected data to a separate environment and reconcile the results.. Only an actual restoration test demonstrates that backup data can be read and used to recover the application. Job success logs, offsite storage, and schedule alignment all address supporting conditions but none proves recoverability. Periodic test restorations with reconciliation of results provide direct evidence and also validate the recovery procedures and dependencies that a real recovery would require.

Answer

Confirm that the backup window and retention schedule align with the recovery point objective.

Answer

Review the backup job logs to confirm that all scheduled jobs completed without errors.

Answer

Verify that backup tapes are stored in a secure offsite location with environmental controls.

Question 4

An IS auditor is evaluating a control that requires the security administrator to review privileged access logs weekly. During testing, the auditor finds the reviews were performed but no evidence of follow-up exists for two anomalies identified in one review. Which of the following conclusions is MOST appropriate?

Accepted Answer

The exceptions should be evaluated for cause and effect before concluding on control effectiveness. When testing identifies exceptions, the auditor evaluates their nature, cause, and effect before concluding on the control. Documented reviews without documented follow-up suggest the detection element worked but the response element may not have. Determining whether the anomalies were resolved, ignored, or escalated elsewhere is essential to deciding whether the control objective was actually achieved.

Answer

The control is ineffective because any deviation, regardless of cause, invalidates the entire control

Answer

The control is operating effectively because the reviews were performed as scheduled

Answer

The control should be retested with a larger sample to determine whether the exceptions are isolated

Question 5

Refer to the exhibit. A security analyst notices that users on the INSIDE network (10.1.1.0/24) can browse HTTPS websites but cannot resolve domain names. What is the most likely cause?

Accepted Answer

The ACL only permits DNS traffic to host 10.2.2.10, but users need to query a different DNS server. The exhibit shows an ACL that permits DNS traffic (UDP port 53) only to host 10.2.2.10. Since users can browse HTTPS (TCP/443) but cannot resolve domain names, the ACL is blocking DNS queries to any other DNS server. Option B correctly identifies that the ACL restricts DNS to a single server, and if users are configured to query a different DNS server, resolution fails.

Answer

The ACL denies TCP traffic to port 443

Answer

The DNS server at 10.2.2.10 is unreachable

Answer

The OUTSIDE interface has no security-level configured correctly

Question 6

An IS auditor is evaluating how an organization enforces segregation of duties (SoD) within its enterprise resource planning (ERP) system. Management states that SoD conflicts are identified during user provisioning. Which TWO of the following audit procedures would BEST determine whether SoD controls operate effectively on an ongoing basis? (Choose two.)

Accepted Answer

Examine a sample of users provisioned in the last quarter to confirm that conflicting access was not granted.. Effective SoD assurance requires both design and operating evidence. Reviewing the conflict ruleset confirms that the detection logic covers the right combinations of duties, while testing recently provisioned users confirms the control actually prevented conflicts in practice. Together they address whether the control is correctly defined and whether it operates as intended. Password policy, backups, and interviews do not provide direct evidence about conflicting access assignments in the ERP system.

Answer

Verify that the ERP system's database backups complete successfully each night.

Answer

Confirm that the ERP system's password policy enforces complexity and expiration requirements.

Answer

Interview the ERP administrator to confirm that SoD conflicts are taken seriously.

Question 7

Which THREE of the following are characteristics of a SMART recommendation? (Select three.)

Accepted Answer

Measurable. A SMART recommendation must be Measurable (A), meaning it includes quantifiable criteria or metrics (e.g., a percentage, count, or threshold) so progress and success can be objectively verified. It must also be Time-bound (C), specifying a deadline or timeframe (e.g., "within 90 days") so the recommendation has a defined completion point. Finally, it must be Specific (D), clearly stating the exact action, system, or process to be changed rather than a vague aspiration. The unmarked options do not belong: General (B) contradicts the specificity requirement of SMART, and Subjective (E) is wrong because SMART criteria rely on objective, verifiable evidence rather than personal opinion.

Answer

General

Answer

Subjective

Question 8

During a firewall rule review, an IS auditor identifies several rules that allow any-to-any traffic. Which THREE of the following should the auditor recommend as the MOST appropriate actions?

Accepted Answer

Obtain business justification for each any-to-any rule. Option A is correct because an IS auditor must first obtain business justification for each any-to-any rule, since a rule may be required for a legitimate business or technical purpose and cannot be judged in isolation. Option B is correct because the fundamental remediation for overly permissive rules is to replace any-to-any rules with specific source, destination, port, and protocol rules that enforce least privilege and reduce the attack surface. Option E is correct because any any-to-any rule that lacks a valid business justification should be removed, as it represents unnecessary exposure with no documented need. Option C is not appropriate because immediately deleting all any-to-any rules without review could disrupt legitimate business traffic and cause outages, violating change management and availability requirements. Option D is not the most appropriate action because increasing logging only detects misuse after the fact; it does not remediate the excessive permissiveness that the auditor should recommend eliminating.

