CISA Hard Questions — 25 Difficult Questions

Question 1

An IS auditor reviews the exhibit from a cloud access policy. Which of the following is a potential security concern?

Accepted Answer

The policy does not require encryption in transit. The cloud access policy does not specify encryption in transit (e.g., HTTPS, TLS), leaving data vulnerable to interception over the network. Without a condition requiring secure transport, the policy allows unencrypted requests, exposing sensitive data to man-in-the-middle attacks. This is a fundamental security gap in cloud access policies.

Answer

The policy grants access to all objects in the bucket

Answer

The policy allows access from any IP in the 10.0.0.0/8 range

Answer

The condition uses a private IP range which is not routable from the internet

Question 2

An organization has configured HSRP as shown. During a failover test, the primary router (G0/1) is shut down, but the DR site router does not become active. What is the MOST likely reason?

Accepted Answer

The HSRP group numbers on the two interfaces do not match. HSRP requires that both routers participating in the same virtual IP address use the same group number to form a single HSRP group. If the group numbers on the two interfaces do not match, each router will form its own separate HSRP group, and neither will recognize the other as a peer. Consequently, when the primary router fails, the DR router does not assume the active role because it is not part of the same HSRP group.

Answer

The default route on the primary router points to the wrong next-hop

Answer

The preempt command is missing on the DR router

Answer

The OSPF routing protocol is not redistributing the default route

Question 3

A multinational corporation has implemented a hot site disaster recovery solution for its critical financial applications. Which of the following is the MOST important consideration to ensure the effectiveness of the hot site?

Accepted Answer

Regular, documented testing of the failover process is performed. Without regular testing, the hot site may not function as expected. Options A, B, and C are important but secondary: A is part of planning, B is operational, C is compliance but not the most critical for effectiveness.

Answer

Data replication latency is less than 15 minutes

Answer

The hot site is located in a different seismic zone

Answer

The hot site complies with regional data privacy regulations

Question 4

Refer to the exhibit. During a penetration test, a security analyst captures this SAML response. Which of the following security weaknesses is most evident?

Accepted Answer

The assertion is not encrypted. The SAML response shows the assertion is sent in plaintext (no xenc:EncryptedData element), meaning the authentication assertion is not encrypted. This allows an attacker who intercepts the SAML response to extract the assertion and reuse it in a replay or impersonation attack, violating the confidentiality requirement for sensitive authentication tokens.

Answer

The name identifier format is inappropriate

Answer

The session is too short

Answer

The authentication context is weak

Question 5

An organization's IT strategy is not aligned with business strategy due to lack of communication. Which of the following would BEST improve alignment?

Accepted Answer

Business-IT strategy mapping workshops. Business-IT strategy mapping workshops facilitate direct communication and collaboration, ensuring both sides understand and agree on priorities. Status reports, budget increases, or outsourcing do not address the communication gap.

Answer

Weekly IT status reports

Answer

Outsourcing non-core IT functions

Answer

IT budget increase

Question 6

An organization uses a risk-based audit approach. For a high-risk area, the auditor decides to perform 100% testing instead of sampling. Which of the following is a valid reason for this decision?

Accepted Answer

The population size is small and errors are critical. When a high-risk area is identified and the population size is small, 100% testing is justified because the cost of missing a critical error outweighs the cost of testing every item. This approach eliminates sampling risk entirely, ensuring that all errors are detected. In audit, 100% testing is appropriate when the population is small enough to make full examination feasible and the consequences of error are severe.

Answer

The auditor has limited time

Answer

The tolerable error rate is high

Answer

The control is automated and always effective

Question 7

An IS auditor is evaluating the encryption strategy for a healthcare organization subject to HIPAA. Which of the following is the MOST significant risk if the organization relies solely on encryption as a safe harbor?

Accepted Answer

Encryption keys are stored on the same server as the encrypted data.. Encryption safe harbor only applies if encryption meets specific standards; gaps in key management can invalidate safe harbor.

Answer

The encryption algorithm used is not FIPS 140-2 validated.

Answer

Encryption is not applied to all ePHI in transit.

Answer

The encryption key rotation policy is not documented.

Question 8

A company's endpoint protection solution alerts on a file that is digitally signed by a trusted software vendor but exhibits malicious behavior on execution. What type of threat does this scenario most likely depict?

Accepted Answer

Signed malware, indicating the certificate may have been compromised.. The scenario describes a file that is digitally signed by a trusted vendor yet exhibits malicious behavior. This is the classic definition of signed malware, where the digital certificate used to sign the file has likely been stolen, misused, or issued fraudulently. The trusted signature bypasses reputation-based and allowlist controls, making the threat particularly dangerous because the file appears legitimate to security tools that trust the vendor's certificate.

