Certified Information Systems Auditor CISA CISA Questions 676–750 | Page 10/14

676

MCQmedium

An organization classifies IT incidents based on severity. A critical financial application is unavailable, impacting all users. According to ITIL best practices, which severity level should this incident be assigned?

A.P2

B.P3

C.P1

D.P4

AnswerC

Correct: P1 is for critical incidents with major business impact, such as a full application outage.

Why this answer

P1 incidents are the highest severity, typically involving a critical service outage affecting all users with significant business impact.

Full explanation →

677

MCQeasy

Which type of disaster recovery test involves a full switch-over from the primary site to the alternate site, resulting in actual disruption of normal operations?

A.Full interruption test

B.Tabletop test

C.Parallel test

D.Simulation test

AnswerA

Correct. This is the most realistic and disruptive test.

Why this answer

A full interruption test (also called full-scale test) involves actual failover, shutting down primary operations and running completely from the alternate site.

Full explanation →

678

MCQmedium

An IS auditor is reviewing the logical access controls for a financial application. The auditor notices that user access reviews are performed annually by the application owner, but there is no documentation indicating that managers confirm the continued need for access. Which of the following is the MOST significant risk associated with this finding?

A.Unauthorized access to sensitive data due to excessive privileges

B.Increased likelihood of successful social engineering attacks

C.Non-compliance with regulatory requirements for access controls

D.Inability to detect insider threats in a timely manner

AnswerA

Without manager confirmation, users may retain access they no longer need, increasing the risk of unauthorized access.

Why this answer

Without manager confirmation, access may remain for users who no longer need it, leading to segregation of duties conflicts or unauthorized access. Annual reviews without manager sign-off increase the risk that access is not appropriately revoked when roles change.

Full explanation →

679

MCQmedium

During an audit of an organization's change management process, the IS auditor selects a sample of 50 change requests from a population of 500. The auditor finds that 3 of the 50 did not have proper approval. What is the estimated error rate in the population?

A.3%

B.6%

C.10%

D.5%

AnswerB

Correct: 3/50 = 6% is the point estimate of the population error rate.

Why this answer

The estimated error rate is calculated by dividing the number of errors found in the sample (3) by the sample size (50), yielding 6%. This is a point estimate of the population error rate, assuming the sample is representative. The auditor would then use statistical sampling techniques to determine a confidence interval for the true population error rate.

Exam trap

The trap here is that candidates often mistakenly divide the number of errors by the total population (500) instead of the sample size (50), leading to the incorrect 3% answer, confusing the sample error rate with the population error rate.

How to eliminate wrong answers

Option A (3%) is wrong because it incorrectly divides the number of errors (3) by the total population (500), which is not the correct method for estimating the error rate from a sample; the sample error rate is 3/50 = 6%. Option C (10%) is wrong because it might come from misreading the numbers (e.g., 5/50 or confusing 3 with 5) or incorrectly applying a rule of thumb. Option D (5%) is wrong because it could result from a miscalculation such as 2.5/50 rounded or confusing the sample size with the population size.

Full explanation →

680

MCQhard

An organization is adopting ITIL 4 to improve its service management practices. Which guiding principle emphasizes understanding how different components work together to deliver value?

A.Think and work holistically

B.Start where you are

C.Keep it simple and practical

D.Focus on value

AnswerA

This principle addresses the need to see the big picture and understand interconnections.

Why this answer

The ITIL 4 guiding principle 'Think and work holistically' emphasizes considering the entire service value system and how all components interact.

Full explanation →

681

MCQmedium

Refer to the exhibit. Which of the following services is accessible from the internet to host 10.1.1.100?

A.HTTP only

B.Telnet only

C.HTTPS and SSH

D.FTP only

AnswerC

Ports 443 (HTTPS) and 22 (SSH) are explicitly permitted.

Why this answer

The exhibit shows an access control list (ACL) permitting TCP ports 443 (HTTPS) and 22 (SSH) from any source to host 10.1.1.100. Since the ACL is applied inbound on the internet-facing interface, only HTTPS and SSH traffic are allowed through to that host. Therefore, option C is correct.

Exam trap

The trap here is that candidates often confuse HTTP with HTTPS or Telnet with SSH, assuming that if one is allowed, the other must also be allowed, but the ACL explicitly permits only the specific port numbers listed.

How to eliminate wrong answers

Option A is wrong because HTTP (port 80) is not permitted by the ACL; only HTTPS (port 443) is allowed, so HTTP alone is not accessible. Option B is wrong because Telnet (port 23) is not listed in the ACL; only SSH (port 22) is permitted for remote access. Option D is wrong because FTP (ports 20/21) is not permitted by the ACL; no FTP traffic is allowed to reach host 10.1.1.100.

Full explanation →

682

MCQeasy

An organization is implementing a business continuity plan (BCP). Which of the following is the PRIMARY purpose of conducting a business impact analysis (BIA)?

A.To document the step-by-step recovery procedures for each system

B.To identify potential threats and vulnerabilities to the organization

C.To inventory all IT assets and their configurations

D.To identify critical business processes and their recovery time objectives (RTOs)

AnswerD

BIA helps prioritize processes and define RTOs and RPOs.

Why this answer

The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the impact of their disruption, which directly drives the recovery time objectives (RTOs) and recovery point objectives (RPOs). These RTOs and RPOs form the foundation for selecting appropriate recovery strategies and technologies, such as synchronous replication for near-zero RPO or warm standby sites for specific RTO windows. Without a BIA, the BCP would lack the business-driven metrics needed to prioritize recovery efforts and allocate resources effectively.

Exam trap

The trap here is that candidates often confuse the BIA with a risk assessment or asset inventory, but the BIA is exclusively focused on business process criticality and recovery time objectives, not on threats, vulnerabilities, or hardware lists.

How to eliminate wrong answers

Option A is wrong because documenting step-by-step recovery procedures is the purpose of the recovery plan development phase, not the BIA; the BIA identifies what needs recovery and how quickly, but does not prescribe the technical steps. Option B is wrong because identifying potential threats and vulnerabilities is the domain of a risk assessment, which is a separate process that often uses the BIA's outputs to prioritize risks, but the BIA itself focuses on business process impact, not threat enumeration. Option C is wrong because inventorying all IT assets and their configurations is part of asset management or configuration management (e.g., CMDB), not the BIA; the BIA identifies which processes are critical, not the detailed hardware/software inventory.

Full explanation →

683

MCQmedium

An administrator sees the above error after a failed backup job. What is the MOST likely cause?

A.The backup service account does not have write permissions to the destination

B.The network share \\BACKUPSRV\DBBackups\DB01\ is offline or unreachable

C.The SQL Server backup client is not installed

D.The backup destination disk is full

AnswerB

The error indicates the path specified does not exist or is unavailable.

Why this answer

The error message indicates that the backup destination path \BACKUPSRV\DBBackups\DB01\ is inaccessible. This is most commonly caused by the network share being offline, unreachable due to network issues, or the target server being down. Without connectivity to the UNC path, the backup job cannot proceed, even if permissions and disk space are adequate.

Exam trap

The trap here is that candidates often assume a failed backup is always due to permissions or disk space, but the error message's specific wording about the path being 'offline or unreachable' directly points to a network connectivity issue, not authorization or capacity.

How to eliminate wrong answers

Option A is wrong because the error message does not mention permission denial; a permissions issue would typically produce an 'access denied' or similar error, not a generic 'unreachable' failure. Option C is wrong because the SQL Server backup client is not required for backing up to a network share; SQL Server uses its native VDI or T-SQL BACKUP command, and the error points to connectivity, not missing client software. Option D is wrong because a full disk would generate a 'disk full' or 'insufficient space' error, not a failure to reach the destination path.

Full explanation →

684

MCQeasy

An organization has a policy requiring strong passwords. Which additional control is most effective at preventing credential stuffing attacks?

A.Increasing password length and complexity requirements.

B.Implementing account lockout after 3 failed attempts.

C.Requiring multi-factor authentication (MFA) for all logins.

D.Conducting annual security awareness training.

AnswerC

MFA renders stolen passwords useless as the second factor is required for access.

Why this answer

Multi-factor authentication (MFA) stops attackers who have stolen passwords because they cannot provide the second factor.

Full explanation →

685

MCQeasy

Which document is typically included in the permanent file of audit documentation?

A.Organizational chart

B.Management representation letter

C.Current year audit program

D.Working papers for testing

AnswerA

Organizational charts are carryforward items.

Why this answer

The permanent file contains information that is relevant for multiple audits, such as organizational charts and key contracts.

Full explanation →

686

MCQhard

An auditor is reviewing IT policy compliance and finds that a critical policy was last updated three years ago. The organization has undergone significant changes. What is the auditor's PRIMARY concern?

