CISA Information System Auditing Process Practice Test 2 — 15 Questions

Question 1

During an audit of a cloud service provider, the IS auditor discovers that the provider's data center access logs show an employee accessing the production environment outside of normal business hours without a change request. What should the auditor do FIRST?

Accepted Answer

Evaluate the potential impact and the effectiveness of compensating controls. Option D is correct because the IS auditor's first priority is to assess risk. Without evaluating the potential impact of the unauthorized access and the effectiveness of any compensating controls (e.g., intrusion detection systems, session recording, or multi-factor authentication), the auditor cannot determine the severity of the finding or the urgency of subsequent actions. This aligns with the ISACA audit methodology, which mandates risk-based analysis before recommending remediation or reporting.

Answer

Report the incident to the provider's management immediately

Answer

Recommend immediate remediation procedures

Answer

Obtain supporting evidence such as system logs and change tickets

Question 2

An IS auditor is reviewing an organization's change management process. The auditor notes that all emergency changes are approved post-implementation by the change advisory board (CAB) within 48 hours. Which of the following is the auditor's BEST course of action?

Accepted Answer

Assess whether the emergency change policy includes proper justification and post-approval controls. Option D is correct because the auditor should assess whether emergency changes are properly authorized, but the post-approval within 48 hours is acceptable if controls are adequate. Option A is incorrect because immediate escalation is not warranted without evidence of a problem. Option B is wrong because testing is important but the issue is authorization. Option C is incorrect because there is no inherent violation; the auditor should evaluate the control design.

Answer

Escalate the issue to senior management as a control weakness

Answer

Verify that all emergency changes are tested before implementation

Answer

Recommend that emergency changes be approved prior to implementation

Question 3

An IS auditor is using statistical sampling to test a population of 10,000 transactions. The desired confidence level is 95%, and the tolerable error rate is 5%. Which of the following factors would MOST likely increase the required sample size?

Accepted Answer

An increase in the expected error rate to 6%. An increase in the expected error rate to 6% increases the required sample size because the sample size formula is directly proportional to the product of the expected error rate and its complement (p × (1-p)). At a 95% confidence level, the z-value is fixed (1.96), and as the expected error rate moves closer to 50%, the variance increases, requiring a larger sample to achieve the same precision. This is a core statistical sampling principle in audit testing.

Answer

A decrease in the tolerable error rate to 3%

Answer

A decrease in the confidence level to 90%

Answer

An increase in the population size to 15,000

Question 4

During an audit of an organization's disaster recovery plan (DRP), the IS auditor finds that the plan was last tested 18 months ago and no test results were documented. What should the auditor recommend?

Accepted Answer

Conduct a DRP test and document the results within the next quarter. Option C is correct because a recent test with documented results provides assurance. Option A is incorrect because testing frequency should be based on risk, not necessarily semiannual. Option B is wrong because the recommendation should address the lack of testing and documentation. Option D is incorrect because that is management's role; the auditor recommends.

Answer

Test the DRP semiannually

Answer

Document the results of all past tests

Answer

Assign responsibility for DRP testing to the IT manager

Question 5

An IS auditor is evaluating the effectiveness of an organization's information security awareness program. Which of the following is the BEST indicator of program effectiveness?

Accepted Answer

Trend in security incidents attributed to human error. Option D is the best indicator because it directly measures the program's outcome: a reduction in security incidents caused by human error. While training completion, policy acknowledgment, and quiz scores measure activity or knowledge, they do not confirm that employees have changed their behavior. A downward trend in human-error-related incidents provides empirical evidence that the awareness program is effectively influencing employee actions in real-world scenarios.

Answer

Percentage of employees who completed the training

Answer

Number of employees who acknowledged the security policy

Answer

Average score on the post-training quiz

Question 6

An IS auditor is reviewing the logical access controls of an enterprise resource planning (ERP) system. The auditor finds that terminated employees' accounts are disabled but not deleted. What is the PRIMARY risk associated with this practice?

Accepted Answer

Disabled accounts could be re-enabled without proper authorization. The primary risk of disabling rather than deleting terminated employees' accounts is that a disabled account retains its existing privileges and can be re-enabled by an attacker or insider with sufficient access (e.g., a system administrator with compromised credentials). In an ERP system, this could allow unauthorized re-activation of accounts with elevated roles, bypassing the intended termination process and leading to data theft, fraud, or system compromise.

Answer

Segregation of duties controls may be compromised

Answer

System performance may degrade due to accumulation of disabled accounts

Answer

Audit trail completeness may be affected

Question 7

An organization uses continuous auditing techniques to monitor transactions. The IS auditor is evaluating the effectiveness of these techniques. Which of the following is the PRIMARY benefit of continuous auditing over traditional periodic auditing?

Accepted Answer

Early detection of anomalies and potential fraud. Continuous auditing enables real-time or near-real-time monitoring of transactions, allowing the IS auditor to detect anomalies and potential fraud as they occur. This is the primary benefit because it shifts the audit function from retrospective review to proactive identification, which is critical for timely risk mitigation.

Answer

Reduced cost of audit resources

Answer

More timely identification of control weaknesses

Answer

Increased sample size for transaction testing

Question 8

An IS auditor is performing a review of an organization's IT governance framework. Which of the following findings would be of MOST concern?