Answer

A Trojan horse disguised as legitimate software.

Answer

A zero-day exploit targeting an unpatched vulnerability.

Answer

A fileless attack that never writes to disk.

Question 9

An IS auditor is assessing the backup and recovery procedures for a critical database. Which TWO of the following are the MOST important controls to ensure recoverability?

Accepted Answer

Restore tests are conducted quarterly.. Regular restore tests (e.g., quarterly) are the only way to validate that backup data can actually be recovered and that the recovery procedures work as intended, which directly ensures recoverability. Option E is correct because storing backups offsite protects against site-level disasters (fire, flood, physical theft) that could destroy both primary data and on-site backups, ensuring data can be recovered from a separate location.

Answer

Backup media is encrypted.

Answer

Full backups are performed weekly.

Answer

Backup logs are reviewed daily.

Question 10

Refer to the exhibit. An IS auditor is reviewing an IAM policy for a cloud data platform. The auditor notices that user jdoe has READ_ONLY access to all tables matching 'sales_', but asmith has READ_WRITE access to the same set of tables. Which of the following is the MOST critical control issue?

Accepted Answer

The resource pattern '.*' in the regex could grant access to unintended tables. The regex pattern '.*' in the resource block is overly permissive and could match unintended tables beyond the intended 'sales_' prefix. In AWS IAM policies, the resource element uses regex-like patterns, and '.*' after 'sales_' would match any characters, including tables like 'sales_archive_private' or 'sales_2024_sensitive', potentially exposing sensitive data. This violates the principle of least privilege and is a critical control issue.

Answer

Users should not be directly assigned roles; use groups

Answer

The roles data_analyst and data_scientist have overlapping permissions

Answer

User jdoe should not have access to the sales_ tables

Question 11

An organization is developing a critical application using an agile methodology. The project sponsor demands frequent deliveries but the development team is concerned about insufficient testing. Which of the following BEST mitigates this risk?

Accepted Answer

Implement continuous integration and automated testing. Continuous integration (CI) and automated testing enable frequent, reliable code integration and immediate feedback on defects, directly addressing the tension between rapid delivery and insufficient testing. Automated tests run on every commit, catching regressions early without manual overhead, which is essential for agile sprints where manual testing alone cannot scale to match delivery velocity.

Answer

Deploy with known defects and fix them in the next sprint

Answer

Increase manual testing effort at the end of each sprint

Answer

Extend the release cycle to allow more time for testing

Question 12

Which TWO of the following are primary objectives of a data loss prevention (DLP) strategy?

Accepted Answer

Identify and classify sensitive data. Identifying and classifying sensitive data is the foundational step in a DLP strategy. Without knowing where sensitive data resides (e.g., PII, PCI, IP), DLP policies cannot accurately detect or prevent unauthorized transfers. Classification enables the DLP system to apply context-aware rules, such as blocking credit card numbers in email attachments or flagging confidential documents uploaded to cloud storage.

Answer

Encrypt all data in transit

Answer

Replace all existing security controls

Answer

Ensure compliance with all regulations

Question 13

An IS auditor is reviewing the incident management process. Incidents are categorized as P1 (critical) through P4 (low). The SLA for P1 incidents requires initial response within 15 minutes and resolution within 4 hours. The auditor notes that the average time to respond to P1 incidents is 12 minutes, but the average resolution time is 6 hours. The root cause analysis shows that many P1 incidents are due to known errors documented in the known error database (KEDB). What is the most significant finding?

Accepted Answer

Problem management is not effectively utilizing the KEDB to prevent recurring incidents.. If known errors are causing P1 incidents, problem management should have identified workarounds or permanent fixes. The fact that these incidents recur indicates a weakness in the problem management process, which should reduce incidents from known errors.

Answer

The average resolution time for P1 incidents exceeds SLA.

Answer

The average response time for P1 incidents is within SLA.

Answer

Incident management is not escalating P1 incidents properly.

Question 14

During an IT audit, the auditor observes that mandatory vacation policies are not enforced for IT staff with access to financial systems. What is the PRIMARY risk associated with this finding?

Accepted Answer

Increased risk of undetected fraud. Mandatory vacation policies force the periodic removal of an employee's access, which allows detection of irregularities or fraudulent activities that require the employee's continued presence to conceal. Without enforcement, a malicious insider could perpetrate fraud (e.g., creating ghost vendors, altering payment records) and cover it up by maintaining daily control over transactions. This directly increases the risk that fraudulent actions will go undetected over extended periods.