A.Employees may not be aware of the policy

B.The policy may not have been approved by management

C.The policy may not be enforced

D.The policy may not be aligned with current business objectives

AnswerD

Outdated policies may not reflect current objectives, risks, or regulatory requirements, leading to governance gaps.

Why this answer

Policies should be reviewed and updated regularly to remain current and effective. The primary concern is that the policy may no longer be relevant or effective due to changes in the organization, technology, or regulatory environment.

Full explanation →

687

MCQeasy

An IS auditor is reviewing a software development project that follows the waterfall model. Which of the following is the MAIN advantage of this methodology?

A.Reduced risk of requirements misinterpretation

B.Clear milestones and documentation at each phase

C.Early delivery of working software increments

D.Ability to accommodate changing requirements easily

AnswerB

Each phase produces deliverables and sign-offs.

Why this answer

Waterfall's sequential phases and formal sign-offs provide clear milestones and documentation.

Full explanation →

688

Multi-Selecthard

Which THREE of the following are responsibilities of the board of directors regarding IT governance? (Choose three.)

Select 3 answers

A.Designing network security architecture

B.Setting IT risk appetite

C.Reviewing IT performance

D.Implementing IT controls

E.Approving IT strategy

AnswersB, C, E

Correct. Board defines risk tolerance.

Why this answer

Options B, C, and E are correct because setting IT risk appetite, reviewing IT performance, and approving IT strategy are board-level responsibilities under IT governance. Option A is incorrect as designing network security architecture is an operational task typically handled by management or technical staff. Option D is incorrect because implementing IT controls is also a management function, not a board responsibility.

Full explanation →

689

MCQmedium

During a change management audit, an IS auditor finds that a critical system change was approved by the change manager without a CAB meeting. The change was categorized as a standard change. Which of the following should the auditor do FIRST?

A.Report a lack of segregation of duties

B.Recommend immediate rollback of the change

C.Escalate to senior management

D.Determine if the change was correctly classified as standard

AnswerD

If it is a standard change, the process was followed.

Why this answer

The auditor's first step must be to verify whether the change was correctly classified as a standard change, because standard changes are pre-approved and do not require a CAB meeting. If the classification is correct, the process was followed; if not, the lack of CAB approval is a control failure. This aligns with ITIL best practices, where standard changes are low-risk, pre-authorized changes with a defined procedure, and the auditor must confirm the classification before escalating or recommending action.

Exam trap

The trap here is that candidates assume any change approved without a CAB meeting is a control failure, but they overlook the critical first step of verifying whether the change was correctly classified as a standard change, which is pre-approved and does not require CAB involvement.

How to eliminate wrong answers

Option A is wrong because a lack of segregation of duties would involve the same person approving and implementing the change, but here the change manager approved a standard change, which is within their role; the issue is classification, not segregation. Option B is wrong because recommending an immediate rollback is premature without first confirming whether the change was correctly classified as standard; if it was standard, no rollback is needed. Option C is wrong because escalating to senior management is a reactive step that should only occur after the auditor has determined whether the change classification was correct, as the classification dictates the required approval process.

Full explanation →

690

MCQmedium

An auditor is reviewing the encryption strategy for a healthcare application that stores protected health information (PHI) in a database. The database currently uses transparent data encryption (TDE). What is a key risk associated with TDE?

A.It requires complex key management

B.It significantly degrades database performance

C.It does not protect against privileged database users

D.It cannot be used with column-level encryption

AnswerC

TDE encrypts data at rest but decrypts when accessed by authorized users, so DBA's can still see data.

Why this answer

TDE protects data at rest but does not protect against privileged database users because decryption happens transparently at the database level, allowing authorized users (e.g., DBAs) to access plaintext. This is a key risk, as it does not provide access control. Option A is wrong because key management is a consideration but not the primary risk.

Option B is wrong because performance impact is typically minor with modern hardware. Option D is wrong because TDE can coexist with column-level encryption, but column-level encryption is not a substitute for the overall risk.

Full explanation →

691

MCQmedium

Refer to the exhibit. A tester executes test case TC-101 and records the result shown. What is the NEXT appropriate step in the testing process?

A.Re-run the test case after the defect is fixed

B.Create a new test case to cover the error

C.Update the requirements to reflect the actual behavior

D.Log a defect in the defect tracking system

AnswerD

The discrepancy indicates a defect that should be logged for resolution.

Why this answer

The tester executed TC-101 and observed a result that deviates from the expected behavior, indicating a defect. The immediate next step in the structured testing process is to log the defect in the defect tracking system to formally document the issue, assign severity, and initiate the resolution workflow. This aligns with the CISA testing lifecycle, where defects are captured before any re-testing or requirement changes.

Exam trap

The trap here is that candidates may think re-running the test (Option A) is the logical next step, but CISA emphasizes that defects must be formally logged before any remediation actions to maintain audit trail and process integrity.

How to eliminate wrong answers

Option A is wrong because re-running the test case after a fix is premature; the defect must first be logged and triaged before any fix is applied. Option B is wrong because creating a new test case to cover the error is not the immediate next step; the existing test case already exposes the defect, and additional coverage is handled after defect logging. Option C is wrong because updating requirements to reflect actual behavior would incorrectly treat a defect as a feature, violating the principle that requirements drive expected outcomes, not the other way around.

Full explanation →

692

MCQeasy

A small business lacks formal IT governance. What is the FIRST step to establish governance?

A.Assign an IT manager

B.Define IT policies

C.Conduct a risk assessment

D.Implement COBIT

AnswerC

Risk assessment reveals the starting point for governance.

Why this answer

Conducting a risk assessment identifies the most critical issues and guides the development of governance policies and structure. Defining policies or assigning roles without understanding risks may be premature.

Full explanation →

693

MCQmedium

An organization is implementing a new IT governance framework. Which of the following is the BEST approach to ensure alignment between IT strategy and business goals?

A.Align IT budget with the previous year's business plan

B.Conduct annual IT strategy reviews independent of business cycles

C.Establish an IT steering committee with business representation

D.Delegate IT strategy to the CIO without business input

AnswerC

A steering committee with business leaders ensures ongoing alignment.

Why this answer

An IT steering committee with both IT and business leaders ensures continuous strategic alignment by involving business stakeholders in IT decision-making. Option A is incorrect because aligning the IT budget with a previous year's business plan uses outdated information and does not guarantee alignment with current goals. Option B is incorrect because annual IT strategy reviews independent of business cycles create a disconnect between IT and business priorities.

Option D is incorrect because delegating IT strategy solely to the CIO without business input can lead to misalignment with organizational objectives.

Full explanation →

694

MCQeasy

When implementing a commercial off-the-shelf (COTS) software package, which of the following is the MOST important activity to ensure the software meets business requirements?

A.Conducting a vendor demonstration

B.Developing a project plan with milestones

C.Performing a gap analysis between requirements and software features

D.Reviewing the software's technical architecture

AnswerC

Directly addresses requirements coverage.

Why this answer

Performing a gap analysis is the most important activity because it systematically maps each business requirement against the COTS software's delivered features, identifying any shortfalls that must be addressed through configuration, customization, or process adaptation. Without this structured comparison, the organization risks deploying software that fails to support critical business processes, leading to costly rework or project failure.

Exam trap

The trap here is that candidates often confuse vendor demonstrations with functional validation, assuming a demo proves the software fits all requirements, when in reality demos are scripted and omit edge cases that a gap analysis would expose.

How to eliminate wrong answers

Option A is wrong because a vendor demonstration is a marketing tool that showcases the software under ideal conditions, not a rigorous method to verify that every specific business requirement is met; it cannot uncover gaps in functionality or data handling. Option B is wrong because developing a project plan with milestones is a project management activity that ensures tasks are scheduled and tracked, but it does not directly assess whether the software's features align with business needs. Option D is wrong because reviewing the software's technical architecture focuses on infrastructure, scalability, and security design, not on functional fit; a technically sound system can still completely miss key business requirements.

Full explanation →

695

Multi-Selecteasy

Which TWO of the following are examples of administrative controls for information security?

Select 2 answers

A.Intrusion detection system

B.Firewall configuration

C.Access control policy

D.Encryption algorithms

E.Security awareness training

AnswersC, E

Policies are administrative controls that define rules and procedures.

Why this answer

Access control policy is an administrative control because it defines the rules, roles, and responsibilities for granting or restricting access to information assets. It is a documented directive that governs user behavior and management processes, not a technical mechanism. Administrative controls are management-level safeguards, such as policies, procedures, and training, that guide the implementation of technical and physical controls.

Exam trap

ISACA often tests the distinction between administrative, technical, and physical controls, and the trap here is that candidates confuse policy documents (administrative) with the technical mechanisms that implement them, such as firewalls or encryption.

Full explanation →

696

MCQhard

An organization uses the policy shown. Which of the following is an omission in the policy?

