Certified Information Systems Auditor CISA (CISA) — Questions 1–75

Why this answer

How to eliminate wrong answers

Option A is wrong because a Data Protection Impact Assessment (DPIA) is a risk assessment tool required under GDPR Article 35 for high-risk processing, not a transfer mechanism that provides adequate protection for cross-border data transfers. Option C is wrong because explicit consent under GDPR Article 49 is an exception for specific, occasional transfers and is not considered a reliable, ongoing adequate protection mechanism due to issues of revocability and power imbalance. Option D is wrong because Binding Corporate Rules (BCRs) are a valid intra-group transfer mechanism, but they require approval from the relevant supervisory authority and are less commonly used than SCCs due to the lengthy approval process and complexity of implementation.

Why this answer

How to eliminate wrong answers

Option A is wrong because upgrading the SAN fabric switches addresses disk I/O latency, which is a performance issue, not the replication lag that causes the RPO violation. Option B is wrong because adding storage capacity to the DR site does not reduce replication lag; it may even increase the amount of data that needs to be replicated. Option C is wrong because implementing more frequent incremental backups does not solve the replication link saturation; it could increase the load on the link and worsen the lag, and backups are not the same as synchronous or asynchronous replication used for RPO.

Why this answer

How to eliminate wrong answers

Option A is wrong because forcing a switch to waterfall would disrupt the existing agile workflow, likely causing delays and team resistance, and is not a proportionate response to a documentation gap. Option B is wrong because accepting the lack of documentation ignores the auditor's responsibility to ensure that critical business applications have sufficient records for maintenance, compliance, and knowledge transfer; agile emphasizes working software but does not prohibit necessary documentation. Option C is wrong because code review, while valuable for quality, does not capture design decisions, rationale, or change history that documentation provides; it is a complementary practice, not a substitute for documentation.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because granting access to all objects in a bucket is not inherently a security concern if the policy is properly scoped with least privilege and combined with other controls like authentication and encryption. Option C is wrong because allowing access from any IP in the 10.0.0.0/8 range is a private IP range (RFC 1918) and is not directly routable from the internet, so it does not represent a security concern by itself; it is a common practice for internal network access. Option D is wrong because the condition using a private IP range is actually a security best practice—it restricts access to internal networks, which are not directly reachable from the internet, reducing exposure.

Why this answer

How to eliminate wrong answers

Option A is wrong because a narrow scope would typically result in missing findings, not in a specific closure percentage; the 80% figure does not indicate scope deficiency. Option C is wrong because an effective audit process requires not only corrective actions but also timely closure of all findings; 80% closure alone does not prove the overall process is effective, as the remaining 20% may represent critical gaps. Option D is wrong because management implementing 80% of recommendations explicitly means they are not compliant with all recommendations; the remaining 20% are outstanding.

Why this answer

How to eliminate wrong answers

Option A is wrong because system testing validates the complete integrated system against functional and non-functional requirements but does not involve end users; it focuses on technical correctness rather than user perspective. Option C is wrong because unit testing verifies individual components or modules in isolation, typically by developers, and cannot assess end-to-end user workflows or usability. Option D is wrong because integration testing checks the interactions between integrated modules or external systems (e.g., APIs, databases) but does not evaluate the application from an end user's viewpoint or validate business processes.

Why this answer

How to eliminate wrong answers

Option A is wrong because legitimate system maintenance activity would not involve an outbound reverse shell to an external IP on a non-standard port; maintenance tasks use standard protocols like SSH (port 22) or RDP (port 3389) to known internal servers. Option B is wrong because a brute force attack would show multiple failed login attempts from various IPs or usernames, not a single successful login followed by a reverse shell connection. Option C is wrong because unauthorized installation of a critical update would typically involve file downloads or execution of installer binaries, not the establishment of a persistent outbound reverse shell channel.

Why this answer

How to eliminate wrong answers

Option A is wrong because a web server typically requires a public IP address to serve external clients; this is a design choice, not a security finding. Option B is wrong because SQL traffic from the web server to the database server is expected and necessary for application functionality; the issue is not the existence of the traffic but its lack of encryption. Option D is wrong because placing the database server in the DMZ would expose it directly to external threats; best practice is to place the database server on a separate internal network segment behind the DMZ, not inside it.