Answer

Increased likelihood of system downtime

Answer

Inadequate segregation of duties

Answer

Non-compliance with licensing agreements

Question 15

A multinational corporation is deploying a data loss prevention (DLP) solution across its network. The DLP system must be configured to prevent the exfiltration of personally identifiable information (PII) while minimizing false positives. Which approach is most effective?

Accepted Answer

Use regex patterns for PII combined with context-aware policies (e.g., user role, destination domain). Using regex patterns for PII combined with context-aware policies (e.g., user role, destination domain) allows the DLP system to accurately detect sensitive data while minimizing false positives. Option A is too simplistic; keyword-based blocking can cause high false positives. Option B relies on user training and self-reporting, which is not a technical DLP control and is ineffective. Option C (encryption) protects data at rest and in transit but does not prevent exfiltration; it is not a DLP method.

Answer

Block all outbound email containing keywords such as 'SSN' or 'credit card'

Answer

Require all users to complete annual data handling training and rely on self-reporting

Answer

Implement full disk encryption on all endpoints and encrypt all outbound traffic

Question 16

An IS auditor is reviewing a vulnerability scan report and finds that a critical vulnerability on a web server has been open for 90 days beyond the remediation SLA. The system owner states that the vulnerability cannot be patched because it would break a legacy application. What should the auditor recommend?

Accepted Answer

Require the system owner to sign a risk acceptance form. The appropriate action is to formally accept the risk through a documented risk acceptance process, with sign-off from management. This ensures accountability and awareness. The other options are either premature or inappropriate.

Answer

Escalate the issue to the board of directors

Answer

Implement compensating controls and close the finding

Answer

Recommend decommissioning the web server

Question 17

An IT auditor is reviewing the business continuity plan (BCP) for a financial services firm. The plan includes a hot site that is shared with another organization under a reciprocal agreement. Which of the following findings should be of MOST concern to the auditor?

Accepted Answer

The reciprocal agreement does not guarantee exclusive use of the hot site during a disaster. A reciprocal agreement for a shared hot site does not guarantee exclusive access during a disaster. If both organizations declare a disaster simultaneously, the site may become oversubscribed, leading to resource contention and potential failure of the BCP. This directly undermines the recovery capability, making it the most critical finding.

Answer

The hot site uses a different internet service provider than the primary site

Answer

The hot site has not been tested in the past 12 months

Answer

The hot site is located in the same seismic zone as the primary site

Question 18

During a system development project, the project manager notices that the actual cost is significantly higher than the planned cost at the 50% completion point. The earned value (EV) is $500,000, the actual cost (AC) is $600,000, and the planned value (PV) is $550,000. Which of the following is the MOST appropriate action?

Accepted Answer

Conduct a root cause analysis to identify the reasons for cost overrun. The project is over budget (EV $500K vs AC $600K) and behind schedule (EV $500K vs PV $550K). Before taking corrective action, the project manager must first perform a root cause analysis to understand why costs are exceeding planned values. This aligns with the CISA’s emphasis on identifying the underlying cause of variances before implementing changes to scope, budget, or schedule.

Answer

Request additional budget from senior management

Answer

Reduce the project scope to align with the budget

Answer

Crash the project schedule to make up for lost time

Question 19

Which THREE of the following are essential components of a data classification program?

Accepted Answer

Data retention and disposal schedules. Data retention and disposal schedules are essential to a data classification program because they define how long each classification level of data must be retained and the secure methods for its disposal (e.g., degaussing, cryptographic erasure, or physical shredding). This ensures that data is not kept beyond its useful life, reducing the risk of unauthorized access or legal non-compliance. Without these schedules, the classification program lacks the lifecycle management component necessary for operational security.

Answer

Regular vulnerability scanning

Answer

Implementation of database encryption

Question 20

An organization is adopting an agile development methodology for a new financial application. During a sprint review, the product owner expresses concern that the system does not enforce segregation of duties (SoD). The development team argues that SoD will be addressed in a future sprint. As the IS auditor, what is the BEST recommendation?

Accepted Answer

Insist that SoD be implemented in the next sprint.. In agile development, security and compliance requirements like segregation of duties (SoD) must be addressed as early as possible, especially for a financial application where regulatory compliance is critical. Delaying SoD to a future sprint introduces significant risk and violates the principle of 'secure by design.' The IS auditor's best recommendation is to insist that SoD be implemented in the next sprint, ensuring that the control is prioritized and integrated into the development lifecycle without waiting for an indefinite future iteration.

Answer

Suggest that the product owner accept the residual risk.

Answer

Accept the team's plan and document the risk.

Answer

Require immediate implementation of SoD in this sprint.