CISA Timed Practice Test 3 — 10 Questions

Question 1

An IS auditor is evaluating an organization's SDLC controls for a new system. Which TWO of the following are key controls that should be in place during the design phase? (Select TWO.)

Accepted Answer

Architecture review by a senior architect. Architecture review by a senior architect is a key control during the design phase because it ensures the system's high-level structure aligns with security, scalability, and business requirements before development begins. This review catches design flaws early, reducing costly rework and preventing architectural weaknesses that could be exploited later. It is a formal gate in the SDLC that validates the design against established patterns and standards.

Answer

Static application security testing (SAST)

Answer

User acceptance testing (UAT)

Answer

Regression testing

Question 2

An organization is selecting a vendor for a new procurement system. Which of the following is the MOST important factor to include in the contract?

Accepted Answer

Right to audit the vendor's security controls. Audit rights ensure the organization can verify vendor controls and compliance, which is critical for outsourcing.

Answer

A clause limiting vendor liability

Answer

Fixed price for the entire contract term

Answer

Detailed service level agreements (SLAs)

Question 3

An organization has defined an SLA that requires critical incidents to be resolved within 4 hours. A P1 incident is reported at 10:00 AM. At what time must the incident be resolved to meet the SLA?

Accepted Answer

2:00 PM. P1 incidents are critical and require immediate resolution. With a 4-hour SLA from the time of reporting (10:00 AM), the resolution must occur by 2:00 PM.

Answer

4:00 PM

Answer

6:00 PM

Answer

12:00 PM

Question 4

An IS auditor is evaluating the encryption strategy for a healthcare organization subject to HIPAA. Which of the following is the MOST significant risk if the organization relies solely on encryption as a safe harbor?

Accepted Answer

Encryption keys are stored on the same server as the encrypted data.. Encryption safe harbor only applies if encryption meets specific standards; gaps in key management can invalidate safe harbor.

Answer

The encryption algorithm used is not FIPS 140-2 validated.

Answer

Encryption is not applied to all ePHI in transit.

Answer

The encryption key rotation policy is not documented.

Question 5

Which of the following is the MOST effective control to prevent unauthorized USB devices from connecting to corporate workstations?

Accepted Answer

Device control software that blocks non-approved USB devices.. Device control software (e.g., endpoint DLP or USB whitelisting tools) operates at the OS kernel or driver level to enforce a hardware ID or vendor ID allowlist, blocking any USB device not explicitly approved. This is the only option that provides a preventive, automated, and continuous control against unauthorized USB connections, regardless of user behavior or physical access.

Answer

User awareness training.

Answer

Physical security guards.

Answer

Encrypting all USB devices.

Question 6

A company's endpoint protection solution alerts on a file that is digitally signed by a trusted software vendor but exhibits malicious behavior on execution. What type of threat does this scenario most likely depict?

Accepted Answer

Signed malware, indicating the certificate may have been compromised.. The scenario describes a file that is digitally signed by a trusted vendor yet exhibits malicious behavior. This is the classic definition of signed malware, where the digital certificate used to sign the file has likely been stolen, misused, or issued fraudulently. The trusted signature bypasses reputation-based and allowlist controls, making the threat particularly dangerous because the file appears legitimate to security tools that trust the vendor's certificate.

Answer

A Trojan horse disguised as legitimate software.

Answer

A zero-day exploit targeting an unpatched vulnerability.

Answer

A fileless attack that never writes to disk.

Question 7

During a review of firewall rule sets, an IS auditor finds a rule that allows any source IP to access any destination IP on TCP port 443. Which of the following should the auditor do FIRST?

Accepted Answer

Determine if the rule has a documented business justification.. The first step is to verify the business justification for the rule, as it may be necessary for a specific application.

Answer

Test whether the rule is actually being used.

Answer

Escalate the finding to senior management.

Answer

Recommend immediate removal of the rule.

Question 8

An IS auditor is reviewing the backup process for a critical database. Which TWO of the following are essential controls to ensure data recoverability?

Accepted Answer

Offsite storage of backup media.. Offsite storage of backup media (Option B) is essential because it protects against site-level disasters such as fire, flood, or physical theft. Without geographic separation, a single incident could destroy both the primary data and its backups, making recovery impossible. This control directly supports the recoverability objective by ensuring a usable copy exists outside the primary facility.

Answer

Automated job scheduling for backups.

Answer

Encryption of backup data.

Answer

Backup retention period of at least one year.

Question 9

An IS auditor is assessing the backup and recovery procedures for a critical database. Which TWO of the following are the MOST important controls to ensure recoverability?

Accepted Answer

Restore tests are conducted quarterly.. Regular restore tests (e.g., quarterly) are the only way to validate that backup data can actually be recovered and that the recovery procedures work as intended, which directly ensures recoverability. Option E is correct because storing backups offsite protects against site-level disasters (fire, flood, physical theft) that could destroy both primary data and on-site backups, ensuring data can be recovered from a separate location.

Answer

Backup media is encrypted.

Answer

Full backups are performed weekly.

Answer

Backup logs are reviewed daily.

Question 10

An IS auditor is reviewing the design phase of a new procurement system. Which TWO of the following controls are MOST critical to include in the system design to prevent unauthorized purchases?

Accepted Answer

Mandatory approval workflows for purchase orders above a threshold.. Mandatory approval workflows for purchase orders above a threshold are critical because they enforce a policy-based control that prevents unauthorized high-value purchases by requiring explicit authorization from a designated approver. This control is designed into the system to intercept transactions that exceed a predefined limit, ensuring that no single user can bypass financial authority limits.

Answer

Automated performance reports on purchase cycle times.

Answer

Real-time audit logging of all purchase transactions.

Answer

Encryption of purchase order data in transit.