How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 13 Refer to the Exhibit Practice Questions scenario questions for the CISA exam, each with detailed explanations and wrong-answer analysis.

How should I approach CISA scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Certified Information Systems Auditor CISA questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Certified Information Systems Auditor CISA practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CISA

exam code

ISACA

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1easymultiple choice

Full question →

Refer to the exhibit. An IS auditor is reviewing backup error logs. The error indicates a failed backup due to a missing file. What is the MOST likely cause?

Exhibit

Refer to the exhibit.

```
Error Log Entry:
Timestamp: 2024-03-20 10:15:32
Source: BackupServer01
EventID: 213
Level: Error
Message: Backup job 'DailyBackup' failed. Source volume: \\FileServer\Shares, Destination: \\BackupServer01\Backup\Shares. Error code: 0x80070002 (The system cannot find the file specified.)
```

A
The backup job was scheduled during peak hours causing timeout
Why it fails: Timeout errors are different (e.g., 0x80070005).
B
The destination path '\\BackupServer01\Backup\Shares' is invalid
Why it fails: The destination path appears valid; the error is about a file not found.
C
A file in the source volume was moved or deleted during the backup window
A missing file error during backup typically means the source file was moved or deleted mid-window, so the backup agent could no longer read it. This differs from media failure, which reports write or read errors on the target, and from permission changes, which produce access-denied messages.
D
Insufficient disk space on the backup destination
Why it fails: Disk full errors have different codes (e.g., 0x80070070).

Full breakdown with real-world context →

Question 2easymultiple choice

Full question →

Based on the exhibit, what is the security risk of this bucket policy?

Network Topology

A
The bucket is publicly readable
Principal: * allows anonymous access.
B
The bucket allows public write access
Why it fails: Only GetObject is allowed.
C
The bucket policy restricts access to a specific IAM role
Why it fails: Principal is *, not a role.
D
The bucket policy is not encrypted
Why it fails: Encryption is not shown.

Full breakdown with real-world context →

Question 3hardmultiple choice

Full question →

Based on the exhibit, which control is most likely missing to prevent this type of event?

Exhibit

Refer to the exhibit.

syslog output:
Mar 15 10:23:45 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2
Mar 15 10:23:46 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2
Mar 15 10:23:47 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2
Mar 15 10:23:48 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2
Mar 15 10:23:49 server01 sshd[1234]: Failed password for root from 10.0.0.99 port 22 ssh2

A
Applying the latest security patches to the SSH service
Why it fails: Patch management addresses software vulnerabilities, not the unauthorised access shown in the exhibit. If the event stemmed from weak authentication, exposed credentials or misconfigured access, patching the SSH service would not prevent it. Patching is the correct control when the incident exploits a known unpatched vulnerability.
B
Implementing account lockout after three failed attempts
Account lockout after three failed attempts blocks continued password guessing against the same account, directly preventing the brute-force authentication event shown. This satisfies the control gap by throttling repeated failures rather than merely logging or alerting on them.
C
Disabling direct root login via SSH
Why it fails: Disabling direct root login via SSH does not address the exhibit's event, which occurs through a different access path or vulnerability than root SSH authentication. It is tempting because it is a genuine hardening step, and would be correct where the exhibit showed attackers authenticating as root over SSH.
D
Enforcing strong password complexity
Why it fails: Strong password complexity cannot stop the event shown, which stems from an unpatched or misconfigured service rather than weak credentials; complexity only resists brute-force and guessing attacks. It is tempting because password policies are a standard hardening control, and would be the right answer where the exhibit showed successful credential brute-forcing or password spraying.

Full breakdown with real-world context →

Question 4mediummultiple choice

Full question →

Based on the exhibit, what is the MOST likely security risk?

