ISACA CISA — Certified Information Systems Auditor

Question 1

An organization is replacing its core inventory management system. Project management has selected an abrupt (direct) changeover on a weekend, decommissioning the legacy system immediately once the new system goes live. As the IS auditor reviewing the implementation plan, which aspect should raise the GREATEST concern?

Accepted Answer

There is no documented fallback plan to revert to the legacy system if the new system fails after cutover

Answer

The changeover is scheduled for a weekend rather than a weekday

Answer

User acceptance testing was completed two weeks before the cutover date

Answer

The new system uses a different database platform than the legacy system

Question 2

During a review of a perimeter firewall, an IS auditor finds that the rule base ends with an explicit 'permit any any' statement placed after several specific deny rules. Which of the following is the auditor's GREATEST concern?

Accepted Answer

Traffic not matching the specific deny rules will be allowed through, undermining the default-deny principle

Answer

The specific deny rules will slow packet processing and degrade throughput

Answer

Logging of denied traffic will consume excessive storage on the firewall

Answer

The firewall cannot perform stateful inspection with this rule ordering

Question 3

An IS auditor is reviewing an agile software development project. The development team completes sprints every two weeks and demonstrates working features to stakeholders. However, the auditor notices that several completed user stories lacked documented acceptance criteria before development began, and defects related to these stories are frequently found only after release to production. Which of the following is the auditor's BEST recommendation to address the root cause?

Accepted Answer

Require that acceptance criteria be defined and agreed with the product owner before a user story enters a sprint

Answer

Extend the sprint length from two weeks to four weeks to allow more time for testing

Answer

Introduce a separate quality assurance team that independently tests all releases after production deployment

Answer

Replace the agile methodology with a predictive (waterfall) approach to enforce upfront requirements

Question 4

A financial analyst needs to send a confidential report to an external business partner and wants to ensure that only that partner can read the message. Both parties have valid PKI certificates. Which key should the analyst use to encrypt the report so that confidentiality is preserved?

Accepted Answer

The recipient's public key

Answer

The analyst's private key

Answer

The analyst's public key

Answer

The recipient's private key

Question 5

A newly appointed IS audit manager discovers that the internal audit function has been operating without a formally approved audit charter for the past two years. The manager wants to establish the charter's authority appropriately. To BEST ensure the audit function's independence and organizational authority, who should approve the audit charter?

Accepted Answer

The audit committee of the board of directors

Answer

The chief information officer (CIO)

Answer

The chief executive officer (CEO)

Answer

The chief information security officer (CISO)

Question 6

During a review of an organization's purchase-to-pay process, an IS auditor gains read-only access to the complete general ledger and accounts payable transaction files for the fiscal year. Rather than selecting a statistical sample, the auditor decides to use data analytics software to test 100% of the transactions for duplicate payments, split purchase orders below approval thresholds, and payments to vendors not in the approved master file. What is the PRIMARY advantage of this approach compared to traditional sampling?

Accepted Answer

It removes sampling risk by allowing the entire population to be examined for the defined conditions

Answer

It eliminates the need to document the audit methodology in the working papers

Answer

It guarantees that all identified exceptions represent confirmed control failures

Answer

It transfers responsibility for the accuracy of the results to the data owner

Question 7

During a fraud investigation, an IS auditor collects log files and a copy of a suspect employee's hard drive as potential evidence for possible legal proceedings. To ensure the evidence will be admissible and defensible, which action is MOST important for the auditor to perform?

Accepted Answer

Maintain a documented chain of custody recording every person who handled the evidence and when

Answer

Analyze the original hard drive immediately to preserve the timeliness of findings

Answer

Summarize the log files in the audit workpapers and discard the raw files

Answer

Obtain a signed statement from the suspect acknowledging the collection

Question 8

During an audit of a data center's physical access controls, an IS auditor observes badge-reader operation for one hour on the day of the visit and notes that all entries required a valid badge. The auditor plans to conclude that access controls operated effectively throughout the entire audit period. What is the MOST significant limitation of relying on this observation as audit evidence?

Accepted Answer

The observation reflects only a point in time and may not represent control operation across the whole period

Answer

Observation evidence is inadmissible unless corroborated by management interviews

Answer

Physical controls cannot be evaluated without penetration testing

Answer

Observation is less reliable than management's verbal assertions about the controls

Question 9

During a review of a company's procurement process, an IS auditor is evaluating several pieces of evidence to support a finding about unauthorized purchase orders. The auditor has collected: (1) a system-generated exception report produced by the auditor using the ERP database, (2) a verbal confirmation from the procurement manager, (3) a screenshot of the approval screen emailed by an accounts payable clerk, and (4) a signed policy document provided by the vendor. Which piece of evidence should the auditor consider MOST reliable?

