CISA Practice Test

1. An IS auditor is evaluating evidence gathered during fieldwork. Which characteristic of evidence is MOST important when the auditor must rely on it to support a significant audit finding?

• A. The evidence was easy and inexpensive to obtain
• B. The evidence confirms the auditor's initial expectations
• C. The evidence was provided directly by the process owner
• D. The evidence is sufficient, reliable, and relevant to the audit objective

2. Which sampling method is MOST appropriate when an IS auditor wants every item in the population to have an equal chance of selection, without bias from the auditor's judgment?

• A. Discovery sampling only
• B. Haphazard sampling
• C. Judgmental sampling
• D. Statistical (random) sampling

3. An organization's internal audit charter grants the CISA-certified auditor authority to review all IT systems but is silent on access to third-party service providers used for payroll processing. What is the BEST way to address this gap?

• A. Assume authority extends automatically to any vendor touching company data
• B. Rely solely on the vendor's own internal audit reports without independent verification
• C. Update the audit charter or contractual right-to-audit clauses to explicitly cover third-party providers
• D. Decline to audit any process that involves a third party

4. An IS auditor finds that a control was operating effectively for 10 of 12 months tested, with two months showing exceptions due to a since-corrected configuration error. What is the MOST appropriate conclusion?

• A. The control can be rated fully effective because it is now corrected
• B. The control exceptions should be reported along with root cause, remediation, and residual risk during the exception period
• C. The finding should be dropped since the issue is already fixed
• D. The sample size is too small to draw any conclusion

5. During an audit, management disagrees with a draft finding and provides additional documentation not previously available to the auditor. What is the BEST course of action?

• A. Escalate immediately to the audit committee without reviewing the documentation
• B. Ignore the new documentation since the audit fieldwork is complete
• C. Remove the finding automatically to maintain a good working relationship with management
• D. Evaluate the new evidence objectively and revise the finding if warranted before finalizing the report

6. During the planning phase of an IS audit, an IS auditor discovers that a business process has never been formally risk-assessed. What should the auditor do FIRST?

• A. Perform a risk assessment of the process to determine audit scope and priority
• B. Exclude the process from the audit since no risk assessment exists
• C. Immediately report the missing risk assessment to the audit committee as a finding
• D. Ask management to sign off on the process as low risk before proceeding

7. An internal audit function reports administratively to the chief information officer and functionally to the audit committee. Why does the functional reporting line matter?

• A. Because independence requires that audit conclusions and resourcing are not controlled by the management whose activities are audited
• B. Because administrative reporting is prohibited
• C. Because the audit committee performs the fieldwork
• D. Because the audit committee approves individual audit test steps

8. An auditor uses computer-assisted audit techniques to test an entire population rather than a sample. What is the primary benefit?

• A. Management review of the results becomes unnecessary
• B. The need to understand the control is removed
• C. Sampling risk is eliminated for that test, since every item is examined rather than an inference drawn from a subset
• D. The reliability of the source data no longer matters

9. An auditor uses attribute sampling to test whether change approvals were obtained. What is being measured?

• A. The average time taken to approve a change
• B. The monetary value of unapproved changes
• C. The total number of changes in the population
• D. The rate of deviation from the control, expressed as a proportion of items lacking the attribute

10. An IS auditor is planning an engagement and must decide how much testing to perform. What primarily drives that decision?

• A. The preferences of the audited business unit
• B. The number of staff available in the audit function
• C. The size of the department's budget
• D. The assessed risk of the area under review, since audit effort is allocated where misstatement or control failure would matter most

11. What distinguishes a test of control design from a test of operating effectiveness?

• A. Design testing asks whether a properly functioning control would address the risk, while effectiveness testing asks whether it actually operated as intended over the period
• B. Design testing is performed by the auditee and effectiveness testing by the auditor
• C. Design testing uses sampling and effectiveness testing uses inquiry
• D. The two are interchangeable descriptions of the same procedure

12. An auditor discovers a control deficiency mid-engagement. What is the appropriate immediate action?

• A. Withhold the finding until the report is issued in all cases
• B. Correct the deficiency personally to demonstrate the remediation
• C. Document the condition, criteria, cause and effect, and communicate significant matters to management on a timely basis rather than only in the final report
• D. Expand the engagement scope to every adjacent system

13. An auditor is asked to review a system they helped configure two years ago. What is the concern?

• A. There is no concern once two years have passed
• B. The concern applies only to external auditors
• C. The prior involvement makes the auditor the best-qualified reviewer
• D. Self-review impairs objectivity, so the assignment should be reallocated or the impairment disclosed and mitigated

14. Management proposes a remediation action for an audit finding. What should the auditor evaluate before accepting it?

• A. Whether the action addresses the root cause rather than the symptom, and whether the owner and target date are specific enough to be followed up
• B. Whether the action is the least expensive option available
• C. Whether the action was proposed by senior rather than junior management
• D. Whether the action can be completed before the report is issued

15. An IS auditor gathers evidence through several methods on the same control. Which evidence is generally considered most reliable?

