CISA Multiple Select — 20 Questions

Question 1

An IT governance framework should include which TWO key components? (Select exactly two.)

Accepted Answer

Strategic alignment. Strategic alignment ensures IT supports business goals; performance measurement tracks achievement. Network firewall rules, user training, and vendor lock-in are operational or tactical, not core governance components.

Answer

User training

Answer

Vendor lock-in

Answer

Network firewall rules

Question 2

An IS auditor is evaluating an organization's SDLC controls for a new system. Which TWO of the following are key controls that should be in place during the design phase? (Select TWO.)

Accepted Answer

Architecture review by a senior architect. Architecture review by a senior architect is a key control during the design phase because it ensures the system's high-level structure aligns with security, scalability, and business requirements before development begins. This review catches design flaws early, reducing costly rework and preventing architectural weaknesses that could be exploited later. It is a formal gate in the SDLC that validates the design against established patterns and standards.

Answer

Static application security testing (SAST)

Answer

User acceptance testing (UAT)

Answer

Regression testing

Question 3

An IS auditor is reviewing the backup process for a critical database. Which TWO of the following are essential controls to ensure data recoverability?

Accepted Answer

Offsite storage of backup media.. Offsite storage of backup media (Option B) is essential because it protects against site-level disasters such as fire, flood, or physical theft. Without geographic separation, a single incident could destroy both the primary data and its backups, making recovery impossible. This control directly supports the recoverability objective by ensuring a usable copy exists outside the primary facility.

Answer

Automated job scheduling for backups.

Answer

Encryption of backup data.

Answer

Backup retention period of at least one year.

Question 4

An IS auditor is assessing the backup and recovery procedures for a critical database. Which TWO of the following are the MOST important controls to ensure recoverability?

Accepted Answer

Restore tests are conducted quarterly.. Regular restore tests (e.g., quarterly) are the only way to validate that backup data can actually be recovered and that the recovery procedures work as intended, which directly ensures recoverability. Option E is correct because storing backups offsite protects against site-level disasters (fire, flood, physical theft) that could destroy both primary data and on-site backups, ensuring data can be recovered from a separate location.

Answer

Backup media is encrypted.

Answer

Full backups are performed weekly.

Answer

Backup logs are reviewed daily.

Question 5

An IS auditor is reviewing the design phase of a new procurement system. Which TWO of the following controls are MOST critical to include in the system design to prevent unauthorized purchases?

Accepted Answer

Mandatory approval workflows for purchase orders above a threshold.. Mandatory approval workflows for purchase orders above a threshold are critical because they enforce a policy-based control that prevents unauthorized high-value purchases by requiring explicit authorization from a designated approver. This control is designed into the system to intercept transactions that exceed a predefined limit, ensuring that no single user can bypass financial authority limits.

Answer

Automated performance reports on purchase cycle times.

Answer

Real-time audit logging of all purchase transactions.

Answer

Encryption of purchase order data in transit.

Question 6

Which THREE of the following are acceptable methods for gathering audit evidence? (Select THREE.)

Accepted Answer

Observation of processes being performed. Observation of processes being performed (Option B) is an acceptable audit evidence-gathering technique because the auditor directly witnesses the execution of controls or procedures, providing firsthand evidence of their operation. This method is particularly valuable for assessing the effectiveness of manual controls or physical security measures, as it allows the auditor to verify that the process is performed as documented and to identify any deviations in real-time.

Answer

Accepting management's assertions without corroboration

Answer

Obtaining hearsay from third parties

Question 7

Which TWO of the following are primary objectives of a data loss prevention (DLP) strategy?

Accepted Answer

Identify and classify sensitive data. Identifying and classifying sensitive data is the foundational step in a DLP strategy. Without knowing where sensitive data resides (e.g., PII, PCI, IP), DLP policies cannot accurately detect or prevent unauthorized transfers. Classification enables the DLP system to apply context-aware rules, such as blocking credit card numbers in email attachments or flagging confidential documents uploaded to cloud storage.

Answer

Encrypt all data in transit

Answer

Replace all existing security controls

Answer

Ensure compliance with all regulations

Question 8

An IS auditor is reviewing a change management process. Which TWO elements should be documented in a normal change request to ensure adequate governance? (Select TWO)

Accepted Answer

Test plan. A change request should include a test plan to verify the change works as intended and a rollback plan to revert if the change fails. These are critical for risk management and governance.

Answer

Vendor contact information

Answer

Change requester's name

Answer

Project budget remaining

Question 9

Which TWO of the following are key elements of an effective incident response plan? (Select exactly 2.)

Accepted Answer

A clear escalation path with contact information. A clear escalation path (C) ensures incidents are reported to the right stakeholders for timely decision-making, while predefined communication templates (E) enable rapid and consistent notifications to internal and external parties. These are directly used during incident response. Post-incident reviews (A) are important but not a key element of the plan itself; software licenses (B) and hardware serial numbers (D) are asset management details, not incident response essentials.

Answer

A schedule for post-incident reviews

Answer

A detailed inventory of software licenses

Answer

A list of all hardware serial numbers

Question 10

Which THREE of the following are essential components of a data classification program?

Accepted Answer

Data retention and disposal schedules. Data retention and disposal schedules are essential to a data classification program because they define how long each classification level of data must be retained and the secure methods for its disposal (e.g., degaussing, cryptographic erasure, or physical shredding). This ensures that data is not kept beyond its useful life, reducing the risk of unauthorized access or legal non-compliance. Without these schedules, the classification program lacks the lifecycle management component necessary for operational security.

