CISA Practice Questions

Question 1

Order the steps for performing a data backup in the correct sequence.

Accepted Answer

Identify data to be backed up, then choose backup method, then schedule the backup, then execute backup and verify integrity, then store backup offsite.. Backup process: identify data, choose method, schedule, execute/verify, and store offsite.

Answer

Identify data to be backed up, then schedule the backup, then choose backup method, then execute backup and verify integrity, then store backup offsite.

Answer

Choose backup method, then identify data to be backed up, then schedule the backup, then execute backup and verify integrity, then store backup offsite.

Answer

Identify data to be backed up, then choose backup method, then execute backup and verify integrity, then schedule the backup, then store backup offsite.

Question 2

A company requires employees to use smart cards for facility access. Which additional control would BEST prevent tailgating?

Accepted Answer

Install mantraps at entry points. Mantraps prevent tailgating by allowing only one person per authentication. Biometrics address identity, not tailgating. Random audits are detective. Keypad locks are simple and do not prevent tailgating.

Answer

Require biometric authentication

Answer

Use keypad locks on doors

Answer

Conduct random audits of access logs

Question 3

During a build vs. buy analysis, the IS auditor observes that the organization decided to build a custom application because no vendor solution met all requirements. Which of the following risks should the auditor emphasize?

Accepted Answer

Increased time-to-market and development costs. Custom development carries risk of longer time-to-market and higher cost due to unforeseen complexities.

Answer

Lack of customization

Answer

Dependence on external support

Answer

Vendor lock-in

Question 4

An IS auditor is evaluating the security of the architecture. Which of the following is the MOST critical finding?

Accepted Answer

No encryption for SQL traffic between web and database servers. The most critical finding because unencrypted SQL traffic between the web and database servers exposes sensitive data to interception via man-in-the-middle attacks. Even if the traffic is confined to an internal network, an attacker who compromises the web server can sniff credentials or query results in plaintext. Encrypting SQL traffic with TLS or IPSec is a fundamental security control to protect data in transit.

Answer

The web server has a public IP address

Answer

SQL traffic from the web server to the database server is allowed

Answer

The database server is not placed in the DMZ

Question 5

A mid-sized company is upgrading its legacy financial system to a new cloud-based ERP. The project manager has decided to use a big-bang cutover approach to minimize costs and time. During the first week post-go-live, users report that several critical reports are generating incorrect totals. An initial investigation reveals that the data mapping from the old system to the new system was not fully validated. Which of the following should the IS auditor recommend as the most appropriate corrective action?

Accepted Answer

Perform a data mapping review and remediation, then run parallel operations until accuracy is confirmed. A big-bang cutover with unvalidated data mapping introduces a high risk of data integrity issues, as seen with the incorrect report totals. Running parallel operations after a data mapping review and remediation allows the IS auditor to validate that the new ERP processes data correctly by comparing outputs with the legacy system, ensuring accuracy before full reliance. This aligns with ISACA's guidance on post-implementation verification and control testing for data conversion in cloud-based ERP migrations.

Answer

Implement additional manual controls and have users double-check all reports

Answer

Increase the project budget and hire more consultants to fix the issues

Answer

Immediately revert to the legacy system and restart the project with a phased approach

Question 6

An organization has configured HSRP as shown. During a failover test, the primary router (G0/1) is shut down, but the DR site router does not become active. What is the MOST likely reason?

Accepted Answer

The HSRP group numbers on the two interfaces do not match. HSRP requires that both routers participating in the same virtual IP address use the same group number to form a single HSRP group. If the group numbers on the two interfaces do not match, each router will form its own separate HSRP group, and neither will recognize the other as a peer. Consequently, when the primary router fails, the DR router does not assume the active role because it is not part of the same HSRP group.

Answer

The default route on the primary router points to the wrong next-hop

Answer

The preempt command is missing on the DR router

Answer

The OSPF routing protocol is not redistributing the default route

Question 7

An organization has a policy requiring strong passwords. Which additional control is most effective at preventing credential stuffing attacks?

Accepted Answer

Requiring multi-factor authentication (MFA) for all logins.. Multi-factor authentication (MFA) stops attackers who have stolen passwords because they cannot provide the second factor.

Answer

Increasing password length and complexity requirements.

Answer

Implementing account lockout after 3 failed attempts.

Answer

Conducting annual security awareness training.

Question 8

Refer to the exhibit. Based on the governance status report, which component should be addressed as a priority?

