Courseiva

Certified Information Systems Auditor CISA (CISA) — Questions 451–525

995 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 6

Page 7 of 14

Page 8
451
MCQmedium

During a privacy audit, the IS auditor discovers that the organization does not have a complete data inventory. What is the PRIMARY risk associated with this finding?

A.Increased likelihood of data breaches
B.Inability to fulfill data subject access requests within required timeframes
C.Higher costs for data storage
D.Difficulty in encrypting data at rest
AnswerB

This is a direct consequence of not knowing where PII resides.

Why this answer

Without knowing where PII is stored and processed, the organization cannot effectively protect it, respond to data subject requests, or ensure compliance with privacy regulations like GDPR.

Full explanation →
452
MCQeasy

Which of the following audit types is MOST likely to be performed by an organization's own employees?

A.External audit
B.IS audit
C.Internal audit
D.Compliance audit
AnswerC

Internal audits are conducted by the organization's own staff.

Why this answer

Internal audits are conducted by employees of the organization, providing deep knowledge but raising independence concerns.

Full explanation →
453
MCQmedium

An IS auditor is reviewing a system development project to assess whether it is on schedule. Which of the following would provide the BEST evidence of project progress against the planned timeline?

A.Minutes from status review meetings
B.Approved requirements document
C.Successful unit test results
D.Updated project schedule with actual completion dates for milestones
AnswerD

The project schedule directly compares planned vs actual milestones.

Why this answer

The updated project schedule with actual completion dates for milestones (Option D) provides direct, objective evidence of progress against the planned timeline. It shows the baseline plan, the actual dates work was completed, and the variance, allowing the IS auditor to quantitatively assess schedule adherence. This is the primary artifact for schedule tracking in system development projects.

Exam trap

The trap here is that candidates often confuse evidence of technical progress (like passing unit tests) with evidence of schedule progress, failing to recognize that technical success does not equate to on-time delivery.

How to eliminate wrong answers

Option A is wrong because minutes from status review meetings are subjective summaries of discussions and opinions, not objective evidence of actual completion dates or schedule variance. Option B is wrong because an approved requirements document defines what the system should do, not when tasks were completed or how the project is tracking against the timeline. Option C is wrong because successful unit test results verify that individual code modules function correctly, but they do not provide any information about whether those tests were completed on schedule or how the project is performing against the planned timeline.

Full explanation →
454
MCQhard

A government agency has an IT governance framework that includes an IT strategy committee, an IT steering committee, and a project management office. Despite this, there is a lack of transparency regarding IT spending and resource allocation. The agency's annual audit found that several IT initiatives were not approved by the steering committee and were funded out of operational budgets. The CFO is frustrated because IT costs are unpredictable. The agency's chief information officer (CIO) reports to the CFO but the IT steering committee is chaired by the CIO. The auditor's best recommendation to improve governance is to:

A.Establish a chargeback system to allocate IT costs to business units
B.Require all IT projects to submit a business case to the steering committee for approval
C.Change the steering committee chair to a senior business executive independent of IT
D.Implement a policy that prohibits funding IT projects from operational budgets without steering committee approval
AnswerC

Independence strengthens oversight and reduces the ability of the CIO to bypass governance.

Why this answer

Having an independent steering committee chair (e.g., a senior business executive) eliminates the conflict of interest where the CIO chairs the committee and can bypass governance. Option A (chargeback) addresses cost allocation but not the root cause of unauthorized spending. Option B (business case) is a good practice but can still be ignored if the committee chair is the CIO.

Option D (policy) can be overridden or ignored without structural change in governance.

Full explanation →
455
MCQhard

Refer to the exhibit. During a security audit, an IS analyst identifies that a critical business application hosted on 192.168.1.100:443 is unreachable from the 10.0.1.0/24 subnet. Which of the following is the MOST likely cause?

A.The first rule blocks all traffic from 10.0.1.0/24
B.The second rule blocks HTTPS traffic from any source to the host
C.The third rule permits all traffic from the 10.0.0.0/16 subnet
D.The firewall is misconfigured for TCP traffic
AnswerA

Correct: The deny rule for the subnet overrides any permit.

Why this answer

The first rule in the exhibit explicitly denies all traffic from the 10.0.1.0/24 subnet, which is the source subnet in the scenario. Since firewall rules are processed sequentially from top to bottom, this deny rule matches the traffic before any subsequent permit rules can be evaluated, making the host at 192.168.1.100:443 unreachable from that subnet.

Exam trap

The trap here is that candidates often assume a broader permit rule (like the third rule) will override a more specific deny rule, but they forget that firewall rules are evaluated top-down and the first match wins, so the deny rule takes precedence.

How to eliminate wrong answers

Option B is wrong because the second rule blocks HTTPS traffic from any source to the host, but it would only apply if the first rule did not already deny the traffic; however, the first rule is more specific to the source subnet and is processed first, so the second rule is never reached. Option C is wrong because the third rule permits all traffic from the 10.0.0.0/16 subnet, which includes 10.0.1.0/24, but it is placed after the deny rule and is never evaluated due to the sequential nature of firewall rule processing. Option D is wrong because the firewall is not misconfigured for TCP traffic in general; the specific deny rule for the source subnet is the direct cause, and TCP traffic from other subnets would be handled by subsequent rules.

Full explanation →
456
MCQmedium

During a business impact analysis (BIA), the IS auditor identifies that the maximum tolerable downtime (MTD) for an online payment system is 2 hours, and the recovery point objective (RPO) is 15 minutes. The current disaster recovery solution uses nightly backups (12-hour RPO) and can restore the system in 4 hours. Which risk is most critical?

A.The backup frequency is not aligned with the RPO.
B.The disaster recovery plan has not been tested.
C.Recovery time exceeds the MTD.
D.Data loss exceeds the RPO.
AnswerD

The RPO of 15 minutes is not met by 12-hour backups, risking significant data loss.

Why this answer

The current solution has a 12-hour RPO (nightly backups), but the business requires an RPO of 15 minutes. This means up to 11 hours and 45 minutes of transaction data could be lost, far exceeding the acceptable data loss threshold. While the recovery time of 4 hours also exceeds the MTD of 2 hours, the most critical risk is data loss because the gap between the actual RPO and the required RPO is proportionally larger and directly impacts transaction integrity and financial reconciliation.

Exam trap

The trap here is that candidates focus on the recovery time exceeding the MTD (Option C) because it seems more obvious, but the RPO gap is more critical because data loss has a longer-lasting financial and operational impact than temporary downtime.

How to eliminate wrong answers

Option A is wrong because the backup frequency is indeed not aligned with the RPO, but this is a symptom of the underlying risk—the real critical issue is that data loss exceeds the RPO, not just misalignment. Option B is wrong because the question does not provide any evidence that the disaster recovery plan has or has not been tested; the risk is based on the documented recovery capabilities, not the testing status. Option C is wrong because while the recovery time of 4 hours exceeds the MTD of 2 hours, the RPO gap (12 hours vs 15 minutes) represents a more severe and immediate risk to data integrity and business operations, as data loss is often harder to recover from than downtime.

Full explanation →
457
MCQeasy

During a change management board (CAB) meeting, a proposed change to the network firewall configuration is discussed. The change is considered low risk and pre-approved. Which type of change does this represent?

A.Emergency change
B.Major change
C.Standard change
D.Normal change
AnswerC

Correct: Standard changes are low-risk, pre-approved, and follow a documented procedure.

Why this answer

Standard changes are pre-approved, low-risk, and follow a defined procedure, often requiring only a CAB notification.

Full explanation →
458
Multi-Selectmedium

Which TWO of the following are effective controls to prevent unauthorized access to sensitive data in a database? (Choose two.)

Select 2 answers
A.Database activity monitoring (DAM)
B.Strong password policy
C.Database encryption at rest
D.Regular patch management
E.Network segmentation
AnswersA, C

DAM detects and blocks unauthorized access.

Why this answer

Options A (Database activity monitoring) and C (Database encryption at rest) are effective controls to prevent unauthorized access to sensitive data in a database. Database activity monitoring (DAM) detects and can block unauthorized queries in real-time. Database encryption at rest protects data even if the storage media is accessed without authorization.

Option B (Strong password policy) is a general security control but does not prevent access if passwords are compromised or bypassed. Option D (Regular patch management) addresses vulnerabilities but does not directly prevent unauthorized access. Option E (Network segmentation) limits network-level access but does not protect against authorized users misusing access or credential theft.

Full explanation →
459
MCQhard

You are the IT governance lead at a multinational corporation with a complex IT environment spanning multiple business units. The company has recently experienced a series of minor security incidents where unauthorized access was gained through unused user accounts that were not disabled after employees left the organization. Additionally, there have been delays in provisioning access for new hires, leading to productivity losses. The IT department currently uses a manual process for access management, with each business unit maintaining its own user lists. The company has a policy that requires access reviews every quarter, but these are often missed or performed superficially. The CIO has asked you to recommend a solution that addresses these issues while ensuring compliance with regulations such as GDPR and SOX. Which of the following is the BEST course of action?

