Courseiva
← Back to Certified Information Systems Auditor CISA questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Certified Information Systems Auditor CISA practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
15
scenario questions
CISA
exam code
ISACA
vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Related practice questions

Related CISA topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Governance and Management of IT practice questions

Targeted CISA practice covering Governance and Management of IT.

Information Systems Operations and Business Resilience practice questions

Sharpen your CISA knowledge of Information Systems Operations and Business Resilience.

Information System Auditing Process practice questions

Information System Auditing Process practice questions for CISA.

Information Systems Acquisition, Development, and Implementation practice questions

Sharpen your CISA knowledge of Information Systems Acquisition, Development, and Implementation.

Protection of Information Assets practice questions

Sharpen your CISA knowledge of Protection of Information Assets.

CISA fundamentals practice questions

Targeted CISA practice covering CISA fundamentals.

CISA scenario practice questions

CISA scenario practice questions for CISA.

CISA troubleshooting practice questions

Work through CISA questions on CISA troubleshooting.

Practice set

Practice scenarios

Question 1easymultiple choice
Full question →

Refer to the exhibit. Based on the governance status report, which component should be addressed as a priority?

Network Topology
|> show governance-status| Component | Status |
Question 2hardmultiple choice
Full question →

Refer to the exhibit. During a penetration test, a security analyst captures this SAML response. Which of the following security weaknesses is most evident?

Exhibit

SAML 2.0 Response excerpt:
<saml:Assertion>
  <saml:Subject>
    <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">user@example.com</saml:NameID>
  </saml:Subject>
  <saml:Conditions NotBefore="2024-01-01T00:00:00Z" NotOnOrAfter="2024-01-01T00:00:30Z" />
  <saml:AuthnStatement>
    <saml:AuthnContext>
      <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
    </saml:AuthnContext>
  </saml:AuthnStatement>
</saml:Assertion>
Question 3mediummultiple choice
Full question →

Refer to the exhibit. An IS auditor reviewing backup logs notices this error. Which of the following is the MOST likely root cause?

Exhibit

Backup Job Report - 2025-03-15
Job Name: DailyFullBackup_DB01
Status: FAILED
Error Code: E-103
Error Description: Unable to mount backup target /mnt/backup
Recommended Action: Check network connectivity to storage array.
Question 4hardmultiple choice
Full question →

A company's endpoint protection solution alerts on a file that is digitally signed by a trusted software vendor but exhibits malicious behavior on execution. What type of threat does this scenario most likely depict?

Question 5hardmultiple choice
Full question →

Refer to the exhibit. An IS auditor is reviewing an IAM policy for a cloud data platform. The auditor notices that user jdoe has READ_ONLY access to all tables matching 'sales_', but asmith has READ_WRITE access to the same set of tables. Which of the following is the MOST critical control issue?

Exhibit

Refer to the exhibit.

```
<iam-policy>
  <role name="data_analyst">
    <permission>READ_ONLY</permission>
    <resource pattern="^projects/prod/datasets/.*/tables/sales_.*$">ALLOW</resource>
  </role>
  <role name="data_scientist">
    <permission>READ_WRITE</permission>
    <resource pattern="^projects/prod/datasets/.*/tables/sales_.*$">ALLOW</resource>
  </role>
  <user name="jdoe@company.com">
    <role>data_analyst</role>
  </user>
  <user name="asmith@company.com">
    <role>data_scientist</role>
  </user>
</iam-policy>
```
Question 6mediummultiple choice
Full question →

Refer to the exhibit. Which of the following statements is TRUE regarding this S3 bucket policy?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::confidential-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "true"
        }
      }
    }
  ]
}
Question 7mediummultiple choice
Full question →

Refer to the exhibit. The IAM policy is intended to allow only requests originating from account 123456789012 to perform any S3 actions. Why does the policy NOT achieve this objective?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "123456789012"
        }
      }
    }
  ]
}
Question 8easymultiple choice
Study the full ACL explanation →

Refer to the exhibit. An auditor reviews the ACL and notes that it allows traffic from a specific host while blocking other IPs in the same subnet. What is the most likely security issue?