A.No definition of authorized users

B.No mention of backup frequency

C.No specification of data disposal methods after retention periods

D.Missing encryption requirement for log data

AnswerC

The policy defines retention but not deletion or archiving.

Why this answer

The policy does not specify data disposal methods after the retention period, which is a critical omission for data lifecycle management. Option A is incorrect because authorized users are likely defined elsewhere in the policy. Option B is incorrect because backup frequency is mentioned.

Option D is incorrect because encryption may not be required for all log data based on the policy context.

Full explanation →

697

MCQhard

An IS auditor is evaluating the design of controls over a new financial system. Which of the following is the BEST approach to assess control design?

A.Use analytical procedures to identify anomalies

B.Review system documentation and conduct walkthroughs

C.Perform detailed testing of transactions

D.Interview management and review policies

AnswerB

Correct; documentation and walkthroughs are primary methods for assessing design.

Why this answer

Reviewing system documentation and conducting walkthroughs allows the auditor to understand the intended design and compare it to actual implementation.

Full explanation →

698

MCQmedium

During a penetration test, a tester discovers that an application stores passwords using a reversible encryption algorithm. Which of the following is the BEST remediation?

A.Use MD5 hashing with a salt

B.Replace the encryption algorithm with AES-256

C.Implement a strong one-way hashing algorithm such as bcrypt

D.Add a random salt before encryption

AnswerC

bcrypt is designed for password storage.

Why this answer

Storing passwords using reversible encryption is fundamentally flawed because any encryption key can be compromised, allowing an attacker to decrypt all passwords. The best remediation is to use a strong, one-way hashing algorithm like bcrypt, which is designed to be computationally expensive and includes a built-in salt to resist rainbow table attacks and brute-force attempts. Unlike encryption, hashing is irreversible, so even if the database is breached, the original passwords cannot be recovered.

Exam trap

The trap here is that candidates confuse encryption with hashing, thinking that a strong encryption algorithm like AES-256 is sufficient for password storage, when in fact any reversible method is insecure for this purpose.

How to eliminate wrong answers

Option A is wrong because MD5 is a broken hashing algorithm that is vulnerable to collision attacks and fast brute-force computation; even with a salt, it is not considered secure for password storage. Option B is wrong because AES-256 is a symmetric encryption algorithm, not a hashing algorithm; replacing one reversible encryption with another still leaves passwords recoverable if the encryption key is compromised. Option D is wrong because adding a salt before encryption does not address the core issue—the passwords remain reversible and can be decrypted if the key is obtained.

Full explanation →

699

MCQmedium

According to ITIL 4, which guiding principle emphasizes understanding the current state before making improvements?

A.Progress iteratively

B.Focus on value

C.Start where you are

D.Keep it simple and practical

AnswerC

This principle emphasizes understanding the current state before making changes.

Why this answer

ITIL 4's guiding principle 'Start where you are' advises assessing the current state before embarking on improvements.

Full explanation →

700

MCQhard

An IS auditor is reviewing the change management process for a financial institution. The auditor finds that emergency changes bypass normal approval but are documented and reviewed within 48 hours. Which of the following is the BEST recommendation?

A.Require a second administrator to approve during the emergency.

B.Implement a risk classification for changes and apply controls accordingly.

C.Increase the frequency of post-implementation reviews to every 24 hours.

D.Require all emergency changes to be approved by the change advisory board (CAB) before implementation.

AnswerB

Risk classification allows appropriate control for each change type.

Why this answer

Implementing a risk classification for changes allows the organization to apply appropriate controls based on the change's impact and urgency. Emergency changes inherently require speed, but a risk-based approach ensures that high-risk emergency changes receive more stringent controls (e.g., mandatory peer review) while low-risk changes can proceed with lighter oversight. This balances security with operational agility, which is critical in a financial institution where system availability and data integrity are paramount.

Exam trap

The trap here is that candidates assume all emergency changes must be treated equally and thus focus on adding more approval steps (A or D) or increasing review frequency (C), rather than recognizing that a risk-based classification is the most effective and efficient control to address varying levels of risk in emergency changes.

How to eliminate wrong answers

Option A is wrong because requiring a second administrator to approve during the emergency introduces a bottleneck that defeats the purpose of an emergency change process, which is to rapidly address critical incidents; it also does not address the root issue of varying risk levels across changes. Option C is wrong because increasing post-implementation reviews to every 24 hours does not solve the lack of pre-implementation controls for emergency changes; it only adds administrative overhead without ensuring that high-risk changes are properly vetted before deployment. Option D is wrong because requiring all emergency changes to be approved by the CAB before implementation is impractical for true emergencies, as CAB meetings are typically scheduled and cannot convene instantly; this would delay critical fixes and potentially cause service outages or security breaches.

Full explanation →

701

MCQeasy

A company is experiencing frequent server crashes due to memory leaks. The operations team has implemented a monitoring solution. Which of the following is the BEST indicator to trigger an automated failover to a standby server?

A.Memory usage exceeding 90% for more than 5 minutes

B.Disk I/O latency greater than 10ms

C.CPU utilization spikes above 80% for 1 minute

D.Network packet loss exceeding 1%

AnswerA

Correct: Directly reflects memory leak condition.

Why this answer

Memory leaks cause gradual memory consumption; sustained high memory usage directly indicates the condition. CPU spikes, disk latency, and packet loss are less specific to memory leaks.

Full explanation →

702

Multi-Selectmedium

An organization is adopting COBIT 2019. Which TWO of the following are components of the governance system?

Select 2 answers

A.Processes

B.IT hardware inventory

C.Information flows

D.Organizational structures

E.Employee satisfaction surveys

AnswersA, D

Processes are a core component in COBIT.

Why this answer

The correct answers are A (Processes) and D (Organizational structures). COBIT 2019 defines governance system components that include processes and organizational structures, among others. Processes describe the organized sets of practices, while organizational structures define roles and responsibilities.

Option B (IT hardware inventory) is a resource or asset, not a component of the governance system. Option C (Information flows) is related to the Information component but is not a standalone component; information itself is a component, but flows are part of processes. Option E (Employee satisfaction surveys) is an HR activity, not a governance component.

Full explanation →

703

MCQmedium

During system development, the project team discovers that the original requirements are incomplete. What is the BEST course of action?

A.Formally document the new requirements and follow the change management process

B.Inform the steering committee and continue as planned

C.Proceed with development and address changes during maintenance

D.Halt the project until all requirements are finalized

AnswerA

Change management ensures proper evaluation and approval of new requirements.

Why this answer

Formally documenting new requirements and following the change management process ensures that all changes are controlled, assessed for impact on scope, budget, and schedule, and approved by stakeholders. This aligns with the systems development lifecycle (SDLC) best practices and the ISACA standard for managing requirements changes, preventing scope creep and maintaining project integrity.

Exam trap

The trap here is that candidates often choose Option D (halting the project) because they assume all requirements must be fully finalized before development, but the CISA exam emphasizes that change management is the appropriate mechanism to handle evolving requirements without stopping the project entirely.

How to eliminate wrong answers

Option B is wrong because simply informing the steering committee without formally documenting and processing the new requirements through change management bypasses the necessary impact analysis and approval controls, risking unauthorized scope changes. Option C is wrong because deferring requirement changes to maintenance violates the principle of early defect detection and correction; addressing changes during maintenance is significantly more costly and can introduce technical debt and security vulnerabilities. Option D is wrong because halting the project entirely is an overreaction; incomplete requirements are common, and the proper response is to manage them through a structured change control process, not to stop all progress.

Full explanation →

704

MCQmedium

An organization is implementing an automated job scheduling system. Which of the following is the PRIMARY benefit of using dependency management in job scheduling?

A.Reducing the need for backup procedures

B.Automatically rerunning failed jobs without notification

C.Eliminating the need for human operators

D.Ensuring jobs execute in the correct sequence based on prerequisites

AnswerD

This is the primary benefit of dependency management.

Why this answer

Dependency management ensures jobs run in the correct sequence based on prerequisites, reducing errors and manual intervention.

Full explanation →

705

MCQmedium

An IS auditor is reviewing a change management process. A developer made an emergency change directly to production without following the standard change approval process. The change was later documented as a normal change. Which control weakness is MOST indicated by this scenario?

A.Inadequate segregation of duties between development and production environments

B.Absence of a rollback plan for emergency changes

C.Insufficient testing of emergency changes before deployment

D.Lack of a formal change documentation policy

AnswerA

Direct production access by developers violates segregation of duties.

Why this answer

The developer bypassed the standard change approval process by making an emergency change directly to production, then retroactively documenting it as a normal change. This directly violates the principle of segregation of duties (SoD), as the same individual who implemented the change also controlled the documentation and approval trail, eliminating independent oversight. In a properly segregated environment, developers should not have direct write access to production systems without a separate change authorization and deployment step.