A.Require each business unit to submit monthly reports of active users to IT, which will then manually disable accounts not on the list.
B.Develop a new policy that mandates quarterly access reviews and disciplinary action for non-compliance.
C.Increase the frequency of access reviews to monthly and assign a dedicated team to perform them.
D.Implement an identity governance and administration (IGA) tool that automates user provisioning and de-provisioning, integrates with HR systems, and enforces access reviews.
AnswerD

Automation addresses the root causes: timely de-provisioning, consistent reviews, and compliance.

Why this answer

Implementing an Identity Governance and Administration (IGA) tool directly addresses the root causes: manual, decentralized access management and lack of automated de-provisioning. IGA integrates with HR systems (e.g., Workday, SAP SuccessFactors) to trigger automatic account creation for new hires and immediate deactivation upon termination, eliminating orphaned accounts. It also enforces scheduled, auditable access reviews with certification workflows, ensuring compliance with GDPR (right to erasure, data minimization) and SOX (segregation of duties, access controls).

This automated approach resolves both the security incidents from unused accounts and the productivity losses from delayed provisioning.

Exam trap

The trap here is that candidates often choose options that increase manual oversight (like monthly reports or dedicated teams) because they seem practical, but the CISA exam emphasizes automated, integrated solutions (IGA) as the only sustainable way to achieve compliance and security at scale in complex, multi-unit environments.

How to eliminate wrong answers

Option A is wrong because it perpetuates the manual, error-prone process by relying on business units to submit reports and IT to manually disable accounts, which does not scale, introduces latency, and fails to prevent orphaned accounts between reporting cycles. Option B is wrong because developing a new policy without automated enforcement tools does not address the root cause of missed or superficial reviews; it merely adds another layer of documentation that is likely to be ignored without technical controls. Option C is wrong because increasing review frequency and assigning a dedicated team still relies on manual processes, which are costly, prone to human error, and cannot guarantee timely de-provisioning or integration with HR lifecycle events.

Full explanation →
460
MCQmedium

During system development, which testing phase is performed by developers to verify that individual program units function correctly?

A.Integration testing
B.User acceptance testing
C.Unit testing
D.System testing
AnswerC

Unit testing verifies individual program units.

Why this answer

Unit testing is the phase where developers test individual program units or modules in isolation to verify they function correctly according to their design specifications. This is the lowest level of testing and is typically performed using stubs and drivers to simulate interfaces with other components.

Exam trap

The trap here is confusing the scope of testing phases: candidates often mistake integration testing (which tests module interactions) for unit testing (which tests individual modules in isolation), especially when the question emphasizes 'by developers' and 'individual program units'.

How to eliminate wrong answers

Option A is wrong because integration testing focuses on verifying the interactions and data flow between integrated modules, not individual units. Option B is wrong because user acceptance testing is performed by end users to validate that the system meets business requirements, not by developers to test code units. Option D is wrong because system testing validates the complete, integrated system against functional and non-functional requirements, not individual program units.

Full explanation →
461
Multi-Selecthard

Which TWO of the following are indicators that a project is at risk of failure according to ISACA's project governance framework?

Select 2 answers
A.Regular status meetings with stakeholders.
B.Lack of clear communication channels among team members.
C.Adoption of iterative development.
D.Frequent changes to project scope without formal approval.
E.Use of a project management office (PMO).
AnswersB, D

Poor communication causes misunderstandings and delays.

Why this answer

ISACA's project governance framework identifies lack of clear communication channels as a key risk indicator. Without defined communication paths, team members cannot effectively share status updates, escalate issues, or coordinate tasks, leading to misalignment and increased failure probability.

Exam trap

The trap here is that candidates may confuse a lack of communication channels with other common risk factors like scope creep, but ISACA specifically lists communication breakdowns as a distinct risk indicator separate from scope change management.

Full explanation →
462
MCQmedium

Refer to the exhibit. An auditor notices this log entry during a review. The user john.doe does not have a legitimate business need to access executive salaries. Which of the following is the MOST likely control failure?

A.Database firewall misconfiguration
B.Audit logging is not enabled
C.Inadequate access controls or role-based permissions
D.Lack of encryption at rest
AnswerC

The user should not have SELECT privilege on the Employee_salaries table.

Why this answer

The log entry shows user john.doe successfully accessed executive salary data via a SELECT query. Since the user has no legitimate business need for this data, the most likely control failure is inadequate access controls or role-based permissions (RBAC). Proper RBAC would restrict access to sensitive columns or tables based on job function, preventing unauthorized queries regardless of other controls.

Exam trap

The trap here is that candidates may focus on the log entry's existence and incorrectly assume audit logging is the issue (Option B), when in fact the log proves logging works, and the real failure is the lack of preventive access controls that should have blocked the query before it executed.

How to eliminate wrong answers

Option A is wrong because a database firewall misconfiguration might allow or deny traffic at the network layer, but it does not typically enforce granular row- or column-level access based on user identity within a query; the log shows the query succeeded, indicating the firewall (if present) allowed it, but the core issue is that the user should not have been permitted to see the data at all. Option B is wrong because audit logging is clearly enabled—the log entry itself is evidence of logging; the failure is not the absence of logs but the absence of preventive controls. Option D is wrong because lack of encryption at rest protects data from physical theft or unauthorized file access, but it does not prevent an authenticated user from querying data through the application or database interface; encryption at rest would not have blocked this SELECT statement.

Full explanation →
463
Multi-Selecthard

Which THREE of the following are essential elements of an emergency change request? (Select three.)

Select 3 answers
A.Test plan
B.Impact analysis
C.Pre-approval from CAB
D.Rollback plan
E.Justification for emergency
AnswersA, D, E

Even emergency changes should have minimal testing.

Why this answer

Emergency changes require justification, a documented test plan (even if abbreviated), and a rollback plan to restore service if needed.

Full explanation →
464
MCQhard

An IS auditor is reviewing an organization's key management program. Which of the following is the GREATEST risk associated with using a single key for both encryption and decryption of sensitive data?

A.The key management system cannot generate such a key.
B.The key may be more easily guessed by attackers.
C.Non-repudiation cannot be achieved.
D.Key rotation requires re-encrypting all data encrypted with that key.
AnswerD

This operational difficulty may lead to prolonged use of a compromised key.

Why this answer

Symmetric keys must be protected; if compromised, both confidentiality and integrity are at risk. However, the primary risk is the inability to rotate keys without re-encrypting all data, leading to potential exposure if the key is compromised.

Full explanation →
465
MCQmedium

An IT steering committee is reviewing a proposal for a new customer relationship management (CRM) system. What is the committee's MOST important role?

A.Approving technical specifications
B.Selecting the vendor
C.Ensuring alignment with business objectives
D.Managing the project budget
AnswerC

Correct. The committee provides strategic oversight.

Why this answer

The IT steering committee's most important role is to ensure that proposed IT projects align with the organization's business objectives. Option A is incorrect as technical specifications are typically reviewed by technical architects or engineering teams. Option B is incorrect because vendor selection is often a procurement or business decision, and while the committee may provide input, it is not their primary role.

Option D is incorrect because managing the project budget is the responsibility of the project manager and project team, not the steering committee.

Full explanation →
466
MCQeasy

Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

A.To establish service level agreements (SLAs)
B.To identify critical business processes and their recovery requirements
C.To test the effectiveness of backup procedures
D.To develop the disaster recovery plan
AnswerB

This is the primary purpose of BIA.

Why this answer

BIA identifies critical processes, dependencies, and recovery requirements.

Full explanation →
467
MCQhard

An auditor discovers that a financial institution's IT department uses a decentralized model, with each business unit managing its own applications. What is a PRIMARY risk of this structure?

A.Inconsistent security controls across units
B.Reduced agility in responding to business needs
C.Difficulty in scaling IT infrastructure
D.Higher IT costs due to duplication
AnswerA

Lack of centralized oversight can lead to varying security postures.

Why this answer

Decentralized IT often leads to inconsistent security controls and increased risk of data breaches.

Full explanation →
468
MCQmedium

An auditor is selecting a sample of purchase orders for testing. The auditor decides to select every 50th purchase order from a list. This is an example of:

A.Judgmental sampling
B.Random sampling
C.Systematic sampling
D.Stratified sampling
AnswerC

Correct definition.

Why this answer

Systematic sampling selects items at a fixed interval (every nth item).

Full explanation →
469
Multi-Selectmedium

Which TWO of the following are types of analytical procedures used in an IS audit? (Select two.)

Select 2 answers
A.Ratio analysis
B.Observation
C.Re-performance
D.Trend analysis
E.Inquiry
AnswersA, D

Correct analytical procedure.

Why this answer

Ratio analysis and trend analysis are common analytical procedures.

Full explanation →
470
Multi-Selecthard

Which THREE of the following are key performance indicators (KPIs) commonly used to measure IT performance? (Select THREE.)

Select 3 answers
A.IT budget as percentage of revenue
B.System availability percentage
C.Number of IT employees
D.Help desk resolution time
E.Security incident count
AnswersB, D, E

System availability percentage is a common KPI measuring IT service uptime.

