How many Hard Difficulty Questions questions are on this page?

This page has 20 Hard Difficulty Questions scenario questions for the CISA exam, each with detailed explanations and wrong-answer analysis.

How should I approach CISA scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Certified Information Systems Auditor CISA questions

Scenario-based practice

Hard Difficulty Questions

Practise Certified Information Systems Auditor CISA practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CISA

exam code

ISACA

vendor

Scenario guide

How to approach hard difficulty questions

These are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam.

Quick answer

Hard Difficulty Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

An IS auditor reviews the exhibit from a cloud access policy. Which of the following is a potential security concern?

Exhibit

Refer to the exhibit.
```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::confidential-data/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}
```

A
The policy does not require encryption in transit
Without requiring HTTPS (aws:SecureTransport), data can be transmitted in plaintext.
B
The policy grants access to all objects in the bucket
Why wrong: This is the intended effect; it does not inherently create a security issue.
C
The policy allows access from any IP in the 10.0.0.0/8 range
Why wrong: While broad, this is a CIDR that may be intended for internal use; not necessarily a security concern if properly managed.
D
The condition uses a private IP range which is not routable from the internet
Why wrong: This is a functional constraint, not a security concern; it restricts access to internal networks.

Hard Difficulty Questions

How to approach hard difficulty questions

Quick answer

Related CISA topic practice pages

Governance and Management of IT practice questions

Information Systems Operations and Business Resilience practice questions

Information System Auditing Process practice questions

Information Systems Acquisition, Development, and Implementation practice questions

Protection of Information Assets practice questions

CISA fundamentals practice questions

CISA scenario practice questions

CISA troubleshooting practice questions

Practice scenarios

An IS auditor reviews the exhibit from a cloud access policy. Which of the following is a potential security concern?

Exhibit

An organization has configured HSRP as shown. During a failover test, the primary router (G0/1) is shut down, but the DR site router does not become active. What is the MOST likely reason?

Exhibit

A multinational corporation has implemented a hot site disaster recovery solution for its critical financial applications. Which of the following is the MOST important consideration to ensure the effectiveness of the hot site?

Refer to the exhibit. During a penetration test, a security analyst captures this SAML response. Which of the following security weaknesses is most evident?

Exhibit

An organization's IT strategy is not aligned with business strategy due to lack of communication. Which of the following would BEST improve alignment?

An organization uses a risk-based audit approach. For a high-risk area, the auditor decides to perform 100% testing instead of sampling. Which of the following is a valid reason for this decision?

An IS auditor is evaluating the encryption strategy for a healthcare organization subject to HIPAA. Which of the following is the MOST significant risk if the organization relies solely on encryption as a safe harbor?

A company's endpoint protection solution alerts on a file that is digitally signed by a trusted software vendor but exhibits malicious behavior on execution. What type of threat does this scenario most likely depict?

An IS auditor is assessing the backup and recovery procedures for a critical database. Which TWO of the following are the MOST important controls to ensure recoverability?

Refer to the exhibit. An IS auditor is reviewing an IAM policy for a cloud data platform. The auditor notices that user jdoe has READ_ONLY access to all tables matching 'sales_', but asmith has READ_WRITE access to the same set of tables. Which of the following is the MOST critical control issue?

Exhibit

An organization is developing a critical application using an agile methodology. The project sponsor demands frequent deliveries but the development team is concerned about insufficient testing. Which of the following BEST mitigates this risk?

Which TWO of the following are primary objectives of a data loss prevention (DLP) strategy?

During an IT audit, the auditor observes that mandatory vacation policies are not enforced for IT staff with access to financial systems. What is the PRIMARY risk associated with this finding?

A multinational corporation is deploying a data loss prevention (DLP) solution across its network. The DLP system must be configured to prevent the exfiltration of personally identifiable information (PII) while minimizing false positives. Which approach is most effective?

An IT auditor is reviewing the business continuity plan (BCP) for a financial services firm. The plan includes a hot site that is shared with another organization under a reciprocal agreement. Which of the following findings should be of MOST concern to the auditor?

Which THREE of the following are essential components of a data classification program?