Exam trap

The trap here is that candidates focus on the lack of testing or documentation, but the most critical control weakness is the violation of segregation of duties, as the developer both made the change and controlled its documentation, eliminating independent oversight.

How to eliminate wrong answers

Option B is wrong because the absence of a rollback plan, while a concern, is not the primary control weakness indicated; the core issue is the lack of segregation of duties, not the absence of a recovery procedure. Option C is wrong because insufficient testing of emergency changes is a risk, but the scenario does not mention whether testing occurred or not—the key failure is the unauthorized direct change and subsequent misdocumentation, not the testing process itself. Option D is wrong because a formal change documentation policy may exist (the change was documented as a normal change), but the weakness is that the documentation was falsified to hide the emergency bypass, not that the policy is missing.

Full explanation →

706

MCQhard

A multinational corporation is adopting a hybrid cloud strategy. The IT governance board must decide on a framework to ensure alignment with business objectives and regulatory compliance. Which framework is MOST appropriate?

A.ITIL 4 Service Value System

B.COBIT 2019

C.ISO/IEC 27001 Information Security Management

D.PMBOK Guide

AnswerB

COBIT 2019 is a comprehensive framework for IT governance and management.

Why this answer

COBIT 2019 is the most appropriate framework because it is specifically designed for IT governance, providing a comprehensive set of controls and processes to align IT with business objectives and ensure regulatory compliance. In a hybrid cloud strategy, COBIT 2019's focus on governance objectives, stakeholder needs, and risk management directly addresses the board's need for oversight across on-premises and cloud environments, unlike frameworks that target service management, security, or project management.

Exam trap

The trap here is that candidates often confuse ITIL (service management) with governance, assuming that best practices for service delivery inherently cover board-level alignment and compliance, but ITIL lacks the governance objectives and stakeholder-driven goal cascade that COBIT provides for hybrid cloud strategies.

How to eliminate wrong answers

Option A is wrong because ITIL 4 Service Value System focuses on IT service management (ITSM) best practices, such as incident and change management, but lacks the governance and compliance alignment mechanisms required for board-level decision-making in a hybrid cloud strategy. Option C is wrong because ISO/IEC 27001 is an information security management standard that addresses security controls and risk management, but it does not provide a holistic governance framework for aligning IT with business objectives and regulatory compliance across the entire enterprise. Option D is wrong because PMBOK Guide is a project management framework that covers project lifecycle and processes, but it is not designed for ongoing IT governance or ensuring sustained alignment with business goals and compliance in a hybrid cloud environment.

Full explanation →

707

Multi-Selecthard

Based on the backup logs, the backup administrator notices that the incremental backup job failed due to insufficient storage. Which TWO actions should the administrator take to resolve the immediate issue and prevent recurrence?

Select 2 answers

A.Free up space on the backup storage device by removing old backup sets manually

B.Check network bandwidth between the backup server and storage device

C.Increase the frequency of incremental backups to reduce data volume per job

D.Configure backup retention policies and enable data deduplication on the backup device

E.Investigate and resolve the file-in-use warnings from the full backup job

AnswersA, D

This addresses the immediate 'insufficient storage' error by freeing up space for the next backup.

Why this answer

Freeing up space on the backup storage device by removing old backup sets immediately resolves the insufficient storage issue that caused the incremental backup job to fail. This is a direct, short-term fix that reclaims capacity without altering backup schedules or configurations.

Exam trap

The trap here is that candidates may confuse a storage capacity issue with a performance issue (Option B) or incorrectly assume that increasing backup frequency (Option C) reduces data volume, when in fact it increases the number of backup objects and metadata overhead.

Full explanation →

708

Multi-Selecthard

An IT auditor is reviewing the alignment of IT with business strategy. Which THREE of the following are indicators of effective IT strategy alignment? (Select THREE.)

Select 3 answers

A.IT budget is determined solely by IT department

B.IT department has its own independent strategy

C.IT steering committee includes business leaders

D.IT balanced scorecard includes business outcome metrics

E.IT projects are prioritized based on business value

AnswersC, D, E

Business involvement ensures alignment.

Why this answer

Strategic alignment is demonstrated when IT initiatives support business objectives, governance mechanisms are in place, and IT performance is measured.

Full explanation →

709

MCQmedium

During an audit of a cloud service provider, the IS auditor discovers that the provider's data center access logs show an employee accessing the production environment outside of normal business hours without a change request. What should the auditor do FIRST?

A.Report the incident to the provider's management immediately

B.Recommend immediate remediation procedures

C.Obtain supporting evidence such as system logs and change tickets

D.Evaluate the potential impact and the effectiveness of compensating controls

AnswerD

Understanding the significance helps determine the appropriate response.

Why this answer

The IS auditor's first priority is to assess risk. Without evaluating the potential impact of the unauthorized access and the effectiveness of any compensating controls (e.g., intrusion detection systems, session recording, or multi-factor authentication), the auditor cannot determine the severity of the finding or the urgency of subsequent actions. This aligns with the ISACA audit methodology, which mandates risk-based analysis before recommending remediation or reporting.

Exam trap

The trap here is that candidates often jump to 'gather evidence' (Option C) because it seems logical, but the CISA exam emphasizes that risk assessment (evaluating impact and controls) must precede evidence collection to avoid wasting resources on irrelevant data.

How to eliminate wrong answers

Option A is wrong because reporting to management immediately without first assessing the risk and impact is premature; the auditor must gather sufficient evidence and evaluate the situation to provide an informed report. Option B is wrong because recommending remediation procedures before understanding the full scope and compensating controls could lead to unnecessary or ineffective actions, violating the principle of risk-based auditing. Option C is wrong because while obtaining supporting evidence is important, it is not the first step; the auditor should first evaluate the potential impact and compensating controls to determine what evidence is most relevant and whether immediate escalation is needed.

Full explanation →

710

MCQhard

During a spiral SDLC project, the project team has completed a risk analysis and created a prototype. What is the most likely next step in the spiral model?

A.Deploy the system to production

B.Obtain formal sign-off from the business owner on requirements

C.Develop the next level of the product based on the risk analysis

D.Conduct user acceptance testing (UAT)

AnswerC

In the spiral model, after risk analysis, the team proceeds to develop the next level of the product (e.g., a more refined prototype or increment).

Why this answer

In the spiral model, each iteration begins with identifying objectives, evaluating alternatives, and resolving risks through risk analysis. After completing risk analysis and building a prototype, the next step is to develop the next level of the product, incorporating the risk analysis findings to refine requirements and design. This ensures that high-risk areas are addressed incrementally before proceeding to subsequent phases.

Exam trap

The trap here is that candidates confuse the spiral model's iterative prototyping with a linear waterfall approach, mistakenly thinking that a prototype leads directly to deployment or formal sign-off, rather than understanding that the spiral model uses risk-driven iteration to progressively refine the product.

How to eliminate wrong answers

Option A is wrong because deploying to production occurs only after multiple iterations and final validation, not immediately after a single risk analysis and prototype. Option B is wrong because formal sign-off on requirements is typically done earlier in the planning phase, not after risk analysis and prototyping; the spiral model emphasizes iterative refinement over rigid sign-offs. Option D is wrong because user acceptance testing (UAT) is performed later in the development cycle, after the product has been built and tested, not directly after risk analysis and prototyping.

Full explanation →

711

Multi-Selectmedium

Which TWO of the following are examples of analytical procedures used as audit evidence? (Select two.)

Select 2 answers

A.Ratio analysis

B.Inquiry of management

C.Inspection of documents

D.Trend analysis

E.Observation of process

AnswersA, D

Ratio analysis is an analytical procedure.

Why this answer

Analytical procedures include ratio analysis and trend analysis; inquiry and inspection are other types.

Full explanation →

712

MCQmedium

An IS auditor is reviewing the system design phase of a project. Which of the following activities is most important to ensure that security is adequately addressed?

A.Creating a data flow diagram

B.Developing a detailed project schedule

C.Conducting a threat modeling exercise

D.Reviewing the budget for security tools

AnswerC

Threat modeling proactively identifies and mitigates security risks.

Why this answer

Threat modeling identifies potential security threats and informs the design of controls, ensuring security is built in.

Full explanation →

713

MCQmedium

Which of the following is a characteristic of non-statistical (judgmental) sampling?

A.Every item has an equal chance of selection

B.The auditor uses professional judgment to select sample items

C.The sample size is determined using statistical formulas

D.The sample results can be projected to the population with known confidence

AnswerB

Judgmental sampling is based on auditor expertise.

Why this answer

Non-statistical sampling relies on the auditor's judgment and does not use probability theory.

Full explanation →

714

MCQmedium

An IS auditor is reviewing the logical access controls for a critical database. Which of the following findings should be considered the HIGHEST risk?