Exhibit

Access Control List (ACL) applied to interface GigabitEthernet0/0:
permit ip host 10.0.0.1 any
deny ip 10.0.0.0/24 any
permit ip any any
Question 9easymultiple choice
Review the full routing breakdown →

Refer to the exhibit. The IS auditor reviews the router's version output during an audit. What is the MOST significant finding?

Exhibit

Refer to the exhibit.

Exhibit:
```
[ROUTER1] show version
Cisco IOS Software, C880 Software (C880DATA-UNIVERSALK9-M), Version 15.1(4)M6, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2013 by Cisco Systems, Inc.
Compiled Tue 27-Aug-13 23:32 by prod_rel_team
ROM: System Bootstrap, Version 15.0(1r)M14, RELEASE SOFTWARE (fc1)

Router uptime is 2 years, 3 months, 1 week, 4 days
System returned to ROM by power-on
System image file is "flash:c880data-universalk9-mz.151-4.M6.bin"
```
Question 10hardmultiple choice
Full question →

Based on the exhibit, which of the following is the MOST likely result of the current firewall configuration?

Exhibit

Refer to the exhibit.

```
# iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       192.168.1.0/24       0.0.0.0/0            tcp dpt:443
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
```
Question 11hardmultiple choice
Full question →

Refer to the exhibit. Which perspective shows the greatest deviation from target?

Exhibit

IT BSC Report Q1 2025:
- Financial: Actual 80% of plan (Target 90%)
- Customer: Satisfaction score 4.2/5 (Target 4.0)
- Internal Process: SLA compliance 95% (Target 99%)
- Learning & Growth: Training hours 120 (Target 150)
Question 12mediummultiple choice
Full question →

Refer to the exhibit. The organization is planning to achieve the target level. What is the MOST appropriate action?

Exhibit

> cobit process-capability EDM01
Process: EDM01 - Ensure Governance Framework Setting and Maintenance
Current Level: 3 (Established Process)
Target Level: 4 (Predictable Process)
Gap: 1
Question 13hardmultiple choice
Full question →

Based on the exhibit, which control deficiency is most critical for the IS auditor to address?

Exhibit

Refer to the exhibit.
```
# cat /var/log/auth.log
Mar 10 08:12:34 srv01 sshd[1234]: Accepted password for admin from 192.168.1.10 port 22
Mar 10 08:15:22 srv01 sshd[1235]: Failed password for root from 10.0.0.5 port 22
Mar 10 08:15:25 srv01 sshd[1236]: Failed password for root from 10.0.0.5 port 22
Mar 10 08:15:28 srv01 sshd[1237]: Failed password for root from 10.0.0.5 port 22
Mar 10 08:15:31 srv01 sshd[1238]: Failed password for root from 10.0.0.5 port 22
Mar 10 08:15:34 srv01 sshd[1239]: Failed password for root from 10.0.0.5 port 22
Mar 10 08:15:37 srv01 sshd[1240]: Failed password for root from 10.0.0.5 port 22
Mar 10 08:18:01 srv01 sudo: admin : TTY=pts/0 ; PWD=/home/admin ; USER=root ; COMMAND=/bin/su -
```
Question 14mediummultiple choice
Full question →

Refer to the exhibit. An application log shows an error. What is the MOST likely cause of this error?

Exhibit

Refer to the exhibit.

```
ERROR 2019-11-15 14:23:45,123 [main] com.example.App - Error processing record ID 1045
java.sql.SQLIntegrityConstraintViolationException: ORA-00001: unique constraint (USERS.UK_USERNAME) violated
	at com.example.dao.UserDao.insert(UserDao.java:45)
	... 8 more
```
Question 15mediummultiple choice
Full question →

Refer to the exhibit. An auditor notices this log entry during a review. The user john.doe does not have a legitimate business need to access executive salaries. Which of the following is the MOST likely control failure?

Exhibit

Refer to the exhibit.

Exhibit:
Output from a database audit log:
Timestamp: 2024-03-15 14:23:45
User: john.doe
Action: SELECT
Table: Employee_salaries
Rows: 500
Source_IP: 10.0.0.15
Query: SELECT salary FROM Employee_salaries WHERE department = 'Executive'

These CISA practice questions are part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style CISA questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.