CISA Information System Auditing Process Practice Test 3 — 15 Questions

Question 1

During an audit of an organization's change management process, the IS auditor selects a sample of 50 change requests from a population of 500. The auditor finds that 3 of the 50 did not have proper approval. What is the estimated error rate in the population?

Accepted Answer

6%. The estimated error rate is the sample error rate, which is 3/50 = 6%.

Answer

3%

Answer

10%

Answer

5%

Question 2

An IS auditor is evaluating the use of continuous auditing techniques. Which of the following is the most significant benefit of implementing continuous monitoring over traditional periodic audits?

Accepted Answer

Timely detection of control deficiencies. Continuous monitoring provides timely detection of control deficiencies, enabling faster remediation.

Answer

Reduced need for substantive testing

Answer

Elimination of control risk assessments

Answer

Automated generation of audit reports

Question 3

An organization has outsourced its IT operations to a third-party provider. The IS auditor is planning an audit of the outsourced services. What is the most appropriate source of audit evidence?

Accepted Answer

Service auditor's SOC 2 report. A SOC 2 report (Service Organization Control 2) is specifically designed to provide assurance over a service provider's controls related to security, availability, processing integrity, confidentiality, and privacy. It is issued by an independent service auditor and is the most reliable and relevant source of audit evidence when auditing outsourced IT operations, as it directly addresses the controls in place at the provider.

Answer

Service provider's financial statements

Answer

Interviews with provider's staff

Answer

Internal audit reports from the provider

Question 4

During an audit, the IS auditor discovers that the audit log for a critical server is overwritten every 24 hours. The auditor wants to ensure logs are preserved for a longer period. Which of the following recommendations is most appropriate?

Accepted Answer

Configure the server to archive logs to a centralized log management system. The most appropriate recommendation is to configure the server to archive logs to a centralized log management system. This ensures logs are preserved beyond the 24-hour overwrite window by sending them to a separate, persistent storage location, which also supports security monitoring, forensics, and compliance requirements. Centralized logging (e.g., using syslog, SIEM, or a dedicated log collector) provides redundancy, integrity checks, and long-term retention without relying on the local server's limited storage.

Answer

Implement a manual backup of logs daily

Answer

Reduce the logging level to minimize data

Answer

Increase the log size to retain more data

Question 5

An IS auditor is testing the effectiveness of a preventive control that rejects invalid transactions. The auditor uses a computer-assisted audit technique (CAAT) to create a set of test transactions. What is the primary risk associated with this approach?

Accepted Answer

Test transactions may be processed as real transactions. The primary risk is that test transactions may be processed as real transactions if the CAAT does not properly isolate them from the production environment. This could result in unintended data corruption, financial misstatements, or operational disruptions. The auditor must ensure that test data is clearly flagged or run in a separate test environment to avoid integration with live processing.

Answer

The audit may disrupt system performance

Answer

Test transactions may not be representative

Answer

The CAAT may corrupt production data

Question 6

Which of the following is the most important factor to consider when determining sample size for a compliance test?

Accepted Answer

Tolerable error rate. In compliance testing (attribute sampling), the tolerable error rate is the maximum deviation rate from a control that the auditor is willing to accept without concluding the control is ineffective. It directly determines the required sample size because a lower tolerable error rate demands a larger sample to achieve sufficient precision, while a higher rate allows a smaller sample. This factor is more critical than others because it sets the boundary for the auditor's risk assessment.

Answer

Expected error rate

Answer

Population size

Answer

Sampling method

Question 7

An IS auditor is reviewing the audit follow-up process. The auditor notes that management has implemented corrective actions for 80% of previous audit findings. What should the auditor conclude?

Accepted Answer

Further investigation of outstanding findings is needed. An 80% closure rate indicates that 20% of findings remain unresolved. ISACA standards require auditors to verify that all high-risk findings are remediated before concluding on control effectiveness. Without evidence that the outstanding 20% are low-risk or have an accepted risk, the auditor must investigate further to ensure residual risk is within the organization's appetite.