Why this answer

Common IT KPIs include system availability, help desk resolution time, and security incident count.

Full explanation →
471
Multi-Selecthard

Which THREE of the following are common challenges when integrating a software package with existing legacy systems? (Select exactly three.)

Select 3 answers
A.Availability of modern integration middleware
B.Lack of documented application programming interfaces (APIs)
C.Performance constraints of the legacy environment
D.Data format and schema mismatches
E.Need for custom development to bridge the gap
AnswersB, C, D

Legacy systems may have undocumented or proprietary interfaces.

Why this answer

Legacy systems often lack well-documented or standardized APIs, making it difficult to establish reliable interfaces for integration. Without clear API documentation, developers must reverse-engineer communication protocols or rely on outdated methods like screen scraping, which increases integration risk and effort.

Exam trap

The trap here is confusing a solution (custom development or middleware) with the underlying challenge, leading candidates to select 'Need for custom development' as a challenge when it is actually a response to the real challenges of missing APIs, data mismatches, and performance constraints.

Full explanation →
472
Multi-Selecthard

An organization is implementing a large ERP system. The project manager is concerned about segregation of duties conflicts. Which THREE controls should the IS auditor recommend to mitigate segregation of duties risks during implementation? (Select THREE)

Select 3 answers
A.Use automated segregation of duties monitoring tools
B.Delay deployment until all segregation conflicts are resolved
C.Implement role-based access controls (RBAC) aligned with job functions
D.Conduct a single user acceptance test (UAT) at the end of the project
E.Require dual approval for sensitive transactions
AnswersA, C, E

Automated tools can detect and report conflicting access assignments.

Why this answer

Segregation of duties conflicts can be mitigated by enforcing access controls based on roles, using automated tools to detect conflicting access, and establishing compensating controls (e.g., dual approval) where segregation is not possible.

Full explanation →
473
MCQmedium

An IS auditor is reviewing an agile software development project. Which of the following would be the BEST evidence that adequate controls are in place for user acceptance?

A.The product backlog is managed by the product owner
B.Daily standup meetings are held to track progress
C.Retrospectives are conducted after each sprint
D.Each sprint concludes with a sprint review attended by stakeholders
AnswerD

Sprint review provides real-time user feedback and acceptance.

Why this answer

In agile, the sprint review is a ceremony where stakeholders inspect the increment and provide feedback, serving as a control for user acceptance.

Full explanation →
474
Matchingmedium

Match each log type to its typical content.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

System and application events

User login attempts and access

Changes to sensitive data

System errors and failures

Why these pairings

Logs are essential for monitoring and forensics. Correct matches: Audit Log tracks user activities and compliance, Security Log tracks security events, System Log tracks OS events, Application Log tracks application events. Common confusions include mixing system events with audit logs and application errors with security logs.

Full explanation →
475
MCQeasy

An IT manager needs to ensure that the organization's IT resources are used efficiently. Which of the following is the BEST metric to measure IT resource utilization?

A.System uptime percentage
B.Average server CPU utilization
C.Number of help desk tickets resolved per day
D.Percentage of projects completed on time
AnswerB

Directly measures how efficiently computing resources are used.

Why this answer

Average server CPU utilization directly measures how much of the computing capacity is being consumed over time, making it the most relevant metric for assessing whether IT resources are being used efficiently. High or low CPU utilization can indicate over-provisioning, under-utilization, or potential performance bottlenecks, enabling the IT manager to optimize resource allocation.

Exam trap

The trap here is that candidates often confuse availability metrics (uptime) with utilization metrics, or they mistakenly equate operational outputs (tickets resolved, project completion) with resource efficiency, leading them to pick a superficially plausible but incorrect answer.

How to eliminate wrong answers

Option A is wrong because system uptime percentage measures availability, not utilization; a server can be up 99.999% of the time but idle, wasting resources. Option C is wrong because the number of help desk tickets resolved per day measures service desk productivity and incident handling efficiency, not the utilization of IT resources like servers or storage. Option D is wrong because the percentage of projects completed on time measures project management performance and schedule adherence, not the operational efficiency of IT resource usage.

Full explanation →
476
Multi-Selecthard

Which TWO of the following are BEST indicators that a system development project is at risk of failure?

Select 2 answers
A.Frequent scope changes
B.Clear communication
C.Robust testing
D.Unrealistic schedule
E.High team morale
AnswersA, D

Scope changes can lead to rework, budget overruns, and missed deadlines.

Why this answer

Frequent scope changes (A) are a classic risk indicator because they disrupt the project's baseline requirements, leading to rework, budget overruns, and schedule delays. In system development, uncontrolled scope creep often results in 'analysis paralysis' and can cause the final product to deviate from original objectives, increasing the likelihood of failure.

Exam trap

The trap here is that candidates confuse project risk indicators with project success factors, mistakenly selecting positive attributes like clear communication or high morale as signs of risk, when the question asks for indicators of failure.

Full explanation →
477
MCQhard

During a spiral SDLC project, the IS auditor should focus on which aspect as the primary risk?

A.Scope creep
B.Lack of documentation
C.Inadequate user involvement
D.Incomplete risk assessment
AnswerD

Correct. The spiral model's effectiveness depends on thorough risk assessment at each iteration.

Why this answer

The spiral model is risk-driven, so the primary risk is that risk assessment may be incomplete, leading to unaddressed issues.

Full explanation →
478
Multi-Selecthard

During a firewall rule review, an IS auditor identifies several rules that allow any-to-any traffic. Which THREE of the following should the auditor recommend as the MOST appropriate actions?

Select 3 answers
A.Obtain business justification for each any-to-any rule
B.Replace any-to-any rules with specific source/destination rules
C.Immediately delete all any-to-any rules without review
D.Increase logging for any-to-any rules to detect misuse
E.Remove any-to-any rules that lack business justification
AnswersA, B, E

Understanding why the rule exists is the first step.

Why this answer

Overly permissive rules should be reviewed to determine if they are needed, and if so, should be tightened. If no business justification exists, they should be removed. If needed, they should be replaced with specific rules.

Full explanation →
479
MCQmedium

An organization experiences a critical system failure during non-business hours. The IT team discovers that the last full backup was 48 hours ago, and the incremental backups for the past 24 hours are corrupted. The recovery time objective (RTO) for this system is 4 hours, and the recovery point objective (RPO) is 1 hour. Which of the following is the MOST immediate concern?

A.The backup schedule should be changed to daily full backups
B.The data loss may exceed the recovery point objective (RPO)
C.The root cause of the failure must be determined before recovery
D.The recovery time objective (RTO) of 4 hours will be exceeded
AnswerB

With corrupted incremental backups, data loss will be at least 48 hours, far exceeding the 1-hour RPO.

Why this answer

The RPO of 1 hour means the organization can tolerate losing at most 1 hour of data. With the last full backup 48 hours old and incremental backups for the past 24 hours corrupted, the usable recovery point is at least 24 hours old, resulting in data loss far exceeding the 1-hour RPO. This gap between actual and acceptable data loss is the most immediate concern because it directly violates the business continuity requirement.

Exam trap

The trap here is that candidates focus on the RTO (4 hours) as the most urgent metric, overlooking that the RPO violation (data loss of 24+ hours vs. 1-hour tolerance) is a more fundamental and immediate business continuity failure, since lost data cannot be recovered by simply restoring faster.

How to eliminate wrong answers

Option A is wrong because changing the backup schedule to daily full backups does not address the immediate data loss crisis; it is a long-term preventive measure, not an urgent response to the current RPO violation. Option C is wrong because determining the root cause of the failure should occur after recovery, not before; delaying recovery to investigate the cause would worsen the RTO breach and data loss. Option D is wrong because the RTO of 4 hours is a recovery speed target, and while it may be challenged, the primary and most immediate concern is the massive data loss (RPO violation), not the recovery time itself.

Full explanation →
480
MCQeasy

Which of the following is a key advantage of using an iterative SDLC model over a waterfall model?

A.Reduces the need for user involvement
B.Better suited for projects with stable requirements
C.Easier to manage project costs
D.Provides more flexibility to adapt to changing requirements
AnswerD

Iterative models embrace change.

Why this answer

Iterative models allow for adjustments based on feedback and changing requirements, which is a key advantage.

Full explanation →
481
MCQmedium

An organization has a clean desk policy. Which of the following is the BEST audit procedure to test compliance with this policy?

A.Interview employees about their understanding of the policy.
B.Review security awareness training records.
C.Review incident reports related to lost documents.
D.Conduct unannounced walkthroughs of work areas.
AnswerD

Unannounced walkthroughs reveal actual compliance.

Why this answer

Direct observation provides the most reliable evidence of compliance.

Full explanation →
482
MCQhard

A multinational organization operates a critical ERP system on a virtualized infrastructure across two data centers (primary and DR). The primary data center is located in Region A, and the DR site in Region B, 500 km away. The ERP database is 2 TB and changes at an average rate of 10 MB per second. The organization uses synchronous replication between the two sites over a dedicated 10 Gbps WAN link. During a recent disaster simulation, the IT team observed that the replication link experienced 15 ms latency, causing the primary database to slow down significantly under peak load, ultimately missing the defined RTO of 4 hours for full failover. The business has an RPO of 15 minutes. The CISO asks the IS auditor to recommend a solution that balances cost and performance while meeting both RTO and RPO. Which of the following is the BEST course of action?