Accepted Answer

The system-generated exception report the auditor produced directly from the ERP database

Answer

The verbal confirmation from the procurement manager

Answer

The screenshot of the approval screen emailed by the accounts payable clerk

Answer

The signed policy document provided by the vendor

Question 10

During an information systems audit, a senior auditor completes the fieldwork and drafts preliminary conclusions on the effectiveness of change management controls. Before the findings are consolidated into the report, what should the audit manager do FIRST to comply with ISACA's audit and assurance standards regarding supervision?

Accepted Answer

Review the workpapers and evidence to confirm the conclusions are adequately supported before proceeding

Answer

Present the preliminary conclusions to the client's IT management for validation

Answer

Immediately begin drafting the final audit report to meet the reporting deadline

Answer

Expand the sample size to increase statistical confidence in every finding

Question 11

Six months after issuing a report on weaknesses in the change management process, an IS auditor is preparing to conduct follow-up activities. Management previously committed to implementing a formal change approval workflow and provided a memo stating the workflow is now 'fully operational.' What is the auditor's MOST appropriate next step?

Accepted Answer

Obtain and test evidence of actual change records to verify the workflow is functioning as described

Answer

Accept management's written assertion that the workflow is operational and close the finding

Answer

Re-issue the original report to remind management of the outstanding commitment

Answer

Escalate the matter to the audit committee because the remediation was not completed on time

Question 12

An IS auditor is assigned to audit the change management process for a core banking application. Two years ago, before joining the internal audit department, this same auditor served as the lead administrator responsible for configuring and approving changes to that exact application. What is the MOST appropriate action for the audit manager to take?

Accepted Answer

Reassign the engagement to a different auditor to preserve independence and objectivity

Answer

Allow the auditor to proceed because two years have passed and the prior knowledge will improve audit efficiency

Answer

Permit the auditor to conduct the audit but require a second auditor to co-sign all workpapers

Answer

Allow the auditor to proceed after disclosing the prior role in the audit report

Question 13

During an audit of the change management process, an IS auditor interviews the change manager, who states that all emergency changes are reviewed and approved by the Change Advisory Board (CAB) within 48 hours after implementation. What should the auditor do NEXT to support a conclusion on this control?

Accepted Answer

Select a sample of emergency changes and inspect CAB records to corroborate the assertion

Answer

Document the change manager's statement as evidence that the control operates effectively

Answer

Recommend that the emergency change control be strengthened with automated approvals

Answer

Rely on the change manager's experience and issue a favorable opinion on the control

Question 14

During the planning phase of an audit of a payroll application, an IS auditor must decide how much emphasis to place on various control areas. Several minor configuration weaknesses exist, but the auditor is concerned about errors that could significantly affect the accuracy of reported payroll expense. Which concept should MOST guide the auditor in deciding where to focus audit effort?

Accepted Answer

Materiality of potential errors or control weaknesses

Answer

The total number of application configuration settings

Answer

The preferences expressed by the payroll department manager

Answer

The chronological order in which controls were implemented

Question 15

An IS auditor has been assigned to audit a newly implemented procurement application that the audit team has never reviewed before. Before defining the detailed audit scope and objectives, which activity should the auditor perform FIRST?

Accepted Answer

Perform a preliminary survey to gain an understanding of the application, its processes, and associated risks

Answer

Select a statistical sample of purchase transactions for detailed testing

Answer

Draft the audit report structure and identify the recipients of the findings

Answer

Recommend compensating controls for weaknesses in the procurement process

Question 16

Midway through an IS audit of a payroll application, the auditor discovers that the business has quietly added a new self-service module that was not part of the approved audit scope. Testing this module would require significant additional hours that were not budgeted, and management is now pressing for the module to be included because of recent errors it produced. What is the auditor's BEST course of action?

Accepted Answer

Assess the risk and effort of including the module and, if warranted, formally revise the audit scope and resource plan with the appropriate approval before proceeding

Answer

Immediately expand the fieldwork to cover the new module using slack time from other test areas to keep the overall deadline

Answer

Decline any consideration of the module because it was not in the originally approved engagement scope

Answer

Note the module as an observation in the report but perform no additional testing and issue the report on the original schedule

Question 17

An IS audit department has completed several engagements over the past year. Management wants to establish a quality assurance and improvement program (QAIP) to ensure the audit function conforms to professional standards and continuously improves. Which of the following would BEST provide independent assurance about the overall quality of the audit function?

