CISA Information System Auditing Process — 20 Questions

Question 1

An IS auditor is reviewing a change management process. A developer made an emergency change directly to production without following the standard change approval process. The change was later documented as a normal change. Which control weakness is MOST indicated by this scenario?

Accepted Answer

Inadequate segregation of duties between development and production environments. The developer bypassed the standard change approval process by making an emergency change directly to production, then retroactively documenting it as a normal change. This directly violates the principle of segregation of duties (SoD), as the same individual who implemented the change also controlled the documentation and approval trail, eliminating independent oversight. In a properly segregated environment, developers should not have direct write access to production systems without a separate change authorization and deployment step.

Answer

Absence of a rollback plan for emergency changes

Answer

Insufficient testing of emergency changes before deployment

Answer

Lack of a formal change documentation policy

Question 2

Based on the exhibit, what should the IS auditor MOST likely recommend?

Accepted Answer

Review the criteria for emergency changes and enforce proper classification. The exhibit shows changes classified as 'emergency' bypassing the standard approval process. The IS auditor's primary concern is that emergency changes may be misclassified to avoid proper review, increasing risk. Option D is correct because it addresses the root cause: reviewing the criteria for emergency changes and enforcing proper classification ensures that only truly urgent changes bypass standard controls, while all others follow the required approval path.

Answer

Investigate whether any changes are missing from the log

Answer

Immediately block all direct production access for developers

Answer

Require all changes to go through the standard approval process

Question 3

An IS auditor is evaluating the effectiveness of an organization's business continuity plan (BCP). Which of the following findings would be of GREATEST concern?

Accepted Answer

The BCP has not been tested in over two years. The BCP has not been tested in over two years is the greatest concern because testing is the only way to validate that the plan works under real-world conditions. Without recent testing, the organization cannot be confident that recovery time objectives (RTOs) and recovery point objectives (RPOs) are achievable, and any gaps or assumptions in the plan remain undiscovered. ISACA standards recommend testing at least annually, and a two-year gap significantly increases the risk of plan failure during an actual disaster.

Answer

The backup tapes are stored in a locked cabinet in the server room

Answer

The BCP contact list has not been updated in six months

Answer

The BCP relies on manual workarounds for critical systems

Question 4

During an audit of a financial application, the IS auditor discovers that user access reviews are performed quarterly instead of monthly as required by policy. Which of the following is the BEST initial action for the auditor?

Accepted Answer

Determine if compensating controls mitigate the risk of less frequent reviews. The IS auditor's primary role is to assess risk, not to enforce policy blindly. Quarterly reviews may still be acceptable if compensating controls (e.g., automated provisioning/deprovisioning, real-time monitoring, or role-based access controls) effectively reduce the risk of unauthorized access between reviews. Determining the presence and effectiveness of such controls is the best initial action before deciding whether to report noncompliance.

Answer

Recommend that the policy be changed to allow quarterly reviews

Answer

Report the noncompliance with the policy as a finding immediately

Answer

Escalate the issue to senior management for immediate resolution

Question 5

Based on the exhibit, the IS auditor is reviewing access to the payroll folder. Which of the following is the MOST significant finding?

Accepted Answer

Potential excessive privileges for user jdoe due to overlapping permissions. Option D is the most significant finding because user jdoe has overlapping permissions from multiple group memberships (e.g., HR_Managers and Payroll_Admin), which can result in unintended cumulative effective permissions. In Windows NTFS, effective permissions are the sum of all allowed permissions from each group, minus any explicit denies, so overlapping group memberships often grant more access than intended, violating the principle of least privilege.

Answer

Internal_Audit group has Read access to payroll data

Answer

User asmith has only Read access to payroll

Answer

HR_Managers group has Full Control over payroll

Question 6

Which TWO of the following are the MOST effective controls to prevent unauthorized changes to production data?