A.Change replication to asynchronous mode and implement continuous data protection (CDP) to meet the 15-minute RPO.
B.Reduce the RPO to 30 minutes and perform snapshots every 30 minutes on the primary site.
C.Upgrade the WAN link to 40 Gbps to reduce latency and improve replication throughput.
D.Implement a backup-to-disk solution with daily full backups and hourly transaction log backups to the DR site.
AnswerA

Correct: Asynchronous replication eliminates performance impact, and CDP provides point-in-time recovery within RPO.

Why this answer

Synchronous replication over long distance introduces latency that degrades primary performance. Changing to asynchronous replication with continuous data protection (CDP) can meet the 15-minute RPO without impacting the primary site. Upgrading bandwidth does not reduce latency; backup-to-disk with hourly logs may not meet RPO due to potential data loss; reducing RPO changes the business requirement unacceptably.

Full explanation →
483
MCQeasy

A mid-sized company is upgrading its legacy financial system to a new cloud-based ERP. The project manager has decided to use a big-bang cutover approach to minimize costs and time. During the first week post-go-live, users report that several critical reports are generating incorrect totals. An initial investigation reveals that the data mapping from the old system to the new system was not fully validated. Which of the following should the IS auditor recommend as the most appropriate corrective action?

A.Perform a data mapping review and remediation, then run parallel operations until accuracy is confirmed
B.Implement additional manual controls and have users double-check all reports
C.Increase the project budget and hire more consultants to fix the issues
D.Immediately revert to the legacy system and restart the project with a phased approach
AnswerA

This directly fixes the data mapping issue and validates correctness before relying solely on the new system.

Why this answer

A big-bang cutover with unvalidated data mapping introduces a high risk of data integrity issues, as seen with the incorrect report totals. Running parallel operations after a data mapping review and remediation allows the IS auditor to validate that the new ERP processes data correctly by comparing outputs with the legacy system, ensuring accuracy before full reliance. This aligns with ISACA's guidance on post-implementation verification and control testing for data conversion in cloud-based ERP migrations.

Exam trap

The trap here is that candidates may choose Option D (revert to legacy) because it seems safest, but the CISA exam emphasizes cost-effective, risk-based corrective actions that validate data integrity without abandoning the project, making parallel operations the preferred approach.

How to eliminate wrong answers

Option B is wrong because adding manual controls and user double-checks is a detective, not corrective, control that does not address the root cause of incorrect data mapping; it increases operational burden and error risk without fixing the underlying data transformation logic. Option C is wrong because increasing the budget and hiring more consultants is a reactive, non-technical solution that does not guarantee the data mapping errors are identified and corrected; it may accelerate work but does not provide a validation mechanism. Option D is wrong because immediately reverting to the legacy system and restarting with a phased approach is overly disruptive, costly, and time-consuming; it ignores the possibility of a targeted fix and parallel testing, which is more efficient and preserves project momentum.

Full explanation →
484
MCQeasy

Which of the following is the PRIMARY benefit of using a prototype during system development?

A.Clarifying user requirements
B.Accelerating coding
C.Minimizing documentation
D.Reducing development cost
AnswerA

Prototyping provides a tangible model that users can interact with, leading to clearer and more accurate requirements.

Why this answer

Prototyping is primarily used to clarify and validate user requirements by providing a tangible model for users to interact with. This early feedback reduces the risk of misinterpretation and costly rework later. While prototyping may also accelerate development indirectly, its primary benefit is requirement clarification.

Reducing development cost is not a primary benefit; in fact, prototyping can increase initial costs. Accelerating coding and minimizing documentation are secondary or not direct objectives.

Full explanation →
485
MCQmedium

An organization's IT department is considering a shift from insourcing to co-sourcing for application development. What is a PRIMARY advantage of co-sourcing?

A.Eliminates the cost of employee benefits
B.Simplifies performance management
C.Reduces the need for IT governance
D.Provides access to specialized expertise while maintaining internal control
AnswerD

This is the key benefit of co-sourcing.

Why this answer

Co-sourcing combines internal and external resources, allowing access to specialized skills while retaining control.

Full explanation →
486
MCQmedium

An organization is implementing a data masking solution for a non-production database. Which of the following is the MOST important requirement?

A.Masked data should maintain referential integrity.
B.Masked data should be encrypted.
C.Masked data should be irreversible.
D.Masked data should be randomized across all columns.
AnswerA

Maintaining referential integrity ensures application functionality.

Why this answer

In a non-production database, data masking must preserve referential integrity to ensure that relationships between tables (e.g., foreign keys) remain valid after masking. Without referential integrity, application logic that relies on these relationships would break, making the non-production environment unusable for testing or development. This is the most critical requirement because masked data must still function correctly within the database schema.

Exam trap

The trap here is that candidates often confuse data masking with encryption or hashing, assuming irreversibility or encryption are the top priorities, but the CISA exam emphasizes that the primary goal in a non-production environment is usability and data integrity, not cryptographic security.

How to eliminate wrong answers

Option B is wrong because encryption is a security control for data at rest or in transit, not a masking requirement; masked data is already obfuscated and does not need encryption to fulfill its purpose. Option C is wrong because irreversibility is a property of hashing or tokenization, not a mandatory requirement for data masking; masking can be reversible (e.g., using deterministic substitution) as long as the original data is not exposed. Option D is wrong because randomizing data across all columns would destroy referential integrity and consistency; masking often uses deterministic algorithms to maintain relationships and data distribution patterns.

Full explanation →
487
MCQeasy

An organization has a policy requiring annual information security awareness training for all employees. During a recent audit, it was found that 20% of employees had not completed the training. What is the BEST course of action for the IT governance committee?

A.Reduce the training frequency to biennial.
B.Require managers to ensure their teams complete training and escalate non-compliance to HR.
C.Extend the training deadline by three months.
D.Make the training optional for employees with high performance ratings.
AnswerB

Manager accountability and HR escalation enforce policy.

Why this answer

Enforcing compliance through HR and management reinforces the policy. Option A is wrong because reducing training frequency weakens security. Option C is wrong because extending the deadline does not address non-compliance.

Option D is wrong because training is a mandatory policy, not optional.

Full explanation →
488
MCQmedium

An IT auditor is reviewing the problem management process. The IT team maintains a repository of known errors with documented workarounds. Which component of problem management is this?

A.Service request
B.Root cause analysis
C.Known error database
D.Problem record
AnswerC

Correct: The known error database stores known errors and workarounds, aiding in faster incident resolution.

Why this answer

A known error database (KEDB) is used to store known errors and workarounds to expedite incident resolution.

Full explanation →
489
Multi-Selecthard

Which THREE of the following are common challenges when implementing a bring-your-own-device (BYOD) policy that affect information systems operations? (Select exactly 3.)

Select 3 answers
A.Difficulty in enforcing data encryption and remote wipe capabilities
B.Reduced hardware procurement costs for the organization
C.Increased employee productivity due to device familiarity
D.Incompatibility between corporate applications and various device platforms
E.Increased risk of malware infections due to unmanaged devices
AnswersA, D, E

Ensuring data security on personal devices is challenging.

Why this answer

Options A, D, and E are correct. BYOD introduces security risks such as difficulty enforcing data encryption and remote wipe (A), incompatibility between corporate apps and various platforms (D), and increased risk of malware from unmanaged devices (E). Option B is an advantage, not a challenge.

Option C is a potential benefit, not a common challenge.

Full explanation →
490
Multi-Selectmedium

Which TWO of the following are essential controls to ensure data integrity during a cloud migration project?

Select 2 answers
A.Granting all migration team members full database access
B.Implementing encryption at rest and in transit
C.Using a phased migration approach without rollback capability
D.Running reconciliation checks comparing source and target data counts
E.Performing a single full data validation after migration
AnswersB, D

Encryption ensures data confidentiality and integrity during transfer and storage.

Why this answer

Encryption at rest and in transit (Option B) is essential for maintaining data integrity during cloud migration because it prevents unauthorized modification or corruption of data while stored in the source or target systems and while being transferred over networks. Without encryption, data is vulnerable to tampering, which directly undermines integrity. This control aligns with the principle of protecting data throughout its lifecycle, a key requirement in cloud migration projects.

Exam trap

The trap here is that candidates often confuse encryption with confidentiality and overlook its role in integrity, or they assume that a single post-migration validation (Option E) is sufficient, ignoring the need for ongoing reconciliation checks (Option D) to detect incremental data loss or corruption during the transfer process.

Full explanation →
491
Multi-Selecteasy

Which of the following are effective controls to protect sensitive data in use? (Choose TWO.)

Select 2 answers
A.Transport Layer Security (TLS)
B.Access control lists (ACLs)
C.Homomorphic encryption
D.Data masking
E.Hashing
AnswersC, D

Homomorphic encryption allows computations on ciphertext without decrypting.

