Certified Information Systems Auditor CISA (CISA) — Questions 1–75

Custom development carries risk of longer time-to-market and higher cost due to unforeseen complexities.

Under GDPR, cross-border data transfers require appropriate safeguards such as Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or an adequacy decision by the European Commission.

Standard Contractual Clauses (SCCs) are pre-approved model contracts issued by the European Commission that provide a legally recognized mechanism for transferring personal data from the EU to a third country, such as the US, without requiring additional authorization. They are the most commonly accepted transfer mechanism because they impose contractual obligations on both the data exporter and importer to ensure adequate data protection, aligning with GDPR Article 46 requirements.

The immediate issue preventing the organization from meeting its RPO of 1 hour is the saturated replication link, which causes replication lag of up to 3 hours. Upgrading the link to a higher bandwidth connection directly addresses the bottleneck, reducing replication time and enabling the RPO to be met. Other options, while potentially beneficial, do not resolve the primary cause of the RPO failure.

The best approach because it balances agile principles with the need for auditability. In agile, lightweight documentation (e.g., architecture decision records, user story acceptance criteria) captures key decisions and changes without the overhead of full waterfall documentation. This mitigates the risk of knowledge loss while preserving the team's velocity.

An 80% closure rate indicates that 20% of findings remain unresolved. ISACA standards require auditors to verify that all high-risk findings are remediated before concluding on control effectiveness. Without evidence that the outstanding 20% are low-risk or have an accepted risk, the auditor must investigate further to ensure residual risk is within the organization's appetite.

User acceptance testing (UAT) is the most critical phase for verifying that the mobile banking application meets end-user requirements and functions correctly from their perspective. Unlike other testing phases that focus on technical correctness, UAT involves real users performing actual banking transactions (e.g., fund transfers, balance inquiries) in a production-like environment to validate usability, workflow accuracy, and compliance with business rules. This ensures the application is ready for deployment and will be accepted by its intended audience.

Implementing dependency management in the job scheduler ensures that jobs only run when prerequisites are met, preventing such failures.

A walkthrough involves tracing a transaction through the entire process to confirm understanding and assess control design. It combines inquiry, observation, and inspection.

The first step is to verify the business justification for the rule, as it may be necessary for a specific application.

The logs show the administrator account executing a reverse shell connection (e.g., using PowerShell or netcat) to an external IP address on a non-standard port (e.g., 4444 or 8080). This outbound connection initiated by the admin account is a classic indicator of a command and control (C2) channel, where an attacker who has compromised the account uses it to maintain persistent remote access. Legitimate administrative activity would not typically involve establishing a reverse shell to an unknown external host.

A material weakness is a deficiency, or combination, that results in a reasonable possibility of material misstatement.

The most critical finding because unencrypted SQL traffic between the web and database servers exposes sensitive data to interception via man-in-the-middle attacks. Even if the traffic is confined to an internal network, an attacker who compromises the web server can sniff credentials or query results in plaintext. Encrypting SQL traffic with TLS or IPSec is a fundamental security control to protect data in transit.

Policies are high-level statements of intent, while procedures provide detailed step-by-step instructions for implementing policies.

Orphaned resources (e.g., unattached EBS volumes, unused Elastic IPs, stale load balancers) continue to incur costs without providing any business value. Detecting and removing them directly eliminates waste, which is a core principle of cloud cost optimization. This practice aligns with the AWS Well-Architected Framework's Cost Optimization pillar, specifically the 'Stop Spending Money on Undifferentiated Heavy Lifting' design principle.

The correct matches are SOX to financial reporting, GDPR to data privacy, HIPAA to healthcare data, and PCI DSS to payment card security. Common confusions include swapping definitions between SOX and GDPR.

The auditor should report the non-compliance finding and recommend corrective actions, as the primary goal of a compliance audit is to identify gaps.

Automated tracking and reporting provides objective evidence of compliance and enables follow-up.

Average system uptime for critical applications directly measures IT service availability from the customer's perspective. In the balanced scorecard framework, the customer perspective focuses on how end users experience IT services. The other options align with different perspectives: B (under budget) is financial, C (change requests on time) is internal processes, and D (ITIL certification) is learning and growth.

Chargeback models allocate IT costs to business units based on usage, promoting accountability and cost awareness.

A risk-based approach allows the auditor to focus on areas with higher risk, thereby optimizing the use of audit resources and ensuring that significant risks are addressed.

Privileged access requests must be properly authorized to prevent unauthorized elevation of privileges.