Accepted Answer

Requiring change management approval for all production changes. Requiring change management approval for all production changes is a preventive control that ensures every modification to production data is formally authorized, reviewed, and documented before implementation. This directly prevents unauthorized changes by enforcing a gatekeeping process where only approved changes proceed, reducing the risk of data integrity breaches. Without this control, even with other safeguards, an attacker or insider could bypass technical controls by simply requesting a change through official channels.

Answer

Implementing audit logging of all data changes

Answer

Encrypting production data at rest

Answer

Using automated testing for all code changes

Question 7

Which THREE of the following are key elements that should be included in a risk assessment report for information systems?

Accepted Answer

Identification of critical assets and their vulnerabilities. A is correct because a risk assessment report must identify critical assets and their vulnerabilities to establish the scope and basis for risk analysis. Without this, the report cannot prioritize which systems require immediate attention or justify subsequent control recommendations.

Answer

List of all vendors and their contract terms

Answer

Detailed budget for implementing security controls

Question 8

An IS auditor is reviewing the logical access controls of a system. Which of the following is the BEST evidence that access rights are appropriately assigned?

Accepted Answer

A recent user access review report signed by department managers. Option D is the best evidence because a user access review report signed by department managers provides documented confirmation that the assigned access rights have been explicitly verified and approved by the data owners. This is a detective control that directly validates the appropriateness of access assignments, whereas the other options are either preventive or detective controls that do not confirm the correctness of the rights themselves.

Answer

An audit log showing all successful and failed login attempts

Answer

A password policy requiring complex passwords

Answer

An access control matrix defining roles and permissions

Question 9

The exhibit shows a log entry from a domain controller. The IS auditor is investigating account lockout issues. What is the MOST likely cause of this event?

Accepted Answer

Multiple failed authentication attempts from the backup server. The log entry shows a failed authentication attempt from the backup server's IP address (10.0.0.15) using the service account 'svc_backup'. The event ID 4625 indicates an account logon failure, and the 'Failure Reason' field explicitly states 'Unknown user name or bad password'. Since the account name is correct, the most likely cause is multiple failed authentication attempts (e.g., due to a stale or incorrect password cached in the backup software) leading to account lockout, not a single event.

Answer

The service account password has expired

Answer

The service account does not exist

Answer

The service account has been disabled by an administrator

Question 10

An organization uses a cloud-based ERP system to manage financial transactions. The system is accessed by employees in finance, procurement, and sales departments. The IS auditor is reviewing the user access review process. The access review is performed quarterly by the IT manager using a report generated by the ERP system. The report lists all users and their roles. The IT manager manually checks off users who are still employed and approves the report. The auditor notes that the IT manager does not have detailed knowledge of job functions in each department. Additionally, the ERP system allows role combinations that may create segregation of duties conflicts, such as a user having both 'create purchase order' and 'approve purchase order' roles. The company's policy requires segregation of duties reviews to be performed by business process owners. Which of the following is the BEST recommendation?

Accepted Answer

Assign the access review to business process owners from each department. The core issue is that the IT manager lacks the business process knowledge to assess whether role combinations create segregation of duties (SoD) conflicts. Company policy explicitly requires SoD reviews to be performed by business process owners. Assigning the access review to business process owners from each department (Option C) directly aligns with policy and ensures that those with functional knowledge evaluate whether role assignments violate SoD rules, such as a user having both 'create purchase order' and 'approve purchase order' roles.

Answer

Increase the frequency of access reviews to monthly

Answer

Implement an automated tool to identify segregation of duties conflicts

Answer

Require the IT manager to obtain confirmation from each department head

Question 11

Arrange the steps to configure a firewall rule in the correct order.

Question 12

Order the steps for performing a disaster recovery test in the correct sequence.

Question 13

Match each audit risk component to its definition.

Question 14

Match each CISA domain to its focus.

Question 15

An IS auditor is planning an audit of a newly implemented financial system. Which of the following is the PRIMARY consideration when determining the audit scope?

