CISA Information System Auditing Process — Timed 10 Questions

Question 1

An IS auditor is reviewing a change management process. A developer made an emergency change directly to production without following the standard change approval process. The change was later documented as a normal change. Which control weakness is MOST indicated by this scenario?

Accepted Answer

Inadequate segregation of duties between development and production environments. The developer bypassed the standard change approval process by making an emergency change directly to production, then retroactively documenting it as a normal change. This directly violates the principle of segregation of duties (SoD), as the same individual who implemented the change also controlled the documentation and approval trail, eliminating independent oversight. In a properly segregated environment, developers should not have direct write access to production systems without a separate change authorization and deployment step.

Answer

Absence of a rollback plan for emergency changes

Answer

Insufficient testing of emergency changes before deployment

Answer

Lack of a formal change documentation policy

Question 2

Based on the exhibit, what should the IS auditor MOST likely recommend?

Accepted Answer

Review the criteria for emergency changes and enforce proper classification. The exhibit shows changes classified as 'emergency' bypassing the standard approval process. The IS auditor's primary concern is that emergency changes may be misclassified to avoid proper review, increasing risk. Option D is correct because it addresses the root cause: reviewing the criteria for emergency changes and enforcing proper classification ensures that only truly urgent changes bypass standard controls, while all others follow the required approval path.

Answer

Investigate whether any changes are missing from the log

Answer

Immediately block all direct production access for developers

Answer

Require all changes to go through the standard approval process

Question 3

An IS auditor is evaluating the effectiveness of an organization's business continuity plan (BCP). Which of the following findings would be of GREATEST concern?

Accepted Answer

The BCP has not been tested in over two years. The BCP has not been tested in over two years is the greatest concern because testing is the only way to validate that the plan works under real-world conditions. Without recent testing, the organization cannot be confident that recovery time objectives (RTOs) and recovery point objectives (RPOs) are achievable, and any gaps or assumptions in the plan remain undiscovered. ISACA standards recommend testing at least annually, and a two-year gap significantly increases the risk of plan failure during an actual disaster.

Answer

The backup tapes are stored in a locked cabinet in the server room

Answer

The BCP contact list has not been updated in six months

Answer

The BCP relies on manual workarounds for critical systems

Question 4

During an audit of a financial application, the IS auditor discovers that user access reviews are performed quarterly instead of monthly as required by policy. Which of the following is the BEST initial action for the auditor?

Accepted Answer

Determine if compensating controls mitigate the risk of less frequent reviews. The IS auditor's primary role is to assess risk, not to enforce policy blindly. Quarterly reviews may still be acceptable if compensating controls (e.g., automated provisioning/deprovisioning, real-time monitoring, or role-based access controls) effectively reduce the risk of unauthorized access between reviews. Determining the presence and effectiveness of such controls is the best initial action before deciding whether to report noncompliance.

Answer

Recommend that the policy be changed to allow quarterly reviews

Answer

Report the noncompliance with the policy as a finding immediately

Answer

Escalate the issue to senior management for immediate resolution

Question 5

Based on the exhibit, the IS auditor is reviewing access to the payroll folder. Which of the following is the MOST significant finding?

Accepted Answer

Potential excessive privileges for user jdoe due to overlapping permissions. Option D is the most significant finding because user jdoe has overlapping permissions from multiple group memberships (e.g., HR_Managers and Payroll_Admin), which can result in unintended cumulative effective permissions. In Windows NTFS, effective permissions are the sum of all allowed permissions from each group, minus any explicit denies, so overlapping group memberships often grant more access than intended, violating the principle of least privilege.

Answer

Internal_Audit group has Read access to payroll data

Answer

User asmith has only Read access to payroll

Answer

HR_Managers group has Full Control over payroll

Question 6

Which TWO of the following are the MOST effective controls to prevent unauthorized changes to production data?

Accepted Answer

Requiring change management approval for all production changes. Requiring change management approval for all production changes is a preventive control that ensures every modification to production data is formally authorized, reviewed, and documented before implementation. This directly prevents unauthorized changes by enforcing a gatekeeping process where only approved changes proceed, reducing the risk of data integrity breaches. Without this control, even with other safeguards, an attacker or insider could bypass technical controls by simply requesting a change through official channels.

Answer

Implementing audit logging of all data changes

Answer

Encrypting production data at rest

Answer

Using automated testing for all code changes

Question 7

Which THREE of the following are key elements that should be included in a risk assessment report for information systems?

Accepted Answer

Identification of critical assets and their vulnerabilities. A is correct because a risk assessment report must identify critical assets and their vulnerabilities to establish the scope and basis for risk analysis. Without this, the report cannot prioritize which systems require immediate attention or justify subsequent control recommendations.

Answer

List of all vendors and their contract terms

Answer

Detailed budget for implementing security controls

Question 8

An IS auditor is reviewing the logical access controls of a system. Which of the following is the BEST evidence that access rights are appropriately assigned?

Accepted Answer

A recent user access review report signed by department managers. Option D is the best evidence because a user access review report signed by department managers provides documented confirmation that the assigned access rights have been explicitly verified and approved by the data owners. This is a detective control that directly validates the appropriateness of access assignments, whereas the other options are either preventive or detective controls that do not confirm the correctness of the rights themselves.

Answer

An audit log showing all successful and failed login attempts

Answer

A password policy requiring complex passwords

Answer

An access control matrix defining roles and permissions

Question 9

The exhibit shows a log entry from a domain controller. The IS auditor is investigating account lockout issues. What is the MOST likely cause of this event?

Accepted Answer

Multiple failed authentication attempts from the backup server. The log entry shows a failed authentication attempt from the backup server's IP address (10.0.0.15) using the service account 'svc_backup'. The event ID 4625 indicates an account logon failure, and the 'Failure Reason' field explicitly states 'Unknown user name or bad password'. Since the account name is correct, the most likely cause is multiple failed authentication attempts (e.g., due to a stale or incorrect password cached in the backup software) leading to account lockout, not a single event.

Answer

The service account password has expired

Answer

The service account does not exist

Answer

The service account has been disabled by an administrator

Question 10

An organization uses a cloud-based ERP system to manage financial transactions. The system is accessed by employees in finance, procurement, and sales departments. The IS auditor is reviewing the user access review process. The access review is performed quarterly by the IT manager using a report generated by the ERP system. The report lists all users and their roles. The IT manager manually checks off users who are still employed and approves the report. The auditor notes that the IT manager does not have detailed knowledge of job functions in each department. Additionally, the ERP system allows role combinations that may create segregation of duties conflicts, such as a user having both 'create purchase order' and 'approve purchase order' roles. The company's policy requires segregation of duties reviews to be performed by business process owners. Which of the following is the BEST recommendation?

Accepted Answer

Assign the access review to business process owners from each department. The core issue is that the IT manager lacks the business process knowledge to assess whether role combinations create segregation of duties (SoD) conflicts. Company policy explicitly requires SoD reviews to be performed by business process owners. Assigning the access review to business process owners from each department (Option C) directly aligns with policy and ensures that those with functional knowledge evaluate whether role assignments violate SoD rules, such as a user having both 'create purchase order' and 'approve purchase order' roles.

Answer

Increase the frequency of access reviews to monthly

Answer

Implement an automated tool to identify segregation of duties conflicts

Answer

Require the IT manager to obtain confirmation from each department head