A.Database administrators share a common user ID for maintenance tasks.

B.The default 'sa' account is enabled with the default password.

C.Access rights are reviewed on an annual basis.

D.The database has not undergone a vulnerability scan in six months.

AnswerB

Default accounts with default passwords are a critical vulnerability.

Why this answer

Default passwords are a well-known vulnerability that can be easily exploited.

Full explanation →

715

MCQeasy

A company is implementing a new customer relationship management (CRM) system. The project team is currently defining user roles and permissions. Which of the following is the PRIMARY reason to enforce segregation of duties (SoD) within the CRM?

A.To reduce the risk of fraud and errors

B.To ensure data accuracy and completeness

C.To comply with regulatory requirements

D.To improve system performance and efficiency

AnswerA

SoD ensures no single individual has control over two or more phases of a transaction, reducing fraud and error risk.

Why this answer

Segregation of duties (SoD) in a CRM system is primarily enforced to prevent a single user from having conflicting capabilities, such as creating a customer record and also approving credit limits or processing refunds. Without SoD, an employee could both initiate and approve a fraudulent transaction, directly increasing the risk of fraud and undetected errors. While SoD can indirectly support data accuracy and compliance, the primary control objective is risk reduction through separation of conflicting functions.

Exam trap

The trap here is that candidates often choose 'compliance' (Option C) because SoD is a common regulatory requirement, but the question asks for the PRIMARY reason, which is the fundamental control objective of reducing fraud and error risk, not the secondary benefit of meeting external mandates.

How to eliminate wrong answers

Option B is wrong because ensuring data accuracy and completeness is a goal of input validation, data quality controls, and reconciliation processes, not the primary reason for enforcing SoD. Option C is wrong because while SoD may help meet regulatory requirements (e.g., SOX, GDPR), compliance is a secondary benefit; the primary reason is to reduce the risk of fraud and errors inherent in the system's design. Option D is wrong because SoD typically adds process steps and approval workflows, which can reduce system performance and efficiency, not improve them.

Full explanation →

716

Multi-Selectmedium

Which TWO of the following are primary objectives of IT governance as defined by COBIT 5?

Select 2 answers

A.Resource optimization

B.Cost reduction

C.Incident response

D.Value delivery

E.Data encryption

AnswersA, D

Resource optimization is a key governance objective.

Why this answer

Options A and D are correct because COBIT 5 defines primary IT governance objectives as stakeholder value delivery and resource optimization. Option B (cost reduction) is a management objective, not governance. Option C (incident response) is an operational activity.

Option E (data encryption) is a security control.

Full explanation →

717

MCQmedium

A company's IT service desk receives multiple reports of users being unable to access a cloud-based CRM system. The network team confirms that internet connectivity is working. Which of the following should be the FIRST step in troubleshooting the issue?

A.Ask a user to try accessing from a different device

B.Restart the company's firewall and proxy servers

C.Check the vendor's service status page for any reported outages

D.Review recent change requests for the CRM system

AnswerC

This quickly identifies if the issue is widespread and outside the organization's control.

Why this answer

Checking the vendor's service status page is the first logical step to determine if the issue is due to a known outage at the CRM provider. This aligns with best practices for troubleshooting – verify external dependencies before performing internal changes. Options A, B, and D are premature or secondary steps.

Full explanation →

718

MCQeasy

A medium-sized financial services firm recently suffered a ransomware attack that encrypted critical servers and backups. The recovery process took three weeks because the backup tapes were stored in the same building (which was also infected) and the backup software had a vulnerability that allowed the ransomware to delete old backups. The firm's BCP did not account for simultaneous loss of primary and secondary data. As the IS auditor, you are asked to recommend the most effective improvement to the backup strategy to prevent recurrence and improve resilience. Which of the following actions should the firm implement?

A.Implement immutable backups and store them offsite or in a separate air-gapped environment

B.Increase the frequency of full backups to daily

C.Conduct quarterly tabletop exercises to test recovery procedures

D.Move all backups to a cloud storage provider with default settings

AnswerA

Immutable backups prevent unauthorized deletion or modification, directly mitigating the risk from ransomware.

Why this answer

Immutable backups prevent modification or deletion by ransomware, even if the backup software or administrative credentials are compromised. Storing them offsite or in an air-gapped environment ensures that a simultaneous physical or logical attack cannot destroy both primary and secondary data, directly addressing the root cause of the three-week recovery delay.

Exam trap

The trap here is that candidates often choose increased backup frequency or cloud migration, thinking they improve resilience, but they overlook the critical requirement that backups must be protected from deletion or encryption by the same attack that compromises the primary systems.

How to eliminate wrong answers

Option B is wrong because increasing the frequency of full backups to daily does not protect against ransomware that can encrypt or delete existing backups; it only reduces the recovery point objective, not the vulnerability to deletion. Option C is wrong because quarterly tabletop exercises test recovery procedures and team readiness but do not prevent the backup data from being encrypted or deleted by ransomware; they improve process, not data resilience. Option D is wrong because moving all backups to a cloud storage provider with default settings does not guarantee immutability or air-gapping; default cloud storage configurations often allow deletion or overwrite by compromised credentials, leaving backups vulnerable to the same attack vector.

Full explanation →

719

MCQmedium

A multinational corporation is implementing a disaster recovery plan for its critical financial systems. The plan includes off-site backups and redundant hardware. During a recent test, the recovery time objective (RTO) was met, but the recovery point objective (RPO) was exceeded by 30 minutes due to delayed data replication. Which of the following is the BEST action to address this issue?

A.Extend the RPO to accommodate the delay.

B.Implement synchronous replication to the secondary site.

C.Reduce the bandwidth for replication to avoid congestion.

D.Increase the frequency of full backups to every 4 hours.

AnswerB

Synchronous replication ensures near-zero data loss, directly addressing the RPO exceedance.

Why this answer

Synchronous replication ensures that data is written to both primary and secondary sites simultaneously before the write is acknowledged, eliminating replication lag. This directly addresses the RPO exceedance by guaranteeing that the secondary site always has the most current data, whereas the current asynchronous replication caused a 30-minute delay.

Exam trap

The trap here is that candidates often confuse RTO and RPO, thinking that meeting RTO is sufficient, or they incorrectly assume that increasing backup frequency (Option D) can compensate for replication delays, when in fact backups are separate from continuous replication and still leave a recovery point gap equal to the backup interval.

How to eliminate wrong answers

Option A is wrong because extending the RPO to accommodate the delay accepts data loss of up to 30 minutes, which is not a corrective action and may violate business continuity requirements. Option C is wrong because reducing bandwidth for replication would increase latency and worsen the replication delay, making the RPO exceedance even larger. Option D is wrong because increasing the frequency of full backups to every 4 hours does not address the continuous replication delay; backups are point-in-time snapshots and still leave a gap of up to 4 hours of potential data loss, far exceeding the 30-minute RPO breach.

Full explanation →

720

MCQeasy

Which of the following is the PRIMARY purpose of audit working papers?

A.To provide a permanent record of the organization's financial transactions.

B.To support the auditor's conclusions and provide evidence of the work performed.

C.To serve as a basis for the audit fee calculation.

D.To replace the need for management's representation letter.

AnswerB

Working papers serve as the primary evidence of the audit.

Why this answer

Working papers document the audit procedures performed, evidence obtained, and conclusions reached, supporting the audit opinion.

Full explanation →

721

MCQeasy

During which phase of the waterfall SDLC should security requirements be formally documented and approved by the business owner?

A.Development phase

B.Requirements phase

C.Design phase

D.Testing phase

AnswerB

Requirements phase is the correct stage for documenting and approving security requirements.

Why this answer

In the waterfall model, security requirements must be defined during the requirements phase to ensure they are integrated into the design. Formal sign-off by the business owner ensures accountability.

Full explanation →

722

MCQeasy

Which of the following is the primary purpose of conducting a static application security test (SAST) during the development phase of the SDLC?

A.To ensure the application is free of runtime errors

B.To validate that the application meets business requirements

C.To identify security vulnerabilities in the source code

D.To test the application's performance under load

AnswerC

SAST is a white-box test that finds coding flaws.

Why this answer

SAST analyzes source code for vulnerabilities early in development, allowing fixes before deployment.

Full explanation →

723

Multi-Selectmedium

An IT auditor is reviewing the capacity management process. Which TWO of the following are key activities that should be performed?

Select 2 answers

A.Performing daily backup verification

B.Monitoring resource utilization trends

C.Reviewing incident response times

D.Setting threshold alerts for resource usage

E.Conducting annual disaster recovery tests

AnswersB, D

Essential for proactive capacity management.

Why this answer

Monitoring trends helps proactive planning; threshold alerts prevent overload.