Why this answer

Homomorphic encryption allows computations to be performed directly on encrypted data without decrypting it first, thereby protecting the data while it is in use. This is a critical control for scenarios where sensitive data must be processed by untrusted environments, as the plaintext is never exposed during processing.

Exam trap

The trap here is that candidates often confuse controls for data in transit (TLS) or data at rest (ACLs, hashing) with controls for data in use, failing to recognize that homomorphic encryption and dynamic data masking are specifically designed to protect data during active processing.

Full explanation →
492
MCQmedium

A company outsources its data center operations to a third-party provider. Which of the following is the MOST important control to include in the outsourcing contract?

A.Detailed escalation procedures for incidents
B.Service level agreements with financial penalties
C.Requirements for encryption of data at rest
D.Right to audit the provider's facilities and processes
AnswerD

Audit rights enable independent verification of controls.

Why this answer

The right to audit allows the company to verify the provider's compliance. Option A is important but less critical than audit rights. Option B is operational.

Option C is a security control but not the most important contractual safeguard.

Full explanation →
493
Multi-Selecthard

An organization is planning to implement a data loss prevention (DLP) solution to protect sensitive data. Which THREE of the following are essential steps to ensure the effectiveness of the DLP program?

Select 3 answers
A.Encrypting all data at rest and in transit
B.Classifying data based on sensitivity
C.Monitoring and tuning DLP rules regularly
D.Training all employees on data handling procedures
E.Defining DLP policies and rules
AnswersB, C, E

Data classification is prerequisite for DLP rules.

Why this answer

Classifying data based on sensitivity (B) is foundational to know what to protect. Defining DLP policies and rules (E) dictates the rules to enforce. Monitoring and tuning DLP rules regularly (C) ensures policies remain effective.

Encrypting all data at rest and in transit (A) is not always feasible or appropriate and is not an essential step. Training all employees on data handling procedures (D) is important but not an essential step for the effectiveness of the DLP program.

Full explanation →
494
Multi-Selecteasy

Which THREE of the following are commonly used data encryption standards? (Choose three.)

Select 3 answers
A.3DES
B.SHA-256
C.RSA
D.AES
E.MD5
AnswersA, C, D

Triple DES, symmetric encryption.

Why this answer

3DES (Triple Data Encryption Standard) is a symmetric-key block cipher that applies the DES algorithm three times to each data block, effectively increasing the key length to 168 bits. It was widely adopted as a secure replacement for single DES, though it is now considered legacy due to performance and security limitations.

Exam trap

The trap here is confusing cryptographic hash functions (SHA-256, MD5) with encryption standards, leading candidates to select them as methods for protecting data confidentiality rather than integrity.

Full explanation →
495
MCQmedium

An IS auditor is reviewing logical access controls for a critical application. Which of the following is the MOST important control to detect unauthorized access?

A.Strong password policy
B.Audit logging of access attempts
C.Monthly access recertification
D.Role-based access control (RBAC)
AnswerB

Logs provide a record that can be reviewed to identify unauthorized access.

Why this answer

Audit logs of successful and failed access attempts provide the evidence needed to detect unauthorized access. Other controls prevent or limit access but do not detect it after the fact.

Full explanation →
496
Multi-Selecthard

An IS auditor is reviewing change management for a financial application. Which TWO of the following findings would most likely indicate a control weakness?

Select 2 answers
A.Regression testing is not performed for minor changes.
B.Emergency changes are authorized by the change manager only.
C.Normal changes are tested in a development environment before production.
D.The change advisory board meets weekly to review all changes.
E.All changes are documented in a change log.
AnswersA, B

Even minor changes can have unintended impacts; regression testing should be considered.

Why this answer

Regression testing ensures that code changes do not introduce new defects into existing functionality. Skipping regression testing for minor changes is a control weakness because even small modifications can have unintended side effects in a financial application where accuracy and reliability are critical. Without regression testing, the organization risks undetected errors that could lead to financial misstatements or system instability.

Exam trap

The trap here is that candidates may incorrectly consider emergency changes authorized only by the change manager as acceptable, but it is a control weakness because it bypasses proper segregation of duties and approval hierarchy. Even emergency changes should require authorization from a higher authority or be subject to post-implementation review.

Full explanation →
497
MCQhard

A multinational corporation's IT audit reveals that the IT department uses a single instance of an ERP system for all subsidiaries. Which COBIT 2019 governance system component is MOST relevant to address the risks of this centralized approach?

A.Policies
B.Principles
C.Culture, Ethics, and Behavior
D.Organizational Structures
AnswerA

Policies provide the necessary guidance for managing risks of centralized systems.

Why this answer

COBIT 2019 emphasizes policies as a governance component to define rules for consistency and control across the organization.

Full explanation →
498
Multi-Selectmedium

An IS auditor is reviewing an agile software development project. Which TWO controls should the auditor expect to see in place?

Select 2 answers
A.Formal phase-gate approvals between design and development
B.Detailed requirements documentation approved before coding
C.Pair programming for all critical code
D.Sprint retrospective meetings
E.Sprint reviews with stakeholder participation
AnswersD, E

Sprint retrospectives are a key agile practice for continuous improvement and control.

Why this answer

In agile projects, sprint retrospectives help identify improvements, and sprint reviews demonstrate working functionality to stakeholders, serving as a control point. Pair programming is a development practice but not a universal agile control. Detailed requirements documentation and formal phase-gate approvals are characteristic of waterfall, not agile.

Full explanation →
499
MCQeasy

Which of the following is the most important factor to consider when determining sample size for a compliance test?

A.Tolerable error rate
B.Expected error rate
C.Population size
D.Sampling method
AnswerA

Tolerable error rate is the primary driver; lower rates require larger samples.

Why this answer

In compliance testing (attribute sampling), the tolerable error rate is the maximum deviation rate from a control that the auditor is willing to accept without concluding the control is ineffective. It directly determines the required sample size because a lower tolerable error rate demands a larger sample to achieve sufficient precision, while a higher rate allows a smaller sample. This factor is more critical than others because it sets the boundary for the auditor's risk assessment.

Exam trap

The trap here is that candidates often confuse 'expected error rate' (a planning estimate) with 'tolerable error rate' (the maximum acceptable deviation), mistakenly thinking the expected rate is more important because it seems to reflect reality, but the tolerable rate is the key risk-based parameter that governs sample size.

How to eliminate wrong answers

Option B (Expected error rate) is wrong because it is an estimate of the actual deviation rate in the population, used to plan sample size but not the most important factor; it influences efficiency, not the fundamental precision requirement. Option C (Population size) is wrong because for large populations (typically >500), population size has a negligible effect on sample size in attribute sampling, as the sample size formula is driven by confidence level and tolerable error rate, not population size. Option D (Sampling method) is wrong because the method (e.g., random, systematic, or stratified) affects how the sample is selected and its representativeness, but does not determine the sample size; sample size is computed independently of the selection technique.

Full explanation →
500
MCQmedium

An organization is implementing a data classification policy and needs to assign ownership for sensitive data. Which of the following is the most appropriate role to assign as the data owner?

A.The chief information security officer (CISO)
B.The system administrator of the database
C.The head of the business unit that creates and uses the data
D.The legal counsel responsible for compliance
AnswerC

The business unit head is accountable for the data's classification and protection.

Why this answer

The data owner is the person or entity with ultimate accountability for a specific dataset, typically a senior business manager who understands the data's value, legal requirements, and usage context. In this scenario, the head of the business unit that creates and uses the data is best positioned to classify the data, authorize access, and ensure compliance with the data classification policy, as they have direct business responsibility for the data's lifecycle.

Exam trap

The trap here is confusing the data owner (business accountability) with the data custodian (technical implementation) or the data steward (compliance oversight), leading candidates to incorrectly select the CISO or system administrator.

How to eliminate wrong answers

Option A is wrong because the CISO is a security advisor and enforcer, not the business owner; they lack the business context to determine data classification and usage rules. Option B is wrong because the system administrator is a custodian who implements technical controls (e.g., access control lists, encryption) but does not have ownership authority or business accountability for the data. Option D is wrong because legal counsel provides compliance guidance but does not own the data operationally; ownership must reside with the business unit that creates and uses the data.

Full explanation →
501
MCQhard

A multinational corporation is replacing its legacy on-premises customer relationship management (CRM) system with a new cloud-based CRM solution. The project involves migrating data from the old system, customizing the new system to match business processes, and integrating with an existing enterprise resource planning (ERP) system. The project has a tight deadline of six months. During the planning phase, the project team decides to use a waterfall methodology because the requirements are well-defined. However, three months into the project, the business users request significant changes to the customer data fields, which were not originally specified. The project manager is concerned that accommodating these changes will delay the project. The integration with the ERP system is also proving more complex than anticipated, with data mapping errors causing delays. The go-live date is fixed due to the end-of-support for the legacy system. What is the BEST course of action for the project manager?

A.Conduct a formal change impact assessment and prioritize the changes; implement only critical ones for go-live
B.Inform the business users that no changes can be made due to the fixed deadline
C.Delay the go-live date to accommodate all changes and integration issues
D.Switch to an agile methodology for the remaining three months
AnswerA

Balances changes with schedule.