Accepted Answer

Conducting a periodic external assessment performed by a qualified, independent reviewer from outside the organization

Answer

Requiring each auditor to review their own workpapers before issuing the final report

Answer

Increasing the frequency of status meetings between auditors and the audit manager during fieldwork

Answer

Tracking the number of findings raised per engagement as a productivity metric

Question 18

An IS auditor has completed fieldwork on a review of the organization's identity and access management processes. Several control weaknesses were identified, some highly technical (e.g., misconfigured LDAP bind accounts) and some governance-related (e.g., no periodic access recertification). The auditor is preparing to communicate the results to the audit committee, which is composed primarily of non-technical board members. What should the auditor do FIRST when structuring the report for this audience?

Accepted Answer

Summarize findings in terms of business risk and impact, with technical details available in supporting appendices

Answer

Present all findings with full technical detail so the committee has complete information to make decisions

Answer

Omit the technical findings entirely since the committee cannot act on them

Answer

Defer reporting to management and let them decide what to escalate to the audit committee

Question 19

An IS auditor is testing whether user access requests are properly approved before provisioning. Using attribute sampling, the auditor sets a tolerable deviation rate of 5% and tests 60 access requests. The auditor finds 4 requests that were provisioned without documented approval, yielding a sample deviation rate of 6.67%. What is the auditor's MOST appropriate next step?

Accepted Answer

Conclude the control cannot be relied upon and consider expanding testing or reporting a control deficiency

Answer

Conclude the control is operating effectively because only 4 exceptions were found in 60 items

Answer

Remove the 4 exceptions from the sample and recalculate the deviation rate to fall below the tolerable rate

Answer

Immediately issue an unqualified opinion since the deviation rate is close to the tolerable rate

Question 20

During execution of a purchasing controls audit, an IS auditor decides not to use statistical sampling. Instead, the auditor deliberately selects the 30 highest-dollar purchase orders plus all transactions processed during the year-end weekend when a temporary employee had elevated access. Which statement BEST describes a key limitation the auditor must acknowledge when using this approach?

Accepted Answer

The results cannot be statistically projected to the entire population

Answer

The sample size must still be calculated using the expected deviation rate and tolerable error

Answer

The approach eliminates all sampling risk from the engagement

Answer

The selected items must be chosen using a random number generator to remain valid

Question 21

An IS auditor is testing the accuracy of dollar amounts recorded in a company's accounts payable subledger. The auditor wants to estimate the total monetary error present in the population balance rather than simply count how many transactions deviate from a control. Which sampling approach is MOST appropriate for this objective?

Accepted Answer

Variables (substantive) sampling

Answer

Attribute sampling

Answer

Stop-or-go sampling

Answer

Discovery sampling

Question 22

During an engagement, a junior IS auditor argues that an ISACA IT Audit Guideline should be applied exactly as written because 'it is required.' The audit manager reviews the situation and finds that following the guideline as written would not fit the specific technical environment being audited. According to ISACA's framework for IT audit and assurance, how should the manager characterize the applicability of ISACA Guidelines versus Standards?

Accepted Answer

Standards are mandatory requirements, while Guidelines provide guidance on how to apply the standards and allow professional judgment in their application

Answer

Both Standards and Guidelines are mandatory and must be applied without deviation in every engagement

Answer

Guidelines are mandatory requirements, while Standards are optional recommendations that may be tailored to the engagement

Answer

Neither Standards nor Guidelines are mandatory; both are advisory and compliance is at the auditor's discretion

Question 23

During a quality review of a completed IT operations audit, a reviewer notices that one of the audit conclusions states the change management process is 'operating effectively,' but the associated workpaper contains only the auditor's narrative summary of an interview with the change manager. No test results, samples, or supporting artifacts are referenced. What is the reviewer's MOST significant concern regarding this workpaper?

Accepted Answer

The workpaper does not contain sufficient and appropriate evidence to support the stated conclusion

Answer

The workpaper should have been reviewed by the change manager before finalization

Answer

The interview was conducted without a second auditor present as a witness

Answer

The narrative summary was not translated into a formal flowchart of the process

Question 24

During an audit of a company's disaster recovery arrangements, the IS auditor confirms that full backups are performed nightly and encrypted copies are shipped to an offsite vault daily. Backup completion logs show no failures for the past 12 months. Which of the following should be the auditor's GREATEST concern?

Accepted Answer

The organization has never performed a test restoration of the backup media to confirm data can be recovered.

Answer

The backup media is retained offsite rather than in a fireproof safe within the data center.

Answer

Backups are performed nightly rather than through continuous replication.

Answer

The backup completion logs are reviewed by operations staff rather than by an independent party.