Why these pairings

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because 'root' is often locked for direct login (e.g., PermitRootLogin no in sshd_config) or has a strong password enforced by policy, reducing its immediate risk compared to an active admin account. Option C is wrong because 'test' accounts are typically non-privileged, have limited access, and are often disabled or have expired passwords, making them lower risk. Option D is wrong because the 'admin' account clearly presents a higher risk due to its privileged nature and common weak configurations, so it is incorrect to say none are risky.

Why this answer

How to eliminate wrong answers

Option A is wrong because an account lockout would typically generate a different error, such as 'account disabled' or 'account locked', not a certificate CN mismatch. Option B is wrong because an incorrect password would produce a 'bad password' or 'invalid credentials' error, not a certificate validation failure. Option D is wrong because a RADIUS server being unavailable would result in a timeout or 'no server available' error, not a certificate CN mismatch.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because testing incident response capabilities is a secondary benefit, not the primary purpose; a penetration test may trigger IR processes, but its core objective is to validate security controls through exploitation. Option C is wrong because meeting compliance requirements (e.g., PCI DSS 11.4) is a driver for conducting a test, but the primary purpose remains the technical assessment of real-world exploitability and impact. Option D is wrong because identifying vulnerabilities is the goal of a vulnerability assessment, not a penetration test; a penetration test assumes vulnerabilities exist and focuses on exploiting them to measure actual risk.

Why this answer

How to eliminate wrong answers

Option A is wrong because temporarily assigning the user to the Manager role violates the principle of least privilege by granting excessive permissions (e.g., write, delete, or administrative rights) beyond the single file read access needed, increasing the risk of unauthorized actions. Option C is wrong because creating a new role with only read access to that file introduces role proliferation and administrative overhead, bypassing the established RBAC role hierarchy and potentially violating segregation of duties. Option D is wrong because directly changing file permissions to include the Analyst role circumvents the RBAC role-based assignment model, undermining the centralized access control policy and making audit trails inconsistent.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because SAML assertions are inherently signed and often encrypted end-to-end using XML Signature and XML Encryption standards; the lack of encryption for the assertion body does not expose the authentication token if the transport layer (TLS) is used, and the critical security control is the digital signature, not encryption. Option B is wrong because incompatibility with legacy applications is an integration or migration concern, not a security concern; it can be addressed through federation gateways or protocol translation without compromising the security posture of the SSO system. Option C is wrong because downtime of the IDaaS provider is an availability and business continuity issue, not a security concern; while it impacts access, it does not directly lead to unauthorized data disclosure or system compromise.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the log may be complete; the issue is not missing entries but the classification and approval process for changes that are logged. Option B is wrong because blocking all direct production access for developers is an overly restrictive measure that may hinder legitimate emergency fixes; the focus should be on proper change classification and approval, not blanket access denial. Option C is wrong because requiring all changes to go through the standard approval process would eliminate the emergency change process entirely, which is not practical for urgent fixes; the correct approach is to ensure emergency changes are properly classified and justified, not to eliminate the process.

Why this answer

Why this answer

How to eliminate wrong answers

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because password policies are typically set at the system or domain level, not tied to individual RBAC roles; inconsistent application would stem from policy configuration issues, not role review frequency. Option C is wrong because authentication failures due to expired passwords are managed by password expiration policies and account lockout mechanisms, not by the review of role assignments. Option D is wrong because audit log tracking is a function of the logging and monitoring infrastructure (e.g., SIEM, audit trails), not directly dependent on whether role assignments are reviewed; even with stale roles, logs can still be captured and tracked.

Why this answer

How to eliminate wrong answers

Option B is wrong because enabling detailed audit logging only provides detective control—it logs who accessed the data but does not prevent unauthorized access or protect the unencrypted credit card numbers at rest. Option C is wrong because requiring NDAs is an administrative control that does not address the technical vulnerability of unencrypted data; it cannot stop an attacker who gains network access from reading the plaintext data. Option D is wrong because dynamic data masking at the application level would require modifying the legacy application (which cannot be changed) to implement masking logic, and it only obfuscates data in query results, not the underlying stored data, leaving the physical database files exposed.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because postponing security decisions to later phases introduces significant rework costs and integration challenges, as security requirements must be baked into system architecture from the start (e.g., secure coding practices, access control design). Option B is wrong because letting the project team decide based on development ease ignores stakeholder priorities and regulatory compliance (e.g., PCI DSS, SOX), leading to potential audit failures and security gaps. Option D is wrong because implementing all security controls regardless of convenience can cripple user productivity and lead to shadow IT, where users bypass controls (e.g., using unapproved cloud storage), increasing overall risk.