Full explanation →

724

MCQhard

A healthcare organization is required to comply with HIPAA regulations for data backup and disaster recovery. They operate a primary data center and a colocation facility for disaster recovery. The current backup strategy involves nightly full backups to tape, which are stored off-site monthly. The recovery time for the electronic health record (EHR) system is estimated at 8 hours, but the RTO required by the business is 2 hours. Additionally, the RPO requirement is 15 minutes. The IT manager proposes implementing a continuous data protection (CDP) solution. However, the CFO is concerned about the cost. Which of the following is the BEST argument to justify the CDP investment?

A.CDP can achieve an RPO of seconds and significantly reduce recovery time.

B.CDP is required by HIPAA for all healthcare systems.

C.CDP will reduce the need for IT staff to perform backups.

D.CDP eliminates the need for any off-site storage, reducing costs.

AnswerA

CDP can achieve an RPO of seconds and significantly reduce recovery time, directly meeting the 2-hour RTO and 15-minute RPO requirements.

Why this answer

CDP provides near-zero RPO and can significantly reduce recovery time, directly meeting the RTO and RPO requirements. Option B is false because HIPAA does not mandate CDP. Option C is misleading; CDP does not necessarily reduce IT staff, as it may require continuous monitoring and management.

Option D is false because CDP still requires off-site storage or replication for disaster recovery.

Full explanation →

725

MCQhard

Refer to the exhibit. An IS auditor is reviewing the architecture. Which of the following is the MOST critical security weakness?

A.Application servers can initiate outbound internet connections.

B.The use of TLS between tiers.

C.Centralized logging to a SIEM.

D.Lack of encryption on the database server.

AnswerA

This bypasses security controls and can be exploited.

Why this answer

Allowing application servers to initiate outbound connections to the internet is a common attack vector (e.g., for command and control, data exfiltration). In a secure architecture, application servers should only communicate with necessary internal services, and outbound internet access should be restricted. Option B (TLS between tiers) is a security best practice, not a weakness.

Option C (centralized logging) enhances monitoring and is not a weakness. Option D (lack of encryption on database) is not necessarily the most critical compared to the risk of outbound internet access from application servers.

Full explanation →

726

Matchingmedium

Match each CISA domain to its focus.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Information System Auditing Process

Governance and Management of IT

Information Systems Acquisition, Development, and Implementation

Information Systems Operations and Business Resilience

Protection of Information Assets

Why these pairings

Correct matches: Domain 1 focuses on auditing process, Domain 2 on governance and management, Domain 3 on acquisition and development. Distractors mix focuses from other domains.

Full explanation →

727

MCQmedium

A company is implementing a new ERP system. The project team plans to use a parallel conversion strategy. What is the PRIMARY advantage of this approach?

A.Immediate realization of benefits from the new system.

B.Risk mitigation by allowing fallback to the old system.

C.Lower total cost due to reduced training requirements.

D.Faster implementation compared to phased approach.

AnswerB

The main benefit is risk reduction via fallback capability.

Why this answer

The primary advantage of a parallel conversion strategy is risk mitigation. By running the new ERP system alongside the old system for a period, the organization can validate the new system's functionality and data integrity while retaining the ability to immediately fall back to the legacy system if critical failures occur. This approach ensures business continuity and reduces the impact of unforeseen issues during the transition.

Exam trap

The trap here is that candidates often confuse parallel conversion with phased conversion, mistakenly believing that parallel conversion is faster or cheaper, when in fact its primary value is risk reduction through fallback capability.

How to eliminate wrong answers

Option A is wrong because immediate realization of benefits is not a characteristic of parallel conversion; benefits are delayed until the new system is fully validated and the old system is decommissioned. Option C is wrong because parallel conversion typically increases total cost due to the need to operate and maintain both systems simultaneously, and training requirements are not reduced—staff must learn the new system while still using the old one. Option D is wrong because parallel conversion is generally slower than a phased approach, as it requires a full cutover after a parallel run, whereas a phased approach rolls out functionality incrementally.

Full explanation →

728

MCQeasy

What is the PRIMARY purpose of conducting a feasibility study before acquiring a new information system?

A.To define detailed system requirements

B.To select a vendor through a bidding process

C.To assess the technical, operational, and economic viability

D.To determine the total cost of ownership

AnswerC

The primary purpose is to evaluate viability.

Why this answer

The primary purpose of a feasibility study is to evaluate whether a proposed information system is technically achievable, operationally compatible with existing processes, and economically justified before committing resources. This upfront assessment prevents investment in systems that cannot be successfully implemented or sustained, directly addressing risk management in the acquisition lifecycle.

Exam trap

The trap here is that candidates confuse the feasibility study with later phases like requirements gathering or vendor selection, leading them to pick A or B, when the core CISA focus is on the study's role as a go/no-go decision gate based on viability assessment.

How to eliminate wrong answers

Option A is wrong because defining detailed system requirements occurs after the feasibility study, typically during the requirements analysis phase, not as the primary purpose of the feasibility study. Option B is wrong because vendor selection through a bidding process happens later in the procurement cycle, after the feasibility study confirms the project is viable and requirements are defined. Option D is wrong because determining total cost of ownership is a component of the economic viability assessment within the feasibility study, not the primary purpose; the study must also evaluate technical and operational factors.

Full explanation →

729

MCQhard

A company is implementing a privileged access management (PAM) system. Which of the following is the MOST important control to prevent lateral movement after a privileged account is compromised?

A.Implement just-in-time (JIT) privilege elevation

B.Enforce multi-factor authentication for all privileged accounts

C.Monitor and record all privileged sessions

D.Rotate passwords after each use

AnswerA

JIT reduces exposure time.

Why this answer

Just-in-time (JIT) privilege elevation is the most important control to prevent lateral movement because it eliminates standing privileged access. By granting temporary, time-bound privileges only when needed, JIT reduces the attack surface and ensures that even if an attacker compromises a privileged account, they cannot use those credentials to move laterally to other systems after the access window expires. This directly addresses the root cause of lateral movement: persistent privileged credentials that can be reused across the network.

Exam trap

The trap here is that candidates often choose MFA (option B) because it is a well-known security best practice, but they fail to recognize that MFA does not prevent lateral movement after the account is already compromised—it only protects against unauthorized initial access.

How to eliminate wrong answers

Option B is wrong because multi-factor authentication (MFA) is a strong authentication control that can prevent initial compromise, but it does not prevent lateral movement once the account is already compromised (e.g., via session hijacking or token theft). Option C is wrong because monitoring and recording privileged sessions is a detective control that helps identify lateral movement after it occurs, but it does not prevent it. Option D is wrong because rotating passwords after each use (password cycling) reduces the window of credential reuse but still leaves the account with standing privileges during the session; an attacker can still move laterally within that session before the password is rotated.

Full explanation →

730

MCQmedium

An organization is developing a web application using an Agile methodology. The security team wants to integrate security testing early in the development lifecycle. Which of the following is the BEST approach to achieve this?

A.Implement static application security testing (SAST) in the continuous integration pipeline

B.Conduct a penetration test after each sprint

C.Schedule an annual vulnerability scan of the production environment

D.Perform dynamic application security testing (DAST) on deployed builds

AnswerA

SAST scans source code and can be integrated into CI to find vulnerabilities early.

Why this answer

Integrating SAST into the CI pipeline allows automated scanning of source code for vulnerabilities (e.g., SQL injection, XSS) as code is committed, aligning with Agile's iterative development. This shift-left approach catches flaws early, reducing remediation cost and effort compared to later stages.

Exam trap

The trap here is confusing 'early testing' with any security test performed during development, but only SAST in the CI pipeline provides automated, continuous analysis at the code level before builds are deployed.

How to eliminate wrong answers

Option B is wrong because penetration testing after each sprint is too late for early integration; it occurs after code is built and deployed, missing the opportunity to find issues during development. Option C is wrong because an annual vulnerability scan of production is far too infrequent and occurs post-deployment, violating the goal of early lifecycle testing. Option D is wrong because DAST on deployed builds tests the running application, which is still a later-stage activity and does not provide the same early feedback as source-level analysis.

Full explanation →

731

MCQhard

An organization's business continuity plan includes a reciprocal agreement with another company. What is the PRIMARY risk of this arrangement?

A.The other company may be a competitor

B.Both companies may be affected by the same disaster

C.The agreement may not be legally enforceable

D.The other company may not have adequate security

AnswerB

If the companies are geographically close, a single disaster can impact both, rendering the agreement useless.

Why this answer

The primary risk of a reciprocal agreement is that both organizations may be located in the same geographic area or rely on the same infrastructure (e.g., power grid, network backbone, or transportation). If a regional disaster such as an earthquake, flood, or prolonged power outage occurs, both companies could be incapacitated simultaneously, rendering the agreement useless. This defeats the core purpose of business continuity, which requires geographic diversity and independence of resources.