Question 25

During a review of nightly batch operations, an IS auditor notes that the overnight processing window has begun to overrun into online business hours, delaying transaction availability for morning users. Data volumes have grown 40% over the past year, but the job schedule and hardware have not changed. What should the auditor recommend as the MOST appropriate first action?

Accepted Answer

Perform a capacity and throughput analysis of the batch jobs to identify bottlenecks and forecast future demand

Answer

Immediately purchase additional processing hardware to eliminate the overrun

Answer

Move all batch jobs to weekends to avoid interfering with online hours

Answer

Reduce the retention period of processed transaction data to shrink file sizes

Question 26

An IS auditor reviewing an enterprise's IT performance monitoring program notes that management measures internal metrics such as help desk ticket resolution time and server uptime, and reports steady year-over-year improvement. However, business units continue to complain that IT service quality lags behind competitors. Which action would BEST enable management to determine whether IT performance is genuinely competitive?

Accepted Answer

Benchmark the internal IT performance metrics against comparable industry peers and recognized standards

Answer

Increase the frequency of internal performance reporting from quarterly to monthly

Answer

Add more internal KPIs to the existing performance dashboard

Answer

Set more aggressive year-over-year improvement targets for the existing metrics

Question 27

An IS auditor is reviewing the results of a recently completed business impact analysis (BIA) for a financial services firm. The BIA identifies several business processes but does not rank them or specify the maximum tolerable downtime for each. Management wants to proceed directly to selecting recovery technologies based on the BIA. What should the auditor recommend as the MOST important missing element before recovery solutions are chosen?

Accepted Answer

Determine the criticality and maximum tolerable downtime of each process to establish recovery priorities

Answer

Negotiate contracts with a hot-site provider for all identified processes

Answer

Perform a full restoration test of the current backup media

Answer

Document the current network topology and hardware inventory

Question 28

During an audit of a data center's biometric access control system, the IS auditor notes that the system administrator recently lowered the sensitivity threshold to reduce the number of complaints from employees who were repeatedly denied entry. Which risk is MOST directly increased by this change?

Accepted Answer

The false acceptance rate (FAR) increases, allowing unauthorized individuals to gain access

Answer

The false rejection rate (FRR) increases, locking out authorized employees more often

Answer

The crossover error rate (CER) becomes impossible to calculate

Answer

The enrollment database is corrupted, requiring re-registration of all users

Question 29

An IS auditor is reviewing the initiation phase of a proposed customer relationship management (CRM) system replacement. The project charter has been drafted and a preliminary budget approved, but the auditor notes that the organization proceeded directly to vendor selection. Which of the following, if MISSING, would represent the MOST significant control weakness in the project initiation process?

Accepted Answer

A documented business case that justifies the investment against defined benefits, costs, and alternatives

Answer

A detailed work breakdown structure for the implementation phase

Answer

A signed non-disclosure agreement with each shortlisted vendor

Answer

A finalized data migration and changeover plan for the legacy system

Question 30

An IS auditor is reviewing a bring-your-own-device (BYOD) program in which employees access corporate email and documents from personal smartphones. Management's primary concern is protecting confidential corporate data if a device is lost or the employee leaves the company, without infringing on personal data such as family photos. Which control BEST addresses this concern?

Accepted Answer

Containerization that isolates corporate data and allows selective remote wipe

Answer

Full-device encryption enforced on every enrolled personal device

Answer

A signed acceptable-use policy acknowledging the employee's data protection responsibilities

Answer

Requiring a complex device passcode with automatic lockout after failed attempts

Question 31

During an audit of IT operations, an IS auditor notes that the organization only investigates system performance after users report slowdowns, and no forecasting of future resource demand is performed. Which weakness should the auditor identify as the MOST significant concern?

Accepted Answer

The absence of proactive capacity management to anticipate and prevent performance and availability problems

Answer

The lack of a formal help desk ticketing tool for logging user complaints

Answer

The failure to encrypt performance monitoring data in transit

Answer

The absence of a documented data retention schedule for system logs

Question 32

During a review of the change management process, an IS auditor finds that emergency changes are deployed directly to production by on-call engineers using elevated access, and that the process relies on a documented step to formally record and approve the change after deployment. Which control MOST effectively ensures that these emergency changes do not become a means to bypass normal change governance?

Accepted Answer

Requiring that all emergency changes be reviewed and retroactively authorized by the change advisory board within a defined timeframe

Answer

Prohibiting emergency changes entirely and routing all fixes through the standard change queue

Answer

Allowing on-call engineers to self-approve emergency changes to minimize downtime

Answer

Increasing the frequency of vulnerability scans on production servers

Question 33

During a physical walkthrough of an open-plan office, an IS auditor observes several workstations left unlocked and unattended, with printed customer records visible on desks and sticky notes containing passwords attached to monitors. Which control would BEST address the root cause of these observations?