Exhibit

Refer to the exhibit.

```
access-list 101 permit tcp any host 192.168.1.100 eq 80
access-list 101 permit tcp any host 192.168.1.100 eq 443
access-list 101 deny ip any host 192.168.1.100
access-list 101 permit ip any any
```

A
The web server is fully protected
Why it fails: The final rule allows all traffic, so protection is bypassed.
B
Traffic to port 80 is not encrypted
Why it fails: Encryption is not addressed by ACL.
C
Unrestricted traffic is allowed after the specific deny
This option accurately highlights a common security misconfiguration in sequential rule processing, typical of firewalls or Access Control Lists. If an exhibit demonstrates a specific deny rule that is subsequently followed by a broader, less restrictive allow rule (e.g., an implicit or explicit 'allow any any'), any traffic not explicitly matched and denied by the preceding specific rule will be permitted. This circumvents the intended denial, creating a significant vulnerability by failing to enforce the principle of least privilege.
D
The host 192.168.1.100 is exposed to denial-of-service attacks
Why it fails: While possible, the immediate risk is the blanket permit rule.

Full breakdown with real-world context →

Question 5easymultiple choice

Full question →

Refer to the exhibit. An auditor finds that the file 'sensitive.txt' has world-writable permissions. Which of the following is the most appropriate remediation action?

Exhibit

-rw-rw-rw- 1 root root 1024 Jan 1 12:00 sensitive.txt

A
Remove world-writable permissions using chmod 644.
chmod 644 sets the file to rw-r--r--, removing world-writable and providing proper access.
B
Encrypt the file using GnuPG to protect its contents.
Why it fails: Encryption protects content but does not fix the permissions that allow others to read or modify the file.
C
Apply an ACL to restrict access only to specific users.
Why it fails: While ACLs can refine access, removing world-writable is the simplest and most direct fix.
D
Change the file owner to a different user using chown.
Why it fails: Changing ownership does not directly address the world-writable permission issue.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

A company's endpoint protection solution alerts on a file that is digitally signed by a trusted software vendor but exhibits malicious behavior on execution. What type of threat does this scenario most likely depict?

A
A Trojan horse disguised as legitimate software.
Why it fails: A valid vendor signature with malicious execution indicates the vendor's signing key or update channel was compromised, or the binary was trojanised — supply-chain compromise, not a Trojan posing as legitimate software. It is tempting because signed malware resembles a Trojan, but Trojans impersonate trusted software without genuine vendor signatures.
B
Signed malware, indicating the certificate may have been compromised.
A valid vendor certificate means the binary passes signature checks, so detection relies on behaviour rather than reputation; malicious code signed with a compromised or misused certificate is signed malware. This matches the stem's trusted-signature-but-malicious-execution scenario.
C
A zero-day exploit targeting an unpatched vulnerability.
Why it fails: A zero-day exploits an unpatched software vulnerability; here the file is validly signed and runs as intended, so no vulnerability is exploited. It is tempting because signed malware evades signature detection, but zero-day would be correct where an unknown flaw is exploited before a patch exists.
D
A fileless attack that never writes to disk.
Why it fails: The stem describes a validly signed executable that turns malicious at runtime, which is a signed-binary or trojanised-software threat. Fileless attacks execute in memory via scripting or LOLBins and typically leave no signed file on disk, so the trusted signature contradicts this. Fileless detection would be the answer if no file were written.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

Based on the exhibit, what should the IS auditor MOST likely recommend?

Exhibit

Refer to the exhibit.
```
Change Management Log Extract:
CR-2024-001: Approved | Implemented 01/15 14:00
CR-2024-002: Approved | Implemented 01/20 09:30
CR-2024-003: Emergency (post-approved) | Implemented 01/25 22:15
CR-2024-004: Approved | Implemented 02/01 11:00
CR-2024-005: Emergency (post-approved) | Implemented 02/10 23:45
CR-2024-006: Approved | Implemented 02/15 10:00
CR-2024-007: Emergency (post-approved) | Implemented 02/20 21:30
```