Exam trap

The trap here is that candidates focus on legal or security concerns (options C and D) because they seem like obvious risks, but CISA emphasizes that the fundamental flaw in reciprocal agreements is the lack of geographic separation, which directly violates the principle of diversity in business continuity planning.

How to eliminate wrong answers

Option A is wrong because being a competitor is a secondary concern (e.g., data confidentiality) but not the primary risk to continuity; the agreement's failure due to simultaneous impact is more critical. Option C is wrong because legal enforceability is a contractual issue, but even an enforceable agreement cannot help if both sites are down; the primary risk is operational, not legal. Option D is wrong because inadequate security at the other company is a risk to data protection, but it does not directly threaten the availability of the alternate processing site during a disaster; the core continuity risk is co-location vulnerability.

Full explanation →

732

Multi-Selecteasy

Which TWO of the following are key components of an IT governance framework?

Select 2 answers

A.IT strategy committee

B.IT asset inventory

C.IT risk management

D.IT project portfolio management

E.IT help desk ticketing system

AnswersA, C

Governance requires a steering or strategy committee.

Why this answer

Options A and C are correct. An IT governance framework includes structures like an IT strategy committee (A) and processes like IT risk management (C). B (IT asset inventory) is an operational practice, D (IT project portfolio management) is a management practice, and E (IT help desk ticketing system) is operational.

None of these are core governance components.

Full explanation →

733

MCQhard

An IS auditor is preparing working papers. Which of the following items should be included in the permanent file rather than the current file?

A.Audit programme for the current year

B.Testing results from current audit

C.Management responses to current findings

D.Organization chart

AnswerD

Organization chart is a carryforward item.

Why this answer

The permanent file contains carryforward items like organizational charts and key contracts.

Full explanation →

734

MCQeasy

In a RACI matrix, the person who is ultimately accountable for a process outcome is assigned which role?

A.Informed

B.Accountable

C.Consulted

D.Responsible

AnswerB

The accountable person has final authority and ownership.

Why this answer

Accountable (A) is the person ultimately answerable for the task or decision. Responsible (R) does the work.

Full explanation →

735

MCQeasy

In ITIL incident management, which severity level typically indicates a critical incident that severely impacts business operations and requires immediate resolution?

A.P2

B.P3

C.P1

D.P4

AnswerC

P1 is the highest priority.

Why this answer

P1 (Priority 1) incidents are the highest severity, requiring immediate attention.

Full explanation →

736

MCQeasy

An IS auditor is using statistical sampling to test a population of 10,000 transactions. The desired confidence level is 95%, and the tolerable error rate is 5%. Which of the following factors would MOST likely increase the required sample size?

A.An increase in the expected error rate to 6%

B.A decrease in the tolerable error rate to 3%

C.A decrease in the confidence level to 90%

D.An increase in the population size to 15,000

AnswerA

Increasing the expected error rate to 6% increases the product p×(1-p) in the sample size formula, thus increasing sample size. This is the correct answer.

Why this answer

An increase in the expected error rate increases the required sample size because the sample size formula includes the term p × (1-p), where p is the expected error rate. As p increases from 5% to 6%, this product increases, raising the variance and thus the sample size. While a decrease in tolerable error rate also increases sample size, the question asks for the factor that most likely increases sample size in the context of audit sampling.

An increase in expected error rate directly signals higher risk, making it the primary driver for increasing sample size. Therefore, option A is correct.

Exam trap

The trap here is that candidates mistakenly think increasing population size always increases sample size, but in statistical sampling for large populations, the population size has a diminishing effect and is not the primary driver of sample size.

How to eliminate wrong answers

Option B is wrong because a decrease in the tolerable error rate to 3% actually increases the required sample size, not decreases it, as the auditor needs more precision to detect smaller deviations. Option C is wrong because a decrease in the confidence level to 90% reduces the z-value (from 1.96 to 1.645), which decreases the required sample size. Option D is wrong because for large populations (over 5,000), the population size has a negligible effect on sample size; increasing it to 15,000 does not materially increase the required sample size.

Full explanation →

737

MCQeasy

Which of the following disaster recovery test types involves a full switch-over to the alternate site, resulting in actual disruption to normal operations?

A.Simulation test

B.Full interruption test

C.Parallel test

D.Tabletop test

AnswerB

Actual switch-over causing disruption.

Why this answer

The full interruption test (also known as a cold-start test) involves an actual shutdown of primary systems and a complete switch-over to the alternate site, causing real disruption to normal operations. This validates the entire recovery capability under realistic conditions, including failover, data synchronization, and user reconnection, but carries the highest risk of data loss or extended downtime.

Exam trap

The trap here is confusing a parallel test with a full interruption test, as both involve the alternate site processing live data, but only the full interruption test causes actual disruption by taking the primary site offline.

How to eliminate wrong answers

Option A is wrong because a simulation test models a disaster scenario without actually failing over or disrupting live systems; it typically uses walkthroughs or scripted exercises to validate procedures. Option C is wrong because a parallel test runs the alternate site in parallel with the primary site, processing live data but not switching over, so normal operations continue uninterrupted. Option D is wrong because a tabletop test is a discussion-based exercise where key personnel review plans and roles without any actual system failover or operational impact.

Full explanation →

738

MCQeasy

Which of the following is a key performance indicator (KPI) for IT service management?

A.Number of security incidents

B.Help desk first-call resolution rate

C.Number of employees trained on security

D.Percentage of IT budget spent on new projects

AnswerB

First-call resolution rate measures service desk efficiency and is a common ITSM KPI.

Why this answer

IT service management KPIs often include help desk metrics such as average resolution time.

Full explanation →

739

MCQmedium

An IS auditor is reviewing change management procedures and finds that standard changes are approved by the change manager without CAB review. What is the auditor's BEST conclusion?

A.This is acceptable provided that standard changes are clearly defined and low-risk

B.The change manager should be a member of the CAB

C.The auditor should recommend that all changes go through CAB

D.This is a control weakness because all changes should be reviewed by the CAB

AnswerA

ITIL allows standard changes to be handled via a pre-approved process to improve efficiency.

Why this answer

Standard changes are pre-approved, low-risk changes that do not require CAB review. This is acceptable if the criteria for standard changes are properly defined.

Full explanation →

740

Matchingmedium

Match each type of access control to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Owner determines access permissions

System-enforced based on labels

Roles assigned to users

Attributes used to grant access

Why these pairings

The correct matches are: DAC = owner-defined rules, MAC = system-enforced labels, RBAC = role assignments, ABAC = attribute policies. Common confusions include swapping MAC and DAC definitions.

Full explanation →

741

MCQhard

During an IT audit, the auditor discovers that the IT department has not conducted a business impact analysis (BIA) for three years. The organization's disaster recovery plan (DRP) is based on the previous BIA. The IT manager argues that the DRP is still valid because no major changes have occurred. What should the auditor recommend?

A.Recommend that a new BIA be conducted to validate and update the DRP.

B.Accept the IT manager's rationale and close the finding.

C.Recommend terminating the current DRP until the BIA is completed.

D.Recommend accepting the risk and documenting the decision.

AnswerA

A current BIA is essential to identify changes in business processes and threats, ensuring the DRP is aligned.

Why this answer

A business impact analysis (BIA) is the foundation of a valid disaster recovery plan (DRP). Without a current BIA, the DRP may not reflect the organization's current critical processes, recovery time objectives (RTOs), or recovery point objectives (RPOs). Even if no major changes are perceived, subtle shifts in dependencies, resource availability, or regulatory requirements can render the DRP ineffective.

Therefore, the auditor should recommend conducting a new BIA to validate and update the DRP.

Exam trap

The trap here is that candidates may assume the IT manager's claim of 'no major changes' is sufficient, but the CISA exam emphasizes that a BIA must be periodically reviewed (typically annually) regardless of perceived stability, because hidden dependencies or gradual changes can still affect recovery requirements.

How to eliminate wrong answers

Option B is wrong because accepting the IT manager's rationale without evidence ignores the risk that the DRP may be outdated; the auditor's role is to verify, not assume, that no changes have impacted recovery requirements. Option C is wrong because terminating the current DRP would leave the organization without any recovery plan until the BIA is completed, increasing operational risk unnecessarily. Option D is wrong because accepting the risk and documenting the decision without further action is premature; the auditor should first recommend a BIA to determine the actual risk level before deciding to accept it.

Full explanation →

742

MCQhard

During an audit, the auditor uses a sampling method where the population is divided into subgroups, and samples are selected from each subgroup. This method is known as:

A.Systematic sampling

B.Judgmental sampling

C.Random sampling

D.Stratified sampling

AnswerD

Correct definition.

Why this answer

Stratified sampling divides the population into subgroups (strata) and samples from each.