Accepted Answer

Implementing and enforcing a clean desk and clear screen policy with automatic session lock

Answer

Deploying full-disk encryption on all workstations

Answer

Installing surveillance cameras throughout the office floor

Answer

Requiring multifactor authentication for network logon

Question 34

A multinational bank plans to migrate its customer transaction database to a public cloud provider. During the acquisition process, the IS auditor is asked to review the provider selection criteria. The organization operates in jurisdictions that legally require certain customer data to remain within national borders. Which of the following should the auditor recommend receive PRIMARY consideration before finalizing the provider contract?

Accepted Answer

The provider's ability to guarantee data residency in compliant geographic regions consistent with applicable regulations

Answer

The provider's published uptime service-level commitments and associated service credits

Answer

The total cost of ownership compared with competing cloud providers

Answer

The provider's use of the latest virtualization and container technologies

Question 35

An IS auditor reviews a company's backup strategy for a critical transactional database. The organization performs a full backup every Sunday and synthetic full backups are not used; instead, transaction log backups are taken every 15 minutes throughout the week. During a test, the DBA restores the database to the state it was in on Wednesday at 2:00 p.m. Which of the following is the MOST important factor determining whether this point-in-time recovery will succeed?

Accepted Answer

The availability of the Sunday full backup plus every unbroken transaction log backup up to the target recovery point

Answer

The physical distance of the offsite vault from the primary data center

Answer

The storage deduplication ratio achieved on the backup media

Answer

The number of parallel restore threads configured on the database server

Question 36

During a review of IT operations, an IS auditor finds that the configuration management database (CMDB) is used to support incident, problem, and change management processes. However, several recent outages were traced to changes made on servers that were not reflected in the CMDB. What should the auditor recommend as the MOST effective control to address this issue?

Accepted Answer

Perform periodic automated discovery reconciliation between the CMDB and the actual production environment

Answer

Increase the frequency of full backups of the CMDB repository

Answer

Require all users to attend annual configuration management awareness training

Answer

Restrict CMDB read access to the change advisory board members only

Question 37

During the planning phase, an IS auditor is asked to recommend an approach that will allow management to identify control breakdowns in the accounts payable system as transactions are processed, rather than waiting for a scheduled annual audit. Which approach should the auditor recommend?

Accepted Answer

Continuous auditing using embedded audit modules to test transactions in near real time

Answer

A control self-assessment (CSA) workshop conducted quarterly with process owners

Answer

Statistical attribute sampling performed at the end of each fiscal year

Answer

A substantive test of details using stratified sampling during the annual audit

Question 38

An IS auditor is asked to help business unit managers implement a control self-assessment (CSA) program using a facilitated workshop approach. During the first workshop, the participants begin looking to the auditor to identify the control weaknesses and prescribe the corrective actions. What is the MOST appropriate action for the auditor to take to preserve the integrity of the CSA process?

Accepted Answer

Act as a facilitator and guide the participants to identify and assess the risks and controls themselves

Answer

Document the control weaknesses identified and issue them as formal audit findings

Answer

Take ownership of the control assessment to ensure objectivity and consistency across business units

Answer

Assign remediation responsibility to the workshop participants and set completion deadlines

Question 39

An organization is launching an enterprise data protection program. Management wants to ensure that encryption, access restrictions, and retention rules are applied proportionately across all information assets. Before selecting specific technical controls, which activity should the IS auditor recommend be completed FIRST?

Accepted Answer

Establish and apply a data classification scheme based on asset sensitivity and business value

Answer

Deploy a data loss prevention solution to inspect outbound traffic

Answer

Implement full-disk encryption on all endpoints and servers

Answer

Configure role-based access controls for all file shares

Question 40

During the implementation of a new customer billing system, historical account balances are being migrated from the legacy system. Which control provides the BEST assurance that the converted data in the new system is complete and accurate?

Accepted Answer

Reconciling control totals and record counts between the source and target systems after conversion

Answer

Having users visually review a sample of converted records on screen

Answer

Confirming that the conversion program compiled without errors

Answer

Obtaining sign-off from the project sponsor that the migration is complete

Question 41

During a review of a financial application, an IS auditor finds that the database is encrypted at rest using AES-256, but the encryption keys are stored in a plaintext configuration file on the same database server. Which of the following represents the GREATEST concern with this arrangement?