A
Investigate whether any changes are missing from the log
Why it fails: The exhibit already lists the changes, so investigating for missing entries addresses a completeness question the evidence does not raise. This is tempting because log completeness is a genuine audit concern, and it would be correct if the log's total count disagreed with the change-management system's records.
B
Immediately block all direct production access for developers
Why it fails: Blocking all developer production access is a disproportionate control that would halt legitimate support work, and the exhibit shows no unauthorised access. It is tempting because removing standing production privileges is a valid remediation when developers hold unnecessary persistent access, which the evidence here does not establish.
C
Require all changes to go through the standard approval process
Why it fails: Routing every change through standard approval ignores the exhibit's evidence that emergency changes were properly authorised retrospectively; the gap is logging completeness, not the approval path. Standard approval is the right recommendation when changes bypass authorisation entirely, which the exhibit does not show.
D
Review the criteria for emergency changes and enforce proper classification
Emergency changes bypass normal approval, so auditors should verify that classification criteria are defined and consistently applied. Reviewing those criteria and enforcing proper classification prevents unjustified use of the expedited path, directly addressing the control weakness the exhibit reveals.

Full breakdown with real-world context →

Question 8mediummultiple choice

Full question →

Based on the exhibit, what is the most likely control weakness that allowed this condition?

Exhibit

Refer to the exhibit.

Audit Finding Report Excerpt:

Finding ID: F-001
Control: User Account Management
Observation: Review of Active Directory logs from 01-Mar-2024 to 07-Mar-2024 revealed that the default administrator account (Administrator) was used to perform 45% of all privileged actions. No evidence of secondary approval or time-based restrictions.

Configuration snippet from domain controller:

Set-ADUser -Identity Administrator -PasswordNeverExpires $true
Set-ADUser -Identity Administrator -CannotChangePassword $true

Audit Recommendation: Implement a privileged access management (PAM) solution and enforce use of individual privileged accounts.

A
Weak password complexity requirements
Why it fails: Password complexity governs credential strength, not the account, access or configuration condition depicted in the exhibit. It is tempting because weak passwords commonly enable unauthorised access, and strengthening complexity policy would be the right remediation where the exhibit showed brute-force or credential-stuffing compromise.
B
Lack of individual accountability for privileged actions
Shared privileged accounts let multiple administrators act under one identity, so audit logs cannot attribute a specific change to a named person. This directly satisfies the stem's condition: the exhibit shows activity that cannot be traced to an individual, defeating non-repudiation and least-privilege monitoring over privileged actions.
C
Failure to disable the default administrator account
Why it fails: The exhibit shows a condition unrelated to a lingering default administrator account, so disabling that account would not address the observed weakness. It is tempting because default accounts are a classic exposure, and disabling them would be correct where the exhibit showed an unchanged default credential granting privileged access.
D
Inadequate segregation of duties between IT and security teams
Why it fails: Segregation of duties concerns conflicting responsibilities between roles, whereas the exhibit's condition stems from a specific account or configuration setting. It is tempting because poor role separation genuinely enables privileged misuse, and it would be correct where the exhibit showed one person both administering and auditing the same system.

Full breakdown with real-world context →

Question 9hardmultiple choice

Review the full subnetting walkthrough →

Refer to the exhibit. During a security audit, an IS analyst identifies that a critical business application hosted on 192.168.1.100:443 is unreachable from the 10.0.1.0/24 subnet. Which of the following is the MOST likely cause?

Exhibit

access-list extended BLOCK-MALICIOUS
deny ip 10.0.1.0 0.0.0.255 any
deny tcp any host 192.168.1.100 eq 443
permit ip 10.0.0.0 0.0.255.255 any

A
The first rule blocks all traffic from 10.0.1.0/24
Correct: The deny rule for the subnet overrides any permit.
B
The second rule blocks HTTPS traffic from any source to the host
Why it fails: Second rule blocks HTTPS from any source, but first rule already blocks all traffic from 10.0.1.0/24.
C
The third rule permits all traffic from the 10.0.0.0/16 subnet
Why it fails: The permit rule applies to a larger subnet, but the first rule is more specific and blocks the 10.0.1.0/24 range.
D
The firewall is misconfigured for TCP traffic
Why it fails: Configuration is explicit; no general misconfiguration.

Full breakdown with real-world context →

Question 10easymultiple choice

Full question →

Based on the exhibit, what is the MOST appropriate action for IT management?

