CISA Timed Practice Test 3 — 10 Questions

Question 1

An IT manager needs to ensure that the organization's IT resources are used efficiently. Which of the following is the BEST metric to measure IT resource utilization?

Accepted Answer

Average server CPU utilization. Average server CPU utilization directly measures how much of the computing capacity is being consumed over time, making it the most relevant metric for assessing whether IT resources are being used efficiently. High or low CPU utilization can indicate over-provisioning, under-utilization, or potential performance bottlenecks, enabling the IT manager to optimize resource allocation.

Answer

System uptime percentage

Answer

Number of help desk tickets resolved per day

Answer

Percentage of projects completed on time

Question 2

An organization is developing a new customer portal. The development team wants to use an agile methodology. Which of the following is a key benefit of using agile for this project?

Accepted Answer

Continuous stakeholder feedback is incorporated. Agile methodologies emphasize iterative development with continuous stakeholder feedback, which is critical for a customer portal where user needs evolve. This ensures the final product aligns with actual requirements, reducing rework and increasing satisfaction. Option A directly captures this core benefit.

Answer

Detailed requirements are defined upfront

Answer

Documentation is minimized to save time

Answer

The entire system is delivered at once

Question 3

When implementing a commercial off-the-shelf (COTS) software package, which of the following is the MOST important activity to ensure the software meets business requirements?

Accepted Answer

Performing a gap analysis between requirements and software features. Performing a gap analysis is the most important activity because it systematically maps each business requirement against the COTS software's delivered features, identifying any shortfalls that must be addressed through configuration, customization, or process adaptation. Without this structured comparison, the organization risks deploying software that fails to support critical business processes, leading to costly rework or project failure.

Answer

Conducting a vendor demonstration

Answer

Developing a project plan with milestones

Answer

Reviewing the software's technical architecture

Question 4

In a traditional waterfall SDLC, when should the test plan be developed?

Accepted Answer

During the design phase. In a traditional waterfall SDLC, the test plan should be developed during the design phase because testing activities must be planned in parallel with system design to ensure that test cases, test data, and acceptance criteria are aligned with the design specifications. This allows for early identification of testability issues and ensures that the test plan is ready before coding begins, enabling a structured and efficient testing process.

Answer

During the implementation phase

Answer

During the coding phase

Answer

During the requirements phase

Question 5

During a post-implementation review of a new HR system, the auditor finds that the system's disaster recovery plan (DRP) was not tested before go-live. Which of the following is the BEST recommendation?

Accepted Answer

Conduct a DRP test immediately and document results. The DRP should be tested as part of the implementation. Option B is a temporary fix; Option C is not proactive; Option D is not sufficient.

Answer

Accept the risk because the system is new

Answer

Implement a backup procedure for the system

Answer

Schedule a DRP test within the next six months

Question 6

Which TWO of the following are key activities in the system design phase of the SDLC?

Accepted Answer

Defining system architecture. Defining system architecture is a key activity in the system design phase because it establishes the high-level structure of the system, including hardware, software, network components, and their interactions. This blueprint guides subsequent detailed design and implementation, ensuring alignment with functional and non-functional requirements. Without a defined architecture, the system risks integration failures and scalability issues.

Answer

Writing unit tests

Answer

Performing user acceptance testing

Answer

Gathering business requirements

Question 7

A company is implementing a privileged access management (PAM) system. Which of the following is the MOST important control to prevent lateral movement after a privileged account is compromised?

Accepted Answer

Implement just-in-time (JIT) privilege elevation. Just-in-time (JIT) privilege elevation is the most important control to prevent lateral movement because it eliminates standing privileged access. By granting temporary, time-bound privileges only when needed, JIT reduces the attack surface and ensures that even if an attacker compromises a privileged account, they cannot use those credentials to move laterally to other systems after the access window expires. This directly addresses the root cause of lateral movement: persistent privileged credentials that can be reused across the network.

Answer

Enforce multi-factor authentication for all privileged accounts

Answer

Monitor and record all privileged sessions

Answer

Rotate passwords after each use

Question 8

Which TWO of the following are effective controls to prevent unauthorized access to sensitive data in a database? (Choose two.)

Accepted Answer

Database activity monitoring (DAM). Options B and D are correct. Encryption at rest protects data if storage is accessed. Database activity monitoring (DAM) detects and can block unauthorized queries. Option A is wrong because network segmentation alone does not prevent access if credentials are compromised. Option C is wrong because strong passwords are good but not sufficient. Option E is wrong because regular patching addresses vulnerabilities but not access control.

Answer

Strong password policy

Answer

Regular patch management

Answer

Network segmentation

Question 9

An organization wants to ensure that data is not retained longer than necessary. Which of the following is the BEST control to implement?

Accepted Answer

Define and enforce data retention schedules. Defining and enforcing data retention schedules directly addresses the requirement to not retain data longer than necessary by specifying precise timeframes for data deletion or archival. This control ensures compliance with legal, regulatory, and business needs by automating the lifecycle management of data, such as through expiration policies in object storage (e.g., S3 Lifecycle rules) or database TTL (time-to-live) settings. Without such schedules, data may persist indefinitely, increasing storage costs and regulatory risk.

Answer

Encrypt all data at rest

Answer

Implement a backup retention policy

Answer

Use role-based access controls

Question 10

Which THREE of the following are key components of an effective information security awareness program? (Choose three.)

Accepted Answer

Phishing simulation exercises. Phishing simulation exercises are a key component of an effective information security awareness program because they provide hands-on, practical experience in identifying and responding to real-world phishing attempts. By simulating attacks, organizations can measure employee susceptibility, reinforce training, and reduce the risk of successful social engineering attacks. This proactive approach helps build a security-conscious culture and directly addresses the human factor in cybersecurity.

Answer

Reward program for reporting incidents

Answer

Annual one-time training for all employees