Accepted Answer

An attacker who compromises the database server can obtain both the ciphertext and the keys, defeating the encryption

Answer

AES-256 is computationally expensive and may degrade database query performance

Answer

The configuration file may be excluded from the regular backup schedule

Answer

AES-256 keys must be rotated more frequently than shorter keys

Question 42

During a review of an organization's newly launched data governance program, an IS auditor finds that data quality issues in the customer master file keep recurring. The IT operations team applies technical fixes each time errors are reported, but no one in the business is designated as accountable for defining acceptable data quality rules or authorizing corrections. What should the auditor recommend as the MOST effective way to address the root cause?

Accepted Answer

Assign business data owners and stewards with defined accountability for data quality standards and corrections

Answer

Increase the frequency of automated data validation scripts run by IT operations

Answer

Purchase a data quality tool that automatically cleanses the customer master file

Answer

Require the IT operations team to document each technical fix in the incident management system

Question 43

An IS auditor is reviewing controls at a company that recently deployed a data loss prevention (DLP) solution to prevent leakage of customer personally identifiable information (PII). During testing, the auditor discovers that a large volume of PII is being emailed externally without being blocked, even though rules exist to detect PII patterns. Investigation reveals the outbound email is encrypted by the users before sending. Which of the following is the MOST significant limitation the auditor should report?

Accepted Answer

The DLP cannot inspect the content of encrypted traffic, allowing sensitive data to bypass detection

Answer

The DLP rules use pattern matching rather than exact data matching

Answer

Users have not completed security awareness training on data handling

Answer

The DLP is deployed at the network egress point rather than on endpoints

Question 44

A multinational retailer processes customer personal data in several countries. Its internal data protection policy was written to satisfy the requirements of the country where the corporate headquarters is located. During an audit, the IS auditor finds that one subsidiary operates in a jurisdiction whose privacy law imposes stricter consent and data-transfer requirements than the corporate policy. Which of the following should the auditor recommend as the MOST appropriate course of action?

Accepted Answer

Ensure the subsidiary complies with the stricter local privacy law where it applies, and align the corporate policy to accommodate jurisdictional differences

Answer

Apply the corporate policy uniformly across all subsidiaries to ensure consistency of controls

Answer

Allow the subsidiary to define its own independent policy with no oversight from headquarters

Answer

Defer the matter until the local regulator issues an enforcement action against the subsidiary

Question 45

During an audit of a production database, an IS auditor finds that database administrators (DBAs) use a shared privileged account to perform maintenance, and native database audit logging of privileged activity is disabled to improve performance. Which of the following findings should the auditor identify as the MOST significant concern?

Accepted Answer

Privileged actions cannot be attributed to individual DBAs and go unmonitored

Answer

Disabling audit logging slightly improves transaction throughput

Answer

The DBAs have not documented the maintenance schedule

Answer

The shared account password is changed only quarterly

Question 46

A production database server crashes suddenly during peak processing. When the DBA restarts the database management system, the recovery process must determine which transactions to redo and which to roll back. Which database mechanism primarily enables the DBMS to restore the database to a consistent state without replaying every transaction since the last full backup?

Accepted Answer

The transaction log combined with checkpoints

Answer

The database schema and referential integrity constraints

Answer

The most recent full backup restored from offsite storage

Answer

The database indexes and query optimizer statistics

Question 47

During a review of a high-volume transaction processing system, an IS auditor notes that users frequently report intermittent transaction timeouts during peak business hours. The DBA team confirms that database CPU and memory utilization remain well within thresholds during these periods. Which of the following is the MOST likely cause the auditor should recommend investigating first?

Accepted Answer

Lock contention and deadlocks among concurrent transactions

Answer

Insufficient backup frequency causing transaction log overflow

Answer

An undersized disaster recovery site with a longer RTO

Answer

Lack of referential integrity constraints in the schema

Question 48

During a review of a production order-processing database, an IS auditor notes that query response times have gradually worsened over the past several months, though transaction volumes have remained stable and hardware utilization is well within normal ranges. The DBA confirms that no schema or application changes have occurred. Which condition is the auditor MOST likely to identify as the cause?

Accepted Answer

Index fragmentation and outdated database statistics that have not been maintained

Answer

An undersized transaction log causing frequent checkpoints

Answer

A deadlock between two long-running batch jobs

Answer

Insufficient RAID redundancy on the storage array

Question 49

During a review of a newly deployed customer relationship management database, an IS auditor notes that a single 'Orders' table stores customer name, address, and phone number repeated on every order row, and that deleting a customer record leaves orphaned order rows referencing a non-existent customer. Which control weakness is the auditor MOST likely to report as the primary concern?