Exhibit

Refer to the exhibit.
The following is an excerpt from an IT balanced scorecard:
Perspective: Customer
Objective: Improve user satisfaction
KPI: User satisfaction survey score
Target: >85%
Actual: 82%

A
Investigate the reasons for the shortfall and implement corrective actions.
A shortfall against the exhibit's planned targets signals a control or performance gap, so management must first establish root cause before committing resources. Investigating the reasons and implementing corrective actions satisfies the stem's demand for the most appropriate management response, closing the gap rather than merely reporting it.
B
Ignore the variance as it is within acceptable range.
Why it fails: A 20% shortfall against target is a material deviation requiring investigation, not dismissal. It is tempting because tolerances exist in some metrics, so any variance can be waved through. Ignoring variance would be correct only where the deviation falls inside a formally defined acceptable threshold.
C
Adjust the target to 80% to match actual performance.
Why it fails: Lowering the target to 80% merely conceals the shortfall instead of addressing the cause of the 20% gap. It is tempting because aligning the metric with observed output removes the variance from reports. Adjusting targets would be right only when the original target was demonstrably unrealistic, not when performance is deficient.
D
Replace the survey with a different measurement tool.
Why it fails: Swapping the measurement tool discards valid data without diagnosing why performance fell short of target. It is tempting because a different tool may produce figures that look acceptable. Replacing the tool would be correct only if the current instrument were proven inaccurate or unfit for purpose.

Full breakdown with real-world context →

Question 11mediummultiple choice

Full question →

Refer to the exhibit. An application log shows an error. What is the MOST likely cause of this error?

Exhibit

Refer to the exhibit.

```
ERROR 2019-11-15 14:23:45,123 [main] com.example.App - Error processing record ID 1045
java.sql.SQLIntegrityConstraintViolationException: ORA-00001: unique constraint (USERS.UK_USERNAME) violated
	at com.example.dao.UserDao.insert(UserDao.java:45)
	... 8 more
```

A
The database server is offline
Why it fails: A database server being offline would produce connection or timeout failures across every query, not the specific error recorded in the exhibit. It is tempting because connectivity loss is a common outage cause, and it would be the likely answer if the log showed refused connections or timeouts rather than a statement-level failure.
B
The user does not have insert privileges
Why it fails: Missing insert privileges would return a permission-denied error naming the object and user, which the exhibit does not show. It is tempting because authorisation faults are common in application logs, and it would be the likely cause if the message cited insufficient privileges or an access-denied code for the target table.
C
The data type of the username field is incorrect
Why it fails: An incorrect username field data type would surface as a schema or conversion error at the point of binding, not the error the exhibit records. It is tempting because type mismatches are a frequent coding defect, and it would be correct if the log named a datatype conversion or invalid-format exception on that column.
D
A duplicate username was inserted into the USERS table
A duplicate username violates the UNIQUE constraint on the USERS table, causing the insert to fail and the application to log the resulting database error. This directly satisfies the stem's constraint: the logged error stems from a rejected insert, not from authentication, connectivity or permission issues elsewhere.

Full breakdown with real-world context →

Question 12easymultiple choice

Full question →

An IS auditor reviews the exhibit. Which of the following is the most likely cause of the denied traffic?

Exhibit

Refer to the exhibit.
```
Feb 20 10:15:32 firewall %ASA-4-106023: Deny tcp src outside:10.0.0.1/3389 dst inside:192.168.1.100/3389 by access-group "outside_in" [0x0, 0x0]
```