Accepted Answer

Risk assessment of the financial system. The primary consideration for determining audit scope is a risk assessment of the financial system. ISACA standards require auditors to use a risk-based approach to focus audit efforts on areas with the highest residual risk, ensuring that resources are allocated to the most critical controls and processes. Without a risk assessment, the scope may be too broad or miss key vulnerabilities, such as segregation of duties or access control weaknesses in the new system.

Answer

Management's request to include all modules

Answer

Previous audit findings and recommendations

Answer

Regulatory requirements applicable to the system

Question 16

During an audit of a cloud service provider, the IS auditor discovers that the provider's data center access logs show an employee accessing the production environment outside of normal business hours without a change request. What should the auditor do FIRST?

Accepted Answer

Evaluate the potential impact and the effectiveness of compensating controls. Option D is correct because the IS auditor's first priority is to assess risk. Without evaluating the potential impact of the unauthorized access and the effectiveness of any compensating controls (e.g., intrusion detection systems, session recording, or multi-factor authentication), the auditor cannot determine the severity of the finding or the urgency of subsequent actions. This aligns with the ISACA audit methodology, which mandates risk-based analysis before recommending remediation or reporting.

Answer

Report the incident to the provider's management immediately

Answer

Recommend immediate remediation procedures

Answer

Obtain supporting evidence such as system logs and change tickets

Question 17

An IS auditor is reviewing an organization's change management process. The auditor notes that all emergency changes are approved post-implementation by the change advisory board (CAB) within 48 hours. Which of the following is the auditor's BEST course of action?

Accepted Answer

Assess whether the emergency change policy includes proper justification and post-approval controls. Option D is correct because the auditor should assess whether emergency changes are properly authorized, but the post-approval within 48 hours is acceptable if controls are adequate. Option A is incorrect because immediate escalation is not warranted without evidence of a problem. Option B is wrong because testing is important but the issue is authorization. Option C is incorrect because there is no inherent violation; the auditor should evaluate the control design.

Answer

Escalate the issue to senior management as a control weakness

Answer

Verify that all emergency changes are tested before implementation

Answer

Recommend that emergency changes be approved prior to implementation

Question 18

An IS auditor is using statistical sampling to test a population of 10,000 transactions. The desired confidence level is 95%, and the tolerable error rate is 5%. Which of the following factors would MOST likely increase the required sample size?

Accepted Answer

An increase in the expected error rate to 6%. An increase in the expected error rate to 6% increases the required sample size because the sample size formula is directly proportional to the product of the expected error rate and its complement (p × (1-p)). At a 95% confidence level, the z-value is fixed (1.96), and as the expected error rate moves closer to 50%, the variance increases, requiring a larger sample to achieve the same precision. This is a core statistical sampling principle in audit testing.

Answer

A decrease in the tolerable error rate to 3%

Answer

A decrease in the confidence level to 90%

Answer

An increase in the population size to 15,000

Question 19

During an audit of an organization's disaster recovery plan (DRP), the IS auditor finds that the plan was last tested 18 months ago and no test results were documented. What should the auditor recommend?

Accepted Answer

Conduct a DRP test and document the results within the next quarter. Option C is correct because a recent test with documented results provides assurance. Option A is incorrect because testing frequency should be based on risk, not necessarily semiannual. Option B is wrong because the recommendation should address the lack of testing and documentation. Option D is incorrect because that is management's role; the auditor recommends.

Answer

Test the DRP semiannually

Answer

Document the results of all past tests

Answer

Assign responsibility for DRP testing to the IT manager

Question 20

An IS auditor is evaluating the effectiveness of an organization's information security awareness program. Which of the following is the BEST indicator of program effectiveness?

Accepted Answer

Trend in security incidents attributed to human error. Option D is the best indicator because it directly measures the program's outcome: a reduction in security incidents caused by human error. While training completion, policy acknowledgment, and quiz scores measure activity or knowledge, they do not confirm that employees have changed their behavior. A downward trend in human-error-related incidents provides empirical evidence that the awareness program is effectively influencing employee actions in real-world scenarios.

Answer

Percentage of employees who completed the training

Answer

Number of employees who acknowledged the security policy

Answer

Average score on the post-training quiz