Accepted Answer

The database lacks referential integrity and normalization, risking data redundancy and inconsistency

Answer

The database index configuration is degrading query performance

Answer

The backup frequency does not meet the recovery point objective (RPO)

Answer

The database access controls fail to enforce segregation of duties

Question 50

A financial services firm requires that its transaction database be continuously replicated to a geographically distant site so that, in the event of a primary data center failure, the alternate site holds an identical, up-to-the-second copy of the data. Which technique BEST meets this requirement?

Accepted Answer

Remote synchronous database mirroring (shadowing)

Answer

Nightly full backups shipped to an offsite storage vault

Answer

Grandfather-father-son tape rotation stored at the alternate site

Answer

Periodic transaction log exports copied every four hours

Question 51

A data center performs a full backup every Sunday and uses a supplementary daily backup scheme Monday through Saturday. Management wants to minimize the time required to restore a server if it fails on a Friday, while accepting that daily backups will take somewhat longer to complete each night. Which supplementary backup approach best meets this restore-time objective?

Accepted Answer

Differential backups that copy all data changed since the last full backup

Answer

Incremental backups that copy only data changed since the last backup of any type

Answer

Continuous full backups repeated every night

Answer

Snapshot pointers taken hourly with no separate full backup

Question 52

During an audit of a company's public-facing e-commerce site, an IS auditor notes that customers' browsers display a security warning when connecting via HTTPS. Investigation shows the web server presents a certificate that was issued and signed by the company's own internal certificate authority rather than a publicly recognized CA. Which of the following BEST explains why the browser warning appears?

Accepted Answer

The signing CA's root certificate is not in the browsers' trusted root store, so the certificate chain cannot be validated

Answer

The certificate uses asymmetric encryption, which browsers no longer support for TLS sessions

Answer

The certificate's private key is stored on the web server rather than in a hardware security module

Answer

The certificate has not yet been published to a certificate revocation list (CRL)

Question 53

A financial institution sends high-value payment instructions to a correspondent bank electronically. Management wants assurance that a sender cannot later deny having authorized a transaction and that the instruction was not altered in transit. Which control BEST meets both requirements?

Accepted Answer

Applying a digital signature created with the sender's private key over a hash of the instruction

Answer

Encrypting the payment instruction with the recipient's public key

Answer

Transmitting the instruction over a TLS-secured VPN tunnel between the two banks

Answer

Requiring both parties to share a symmetric session key derived at connection time

Question 54

A financial services firm has determined that its core trading platform has a recovery time objective (RTO) of 30 minutes. During a disaster recovery review, the IS auditor finds the organization currently relies on a warm site that requires several hours to load recent data backups and configure applications before the platform can resume. Which recommendation should the auditor make to best address this gap?

Accepted Answer

Migrate the recovery arrangement to a fully equipped and continuously synchronized hot site

Answer

Reduce the recovery point objective (RPO) to minimize data loss during failover

Answer

Switch to a cold site to lower ongoing recovery infrastructure costs

Answer

Increase the frequency of backup restore testing at the warm site

Question 55

During a disaster recovery plan review, an IS auditor finds that the plan document is technically comprehensive but the emergency contact list, vendor phone numbers, and named recovery team members have not been updated in over two years, and several listed staff have left the organization. Which of the following is the auditor's GREATEST concern?

Accepted Answer

The plan may be unexecutable during an actual disaster because current personnel and contacts cannot be reliably reached

Answer

The plan does not reference the latest industry recovery framework terminology

Answer

The recovery time objectives were not recalculated during the two-year period

Answer

The plan is stored only in a single document management system location

Question 56

An IS auditor is evaluating an organization's disaster recovery program. The DR plan has been documented and updated after a recent infrastructure refresh, but the organization has never executed a live failover to the alternate site because operations staff fear disrupting production services. Which testing approach should the auditor recommend as the MOST effective next step to validate recovery capability while minimizing operational risk?

Accepted Answer

A parallel test that brings up recovery systems while production continues to run

Answer

A structured walkthrough of the plan by the recovery team in a conference room

Answer

A full interruption test that shuts down production and fails over to the alternate site

Answer

A checklist review confirming that all plan documentation is current and complete

Question 57

During the closing meeting for an audit of the procurement system, the process owner strongly disputes a finding in the draft report, claiming the auditor misunderstood a compensating control that was in place. The auditor believes the finding is valid but has not yet reviewed the specific control the owner is describing. What should the IS auditor do FIRST?