A
Misconfigured VPN tunnel
Why it fails: A VPN tunnel encrypts traffic between remote peers; it does not filter or deny sessions traversing a firewall, so its misconfiguration would break connectivity rather than produce a logged deny. VPN faults are the likely cause when remote users cannot establish any connection at all.
B
Intrusion prevention system blocking
Why it fails: An IPS blocks traffic matching known attack signatures or anomaly thresholds, yet the exhibit shows a routine session denied by an explicit rule, with no alert or signature trigger recorded. IPS blocking is the correct diagnosis when logs show malicious payloads being dropped mid-session.
C
Missing firewall rule allowing RDP traffic
The exhibit shows the connection reaching the firewall but no matching permit entry, so the implicit deny rule drops the session. RDP requires an explicit inbound rule on port 3389; without it, traffic is denied. The missing firewall rule allowing RDP traffic is therefore the cause.
D
Incorrect NAT configuration
Why it fails: NAT rewrites source or destination addresses for translation, not policy decisions; an incorrect NAT rule would cause routing failure or unreachable addresses, not a rule-based deny entry. NAT misconfiguration fits scenarios where internal hosts cannot reach external services despite permissive firewall rules.

Full breakdown with real-world context →

Question 13hardmultiple choice

Full question →

Refer to the exhibit. This log entry MOST likely indicates:

Exhibit

Event 4648: A logon was attempted using explicit credentials.
Subject: Account Name: svc_backup
Target Account: KORP\administrator
Target Server: FILESRV01
Process Name: C:\Windows\System32\wbem\wmiprvse.exe

A
An attempt to escalate privileges or lateral movement
The log records authentication followed by privileged command execution against remote hosts, the signature pattern of privilege escalation and lateral movement. This satisfies the stem's constraint by matching the observed credential use and cross-host access rather than routine administrative activity.
B
A scheduled backup using the service account
Why it fails: A scheduled backup would show a cron or backup-agent process, not authentication events. The log entry records repeated logon attempts, which points to credential-based intrusion activity rather than routine data protection. Scheduled backup activity would be the right interpretation if the entry showed a backup service account executing a defined job.
C
A brute-force attack
Why it fails: Brute-force attacks typically show many failed authentications from one source against many accounts, or rapid repeated failures. A single successful logon followed by normal session activity does not match that pattern. Brute-force would be correct if the exhibit showed a high volume of failed logon attempts within a short window.
D
Normal administrative activity
Why it fails: Normal administrative activity would originate from a known admin account during business hours with expected commands. The entry shows authentication from an unexpected source or at an unusual time, indicating compromise rather than routine operations. This interpretation would be correct if the account, source and timing all matched established administrative baselines.

Full breakdown with real-world context →

These CISA practice questions are part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style CISA questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related CISA topic practice pages

Governance and Management of IT practice questions

Information Systems Operations and Business Resilience practice questions

Information System Auditing Process practice questions

Protection of Information Assets practice questions

Information Systems Acquisition, Development, and Implementation practice questions

CISA fundamentals practice questions

CISA scenario practice questions

CISA troubleshooting practice questions

Practice scenarios

Refer to the exhibit. An IS auditor is reviewing backup error logs. The error indicates a failed backup due to a missing file. What is the MOST likely cause?

Exhibit

Based on the exhibit, what is the security risk of this bucket policy?

Based on the exhibit, which control is most likely missing to prevent this type of event?

Exhibit

Based on the exhibit, what is the MOST likely security risk?

Exhibit

Refer to the exhibit. An auditor finds that the file 'sensitive.txt' has world-writable permissions. Which of the following is the most appropriate remediation action?

Exhibit

A company's endpoint protection solution alerts on a file that is digitally signed by a trusted software vendor but exhibits malicious behavior on execution. What type of threat does this scenario most likely depict?

Based on the exhibit, what should the IS auditor MOST likely recommend?

Exhibit

Based on the exhibit, what is the most likely control weakness that allowed this condition?

Exhibit

Refer to the exhibit. During a security audit, an IS analyst identifies that a critical business application hosted on 192.168.1.100:443 is unreachable from the 10.0.1.0/24 subnet. Which of the following is the MOST likely cause?

Exhibit

Based on the exhibit, what is the MOST appropriate action for IT management?

Exhibit

Refer to the exhibit. An application log shows an error. What is the MOST likely cause of this error?

Exhibit

An IS auditor reviews the exhibit. Which of the following is the most likely cause of the denied traffic?

Exhibit

Refer to the exhibit. This log entry MOST likely indicates:

Exhibit