The maximum downtime is the recovery time objective (RTO), and the maximum data loss is the recovery point objective (RPO).

The 'admin' account poses the highest security risk because, despite its password being locked (indicated by '!' in the shadow file), it has UID 0 (root privileges). A locked password prevents password-based login, but the account may still be accessible via SSH keys or other authentication methods, and its privileged status makes it a valuable target for privilege escalation attacks. In contrast, the 'root' account may be fully disabled, and the 'test' account is a standard user without elevated privileges.

The log entry indicates an authentication failure with a client certificate. The error 'CN mismatch' or similar certificate validation failure occurs when the Common Name (CN) in the client certificate does not match the expected name configured on the server (e.g., in a RADIUS or TLS mutual authentication context). This is a specific certificate-level issue, not a password or account lockout problem.

ITIL 4 defines four dimensions: organizations and people, information and technology, partners and suppliers, value streams and processes.

The primary purpose of a penetration test is to exploit vulnerabilities in a controlled manner to assess the real-world impact and business risk, not merely to list them. While vulnerability scanning identifies weaknesses, penetration testing goes further by simulating an attacker's actions to determine if and how a vulnerability can be leveraged to compromise systems, data, or operations. This aligns with the CISA focus on evaluating the effectiveness of security controls under realistic attack conditions.

The alternate facility recovery time (24 hours) exceeds the MTD (12 hours), meaning the process would fail its recovery requirement.

The most significant risk is inaccurate cost allocation and potential budget overruns because the orphaned resources are not tagged and are billed under a default account, preventing the organization from accurately attributing cloud costs to the responsible departments. This undermines the purpose of the tagging strategy implemented by the asset management team and can lead to unplanned expenses that are not tracked against any budget owner, directly impacting financial control and operational accountability.

In a properly implemented RBAC system, access changes must follow the principle of least privilege and be formally approved through change management to maintain audit trails and security controls. Granting temporary access via a documented change request ensures that the access is justified, time-bound, and reviewed, preventing unauthorized privilege escalation. This aligns with the CISA domain of Protection of Information Assets, where access control changes must be controlled and monitored.

The post-implementation review should compare actual performance against projections. Significant performance degradation indicates the system is not meeting its intended performance objectives, which is a key project goal.

Analytical procedures involve evaluating financial information by studying plausible relationships among data. Comparing current period expenses to prior periods is a typical example.

The compromise of the identity provider's (IdP) credentials is the most critical security concern because the IdP acts as the central trust anchor for all SSO transactions. If an attacker gains control of the IdP's signing key or administrative credentials, they can forge SAML assertions for any user, bypassing all downstream authentication and gaining unauthorized access to every connected service provider (SP). This represents a single point of failure that undermines the entire SSO trust model.

Backup encryption at rest ensures that data stored offsite is protected from unauthorized access, which is a key control for offsite backups.

Normal changes are those that are not pre-approved or emergency. They require assessment and approval by the CAB to evaluate risks and impacts.

An IT steering committee, comprising business and IT leadership, is responsible for prioritizing IT initiatives and resolving conflicts. IT management may lack authority; board and audit committee have broader oversight roles.

The exhibit shows changes classified as 'emergency' bypassing the standard approval process. The IS auditor's primary concern is that emergency changes may be misclassified to avoid proper review, increasing risk. Option D is correct because it addresses the root cause: reviewing the criteria for emergency changes and enforcing proper classification ensures that only truly urgent changes bypass standard controls, while all others follow the required approval path.

Identifying areas for improvement in IT processes is a primary objective of an information system audit. The audit evaluates the design and operational effectiveness of controls, then recommends enhancements to align IT processes with business goals, risk appetite, and regulatory requirements. This goes beyond mere compliance to drive continuous improvement in governance and control frameworks.

A PIA identifies and mitigates privacy risks associated with the processing of personal data.

The 'no-proxy-arp' command disables proxy ARP on the ASA interface for the public IP address 203.0.113.10. Without proxy ARP, the ASA will not respond to ARP requests from upstream routers for that IP, so traffic destined to the web server is never delivered to the ASA for NAT processing. This is the most likely cause because the NAT rule exists but the ASA cannot intercept the traffic at Layer 2.

In RBAC, permissions are assigned to roles, and users inherit those permissions through role membership. Without regular reviews, users may retain roles (and thus permissions) long after their job functions change, leading to privilege creep. This violates the principle of least privilege and increases the risk of unauthorized access or data breaches within the ERP system.

Patch compliance percentage directly measures the effectiveness of patch management by indicating the proportion of systems that have required patches applied within a defined timeframe.