Answer

Immediately delete all any-to-any rules without review

Answer

Increase logging for any-to-any rules to detect misuse

Question 9

An organization is planning to implement a data loss prevention (DLP) solution to protect sensitive data. Which THREE of the following are essential steps to ensure the effectiveness of the DLP program?

Accepted Answer

Classifying data based on sensitivity. Option B is correct because data classification based on sensitivity is the foundational step of any DLP program: DLP engines rely on labels, metadata, or content fingerprints (e.g., regex, EDM, or document fingerprints) to identify what should be protected, so without classification the tool cannot distinguish sensitive from non-sensitive data. Option E is correct because defining DLP policies and rules translates classification into enforceable actions, specifying what data can be transmitted, by whom, over which channels (email, endpoint, web, cloud), and what action to take (block, quarantine, encrypt, alert). Option C is correct because DLP rules must be monitored and tuned regularly; false positives and false negatives are common, and reviewing incident reports, adjusting thresholds, and refining rules ensures the program remains accurate and effective over time. Option A is not correct because encryption at rest and in transit is a complementary data protection control, not an essential step for making a DLP program effective, and DLP can function without universal encryption. Option D is not correct because while employee training on data handling procedures supports the program, it is an awareness and governance activity rather than an essential technical step for DLP effectiveness.

Answer

Encrypting all data at rest and in transit

Answer

Training all employees on data handling procedures

Question 10

A security review of the above Apache configuration identifies a critical vulnerability. Which of the following is the MOST significant issue?

Accepted Answer

Directory listing is enabled (Indexes option). The Indexes option in Apache enables directory listing, which exposes the entire contents of a directory when no index file (e.g., index.html) is present. This can reveal sensitive files, configuration backups, or source code, making it a critical information disclosure vulnerability. Unlike other options, Indexes directly leads to unauthorized data exposure without requiring any additional conditions.

Answer

Default DocumentRoot path is used

Answer

AllowOverride All allows .htaccess overrides

Answer

Require all granted permits all access

Question 11

An organization uses a COTS (commercial off-the-shelf) ERP system with significant customizations. The IS auditor is reviewing the system's configuration management. Which of the following findings would MOST indicate a weakness?

Accepted Answer

The system administrator has the ability to modify both configuration and production data.. In a COTS ERP system with significant customizations, allowing the system administrator to modify both configuration and production data violates the principle of segregation of duties (SoD). This creates a risk of unauthorized or undetected changes, as the same individual can alter system configurations and then manipulate production data to conceal the impact, bypassing audit trails and controls.

Answer

The vendor releases quarterly patches but the organization only applies critical security patches.

Answer

Customizations are not tracked in a separate change management system.

Answer

The organization does not have a formal testing environment for customizations.

Question 12

Refer to the exhibit. Which perspective shows the greatest deviation from target?

Accepted Answer

Learning & Growth. The Learning & Growth perspective shows the greatest deviation from target, as indicated in the exhibit (likely a balanced scorecard dashboard). This perspective focuses on employee training, culture, and innovation, which are leading indicators for future performance.

Answer

Customer

Answer

Financial

Answer

Internal Process

Question 13

During a spiral model SDLC project, an IS auditor is reviewing risk assessment documentation. Which of the following would be the GREATEST concern?

Accepted Answer

Key risks identified in the first iteration are not reassessed in later iterations. The spiral model is risk-driven; failure to identify critical risks undermines the methodology and could lead to project failure.

Answer

Risk mitigation plans are not documented

Answer

The project uses a combination of waterfall and prototyping

Answer

Risk analysis is performed by the project manager alone

Question 14

During a system development project, the project manager notices that the actual cost is significantly higher than the planned cost at the 50% completion point. The earned value (EV) is $500,000, the actual cost (AC) is $600,000, and the planned value (PV) is $550,000. Which of the following is the MOST appropriate action?

Accepted Answer

Conduct a root cause analysis to identify the reasons for cost overrun. The project is over budget (EV $500K vs AC $600K) and behind schedule (EV $500K vs PV $550K). Before taking corrective action, the project manager must first perform a root cause analysis to understand why costs are exceeding planned values. This aligns with the CISA’s emphasis on identifying the underlying cause of variances before implementing changes to scope, budget, or schedule.