Why this answer

How to eliminate wrong answers

Option B is wrong because encryption of sensitive data at rest is a data protection mechanism, not a benefit of RBAC; RBAC controls access to data but does not encrypt it. Option C is wrong because RBAC does not eliminate compliance requirements; it can help meet compliance (e.g., least privilege) but regulations still mandate audits, logging, and other controls. Option D is wrong because RBAC does not directly protect against malware; malware protection relies on endpoint security, antivirus, and network controls, not role-based access.

Why this answer

How to eliminate wrong answers

Option A is wrong because implementing an untested change immediately before go-live violates change management best practices and could introduce critical defects that compromise patient safety, such as data corruption or loss of vital signs. Option B is wrong because proceeding with a known usability flaw that slows down vital signs entry increases the risk of data entry errors or omissions, which in a clinical setting can lead to incorrect treatment decisions and patient harm. Option D is wrong because delaying go-live by a full month is unnecessarily conservative for a targeted fix that can be validated through fast-tracked regression testing, and it introduces project delays and costs without proportional risk reduction.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because increasing logging and auditing of all user activities is a detective control, not a preventive one; it helps identify breaches after they occur but does not stop an insider from abusing elevated access. Option C is wrong because deploying a SIEM tool aggregates and correlates logs for detection and analysis, but it does not prevent an insider from using privileged access to cause a breach. Option D is wrong because terminating the insider is a reactive disciplinary action that addresses the specific individual but does not fix the underlying lack of access controls, leaving the enterprise vulnerable to future insider threats.

Why this answer

How to eliminate wrong answers

Option A is wrong because creating a prototype and asking for feedback after development violates the iterative validation principle; feedback should be gathered during development, not after, to avoid rework and misalignment with user expectations. Option C is wrong because developing a detailed technical specification before user sign-off assumes that technical details can be finalized without user validation, which often leads to a system that meets technical specs but fails to satisfy business requirements. Option D is wrong because documenting all requirements in a formal specification alone does not ensure that the requirements are correct or understood by stakeholders; it is a passive activity that lacks the interactive validation needed to confirm user needs.

Why this answer

How to eliminate wrong answers

Option B is wrong because encryption in transit and at rest is a necessary baseline control but does not address logic flaws or misconfigurations in the integration code that could allow an attacker to bypass payment validation or steal tokens. Option C is wrong because detailed logging is a detective control that helps after an incident occurs; it does not prevent or identify exploitable vulnerabilities before going live. Option D is wrong because network firewalls restrict traffic at the network layer but cannot protect against application-layer attacks such as API parameter tampering or session hijacking that target the payment gateway integration.

Why this order

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because missing COMMIT statements would cause uncommitted transactions to hold locks indefinitely, but the exhibit shows contention, not missing commits; reviewing application code for missing COMMITs is a generic guess that does not solve the locking conflict. Option B is wrong because enabling automatic retry for failed transactions treats the symptom (deadlock retries) rather than preventing the underlying contention; it can lead to livelock or excessive retry overhead. Option D is wrong because increasing the database timeout parameter only delays the failure or extends lock waits, making contention worse; it does not resolve the root cause of resource contention.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the Chief Information Officer (CIO) is a senior management role responsible for the day-to-day operation and strategic planning of IT, which inherently lacks the independence required for oversight of IT investments. Option B is wrong because the Project Management Office (PMO) director is focused on project execution, resource management, and delivery metrics, not on independent governance or strategic alignment of IT investments. Option D is wrong because the Chief Information Security Officer (CISO) is primarily concerned with information security risk management and compliance, not with the broader financial and strategic oversight of IT investments.

Why this answer

How to eliminate wrong answers

Option B is wrong because the policy only allows `s3:GetObject` (read) actions, not `s3:PutObject` or `s3:DeleteObject` (write) actions, so public write access is not granted. Option C is wrong because the policy sets `"Principal": "*"`, which applies to all principals, not restricting access to a specific IAM role; a restricted policy would specify an ARN like `"AWS": "arn:aws:iam::123456789012:role/MyRole"`. Option D is wrong because S3 bucket policies are not individually encrypted; they are stored as JSON documents within AWS IAM and are protected by AWS's infrastructure encryption at rest, and the question asks about a security risk, not a missing encryption feature that does not exist for policies.