Why this answer

It follows the structured change management process required in a waterfall project with a fixed deadline. By conducting a formal change impact assessment, the project manager can objectively evaluate the cost, schedule, and resource implications of the requested changes. Prioritizing only critical changes for go-live ensures that the core CRM functionality is delivered on time, while non-critical enhancements can be deferred to a post-implementation phase.

This approach balances the need to meet the legacy system's end-of-support deadline with accommodating essential business requirements.

Exam trap

The trap here is that candidates may assume that switching to agile (Option D) is a flexible solution, but they overlook the fact that mid-project methodology changes are disruptive and rarely feasible within a fixed deadline, especially when the project has already invested heavily in waterfall artifacts and integration work.

How to eliminate wrong answers

Option B is wrong because it is an inflexible response that ignores the business value of the requested changes; outright rejection can lead to user dissatisfaction and a system that fails to meet critical business needs. Option C is wrong because delaying the go-live date is not feasible given the fixed deadline imposed by the legacy system's end-of-support, and it would likely cause significant operational risk. Option D is wrong because switching to an agile methodology mid-project is impractical; the project is already three months into a waterfall lifecycle with well-defined requirements, and a methodology shift would require retraining, rework, and disrupt the current integration and data migration work, likely causing further delays.

Full explanation →
502
MCQeasy

A company is in the process of acquiring a new customer relationship management (CRM) system. During which phase of the systems development life cycle (SDLC) should the business requirements be formally documented?

A.Implementation phase
B.Requirements phase (Planning)
C.Design phase
D.Maintenance phase
AnswerB

This phase involves gathering and documenting business requirements.

Why this answer

The business requirements for a new CRM system must be formally documented during the Requirements phase (Planning) of the SDLC. This phase establishes the functional and non-functional needs that the system must satisfy, serving as the foundation for all subsequent design, development, and testing activities. Without a formal requirements document, the project risks scope creep, misalignment with business objectives, and costly rework during later phases.

Exam trap

The trap here is that candidates often confuse the Requirements phase with the Design phase, mistakenly thinking that requirements are documented during design, but in reality, design assumes requirements are already formally approved and focuses on how to implement them, not what to implement.

How to eliminate wrong answers

Option A is wrong because the Implementation phase focuses on deploying the system into production, including installation, configuration, and user training; documenting business requirements at this stage would be too late, as the system has already been built based on earlier decisions. Option C is wrong because the Design phase translates documented requirements into technical specifications (e.g., data models, interface designs); it assumes requirements are already finalized and formalized. Option D is wrong because the Maintenance phase involves post-deployment support, patches, and enhancements; formal business requirements for the initial system must be captured long before this phase to avoid reactive changes that increase cost and risk.

Full explanation →
503
MCQmedium

An organization uses risk-based authentication (RBA) for user access. Which of the following factors would MOST likely trigger a step-up authentication?

A.User logging in from a known device.
B.User accessing sensitive data from an unusual location.
C.User entering correct password.
D.User logging in during business hours.
AnswerB

Unusual location indicates higher risk and may trigger step-up.

Why this answer

Risk-based authentication (RBA) evaluates the risk level of each access attempt based on contextual factors. An unusual location is a high-risk indicator because it deviates from the user's established behavioral baseline, often triggering step-up authentication (e.g., requiring a one-time passcode or biometric verification) to verify the user's identity before granting access to sensitive data.

Exam trap

The trap here is that candidates may confuse 'step-up authentication' with 'multi-factor authentication' and assume any deviation from normal triggers it, but only high-risk anomalies (like unusual location or impossible travel) typically do, while low-risk factors like known devices or business hours do not.

How to eliminate wrong answers

Option A is wrong because logging in from a known device is a low-risk factor that typically reduces the authentication burden, not triggers step-up. Option C is wrong because entering a correct password is the baseline authentication requirement and does not itself indicate elevated risk; step-up is triggered by anomalous context, not by successful password entry. Option D is wrong because logging in during business hours is a normal, expected behavior that aligns with low-risk profiles and would not prompt additional verification.

Full explanation →
504
MCQmedium

An IS auditor is evaluating the effectiveness of a security awareness program. Which of the following metrics would BEST indicate that the program is achieving its objectives?

A.Scores on post-training quizzes
B.Reduction in the number of successful phishing attacks
C.Percentage of employees who completed the annual training
D.Number of security incidents reported by employees
AnswerB

This directly measures behavior change and the effectiveness of training.

Why this answer

A reduction in the number of successful phishing attacks over time demonstrates that employees are better at recognizing and reporting phishing attempts, indicating improved security awareness.

Full explanation →
505
MCQmedium

An organization's IT policy review cycle is set to every two years. However, a new regulation requires immediate changes to data retention policies. What is the best course of action?

A.Reduce the review cycle to annually
B.Update the policy immediately through an exception process
C.Wait until the next scheduled review to make changes
D.Ignore the regulation until the review
AnswerB

An exception process allows for urgent changes outside the normal cycle.

Why this answer

Policy review cycles should be flexible to accommodate urgent regulatory changes; an immediate update is necessary.

Full explanation →
506
MCQmedium

An IS auditor is auditing the user access management process for a large healthcare organization that uses an electronic health records (EHR) system. The organization has 5,000 users including doctors, nurses, and administrative staff. The auditor reviews a sample of access requests and finds that 20% of the requests were approved by the user's manager but the approval was not documented in the system. The auditor also finds that there is no periodic review of user access rights. The IT security manager states that users are automatically provisioned based on their role in the HR system, and that access reviews are performed manually by managers but not documented. What is the auditor's BEST recommendation to address the most significant risk?

A.Implement an automated access recertification process with quarterly reviews.
B.Disable automatic provisioning and require manual approval for all access.
C.Require that all access approvals be documented and stored in the system.
D.Perform a risk assessment to determine appropriate access controls.
AnswerA

Automated recertification ensures regular review and removal of unnecessary access.

Why this answer

The most significant risk is the lack of periodic review of user access rights, which can lead to excessive or inappropriate access (e.g., a former nurse retaining EHR access). Automating access recertification with quarterly reviews directly addresses this by enforcing a regular, documented validation of user entitlements against their current roles, reducing the risk of unauthorized access to protected health information (PHI) under HIPAA. While the undocumented approvals are a control weakness, the absence of any review cycle is a systemic failure that automated recertification resolves.

Exam trap

The trap here is that candidates focus on the documented approval finding (20% undocumented) and choose Option C, missing that the lack of any periodic review is a far more systemic risk that automated recertification directly mitigates.

How to eliminate wrong answers

Option B is wrong because disabling automatic provisioning and requiring manual approval for all access would introduce operational inefficiency and delay for 5,000 users, and it does not address the root cause—the lack of periodic review of existing access rights. Option C is wrong because requiring documentation of approvals only fixes the symptom (undocumented approvals) but ignores the more critical risk that no one is periodically verifying whether current access is still appropriate. Option D is wrong because performing a risk assessment is a preliminary step, not a direct remediation; the auditor already identified the risk (no periodic reviews), so the best recommendation is to implement a control (automated recertification) rather than re-assess.

Full explanation →
507
Multi-Selectmedium

Which TWO of the following are key responsibilities of an IT steering committee?

Select 2 answers
A.Approving the annual IT budget and major capital expenditures
B.Performing daily system monitoring and incident response
C.Defining IT policies and standards
D.Writing application code for new software features
E.Configuring firewall rules and network access controls
AnswersA, C

The steering committee typically approves the IT budget and major expenditures to ensure alignment with business strategy.

Why this answer

The IT steering committee is a senior-level governance body responsible for aligning IT strategy with business objectives. Approving the annual IT budget and major capital expenditures (A) is a core fiduciary duty, ensuring resources are allocated to approved projects and initiatives. Defining IT policies and standards (C) establishes the governance framework for security, compliance, and operational consistency across the enterprise.

Exam trap

The trap here is confusing strategic governance roles (steering committee) with operational or technical roles (system administrators, developers, or network engineers), leading candidates to select hands-on tasks like monitoring, coding, or firewall configuration.

Full explanation →
508
MCQmedium

A project team is using a prototyping approach for a new system. Which of the following is the BEST control to ensure the prototype accurately reflects user needs?

A.Conduct a post-implementation review.
B.Involve users in each iteration and obtain formal sign-off.
C.Require the project sponsor to approve the final design.
D.Perform regression testing after each prototype iteration.
AnswerB

User involvement and sign-off ensures prototype aligns with requirements.

Why this answer

In prototyping, iterative user involvement with formal sign-off at each iteration ensures that evolving requirements are captured and validated continuously. This control directly verifies that each prototype increment aligns with user needs before proceeding, reducing the risk of building a system that fails to meet expectations.

Exam trap

The trap here is that candidates may confuse regression testing (option D) with validation of user needs, but regression testing only ensures existing features still work, not that the prototype matches user expectations.