• A. Evidence the auditor obtains directly through independent observation or reperformance
• B. A written representation from the process owner
• C. A system-generated report supplied by the auditee without validation
• D. An internal procedure document describing how the control should operate

16. An organization uses continuous auditing techniques. What capability does this add?

• A. Automated testing of transactions or configurations as they occur, shortening the interval between a control failure and its detection
• B. Elimination of the need for an annual audit plan
• C. A guarantee that no control failures occur
• D. Replacement of management's own monitoring responsibilities

17. An auditor is asked to provide an opinion where testing was limited because records were unavailable. What is the appropriate reporting treatment?

• A. Disclose the scope limitation and its effect on the conclusion rather than issuing an unqualified opinion
• B. Issue an unqualified opinion based on the testing that was possible
• C. Omit the affected area from the report without comment
• D. Delay the report indefinitely until records appear

18. An IS auditor wants ongoing assurance that a live claims-processing system handles transactions correctly, and arranges for fictitious transactions belonging to a dummy business unit to flow through production processing alongside real data. Which technique is being used?

• A. Integrated test facility, which processes fictitious entities' transactions within the production system
• B. Test data method, which runs prepared transactions through a copy of the application
• C. Snapshot technique, which captures transaction images at defined processing points
• D. Parallel simulation, which reprocesses real data through auditor-controlled software

19. Management asks the IS audit function to help strengthen access controls for a new system that the function expects to audit next year. Which arrangement BEST preserves audit independence?

• A. Auditors advise on control objectives and good practice, while management designs, implements, and owns the controls
• B. Auditors implement the access rules themselves to guarantee they meet audit expectations
• C. Auditors take temporary operational responsibility for the system until the first audit is finished
• D. Auditors decline any contact with the project until it is complete

20. An IS auditor is determining the extent of substantive testing required for a revenue-recognition interface between an order system and the general ledger. Which factor should PRIMARILY drive the auditor's judgment on sample size and testing depth?

• A. The number of IT staff available to support the audit during fieldwork
• B. The preference of the audit committee for a specific testing methodology
• C. The materiality of the account balance and the assessed level of combined risk
• D. The total number of transactions processed by the interface annually

21. A company's IT risk register lists a risk as 'high likelihood, high impact' but no owner or treatment plan is assigned. From a governance perspective, what is the MOST significant concern?

• A. The risk register format does not use a heat map
• B. Without an assigned owner and treatment plan, accountability for managing the risk to an acceptable level is unclear
• C. The risk should be removed from the register since it lacks an owner
• D. High likelihood and high impact risks cannot coexist in a valid register

22. Which of the following BEST describes the purpose of segregation of duties (SoD) within an IT organization's governance structure?

• A. To eliminate the need for management review of transactions
• B. To reduce the number of employees required to run IT operations
• C. To ensure no single individual can both perform and conceal an error or irregularity through incompatible functions
• D. To guarantee compliance with all software licensing agreements

23. A CIO wants to measure whether IT investments are delivering expected business value. Which approach BEST supports this governance objective?

• A. Tracking IT spend against budget only
• B. Establishing a benefits realization framework with defined metrics tied to business objectives
• C. Counting the number of IT projects completed each year
• D. Relying on vendor satisfaction surveys

24. An organization outsources its data center operations. Under an effective IT governance framework, which statement about accountability is MOST accurate?

• A. Accountability for the outsourced function transfers entirely to the service provider
• B. The organization retains ultimate accountability for outcomes even though operational responsibility is delegated to the provider
• C. No governance oversight is needed once a contract is signed
• D. Accountability is shared equally and cannot be defined further

25. An IT steering committee is reviewing whether a proposed enterprise system project aligns with the organization's strategic objectives. This activity is a core function of which governance concept?

• A. Configuration management
• B. Change management
• C. IT governance and strategic alignment
• D. IT service level management

26. An enterprise architecture is maintained and kept current. What audit-relevant benefit does it provide?

• A. A documented view of systems, data flows and dependencies that supports impact analysis, scoping and identification of single points of failure
• B. A guarantee that all systems are patched
• C. Automatic compliance with data protection regulation
• D. Elimination of the need for a business impact analysis

27. An organization measures IT value delivery. What does an auditor look for beyond project delivery metrics?

• A. Whether the project team was the largest available
• B. Whether the project used the most current technology available
• C. Whether the project finished under budget regardless of scope
• D. Whether expected benefits were defined, tracked and realized after implementation, since on-time delivery of an unused system creates no value

28. Management accepts a risk that exceeds the organization's stated appetite. What should the auditor do?

• A. Remove the finding, since management has accepted the risk
• B. Report the matter externally to the regulator immediately
• C. Override the decision and require remediation
• D. Confirm the acceptance was made at an appropriate authority level and documented, and escalate to the audit committee if the residual risk remains unacceptable

29. An organization outsources application hosting to a third party. Where does accountability for the controls reside?

• A. With the regulator that approved the arrangement
• B. Accountability is shared equally regardless of the contract
• C. With the organization, which can delegate the activity but not the accountability, and must obtain assurance over the provider's controls
• D. With the provider, which assumes full accountability under the contract

30. An organization's control self-assessment programme is in place. How does it relate to internal audit's work?

• A. It engages process owners in evaluating their own controls, and internal audit may rely on it only after validating its quality and objectivity
• B. It is performed by internal audit on behalf of process owners
• C. It has no relationship to the audit plan
• D. It replaces the need for internal audit testing entirely

31. An auditor reviews a third-party assurance report covering a service provider. What must be checked beyond the opinion?