Why this answer

How to eliminate wrong answers

Option A is wrong because storing backup tapes in a locked cabinet in the server room, while not ideal (they should be offsite for geographic redundancy), is a physical security control that does not directly invalidate the BCP's effectiveness; the greater risk is the lack of testing. Option B is wrong because a BCP contact list that has not been updated in six months is a maintenance issue, but it can be corrected quickly and does not indicate that the plan itself is unworkable; the lack of testing is a more fundamental flaw. Option D is wrong because relying on manual workarounds for critical systems is a design choice that may be acceptable if the manual procedures are documented, trained, and tested; the absence of testing is what makes this reliance dangerous.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because RAD actually increases stakeholder involvement through continuous user feedback and prototyping, not reduces it. Option C is wrong because RAD is specifically designed to shorten development time through iterative cycles and time-boxed delivery, not lengthen it. Option D is wrong because prototyping is a core strength of RAD, not a difficulty; RAD relies on rapid prototyping to refine requirements and validate functionality.

Why this answer

Why these pairings

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because while a complex policy with too many levels can contribute to confusion, the root cause is typically a lack of understanding of the existing policy, not the number of levels. Option C is wrong because lack of enforcement is a secondary issue; even with enforcement, users cannot comply if they do not know how to classify correctly. Option D is wrong because automated classification tools can help but are not the root cause; the primary issue is human error due to insufficient training, not the absence of technology.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because encrypting the file with GnuPG protects its confidentiality but does not address the world-writable permission; the file remains modifiable by anyone, which could lead to data corruption or unauthorized changes. Option C is wrong because applying an ACL to restrict access to specific users is an alternative approach, but it is not the most appropriate remediation; the simplest and most direct fix is to remove the world-writable bit, and ACLs add complexity without necessity when a simple permission change suffices. Option D is wrong because changing the file owner using `chown` does not remove the world-writable permission; the new owner would still have the same permission issue unless the permissions are also modified.

Why this answer

How to eliminate wrong answers

Option A is wrong because the exhibit does not provide any evidence of access control mechanisms (e.g., ACLs, authentication logs) to conclude that access is improperly restricted. Option B is wrong because the exhibit does not show whether compliance checks are scheduled or performed; the issue is about the physical security of backup media, not the frequency of checks. Option D is wrong because the retention period is not indicated in the exhibit; the problem is the lack of encryption on backup media, not how long it is kept.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because role-based access control (RBAC) manages internal user permissions but does not protect against malicious data arriving from the external payment gateway. Option B is wrong because logging transactions is a detective control that records events after they occur; it does not prevent an attack from exploiting unvalidated input. Option D is wrong because encrypting data with SSL/TLS protects data in transit between the e-commerce platform and the payment gateway, but it does not validate the content of the data received; an encrypted malicious payload is still malicious.

Why this answer

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because changing the Resource to a different bucket does not address the overly permissive principal; it merely moves the vulnerability to another bucket. Option B is wrong because removing 's3:GetObject' and adding 's3:PutObject' would still leave the bucket open to any principal, and it would also remove read access while introducing write access, which could lead to data corruption or unauthorized uploads. Option C is wrong because encrypting the bucket at rest protects data confidentiality if the data is accessed, but it does not prevent unauthorized access; encryption is a defense-in-depth measure, not a substitute for access control.

Why this answer

How to eliminate wrong answers

Option B is wrong because there is no evidence of misconfiguration; the firewall correctly denies SSH (rule 101 likely blocks SSH to 172.16.0.1) and permits HTTPS to 172.16.0.5, which is expected behavior. Option C is wrong because while the host may be performing reconnaissance, the key observation is the shift from a denied protocol to a permitted one, which is more indicative of bypassing controls than simple mapping of allowed services. Option D is wrong because the logs explicitly show denied SSH attempts, meaning the host did not successfully access server 172.16.0.1 via SSH; the subsequent HTTPS connections are to a different server (172.16.0.5).

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because recommending a policy change without first assessing the risk impact of the deviation could weaken security posture and is premature. Option B is wrong because immediately reporting noncompliance as a finding without evaluating compensating controls may result in an incomplete or misleading audit report, failing to consider the actual risk. Option C is wrong because escalating to senior management without first gathering evidence on compensating controls bypasses the auditor's responsibility to perform due diligence and risk assessment.

Why this answer

Why this answer