CISA Timed Practice Test 3 — 10 Questions

Question 1

An IS auditor is evaluating how an organization manages its backup and restoration process for a critical financial application. The backup job completes successfully each night and writes to a tape library. Management states that recovery capability has been proven because the backup job reports success. Which audit procedure would BEST test whether the backups are actually restorable?

10 minute time limit — choose an answer to begin.

Accepted Answer

Perform a periodic test restoration of selected data to a separate environment and reconcile the results.. Only an actual restoration test demonstrates that backup data can be read and used to recover the application. Job success logs, offsite storage, and schedule alignment all address supporting conditions but none proves recoverability. Periodic test restorations with reconciliation of results provide direct evidence and also validate the recovery procedures and dependencies that a real recovery would require.

Answer

Confirm that the backup window and retention schedule align with the recovery point objective.

Answer

Review the backup job logs to confirm that all scheduled jobs completed without errors.

Answer

Verify that backup tapes are stored in a secure offsite location with environmental controls.

Question 2

An IS auditor is evaluating a control that requires the security administrator to review privileged access logs weekly. During testing, the auditor finds the reviews were performed but no evidence of follow-up exists for two anomalies identified in one review. Which of the following conclusions is MOST appropriate?

Accepted Answer

The exceptions should be evaluated for cause and effect before concluding on control effectiveness. When testing identifies exceptions, the auditor evaluates their nature, cause, and effect before concluding on the control. Documented reviews without documented follow-up suggest the detection element worked but the response element may not have. Determining whether the anomalies were resolved, ignored, or escalated elsewhere is essential to deciding whether the control objective was actually achieved.

Answer

The control is ineffective because any deviation, regardless of cause, invalidates the entire control

Answer

The control is operating effectively because the reviews were performed as scheduled

Answer

The control should be retested with a larger sample to determine whether the exceptions are isolated

Question 3

An organization is implementing a new CRM system using an agile methodology. The IS auditor wants to assess whether security requirements are being addressed. What is the best evidence for the auditor to review?

Accepted Answer

The product backlog. In agile development, the product backlog is the single source of truth for all work items, including security requirements. Security features and controls are captured as backlog items (e.g., user stories, acceptance criteria) and prioritized alongside functional requirements. Therefore, reviewing the product backlog provides direct evidence that security requirements are being addressed in the current development effort. Other artifacts like policies or architecture documents may exist but do not show whether security is actively being worked on in the sprint.

Answer

The security policy

Answer

The sprint retrospective minutes

Answer

The system architecture document

Question 4

An IS auditor is evaluating how an organization manages its backup and restoration process for a critical financial application. The backup job completes successfully each night and writes to a tape library. Management states that recovery capability has been proven because the backup job reports success. Which audit procedure would BEST test whether the backups are actually restorable?

10 minute time limit — choose an answer to begin.

Accepted Answer

Examine a sample of users provisioned in the last quarter to confirm that conflicting access was not granted.. Effective SoD assurance requires both design and operating evidence. Reviewing the conflict ruleset confirms that the detection logic covers the right combinations of duties, while testing recently provisioned users confirms the control actually prevented conflicts in practice. Together they address whether the control is correctly defined and whether it operates as intended. Password policy, backups, and interviews do not provide direct evidence about conflicting access assignments in the ERP system.

Answer

Verify that the ERP system's database backups complete successfully each night.

Answer

Confirm that the ERP system's password policy enforces complexity and expiration requirements.

Answer

Interview the ERP administrator to confirm that SoD conflicts are taken seriously.

Question 5

A mid-sized company is upgrading its legacy financial system to a new cloud-based ERP. The project manager has decided to use a big-bang cutover approach to minimize costs and time. During the first week post-go-live, users report that several critical reports are generating incorrect totals. An initial investigation reveals that the data mapping from the old system to the new system was not fully validated. Which of the following should the IS auditor recommend as the most appropriate corrective action?