Isolating the database server on a separate network segment with strict firewall rules (e.g., using VLANs and ACLs to restrict traffic to only the legacy application’s IP and port) prevents unauthorized network-level access to the unencrypted data. This compensating control reduces the attack surface by ensuring that even if the database lacks encryption at rest, an attacker cannot reach it without first compromising the network segmentation, which is a critical defense-in-depth layer.

Notifying all relevant stakeholders in advance is a best practice for a full interruption test. This ensures that business units, IT teams, and external vendors are prepared for the planned outage, minimizing confusion and allowing coordinated execution. Without prior notification, the test could cause unnecessary panic or operational disruption, undermining the controlled nature of the exercise.

A risk assessment provides a structured, evidence-based framework for balancing security controls against user convenience during requirements gathering. By evaluating the likelihood and impact of threats specific to financial systems (e.g., transaction fraud, data breaches) against usability needs, the organization can prioritize controls that mitigate high-risk exposures without unnecessarily impeding legitimate business processes. This aligns with the COBIT 5 principle of balancing benefits, risk, and resource optimization.

RBAC simplifies user permission management by assigning permissions to roles rather than individuals, allowing administrators to grant or revoke access by modifying role memberships. This reduces administrative overhead and the risk of permission errors, as changes propagate automatically to all users in a role. The primary benefit is operational efficiency in access control, not direct security features like encryption or malware protection.

It balances patient safety with project timelines by formally assessing the risk of the untested fix, developing it, and then fast-tracking a targeted regression test. This approach ensures the usability issue is resolved without bypassing necessary quality controls, which is critical for a clinical system where data entry errors could directly impact patient care. The IT director's concern about patient safety is addressed by the risk assessment and focused testing, while the go-live date is preserved if the fix passes.

Outsourcing involves contracting with an external provider to manage specific IT functions.

In agile, security requirements must be integrated into user stories, code reviews and static analysis are key for code quality, and sprint retrospectives help identify process improvements. Maintaining a detailed project plan is less relevant in agile, and formal change requests are not typical.

Data privacy and security are critical when outsourcing services that handle sensitive information.

Clearly defined roles and responsibilities (C) are essential because they ensure that during a security incident, every team member knows their specific tasks, such as who leads the investigation, who communicates with stakeholders, and who executes containment actions. Without this clarity, response efforts become chaotic, leading to delays and missed containment windows, which directly impacts the organization's ability to minimize damage and recover quickly.

A rollback plan ensures that if deployment fails, the system can be restored to a known good state.

SoD conflicts are a high-risk issue. The auditor should recommend immediate implementation of compensating controls (e.g., enhanced monitoring, dual approval) to mitigate risk until the system is reconfigured.

A privileged access management (PAM) solution directly addresses the root cause of an insider threat by controlling, monitoring, and auditing elevated access rights. Since the breach was caused by an insider, limiting and tracking privileged accounts prevents unauthorized or excessive use of administrative credentials, which is the most effective preventive measure against recurrence.

Standard changes are pre-approved, low-risk, and follow a defined procedure. Applying a routine security patch that has been tested and approved falls under this category.

The spiral model is risk-driven; each iteration includes a risk analysis to identify and mitigate project risks before proceeding to the next phase.

Data quality issues (incomplete/inaccurate data) and mapping errors are common risks that can lead to system failures.

Conducting a joint requirements validation session with stakeholders (Option B) is the most important activity because it ensures that the requirements are accurate, complete, and agreed upon before development begins. This collaborative review process directly involves end users and business owners, allowing for immediate clarification and correction of misunderstandings, which is critical for aligning the CRM system with actual business processes. Without this validation, even a perfectly built system may fail to meet user needs, leading to costly rework.

Audit risk = Inherent risk × Control risk × Detection risk. Inherent risk and detection risk are components; control risk is also a component, but the question asks for two; correct ones are inherent and detection.

Audit documentation supports the auditor's conclusions and provides evidence of the work performed. It is not primarily for future audit planning or legal protection.

A penetration test on the integration is the most critical control because it actively validates the security of the API endpoints, data flows, and authentication mechanisms between the e-commerce platform and the third-party gateway. Unlike passive controls like encryption or logging, a penetration test can uncover exploitable vulnerabilities such as injection flaws, broken authentication, or insecure direct object references that could lead to financial fraud or data breach before the system is exposed to live transactions.

Password policy implementation: define requirements, set expiration, lockout, communicate, and enforce.

PKI governance includes CA policies, certificate lifecycle management, and revocation mechanisms.