CISA Timed Practice Test 1 — 10 Questions

Question 1

An organization is implementing a new financial system and has completed user acceptance testing (UAT). The project manager reports that all critical defects have been fixed and retested, but several low-severity issues remain unresolved. What is the BEST course of action?

Accepted Answer

Document the unresolved defects as known issues in a risk acceptance form with a remediation plan, then proceed with go-live. Option A is correct because in a financial system implementation, low-severity issues that do not impair core financial processing or controls can be accepted as known risks. Documenting them with a remediation plan and proceeding with go-live aligns with ISACA’s guidance that UAT sign-off does not require zero defects, only that critical and high-severity defects are resolved. This approach balances business needs with risk management, avoiding unnecessary delays while ensuring accountability through formal risk acceptance.

Answer

Re-run all UAT test cases to ensure no regression occurs

Answer

Delay go-live until all defects are resolved

Answer

Obtain sign-off from business stakeholders acknowledging the risks and proceed with go-live

Question 2

An organization is implementing a data loss prevention (DLP) solution. Which TWO of the following are key considerations for effective DLP deployment?

Accepted Answer

Implementing DLP in monitoring mode initially to baseline traffic. Options A and B are correct. A: Classifying data based on sensitivity is fundamental to DLP policy creation. B: Starting with monitoring before blocking reduces false positives. C: DLP is not a replacement for user training; it is a technical control. D: DLP should be deployed in phases, not organization-wide at once. E: Encryption is separate; DLP can detect but not enforce encryption for all data.

Answer

Deploying DLP agents on all endpoints before defining policies

Answer

Encrypting all data at rest and in transit as a prerequisite

Answer

Replacing user security awareness training with automated DLP

Question 3

Based on the exhibit, which control is most likely missing to prevent this type of event?

Accepted Answer

Implementing account lockout after three failed attempts. The exhibit describes a brute-force attack against an SSH service, where an attacker repeatedly attempts to guess credentials. Implementing account lockout after three failed attempts is the most direct control to prevent this type of event, as it halts further login attempts after a threshold, stopping the attack in its tracks regardless of password strength or patching.

Answer

Applying the latest security patches to the SSH service

Answer

Disabling direct root login via SSH

Answer

Enforcing strong password complexity

Question 4

Arrange the steps to perform a risk assessment in the correct order.

Question 5

Order the steps for conducting an audit engagement from start to finish.

Question 6

Order the steps for responding to a security incident in the correct sequence.

Question 7

Arrange the steps to implement a password policy in the correct order.

Question 8

Order the steps for conducting a business impact analysis (BIA) in the correct sequence.

Question 9

Order the steps for performing a disaster recovery test in the correct sequence.

Question 10

Which of the following is the PRIMARY purpose of a data classification scheme?

Accepted Answer

To ensure appropriate security controls are applied based on data sensitivity. A data classification scheme assigns sensitivity labels (e.g., public, internal, confidential, restricted) to information assets. Its primary purpose is to ensure that appropriate security controls—such as access control lists, encryption strength, and monitoring—are applied proportionally to the data's sensitivity. Without classification, controls would be either insufficient for high-risk data or overly restrictive for low-risk data, undermining both security and operational efficiency.

Answer

To enable encryption of all sensitive data

Answer

To meet regulatory compliance requirements

Answer

To define data retention periods