Accepted Answer

Perform a data mapping review and remediation, then run parallel operations until accuracy is confirmed. A big-bang cutover with unvalidated data mapping introduces a high risk of data integrity issues, as seen with the incorrect report totals. Running parallel operations after a data mapping review and remediation allows the IS auditor to validate that the new ERP processes data correctly by comparing outputs with the legacy system, ensuring accuracy before full reliance. This aligns with ISACA's guidance on post-implementation verification and control testing for data conversion in cloud-based ERP migrations.

Answer

Implement additional manual controls and have users double-check all reports

Answer

Increase the project budget and hire more consultants to fix the issues

Answer

Immediately revert to the legacy system and restart the project with a phased approach

Question 6

An IS auditor is reviewing the change management process for a financial application. Which of the following findings would be of MOST concern?

Accepted Answer

Emergency changes are not reviewed within 30 days. Emergency changes bypass normal controls; failure to review them within a reasonable time (e.g., 30 days) increases risk of undocumented changes. Logging in spreadsheet, pre-approved standard changes, and defined change windows are acceptable or even good practices.

Answer

Change requests are logged in a spreadsheet

Answer

Standard changes are pre-approved

Answer

Change windows are defined in the policy

Question 7

Which THREE of the following are characteristics of a SMART recommendation? (Select three.)

Accepted Answer

Measurable. A SMART recommendation must be Measurable (A), meaning it includes quantifiable criteria or metrics (e.g., a percentage, count, or threshold) so progress and success can be objectively verified. It must also be Time-bound (C), specifying a deadline or timeframe (e.g., "within 90 days") so the recommendation has a defined completion point. Finally, it must be Specific (D), clearly stating the exact action, system, or process to be changed rather than a vague aspiration. The unmarked options do not belong: General (B) contradicts the specificity requirement of SMART, and Subjective (E) is wrong because SMART criteria rely on objective, verifiable evidence rather than personal opinion.

Answer

General

Answer

Subjective

Question 8

Arrange the steps to perform a risk assessment in the correct order.

Accepted Answer

Asset identification, then Threat/vulnerability identification, then Risk analysis, then Prioritization, then Documentation of treatment. Risk assessment begins with asset identification, then threat/vulnerability identification, followed by risk analysis, prioritization, and documentation of treatment.

Answer

Threat/vulnerability identification, then Asset identification, then Risk analysis, then Prioritization, then Documentation of treatment

Answer

Asset identification, then Risk analysis, then Threat/vulnerability identification, then Prioritization, then Documentation of treatment

Answer

Documentation of treatment, then Asset identification, then Threat/vulnerability identification, then Risk analysis, then Prioritization

Question 9

During a firewall rule review, an IS auditor identifies several rules that allow any-to-any traffic. Which THREE of the following should the auditor recommend as the MOST appropriate actions?

Accepted Answer

Obtain business justification for each any-to-any rule. Option A is correct because an IS auditor must first obtain business justification for each any-to-any rule, since a rule may be required for a legitimate business or technical purpose and cannot be judged in isolation. Option B is correct because the fundamental remediation for overly permissive rules is to replace any-to-any rules with specific source, destination, port, and protocol rules that enforce least privilege and reduce the attack surface. Option E is correct because any any-to-any rule that lacks a valid business justification should be removed, as it represents unnecessary exposure with no documented need. Option C is not appropriate because immediately deleting all any-to-any rules without review could disrupt legitimate business traffic and cause outages, violating change management and availability requirements. Option D is not the most appropriate action because increasing logging only detects misuse after the fact; it does not remediate the excessive permissiveness that the auditor should recommend eliminating.

Answer

Immediately delete all any-to-any rules without review

Answer

Increase logging for any-to-any rules to detect misuse

Question 10

An IS auditor is reviewing change management procedures. Which of the following situations would be of GREATEST concern?

Accepted Answer

An emergency change was implemented and not reviewed after resolution. An emergency change bypasses the normal CAB review and testing gates, so the only compensating control is a mandatory post-implementation review (PIR) to confirm the change worked, assess side effects, and retroactively authorize it. If that review never happens, the change remains unauthorized and unverified, leaving a permanent gap in the change management audit trail. This is the greatest concern because it defeats the entire purpose of the emergency-change exception.

Answer

A standard change was implemented without CAB approval

Answer

The change request did not include an impact analysis

Answer

A normal change had a rollback plan that was not tested