Hard — CISA Practice Quiz

Question 1

An IS auditor is testing whether user access requests are properly approved before provisioning. Using attribute sampling, the auditor sets a tolerable deviation rate of 5% and tests 60 access requests. The auditor finds 4 requests that were provisioned without documented approval, yielding a sample deviation rate of 6.67%. What is the auditor's MOST appropriate next step?

Accepted Answer

Conclude the control cannot be relied upon and consider expanding testing or reporting a control deficiency

Answer

Conclude the control is operating effectively because only 4 exceptions were found in 60 items

Answer

Remove the 4 exceptions from the sample and recalculate the deviation rate to fall below the tolerable rate

Answer

Immediately issue an unqualified opinion since the deviation rate is close to the tolerable rate

Question 2

During a review of a high-volume transaction processing system, an IS auditor notes that users frequently report intermittent transaction timeouts during peak business hours. The DBA team confirms that database CPU and memory utilization remain well within thresholds during these periods. Which of the following is the MOST likely cause the auditor should recommend investigating first?

Accepted Answer

Lock contention and deadlocks among concurrent transactions

Answer

Insufficient backup frequency causing transaction log overflow

Answer

An undersized disaster recovery site with a longer RTO

Answer

Lack of referential integrity constraints in the schema

Question 3

An organization wants to protect the confidentiality of sensitive emails sent to external business partners. IT proposes encrypting all outbound messages using the sender's own private key so recipients can verify the origin. As the IS auditor, what is your PRIMARY concern with this proposed approach?

Accepted Answer

Encrypting with the sender's private key provides authentication and integrity but not confidentiality, since anyone with the sender's public key can decrypt the message

Answer

The approach requires each recipient to maintain a hardware security module to store the sender's private key

Answer

Asymmetric encryption is too slow to be used for any email communication, so symmetric keys must always be used instead

Answer

The sender's private key would expire before the recipient could open the message, causing delivery failures

Question 4

An IS auditor reviewing the IT service desk notes that the team has recently improved its first-call resolution (FCR) rate from 62% to 91% over one quarter, which management presents as a major service improvement. However, the auditor observes that repeat incident volume and the number of tickets reopened within 48 hours have both increased during the same period. What should the auditor conclude?

Accepted Answer

The FCR improvement may be overstated because analysts could be prematurely closing tickets, and the metric should be reviewed alongside reopen and repeat-incident data

Answer

The FCR improvement demonstrates effective service delivery and no further review of the metric is warranted

Answer

The reopen rate is irrelevant to service desk performance and should be excluded from the service level reporting

Answer

The service desk should immediately lower its FCR target to reduce the number of reopened tickets

Question 5

During a review of an enterprise single sign-on deployment that uses Kerberos, an IS auditor wants to determine which control most directly prevents an attacker who has captured a valid authentication ticket from re-submitting it later to gain access. Which control should the auditor verify is functioning correctly?

Accepted Answer

Synchronized clocks across servers with timestamps and short ticket lifetimes in authenticator messages

Answer

Enforcement of a minimum password length and complexity policy for all domain accounts

Answer

Full-disk encryption on the key distribution center (KDC) server

Answer

Segregation of the authentication server from the application server on separate VLANs

Question 6

A critical zero-day vulnerability affecting an internet-facing application server has been publicly disclosed, and an active exploit is circulating. The vendor has released an emergency patch. During a review of the organization's response, an IS auditor notes that the operations team deployed the patch directly to production within hours, bypassing the normal test cycle, but did complete a documented emergency change request approved by the change advisory board on-call authority. What should the auditor conclude?

Accepted Answer

The deployment was appropriate because the emergency change process was followed and the exploited risk justified expedited action, but the auditor should verify post-implementation testing and rollback readiness were performed

Answer

The deployment violated change management because all patches must complete full regression testing before reaching production regardless of severity

Answer

The deployment was acceptable and requires no further review since board approval was obtained

Answer

The patch should not have been applied at all until the next scheduled maintenance window to avoid unplanned downtime

Question 7

An IS auditor is testing a population of 8,000 accounts payable transactions to detect whether the total dollar value of the balance is materially overstated. Larger-value transactions carry greater potential for material misstatement, and the auditor wants transactions with higher monetary amounts to have a proportionally greater chance of selection. Which sampling method is MOST appropriate?

Accepted Answer

Monetary unit (probability-proportional-to-size) sampling

Answer

Simple random sampling

Answer

Attribute sampling

Answer

Stratified mean-per-unit sampling with equal selection probability

Question 8

During the development of a new customer portal, the project team decides to integrate with a 20-year-old core banking system using screen-scraping because the legacy system has no documented APIs. An IS auditor reviewing the design should be MOST concerned that this approach:

Accepted Answer

May break silently when the legacy system's screen layouts change, causing undetected data transfer errors

Answer

Will require additional user acceptance testing before go-live

Answer

Increases the number of interface points that must be documented

Answer

Could slow the response time of the new customer portal during peak hours

Question 9

An IS auditor is reviewing an outsourcing arrangement in which a cloud provider hosts a critical customer-facing application. The signed contract specifies a 99.9% monthly availability target and defines financial service credits payable to the organization if the target is missed. During the review, the auditor notes that the organization relies entirely on the provider's self-reported availability figures and receives only a quarterly summary report. Which of the following is the auditor's GREATEST concern?

Accepted Answer

The organization has no independent means to verify the provider's reported performance against the SLA

Answer

The service credits are too small to fully compensate for a prolonged outage

Answer

A 99.9% availability target may be insufficient for a critical customer-facing application

Answer

The report is provided quarterly rather than monthly

Question 10

An IS auditor is reviewing an SLA between an organization and its primary cloud hosting provider. The SLA commits the provider to 99.9% availability. During the review, the auditor learns that the provider relies on a third-party network carrier for connectivity but has no formal underpinning agreement with that carrier guaranteeing comparable service levels. Which of the following is the auditor's GREATEST concern?

Accepted Answer

The provider's availability commitment may not be achievable because the dependent carrier's service levels are not contractually assured

Answer

The organization cannot invoke service credits directly against the network carrier

Answer

The primary provider's data center certifications may have expired

Answer

The organization has not benchmarked the 99.9% target against industry peers

Question 11

An IS auditor is reviewing a backup storage environment that uses data deduplication to reduce storage consumption across multiple daily backups. During the review, the auditor notes that all backup jobs write to a single deduplication appliance located in the primary data center, and no copies are replicated elsewhere. Which of the following represents the GREATEST concern with this configuration?

Accepted Answer

Corruption or loss of the deduplicated data store could render all backups unrecoverable

Answer

Deduplication reduces the total number of restore points available for recovery

Answer

Deduplication increases the time required to complete each backup job

Answer

Deduplicated data cannot be encrypted while at rest on the appliance