Accepted Answer

No documented IT strategy aligned with business strategy. Option D is correct because absence of IT strategy alignment with business strategy undermines governance, making IT decisions misaligned. Option A is incorrect while a steering committee is important, its absence is not as critical as lack of strategic alignment. Option B is wrong because portfolio management is a tactic; without strategic alignment, it may be ineffective. Option C is incorrect because security policies are operational, not strategic governance.

Answer

Incomplete IT project portfolio management

Answer

Lack of an IT steering committee

Answer

Absence of an enterprise-wide information security policy

Question 9

Which TWO of the following are primary objectives of the audit planning phase? (Select TWO.)

Accepted Answer

Identify and assess risks relevant to the audit. During the audit planning phase, the primary objectives are to define the audit scope and objectives (Option E) and to identify and assess risks relevant to the audit (Option B). This sets the foundation for the entire audit engagement, ensuring resources are focused on high-risk areas and that the audit is aligned with organizational goals. Detailed procedures are developed later, and testing controls or issuing reports occur in subsequent phases.

Answer

Develop detailed audit procedures

Answer

Test the effectiveness of internal controls

Answer

Issue the final audit report

Question 10

Which THREE of the following are acceptable methods for gathering audit evidence? (Select THREE.)

Accepted Answer

Observation of processes being performed. Observation of processes being performed (Option B) is an acceptable audit evidence-gathering technique because the auditor directly witnesses the execution of controls or procedures, providing firsthand evidence of their operation. This method is particularly valuable for assessing the effectiveness of manual controls or physical security measures, as it allows the auditor to verify that the process is performed as documented and to identify any deviations in real-time.

Answer

Accepting management's assertions without corroboration

Answer

Obtaining hearsay from third parties

Question 11

Which TWO of the following are indicators that an IS auditor may need to adjust the audit approach during fieldwork? (Select TWO.)

Accepted Answer

Inability to obtain sufficient appropriate audit evidence. Option A is correct because if the IS auditor cannot obtain sufficient appropriate audit evidence, the audit approach must be adjusted—for example, by expanding sample sizes, using alternative procedures, or re-evaluating the reliance on controls. This directly impacts the ability to form an audit opinion and is a key fieldwork trigger per ISACA audit standards.

Answer

Completion of the initial risk assessment

Answer

Audit team members are behind schedule

Answer

Management requests a change in audit scope

Question 12

Refer to the exhibit. An IS auditor is reviewing firewall logs and notices repeated denied SSH attempts from an internal host (10.0.1.50) to a server (172.16.0.1). After the denied attempts, the host initiates permitted HTTPS connections to another server (172.16.0.5). Which of the following is the BEST interpretation of this pattern?

Accepted Answer

The host may be attempting to bypass security controls by using different protocols. The pattern of denied SSH attempts followed by successful HTTPS connections suggests the internal host is probing for an open SSH service and, when blocked, switches to an allowed protocol (HTTPS) to communicate with a different server. This behavior indicates an attempt to bypass security controls by leveraging a permitted protocol after initial reconnaissance or direct access attempts fail. The firewall logs show the host adapts its method, which is a classic indicator of protocol hopping or tunneling attempts.

Answer

The firewall rule 101 is misconfigured and blocking legitimate traffic

Answer

The host is performing reconnaissance and has mapped allowed services

Answer

The host successfully accessed server 172.16.0.1 via SSH

Question 13

Refer to the exhibit. An IS auditor is reviewing an IAM policy for a cloud data platform. The auditor notices that user jdoe has READ_ONLY access to all tables matching 'sales_', but asmith has READ_WRITE access to the same set of tables. Which of the following is the MOST critical control issue?

Accepted Answer

The resource pattern '.*' in the regex could grant access to unintended tables. Option D is correct because the regex pattern '.*' in the resource block is overly permissive and could match unintended tables beyond the intended 'sales_' prefix. In AWS IAM policies, the resource element uses regex-like patterns, and '.*' after 'sales_' would match any characters, including tables like 'sales_archive_private' or 'sales_2024_sensitive', potentially exposing sensitive data. This violates the principle of least privilege and is a critical control issue.

Answer

Users should not be directly assigned roles; use groups

Answer

The roles data_analyst and data_scientist have overlapping permissions

Answer

User jdoe should not have access to the sales_ tables

Question 14

Refer to the exhibit. An IS auditor is reviewing backup error logs. The error indicates a failed backup due to a missing file. What is the MOST likely cause?

Accepted Answer

A file in the source volume was moved or deleted during the backup window. The error indicates a failed backup due to a missing file. The most likely cause is that a file in the source volume was moved or deleted during the backup window. Backup processes that use file-level snapshots or open-file managers (e.g., Volume Shadow Copy Service on Windows) capture a point-in-time view; if a file is moved or deleted after the snapshot is taken but before it is read by the backup agent, the backup will fail with a 'missing file' error. This is a classic race condition in file-level backups without proper snapshot consistency.

Answer

The backup job was scheduled during peak hours causing timeout

Answer

The destination path '\BackupServer01\Backup\Shares' is invalid

Answer

Insufficient disk space on the backup destination

Question 15

An IS auditor is planning an audit of a newly implemented ERP system. The auditor wants to ensure that the audit covers critical controls. Which of the following is the most appropriate first step in the audit planning process?

Accepted Answer

Conduct a risk assessment of the ERP implementation.. The first step in audit planning is to conduct a risk assessment to identify high-risk areas and focus audit efforts.

Answer

Interview the system administrator.

Answer

Review prior audit workpapers.

Answer

Develop a detailed audit program.