Answer

Request additional budget from senior management

Answer

Reduce the project scope to align with the budget

Answer

Crash the project schedule to make up for lost time

Question 15

An organization has outsourced its IT help desk to a third-party provider. Which of the following is the MOST critical control to ensure service quality?

Accepted Answer

Service level agreement (SLA) with key performance indicators. A Service Level Agreement (SLA) with key performance indicators (KPIs) is the most critical control because it defines measurable targets (e.g., average speed to answer, first-call resolution rate, ticket closure time) and establishes contractual remedies for non-compliance. Without an SLA, the organization has no enforceable mechanism to hold the provider accountable for service quality, making it the foundational control for outsourced IT help desk governance.

Answer

Regular background checks on provider employees

Answer

Access to provider's incident management system

Answer

Monthly meetings with provider management

Question 16

An IS auditor is reviewing a contract with a vendor for a new financial system. Which of the following clauses is MOST critical to ensure auditability?

Accepted Answer

Right to audit the vendor's operations and controls. The right-to-audit clause is the most critical for ensuring auditability because it contractually grants the organization and its auditors the ability to examine the vendor's controls, records, and operations. Without this clause, the organization cannot independently verify that the vendor meets security, compliance, and operational requirements, regardless of other contractual protections.

Answer

Penalties for non-performance

Answer

Service level agreements (SLAs) for system uptime

Answer

Data ownership and confidentiality provisions

Question 17

An organization's backup strategy includes taking full backups weekly and transactional log backups every 15 minutes. The auditor wants to verify that backup encryption is implemented for offsite storage. Which control is most relevant?

Accepted Answer

Backup encryption at rest. Backup encryption at rest ensures that data stored offsite is protected from unauthorized access, which is a key control for offsite backups.

Answer

Backup compression

Answer

Offsite transport log

Answer

Backup verification logs

Question 18

A multinational corporation operates in a highly regulated industry. The IT governance framework includes a risk appetite statement approved by the board. Recently, the company suffered a significant data breach due to an unpatched vulnerability that had been identified three months earlier. The IT audit found that the vulnerability was reported to the IT department but was not prioritized for remediation because it was deemed low risk by the IT operations team. The incident response plan was not activated because the breach was not initially detected. The board wants to strengthen governance to prevent recurrence. The most effective course of action for the auditor to recommend is:

Accepted Answer

Establishing a formal vulnerability management policy that requires risk-based prioritization in accordance with the risk appetite and escalation to the IT risk committee for decisions outside tolerance. The root cause is a governance failure: the IT operations team made a risk-acceptance decision that exceeded its authority, without a formal process tying vulnerability prioritization to the board-approved risk appetite. A vulnerability management policy that mandates risk-based prioritization aligned with the risk appetite and requires escalation to the IT risk committee when findings fall outside tolerance directly addresses this governance gap. This is the most effective recommendation because it fixes the decision-making framework, not just the symptom.

Answer

Deploying an intrusion detection system to identify breaches sooner

Answer

Disciplining the IT operations team for not escalating the vulnerability

Answer

Implementing a more robust patch management system with automated patching

Question 19

An IT department uses a balanced scorecard (BSC) to measure performance. The financial perspective shows that IT costs are within budget, but customer satisfaction scores are declining. The learning and growth perspective indicates low employee engagement. Which action should the IT governance committee prioritize?

Accepted Answer

Invest in training and development programs for IT staff.. The BSC's learning and growth perspective is the foundational driver of the other three perspectives — low employee engagement directly undermines process quality, customer satisfaction, and ultimately financial outcomes. Since customer satisfaction is already declining and the root cause traces to employee engagement, the governance committee should prioritize investing in training and development to fix the upstream cause. This aligns with the BSC's cause-and-effect logic where learning and growth improvements cascade into customer and financial results.

Answer

Reduce IT costs further to reallocate savings to customer service.

Answer

Increase the IT budget to hire more staff.

Answer

Outsource customer-facing IT support to a third party.

Question 20

An IS auditor reviews the exhibit from a cloud access policy. Which of the following is a potential security concern?

Accepted Answer

The policy does not require encryption in transit. The cloud access policy does not specify encryption in transit (e.g., HTTPS, TLS), leaving data vulnerable to interception over the network. Without a condition requiring secure transport, the policy allows unencrypted requests, exposing sensitive data to man-in-the-middle attacks. This is a fundamental security gap in cloud access policies.

Answer

The policy grants access to all objects in the bucket

Answer

The policy allows access from any IP in the 10.0.0.0/8 range

Answer

The condition uses a private IP range which is not routable from the internet