Full explanation →

743

Multi-Selecteasy

During a data migration from a legacy system to a new ERP, the following log entries were generated. Which TWO issues should the IS auditor flag as high risk?

Select 2 answers

A.Source system downtime

B.Rapid growth of rollback segment

C.Constraint violation due to missing parent records

D.Duplicate key violation

E.Data type mismatch between source and target

AnswersC, D

This error indicates a foreign key violation where a parent record is missing, compromising referential integrity.

Why this answer

A constraint violation due to missing parent records indicates a referential integrity failure. In a data migration, this means child records are being inserted without their corresponding parent records, which can cause orphaned data and application logic errors. This is a high-risk issue as it compromises data consistency and may require complex reconciliation or rollback.

Exam trap

The trap here is that candidates often confuse operational issues (downtime, performance) with data integrity issues, or they underestimate the severity of referential integrity and duplicate key violations during migration.

Full explanation →

744

MCQmedium

A company is migrating its on-premises data center to a public cloud provider. Which of the following is the MOST important control to implement before migration to ensure data security?

A.Enable multi-factor authentication (MFA) for all cloud accounts

B.Deploy a cloud access security broker (CASB)

C.Establish a virtual private network (VPN) between on-premises and cloud

D.Implement data encryption at rest and in transit

AnswerD

Encryption ensures data confidentiality and integrity during and after migration.

Why this answer

Data encryption at rest and in transit is the most important control before migration because it protects sensitive data from exposure during the transfer process and after it is stored in the cloud. Without encryption, data could be intercepted over the network or accessed by unauthorized parties in the cloud provider's infrastructure. This control directly addresses the core risk of data leakage during and after migration, which is a fundamental security requirement.

Exam trap

The trap here is that candidates often choose a VPN (Option C) thinking it fully secures data during migration, but they overlook that encryption at rest is equally critical and that a VPN only protects data in transit, not after it is stored in the cloud.

How to eliminate wrong answers

Option A is wrong because enabling MFA for cloud accounts is an important identity and access management control, but it does not protect data during the migration process itself or while at rest in the cloud. Option B is wrong because deploying a CASB is a monitoring and policy enforcement tool for cloud usage, but it is not a prerequisite for securing data during migration and does not provide the foundational encryption needed. Option C is wrong because establishing a VPN between on-premises and cloud secures the network channel during transit, but it does not address data at rest in the cloud, nor does it protect against threats within the cloud environment.

Full explanation →

745

MCQhard

During an ERP implementation, data migration is a critical activity. Which of the following controls would be most effective in ensuring the accuracy and completeness of migrated data?

A.Using automated data extraction tools

B.Performing a trial migration and reconciling the results

C.Assigning a data owner for each data field

D.Running parallel processing for one month

AnswerB

Trial migration with reconciliation identifies discrepancies before final migration.

Why this answer

Reconciliation reports compare source and target data, providing evidence of completeness and accuracy. Other options are less direct.

Full explanation →

746

MCQhard

Based on the exhibit, which of the following is the MOST likely result of the current firewall configuration?

A.Remote SSH connections are permitted from any IP address

B.SSH access is restricted to the internal network

C.HTTPS traffic from the internal network is blocked

D.HTTPS traffic from the internet is allowed

AnswerA

Rule 1 allows SSH from anywhere.

Why this answer

The exhibit shows an access control list (ACL) that permits TCP traffic on port 22 (SSH) from any source IP address (0.0.0.0/0) to the destination IP address of the firewall's external interface. Since there is no source restriction, remote SSH connections are allowed from any IP address on the internet. This is a significant security risk because it exposes the firewall's management interface to brute-force attacks from the entire internet.

Exam trap

ISACA often tests the concept that an ACL with a permit statement for a specific service from 'any' source overrides any implicit deny, and candidates may mistakenly think that the implicit deny blocks all traffic, forgetting that explicit permits take precedence.

How to eliminate wrong answers

Option B is wrong because the ACL explicitly permits SSH from any source (0.0.0.0/0), not just the internal network; there is no rule restricting SSH to internal IP ranges. Option C is wrong because the ACL does not block HTTPS (TCP port 443) traffic from the internal network; in fact, there is no deny rule for HTTPS from internal sources, and the implicit deny at the end of the ACL only blocks traffic not explicitly permitted, but the question asks about the 'current firewall configuration' which includes the implicit deny, but HTTPS from internal is not explicitly blocked—it would be allowed if a permit rule existed for it, but the exhibit only shows SSH rules, so HTTPS from internal is not affected by this ACL. Option D is wrong because the ACL does not contain any permit rule for HTTPS (TCP port 443) from the internet; without an explicit permit, the implicit deny at the end of the ACL blocks all HTTPS traffic from the internet.

Full explanation →

747

MCQhard

A project uses a waterfall model. After design, the team discovers that the requirements have changed significantly. What is the BEST action?

A.Cancel the project and start over

B.Update the requirements and proceed with the design revision

C.Continue with original requirements as planned

D.Switch to an agile methodology for the remainder of the project

AnswerB

Updating requirements and adjusting design is necessary to ensure the final product aligns with current needs.

Why this answer

In a waterfall model, each phase must be completed before the next begins, but when requirements change significantly after design, the best action is to update the requirements and revise the design. This preserves the structured, sequential nature of the waterfall while ensuring the final product meets the new needs. Canceling or ignoring changes would waste resources, and switching methodologies mid-project introduces integration risks and process discontinuity.

Exam trap

The trap here is that candidates may think switching to agile is a flexible solution, but the CISA exam tests understanding that changing development methodologies mid-project violates the waterfall's sequential phase completion and introduces significant process and documentation risks.

How to eliminate wrong answers

Option A is wrong because canceling the project and starting over is an extreme, wasteful response that ignores the possibility of revising the design to accommodate the changed requirements, which is a standard practice in waterfall when changes are identified early. Option C is wrong because continuing with the original requirements as planned would deliver a product that no longer meets the stakeholder needs, leading to rework or project failure. Option D is wrong because switching to an agile methodology mid-project disrupts the established waterfall lifecycle, introduces process mismatches (e.g., no iterative feedback loops in place), and typically requires retraining and tooling changes that delay delivery.

Full explanation →

748

MCQmedium

During an audit of the incident management process, the IS auditor finds that tabletop exercises have not been conducted in the past two years. What is the MOST significant risk associated with this finding?

A.The organization may fail to detect an incident in a timely manner

B.The organization may not comply with regulatory reporting requirements

C.The incident response plan may be outdated

D.Employees may not know their roles during an incident

AnswerD

Tabletop exercises help familiarize team members with their responsibilities.

Why this answer

Without regular testing, the incident response team may not be prepared to effectively handle a real incident.

Full explanation →

749

Multi-Selecthard

An organization has implemented a database activity monitoring (DAM) solution. Which of the following are BEST practices for tuning the DAM to reduce false positives? (Choose TWO.)

Select 2 answers

A.Implement exclusions for routine maintenance activities

B.Enable alerts for all database queries

C.Increase the sensitivity of all detection rules

D.Review alerts in real-time only

E.Define a baseline of normal user behavior

AnswersA, E

Excluding known safe activities reduces false positives.

Why this answer

Implementing exclusions for routine maintenance activities (Option A) is a best practice because these activities often generate predictable database queries that are not indicative of security threats. By excluding them, the DAM solution avoids alerting on benign operations, thereby reducing false positives without compromising security coverage.

Exam trap

The trap here is that candidates may think increasing sensitivity (Option C) improves detection, but it actually amplifies false positives, whereas the correct approach is to establish a baseline (Option E) and exclude known benign activities (Option A).

Full explanation →

750

MCQeasy

Which of the following backup types copies only data that has changed since the last full backup?

A.Mirror backup

B.Differential backup

C.Full backup

D.Incremental backup

AnswerB

Correct. Differential copies all changes since the last full backup.

Why this answer

A differential backup copies all data that has changed since the last full backup, regardless of how many incremental backups have been performed. This means each differential backup contains all changes accumulated since the most recent full backup, making it larger than an incremental backup but faster to restore (requiring only the full backup plus the latest differential).

Exam trap

The trap here is that candidates often confuse 'differential' with 'incremental' because both copy changed data, but the key differentiator is the reference point: differential uses the last full backup, while incremental uses the last backup of any type.

How to eliminate wrong answers

Option A is wrong because a mirror backup creates an exact, real-time copy of the source data, often using block-level replication (e.g., RAID 1 or rsync), and does not rely on a 'last full backup' marker; it continuously synchronizes changes. Option C is wrong because a full backup copies all selected data regardless of change status, serving as the baseline for differential and incremental backups. Option D is wrong because an incremental backup copies only data that has changed since the last backup of any type (full or incremental), not specifically since the last full backup; this is the key distinction from differential backups.

Full explanation →

Certified Information Systems Auditor CISA (CISA) — Questions 676–750