Answer

The audit scope was too narrow

Answer

The audit process is effective

Answer

Management is compliant with all recommendations

Question 8

An organization uses a risk-based audit approach. For a high-risk area, the auditor decides to perform 100% testing instead of sampling. Which of the following is a valid reason for this decision?

Accepted Answer

The population size is small and errors are critical. When the population is small and errors are critical, 100% testing ensures complete coverage and minimizes risk.

Answer

The auditor has limited time

Answer

The tolerable error rate is high

Answer

The control is automated and always effective

Question 9

An IS auditor is evaluating the reliability of audit evidence. Which TWO of the following are characteristics of reliable audit evidence?

Accepted Answer

Independent source. Reliable evidence is independent and timely, increasing objectivity and relevance.

Answer

Complex

Answer

Relevant

Answer

Large quantity

Question 10

An IS auditor is selecting an appropriate audit sample. Which THREE of the following are factors that affect the sample size?

Accepted Answer

Tolerable error rate. Sample size is influenced by the expected error rate, tolerable error rate, and confidence level.

Answer

Sampling interval

Answer

Population standard deviation

Question 11

An IS auditor is assessing the effectiveness of an organization's IT governance framework. Which THREE of the following are key indicators of a mature governance process?

Accepted Answer

Defined roles and responsibilities for IT decisions. Mature governance includes defined roles, performance measurement, and an IT steering committee for oversight.

Answer

Annual IT budget approval by senior management

Answer

Outsourcing of all IT operations

Question 12

An IS auditor reviews the exhibit. Which of the following is the most likely cause of the denied traffic?

Accepted Answer

Missing firewall rule allowing RDP traffic. The log shows an RDP connection (port 3389) being denied by the access-group 'outside_in', indicating that no rule permits this traffic.

Answer

Misconfigured VPN tunnel

Answer

Intrusion prevention system blocking

Answer

Incorrect NAT configuration

Question 13

An IS auditor reviews the exhibit during an audit of database controls. What is the most appropriate recommendation?

Accepted Answer

Implement a locking strategy to prevent resource contention. Option C is correct because the exhibit (not shown here, but implied by the context) likely depicts a deadlock graph or lock-wait chain, indicating that concurrent transactions are blocking each other. The most appropriate recommendation is to implement a locking strategy (e.g., row-level locking, lock ordering, or using snapshot isolation) to prevent resource contention and avoid deadlocks. This directly addresses the root cause of the observed performance or failure issues.

Answer

Review the application code for missing commit statements

Answer

Enable automatic retry for failed transactions

Answer

Increase the database timeout parameter

Question 14

An IS auditor reviews the exhibit from a cloud access policy. Which of the following is a potential security concern?

Accepted Answer

The policy does not require encryption in transit. Option A is correct because the cloud access policy does not specify encryption in transit (e.g., HTTPS, TLS), leaving data vulnerable to interception over the network. Without a condition like `aws:SecureTransport` set to `true`, the policy allows HTTP requests, exposing sensitive data to man-in-the-middle attacks. This is a fundamental security gap in cloud access policies.

Answer

The policy grants access to all objects in the bucket

Answer

The policy allows access from any IP in the 10.0.0.0/8 range

Answer

The condition uses a private IP range which is not routable from the internet

Question 15

An IS auditor is evaluating the effectiveness of an organization's change management process. Which of the following is the most important control to verify during the audit?

Accepted Answer

A segregation of duties exists between development and production.. Segregation of duties between development and production environments ensures that code cannot be directly moved from development to production without independent review and testing. This control prevents unauthorized or untested code from affecting live systems, which is a fundamental principle of change management. Without this separation, a developer could introduce malicious or defective code directly into production, bypassing all quality and security checks.

Answer

All changes are approved by the IT manager.

Answer

Emergency changes are documented after implementation.

Answer

Change requests are prioritized by business impact.