How to eliminate wrong answers

Option A is wrong because a post-implementation review occurs after the system is deployed, which is too late to influence the prototype's accuracy during development. Option C is wrong because project sponsor approval of the final design does not provide iterative validation; it bypasses user feedback loops and may overlook detailed user requirements. Option D is wrong because regression testing focuses on detecting defects in existing functionality after changes, not on verifying that the prototype reflects user needs.

Full explanation →
509
MCQhard

Which of the following best describes the primary advantage of using statistical sampling over non-statistical sampling in an IS audit?

A.It is more effective for detecting fraud than non-statistical sampling.
B.It ensures that all items in the population are tested.
C.It provides a basis for quantifying sampling risk and projecting results to the population.
D.It requires less auditor judgment and is easier to apply.
AnswerC

Statistical sampling allows the auditor to measure and control sampling risk and make statistical inferences.

Why this answer

Statistical sampling allows the auditor to quantify sampling risk and project results to the population with a measurable confidence level, unlike non-statistical sampling.

Full explanation →
510
MCQhard

During a disaster recovery test, the IS auditor observes that the alternate site uses a warm site configuration. Which of the following is a characteristic of a warm site?

A.It is a mobile recovery unit
B.It has infrastructure but no processing equipment
C.It has equipment but requires data restoration
D.It is a fully operational duplicate of the primary site
AnswerC

Correct. A warm site has equipment but needs data and application restoration.

Why this answer

A warm site has partially configured infrastructure (e.g., servers, network) but requires additional setup, such as loading data and applications, before full operation.

Full explanation →
511
MCQeasy

When implementing a data classification policy, which of the following roles is PRIMARILY responsible for assigning classification labels to data?

A.Data custodian.
B.Data owner.
C.Data user.
D.Data steward.
AnswerB

Data owner has authority and responsibility for classification.

Why this answer

The data owner is the senior manager or business process owner who has the authority to determine the sensitivity and criticality of the data. They are primarily responsible for assigning classification labels because they understand the business impact if the data is compromised. This role defines the classification level (e.g., Public, Internal, Confidential, Restricted) based on the data's value and legal or regulatory requirements.

Exam trap

ISACA often tests the distinction between data owner (who assigns classification) and data custodian (who implements controls), leading candidates to mistakenly choose the custodian because they confuse technical implementation with business ownership.

How to eliminate wrong answers

Option A is wrong because the data custodian (e.g., database administrator or system administrator) is responsible for implementing technical controls (access controls, encryption, backups) based on the classification assigned by the owner, not for assigning the labels themselves. Option C is wrong because the data user is an end-user who accesses data according to the policies and permissions set by the owner; they have no authority to assign classification labels. Option D is wrong because the data steward focuses on data quality, metadata management, and governance processes (e.g., data dictionary maintenance, data lineage) but does not have the business authority to determine the sensitivity or assign the classification label.

Full explanation →
512
MCQmedium

During a software asset management (SAM) audit, the IS auditor discovers that the organization is using software versions that are no longer supported by the vendor. What is the primary risk?

A.Exposure to security vulnerabilities without patches.
B.Inability to recover data from backups.
C.Increased licensing costs due to non-compliance.
D.Difficulty in migrating to new versions.
AnswerA

End-of-life software no longer receives security updates.

Why this answer

The primary risk of using unsupported software versions is the absence of vendor-provided security patches. Without these patches, known vulnerabilities remain unaddressed, exposing the organization to exploitation, data breaches, and system compromise. This directly impacts the confidentiality, integrity, and availability of information assets.

Exam trap

The trap here is that candidates may focus on operational inconveniences like migration difficulty or licensing costs, overlooking the fact that the most critical and immediate risk from unsupported software is the lack of security patches, which directly enables exploitation.

How to eliminate wrong answers

Option B is wrong because data recovery from backups depends on backup integrity and restoration procedures, not on vendor support status; unsupported software can still be backed up and restored. Option C is wrong because unsupported software typically has no licensing costs (support contracts end), and non-compliance usually involves over-licensing or unlicensed use, not the use of unsupported versions. Option D is wrong while migration difficulty is a potential operational challenge, it is not the primary risk; the immediate and most severe risk is the security exposure from unpatched vulnerabilities.

Full explanation →
513
Multi-Selecthard

An IS auditor is reviewing the system development life cycle (SDLC) for a custom application. The project manager has decided to skip the design phase and proceed directly from requirements to coding. Which of the following risks are MOST likely to increase as a result? (Choose two.)

Select 2 answers
A.Delays in project schedule.
B.Increased cost due to rework.
C.Increased number of defects during unit testing.
D.Inadequate security controls.
E.The system may not meet user requirements.
AnswersD, E

Security controls are often defined in the design phase.

Why this answer

Skipping the design phase means that security requirements are never formally defined or integrated into the system architecture. Without a security design, controls such as authentication, authorization, encryption, and input validation are likely to be omitted or implemented ad hoc, leading to inadequate security controls. This directly increases the risk of vulnerabilities that could be exploited in production.

Exam trap

The trap here is that candidates focus on project management risks (schedule, cost, defects) rather than the specific security and requirements risks that are most directly amplified when the design phase is omitted, as the design phase is where both functional and non-functional requirements (including security) are translated into a technical blueprint.

Full explanation →
514
MCQmedium

An organization is planning to deploy a web application firewall (WAF) to protect a critical application. Which deployment mode should be used to ensure that the WAF can block malicious traffic without introducing a single point of failure?

A.Inline with high-availability clustering.
B.Out-of-band monitoring only.
C.Transparent inline without failover.
D.Reverse proxy with active-passive clustering.
AnswerA

Provides blocking and redundancy.

Why this answer

Inline with high-availability clustering ensures the WAF can actively inspect and block malicious traffic in real time while eliminating a single point of failure through automatic failover between clustered appliances. This mode maintains traffic flow even if one WAF node fails, meeting both security and availability requirements.

Exam trap

The trap here is that candidates confuse 'high-availability clustering' with 'active-passive clustering,' assuming both eliminate single points of failure equally, but active-passive still has a failover delay and potential traffic loss.

How to eliminate wrong answers

Option B is wrong because out-of-band monitoring only allows the WAF to observe traffic and generate alerts without the ability to block malicious requests, failing the requirement to block traffic. Option C is wrong because transparent inline without failover introduces a single point of failure; if the WAF fails, traffic is dropped or bypassed, disrupting availability. Option D is wrong because reverse proxy with active-passive clustering still has a single point of failure if the active node fails and failover is not instantaneous or automatic, and it does not guarantee high availability as effectively as active-active clustering.

Full explanation →
515
MCQmedium

During a system development project, the IS auditor notes that code reviews are performed only after the code is unit tested. Which of the following is the MOST significant risk associated with this practice?

A.Code reviews may be less effective because developers are reluctant to critique tested code
B.Defects may be discovered later in the development lifecycle, increasing rework costs
C.Unit tests may mask code quality issues
D.The code review process may overlook security vulnerabilities
AnswerB

Detecting defects later is more expensive and time-consuming.

Why this answer

Code reviews should be performed before unit testing to catch defects early. Delaying reviews until after testing may lead to rework if issues are found, increasing costs and time.

Full explanation →
516
MCQhard

An IS auditor is assessing the risk of material misstatement in a financial system. The auditor determines that inherent risk is high, control risk is moderate, and detection risk is low. What is the overall audit risk?

A.Low
B.Moderate
C.High
D.Cannot be determined
AnswerA

Correct. Low audit risk results from the combination of high inherent risk, moderate control risk, and low detection risk.

Why this answer

Audit risk is determined by inherent risk, control risk, and detection risk. The standard audit risk model is: Audit Risk = Inherent Risk × Control Risk × Detection Risk. With inherent risk high, control risk moderate, and detection risk low, the product is low (e.g., High × Moderate × Low = Low).

This indicates a low overall audit risk because the auditor plans to perform sufficient substantive procedures to compensate for the high inherent and moderate control risks.

Full explanation →
517
MCQhard

An IS auditor is reviewing the password policy for a system that processes sensitive financial data. Which of the following is the MOST effective control to mitigate the risk of password cracking?

A.Implement account lockout after 5 failed attempts
B.Require passwords of at least 12 characters with complexity
C.Maintain a password history to prevent reuse
D.Enforce two-factor authentication for all users
AnswerA

Lockout stops brute-force attacks by limiting the number of attempts.

Why this answer

Account lockout after a few failed attempts is the most effective control to prevent brute-force password cracking. Complexity and length help but do not prevent automated attacks; 2FA is strong but not specifically for cracking; password history prevents reuse but not cracking.

Full explanation →
518
MCQeasy

In a traditional waterfall SDLC, when should the test plan be developed?

A.During the implementation phase
B.During the coding phase
C.During the requirements phase
D.During the design phase
AnswerD

Allows integration with design.

Why this answer

In a traditional waterfall SDLC, the test plan should be developed during the design phase because testing activities must be planned in parallel with system design to ensure that test cases, test data, and acceptance criteria are aligned with the design specifications. This allows for early identification of testability issues and ensures that the test plan is ready before coding begins, enabling a structured and efficient testing process.