Answer

Regular vulnerability scanning

Answer

Implementation of database encryption

Question 11

Which TWO of the following are primary objectives of a business continuity plan (BCP)?

Accepted Answer

Maintain regulatory compliance during disruptions. A primary objective of a BCP is to ensure that the organization can continue to meet legal and regulatory obligations during a disruption. This includes maintaining required data protection, reporting, and operational standards as mandated by regulations such as GDPR, HIPAA, or SOX, even when normal operations are impaired.

Answer

Replace the disaster recovery plan

Answer

Minimize financial loss

Answer

Guarantee 100% system uptime

Question 12

An IS auditor is reviewing the organization's incident management process. Which THREE of the following are essential components of an effective incident response plan?

Accepted Answer

Defined roles and responsibilities for the incident response team. An effective IR plan must include clear roles, communication procedures, and criteria for escalation and severity classification to ensure timely and coordinated response.

Answer

A list of all employees and their contact information

Answer

A detailed technical guide for each software application

Question 13

Which TWO of the following are considered essential components of an information security policy framework? (Choose two.)

Accepted Answer

Data classification policy. A data classification policy is essential because it defines how information assets are categorized based on sensitivity and criticality (e.g., public, internal, confidential, restricted). This classification directly drives the selection and enforcement of appropriate security controls, such as encryption standards (e.g., AES-256 for confidential data) and access control mechanisms (e.g., role-based access control). Without it, security measures cannot be consistently applied across the organization, leading to gaps in protection.

Answer

Business continuity plan

Answer

Incident response plan

Answer

Network architecture diagram

Question 14

An organization is implementing a change management process based on ITIL. Which THREE change types should be included in the policy?

Accepted Answer

Emergency change – requires immediate implementation to resolve a major incident.. ITIL defines an Emergency change as one that must be implemented as soon as possible—often to resolve a major incident or security vulnerability. This change type bypasses the normal CAB approval cycle and uses a dedicated Emergency CAB (ECAB) process to authorize and implement the fix rapidly while still maintaining control.

Answer

Planned change – scheduled during maintenance windows with no approval needed.

Answer

Major change – requires executive approval and a separate risk assessment.

Question 15

Which TWO of the following are key benefits of using a system development life cycle (SDLC) methodology? (Select exactly two.)

Accepted Answer

It provides a structured approach to system development. SDLC provides a structured approach to system development (Option A), ensuring that phases are followed and projects are managed systematically. It also ensures that user requirements are captured and validated through continuous user involvement (Option B). Option C is incorrect because SDLC does not prevent scope changes; it helps manage and control them. Option D is incorrect because security testing is an integral part of SDLC, not eliminated. Option E is incorrect because SDLC may involve additional upfront costs, though it reduces long-term rework costs.

Answer

It prevents any scope changes during development

Answer

It eliminates the need for security testing

Answer

It reduces the overall cost of development

Question 16

An IS auditor is reviewing backup procedures for a critical database. Which THREE are key considerations for ensuring backup reliability and recoverability?

Accepted Answer

Ensuring backup retention periods meet the recovery point objective (RPO).. Backup reliability requires regular testing (restore verification), secure offsite storage to protect against site disasters, and retention aligned with business recovery objectives. Encryption is important but not directly for reliability; compression may affect performance but not reliability.

Answer

Encrypting backup data to prevent unauthorized access.

Answer

Compressing backup data to reduce storage costs.

Question 17

Which TWO of the following are key controls that an IS auditor should expect to find in a well-managed system development life cycle (SDLC)?

Accepted Answer

Segregation of duties between development and testing.. Segregation of duties between development and testing is a key control because it ensures that code is independently verified before release, preventing developers from approving their own changes and reducing the risk of undetected defects or malicious code. In a well-managed SDLC, this separation enforces an independent testing phase, which is critical for maintaining code integrity and security.

Answer

Vendor due diligence reports.

Answer

Automated unit testing scripts.

Answer

Gantt chart for project scheduling.

Question 18

An IS auditor is assessing the vendor management process. Which TWO are key controls for managing third-party risk?

Accepted Answer

Including right-to-audit clauses in contracts.. Including right-to-audit clauses in contracts is a key control for managing third-party risk because it grants the IS auditor or the organization the contractual authority to independently verify the vendor's security controls, data handling practices, and compliance with policies. This clause ensures ongoing oversight beyond initial due diligence, allowing for on-site inspections or reviews of the vendor's systems and processes, which is critical for detecting control failures or unauthorized changes that could impact the organization's data.

Answer

Requiring vendors to disclose all subcontractors.

Answer

Developing an exit strategy for each vendor.

Answer

Performing vendor due diligence before contract signing.

Question 19

Which THREE of the following are responsibilities of the board of directors regarding IT governance? (Choose three.)

Accepted Answer

Approving the IT strategy. Correct answers: B, C, E. The board is responsible for approving the IT strategy (B), reviewing and approving IT policies (C), and ensuring that IT risks are managed within acceptable levels (E). Implementing IT security controls (A) is a management duty, and monitoring daily IT operations (D) is an operational responsibility.

Answer

Implementing IT security controls

Answer

Monitoring daily IT operations

Question 20

Which TWO of the following are indicators of poor project governance that an IS auditor should identify?

Accepted Answer

Scope changes are frequently requested and approved verbally.. Verbal approval of scope changes bypasses formal change control processes, leading to undocumented scope creep, loss of audit trail, and increased risk of project failure. An IS auditor should identify this as a governance weakness because it violates the principle of documented authorization and traceability required for effective project oversight.

Answer

Project team uses an agile methodology.

Answer

Project status meetings are held weekly.

Answer

The project budget is reallocated across phases.