Accepted Answer

Obtain and evaluate the additional evidence about the compensating control before finalizing the finding

Answer

Remove the finding from the report to preserve a good working relationship with the auditee

Answer

Issue the final report as drafted and document the process owner's disagreement in a management response section

Answer

Escalate the disagreement immediately to the audit committee for resolution

Question 58

An IS auditor is reviewing an automated nightly interface that transfers a consolidated transaction file from a branch banking application to the central core system. The auditor wants assurance that the file received by the core system is complete and has not been altered in transit. Which control would BEST provide this assurance?

Accepted Answer

A cryptographic hash total calculated at the source and independently recomputed and compared at the destination

Answer

A job scheduler that automatically retries the transfer if the initial transmission fails

Answer

Encryption of the file during transmission using a secure tunnel

Answer

A sequential naming convention that timestamps each transferred file

Question 59

A financial services firm requires that transaction data be recoverable with minimal data loss after a disaster, but its current tape backups are physically couriered to an offsite location once each night. During an IS audit, which recommendation would BEST reduce the amount of data that could be lost between the last backup and a disaster event?

Accepted Answer

Implement electronic vaulting to transmit backups to the offsite location throughout the day

Answer

Increase the number of tape rotation cycles retained at the offsite facility

Answer

Relocate the offsite storage facility closer to the primary data center

Answer

Encrypt the backup tapes before they are couriered offsite

Question 60

An IS auditor is reviewing a bank's data protection strategy for its core transaction database. The bank transmits only the database transaction logs to an offsite facility continuously as they are generated, rather than sending full copies of the database files at scheduled intervals. Which technique is the bank using?

Accepted Answer

Remote journaling

Answer

Electronic vaulting

Answer

Full offsite backup rotation

Answer

Disk-to-disk snapshot replication

Question 61

An organization wants to protect the confidentiality of sensitive emails sent to external business partners. IT proposes encrypting all outbound messages using the sender's own private key so recipients can verify the origin. As the IS auditor, what is your PRIMARY concern with this proposed approach?

Accepted Answer

Encrypting with the sender's private key provides authentication and integrity but not confidentiality, since anyone with the sender's public key can decrypt the message

Answer

The approach requires each recipient to maintain a hardware security module to store the sender's private key

Answer

Asymmetric encryption is too slow to be used for any email communication, so symmetric keys must always be used instead

Answer

The sender's private key would expire before the recipient could open the message, causing delivery failures

Question 62

During an audit of a financial reporting process, an IS auditor discovers that the finance department relies on a complex spreadsheet with embedded macros to consolidate quarterly figures fed into the general ledger. The spreadsheet is stored on a shared drive, edited by several analysts, and has no version tracking or formula-lock protection. Which risk should the auditor identify as the MOST significant?

Accepted Answer

Undetected errors in formulas or data may propagate into official financial statements without adequate change and access controls

Answer

The macros may slow the spreadsheet's performance during peak consolidation periods

Answer

Analysts may prefer a purpose-built application over the spreadsheet, reducing user satisfaction

Answer

The shared drive may consume excessive storage capacity as the spreadsheet grows each quarter

Question 63

An IS auditor reviewing an organization's IT strategy notices that a new enterprise architecture (EA) initiative was launched by the IT department to standardize technology platforms. However, business unit leaders complain that recent technology investments do not support their emerging market priorities. What is the auditor's PRIMARY concern?

Accepted Answer

The IT strategy and EA are not aligned with business objectives and strategy

Answer

The EA initiative lacks documented technical standards for each platform

Answer

The IT department did not obtain competitive bids for the new platforms

Answer

The EA initiative was not reviewed by the internal audit function before launch

Question 64

During the implementation phase of a new order-management system, an IS auditor observes that the project team has completed unit testing of individual modules and is preparing for the next testing stage. The team wants to verify that data passed between the newly coded order-entry module and the inventory module behaves correctly when the modules operate together. Which type of testing should the team perform NEXT to address this concern?

Accepted Answer

Integration testing

Answer

Regression testing

Answer

User acceptance testing

Answer

Stress testing

Exam domain	Exam weight	Practice
Information System Auditing Process	18%	Practice this topic
Governance and Management of IT	18%	Practice this topic
Information Systems Acquisition, Development and Implementation	12%	Practice this topic
Information Systems Operations and Business Resilience	26%	Practice this topic
Protection of Information Assets	26%	Practice this topic

ISACA CISA — Certified Information Systems Auditor (CISA) practice exam & study guide

Start studying CISA

All CISA study resources

CISA exam domains

Sample CISA questions

Key CISA terms

CISA frequently asked questions

Information System Auditing Process (18%)

Governance and Management of IT (18%)

Information Systems Acquisition, Development and Implementation (12%)

Information Systems Operations and Business Resilience (26%)

Protection of Information Assets (26%)