Exam trap

The trap here is that candidates often confuse the timing of test plan development with the start of actual testing, mistakenly thinking the test plan can be deferred to the implementation or coding phase, but CISA emphasizes that test planning must begin during design to align with the V-model and ensure testability is built into the system.

How to eliminate wrong answers

Option A is wrong because the implementation phase is when the system is actually built or coded, and developing the test plan at this late stage would delay testing and miss the opportunity to design tests in alignment with the design specifications. Option B is wrong because the coding phase focuses on writing the actual program code, and creating the test plan here would be reactive rather than proactive, increasing the risk of incomplete test coverage and rework. Option C is wrong because the requirements phase is too early for detailed test planning; while high-level test objectives may be identified, the specific test cases, test data, and test environment requirements cannot be finalized until the design is complete.

Full explanation →
519
MCQeasy

During an incident response, the IT team isolates a compromised system from the network. Which of the following is the primary purpose of this action?

A.To preserve evidence for forensic analysis.
B.To allow the system to be patched offline.
C.To comply with regulatory requirements.
D.To prevent further damage and contain the incident.
AnswerD

Correct. Isolation contains the threat and reduces impact.

Why this answer

Isolating a compromised system from the network (e.g., by disconnecting the Ethernet cable, disabling the switch port, or applying a host-based firewall rule to drop all traffic) immediately stops the system from communicating with other hosts. This containment action prevents the attacker from moving laterally, exfiltrating data, or deploying additional malware, thereby limiting the blast radius and stopping ongoing damage.

Exam trap

The trap here is that candidates confuse 'preserving evidence' (a forensic goal) with 'containing the incident' (the immediate operational goal), leading them to choose Option A even though isolation is primarily about stopping the attack, not about evidence handling.

How to eliminate wrong answers

Option A is wrong because isolation is a containment step, not a preservation step; while it can help preserve volatile evidence by preventing remote tampering, the primary purpose is containment, and forensic preservation requires specific steps like creating a bit-for-bit image before any changes. Option B is wrong because patching offline is a remediation activity that occurs after containment; the immediate goal is to stop the attack, not to prepare the system for patching. Option C is wrong because compliance requirements may mandate containment, but the primary operational purpose is to prevent further damage, not to satisfy a regulation.

Full explanation →
520
MCQeasy

A nonprofit organization develops a small online donation platform using a third-party payment gateway. The project team skips formal security testing because of budget constraints. After launch, a security researcher discovers that the application fails to validate input on the donation amount field, allowing manipulation. The nonprofit loses several thousand dollars before the issue is patched. The IS auditor is asked to review the system development process. Which of the following is the PRIMARY finding?

A.The donation amount field was not validated.
B.The organization lost money due to the exploit.
C.Security testing was not performed during development.
D.The payment gateway was not properly integrated.
AnswerC

Testing would have identified the input validation issue.

Why this answer

The primary finding for an IS auditor reviewing the system development process is the absence of security testing during development. Skipping formal security testing (e.g., static application security testing, dynamic application security testing, or penetration testing) violates the secure development lifecycle (SDLC) best practices and directly led to the input validation vulnerability. The IS auditor's focus is on process deficiencies, not the specific exploit or financial loss.

Exam trap

The trap here is that candidates focus on the immediate technical flaw (unvalidated input) or the financial loss, rather than recognizing that the IS auditor's role is to identify the systemic process failure (lack of security testing) that allowed the vulnerability to be introduced.

How to eliminate wrong answers

Option A is wrong because the unvalidated donation amount field is a symptom (a technical vulnerability), not the root cause in the development process; the IS auditor's primary finding should address the process gap that allowed the vulnerability to exist. Option B is wrong because the financial loss is an impact or consequence, not a process finding; the IS auditor evaluates controls and processes, not the monetary outcome. Option D is wrong because the payment gateway integration may be functional; the issue is the lack of input validation on the application side, not a misconfiguration or improper integration of the third-party gateway (e.g., incorrect API endpoint or missing signature verification).

Full explanation →
521
MCQeasy

An IS auditor reviews the exhibit. Which of the following is the most likely cause of the denied traffic?

A.Misconfigured VPN tunnel
B.Intrusion prevention system blocking
C.Missing firewall rule allowing RDP traffic
D.Incorrect NAT configuration
AnswerC

The deny log specifically references the access-group, implying a rule is missing.

Why this answer

The exhibit shows RDP traffic (TCP/3389) being denied at the firewall. Since the traffic reaches the firewall but is blocked, the most likely cause is a missing firewall rule that explicitly permits RDP traffic. A misconfigured VPN tunnel would typically prevent traffic from reaching the firewall at all, while an IPS block would generate an alert and often target specific signatures, not a blanket deny.

Incorrect NAT would affect address translation but not cause a deny action at the firewall.

Exam trap

The trap here is that candidates may confuse a firewall deny with an IPS block or NAT failure, but the log entry's explicit 'denied' action and lack of IPS signature ID or NAT translation error point directly to a missing firewall rule.

How to eliminate wrong answers

Option A is wrong because a misconfigured VPN tunnel would prevent the traffic from reaching the firewall interface (e.g., tunnel not established, mismatched phase 2 parameters), resulting in no log entry at the firewall, not a deny action. Option B is wrong because an intrusion prevention system (IPS) block would be triggered by a specific attack signature (e.g., MS12-020 exploit) and would log an IPS alert, not a simple firewall deny rule; the exhibit shows a firewall deny, not an IPS block. Option D is wrong because an incorrect NAT configuration (e.g., missing or misapplied NAT rule) would cause traffic to be dropped or misrouted due to translation failure, but the firewall log shows a deny action, which is a policy-based block, not a NAT failure.

Full explanation →
522
MCQeasy

Which of the following is an example of a compliance audit?

A.Evaluating whether IT controls meet SOX requirements
B.Assessing the performance of a new system
C.Reviewing the efficiency of a production line
D.Analyzing financial statement ratios
AnswerA

SOX is a regulation; compliance audit checks adherence.

Why this answer

Compliance audits verify adherence to laws, regulations, and policies.

Full explanation →
523
Multi-Selecteasy

Which TWO of the following are HR controls that help mitigate the risk of insider fraud in IT? (Select TWO.)

Select 2 answers
A.Flexible work hours
B.Employee recognition programs
C.Annual performance reviews
D.Job rotation
E.Mandatory vacation
AnswersD, E

Reduces opportunity for long-term concealment.

Why this answer

Mandatory vacation and job rotation are detective and preventive controls against fraud.

Full explanation →
524
MCQmedium

An IS auditor is reviewing the change management process for a financial application. Which of the following findings would be of MOST concern?

A.Change requests are logged in a spreadsheet
B.Standard changes are pre-approved
C.Change windows are defined in the policy
D.Emergency changes are not reviewed within 30 days
AnswerD

Correct: Emergency changes require timely retroactive review to ensure proper authorization.

Why this answer

Emergency changes bypass normal controls; failure to review them within a reasonable time (e.g., 30 days) increases risk of undocumented changes. Logging in spreadsheet, pre-approved standard changes, and defined change windows are acceptable or even good practices.

Full explanation →
525
MCQhard

A company stores sensitive customer data in a database. To comply with privacy regulations, the data must be anonymized for analytics. Which technique provides the strongest anonymization while preserving data utility?

A.Differential privacy with calibrated noise.
B.Tokenization with a reversible mapping.
C.Removing direct identifiers like names and SSNs.
D.Data masking with static substitution.
AnswerA

Correct. Differential privacy provides mathematical guarantees against re-identification while allowing statistical queries.

Why this answer

Differential privacy with calibrated noise is the strongest anonymization technique because it provides a formal mathematical guarantee that the output of a query does not reveal whether any specific individual's data was included. By adding carefully calibrated noise to query results, it preserves statistical utility for analytics while ensuring that re-identification is provably infeasible, meeting strict privacy regulations like GDPR or CCPA.

Exam trap

The trap here is that candidates often confuse pseudonymization (e.g., tokenization) with anonymization, or assume that simply removing direct identifiers is sufficient, failing to recognize that re-identification via quasi-identifiers is a well-known attack vector in privacy regulations.

How to eliminate wrong answers

Option B is wrong because tokenization with a reversible mapping is not anonymization; it is pseudonymization, as the original data can be recovered via the mapping table, which does not meet the irreversible anonymization required by privacy regulations. Option C is wrong because removing direct identifiers like names and SSNs alone leaves quasi-identifiers (e.g., ZIP code, age, gender) that can be combined with external data to re-identify individuals through linkage attacks, providing weak anonymization. Option D is wrong because data masking with static substitution (e.g., replacing values with fixed characters) is a form of obfuscation that does not preserve data utility for analytics (e.g., masked values lose statistical properties) and can often be reversed if the masking pattern is known or inferred.

Full explanation →
Page 6

Page 7 of 14

Page 8

All pages

1234567891011121314

Practice CISA by domain

Target a specific domain to shore up weak areas.

Governance and Management of ITInformation Systems Operations and Business ResilienceInformation System Auditing ProcessInformation Systems Acquisition, Development, and ImplementationProtection of Information Assets
See all domains with question counts →