Accepted Answer

Resource Optimization. Resource Optimization has a Red status, indicating critical risk or non-compliance, requiring immediate attention. Green and Yellow components are less urgent.

Answer

Strategy Alignment

Answer

Performance Measurement

Answer

Risk Management

Question 9

A multinational corporation has implemented a hot site disaster recovery solution for its critical financial applications. Which of the following is the MOST important consideration to ensure the effectiveness of the hot site?

Accepted Answer

Regular, documented testing of the failover process is performed. Without regular testing, the hot site may not function as expected. Options A, B, and C are important but secondary: A is part of planning, B is operational, C is compliance but not the most critical for effectiveness.

Answer

Data replication latency is less than 15 minutes

Answer

The hot site is located in a different seismic zone

Answer

The hot site complies with regional data privacy regulations

Question 10

Refer to the exhibit. During a penetration test, a security analyst captures this SAML response. Which of the following security weaknesses is most evident?

Accepted Answer

The assertion is not encrypted. The SAML response shows the assertion is sent in plaintext (no xenc:EncryptedData element), meaning the authentication assertion is not encrypted. This allows an attacker who intercepts the SAML response to extract the assertion and reuse it in a replay or impersonation attack, violating the confidentiality requirement for sensitive authentication tokens.

Answer

The name identifier format is inappropriate

Answer

The session is too short

Answer

The authentication context is weak

Question 11

An IT governance framework should include which TWO key components? (Select exactly two.)

Accepted Answer

Strategic alignment. Strategic alignment ensures IT supports business goals; performance measurement tracks achievement. Network firewall rules, user training, and vendor lock-in are operational or tactical, not core governance components.

Answer

User training

Answer

Vendor lock-in

Answer

Network firewall rules

Question 12

An organization's IT strategy is not aligned with business strategy due to lack of communication. Which of the following would BEST improve alignment?

Accepted Answer

Business-IT strategy mapping workshops. Business-IT strategy mapping workshops facilitate direct communication and collaboration, ensuring both sides understand and agree on priorities. Status reports, budget increases, or outsourcing do not address the communication gap.

Answer

Weekly IT status reports

Answer

Outsourcing non-core IT functions

Answer

IT budget increase

Question 13

An organization uses a risk-based audit approach. For a high-risk area, the auditor decides to perform 100% testing instead of sampling. Which of the following is a valid reason for this decision?

Accepted Answer

The population size is small and errors are critical. When a high-risk area is identified and the population size is small, 100% testing is justified because the cost of missing a critical error outweighs the cost of testing every item. This approach eliminates sampling risk entirely, ensuring that all errors are detected. In audit, 100% testing is appropriate when the population is small enough to make full examination feasible and the consequences of error are severe.

Answer

The auditor has limited time

Answer

The tolerable error rate is high

Answer

The control is automated and always effective

Question 14

An IT manager notices that the CPU utilization of a critical server consistently exceeds 90% during peak hours. Which is the BEST course of action?

Accepted Answer

Implement load balancing. Implementing load balancing distributes the workload across multiple servers, addressing the performance issue. Options B, C, and D are not the best; B is hasty, C helps but is not best, D does not fix the problem.

Answer

Immediately add more CPUs

Answer

Increase monitoring frequency

Answer

Schedule batch jobs during off-peak

Question 15

A company's backup policy requires that backup media be stored offsite. Which of the following is the PRIMARY reason for this requirement?

Accepted Answer

To ensure data is available in case of a site disaster. The primary reason for storing backup media offsite is to ensure data availability and recoverability in the event of a site-level disaster, such as a fire, flood, or physical destruction of the primary data center. This aligns with the core business continuity principle of geographic separation to avoid a single point of failure. Without offsite storage, a site disaster would destroy both primary and backup data, making recovery impossible.

Answer

To reduce backup storage costs

Answer

To comply with regulatory requirements

Answer

To protect against theft

Certified Information Systems Auditor CISA practice test

Three ways to study

Study CISA by domain

Study CISA by topic

Governance and Management of IT practice questions

Information Systems Operations and Business Resilience practice questions

Information System Auditing Process practice questions

Information Systems Acquisition, Development, and Implementation practice questions

Protection of Information Assets practice questions

CISA fundamentals practice questions

CISA scenario practice questions

CISA troubleshooting practice questions

Top CISA questions

Certified Information Systems Auditor CISA practice questions

How to use these CISA questions

Quick answer