• A. Whether the report's scope, period and control objectives cover the services relied upon, and how complementary user entity controls are addressed
• B. Only whether the opinion is unqualified
• C. Only the identity of the reporting auditor
• D. Only the report's issue date

32. An IT governance framework assigns decision rights for technology investment. Who should hold ultimate accountability?

• A. The IT department, which understands the technology
• B. The external service provider delivering the systems
• C. The internal audit function
• D. The board and executive management, since IT investment allocates enterprise resources against enterprise objectives

33. An auditor finds that a critical vendor has no documented exit plan. Why is this a governance concern?

• A. Because concentration in a provider without a transition path leaves the organization unable to exit on acceptable terms if service or the relationship deteriorates
• B. Because it prevents the vendor from being paid
• C. Because it invalidates the vendor's assurance report
• D. Because exit plans are required by all data protection regulation

34. An organization defines key performance indicators and key risk indicators for IT. What is the distinction?

• A. The two are the same metrics reported to different audiences
• B. Performance indicators measure achievement of objectives, while risk indicators are forward-looking signals that exposure is rising
• C. Risk indicators measure past performance and performance indicators predict the future
• D. Risk indicators apply only to financial risk

35. Executive management wants to confirm that the organization's IT strategic plan remains aligned with overall business strategy as business priorities shift over time. Which practice BEST supports ongoing alignment rather than a one-time check?

• A. Delegating all strategic technology decisions permanently to the IT department without executive involvement
• B. Approving the IT strategic plan once and revisiting it only when a major system failure occurs
• C. Periodically reviewing and updating the IT strategy against evolving business objectives on a defined cycle
• D. Relying on the annual external audit to flag misalignment between IT and business strategy

36. An IS auditor reviews a corporate document that mandates minimum password length and complexity settings that every system must enforce. In a well-structured documentation hierarchy, what type of document is this?

• A. A policy, because it states management's high-level intent for security
• B. A guideline, because it suggests recommended practices for administrators
• C. A standard, because it specifies mandatory settings that implement policy intent
• D. A procedure, because it lists steps for configuring authentication

37. An IT steering committee is documented as responsible for approving major technology investments, but in practice the CIO regularly approves large projects unilaterally without committee review. From a governance perspective, what is the MOST significant concern?

• A. The steering committee meets too infrequently to be useful
• B. The CIO lacks sufficient technical expertise to approve projects alone
• C. Decision rights defined in governance documentation are not being followed in practice
• D. Technology investment decisions are being made too quickly for the organization's needs

38. An organization has run a mandatory annual security-awareness course for three years. Which measure would give management the BEST evidence that the program is actually changing employee behavior?

• A. Course completion rates across all departments
• B. The number of hours of training content produced each year
• C. Employee satisfaction scores for the training modules
• D. A declining click rate on simulated phishing campaigns over successive tests

39. A marketing analyst requests read access to a customer data set maintained on a shared platform. Under a sound data governance model, who should APPROVE this access request?

• A. The database administrator, because they can technically grant the access
• B. The requesting analyst's direct manager, because they know the analyst's duties
• C. The data owner, because they are accountable for how the data is used and by whom
• D. The IT help desk, because access requests flow through its ticketing system

40. A financial services firm requires employees in sensitive treasury-system roles to take an uninterrupted two-week vacation each year, during which their duties are performed by others. What is the PRIMARY control rationale for this requirement?

• A. It reduces payroll costs by spreading work across more employees
• B. It allows managers to evaluate whether the role can be eliminated
• C. It ensures compliance with occupational health regulations on rest periods
• D. It increases the chance that concealed irregularities or fraud will surface while another person performs the duties

41. Which of the following is the PRIMARY reason organizations conduct periodic disaster recovery (DR) testing rather than relying solely on a documented DR plan?

• A. To satisfy an annual budget requirement
• B. To validate that the plan actually works in practice and to identify gaps before a real disaster occurs
• C. To reduce the need for a documented plan going forward
• D. To replace the need for offsite data backups

42. An IS auditor reviewing change management for a production ERP system notes that emergency changes are deployed without prior testing but are documented after the fact. What is the BEST recommendation?

• A. Allow emergency changes to bypass all documentation requirements permanently
• B. Eliminate the emergency change process entirely
• C. Require the same multi-week testing cycle for emergency changes as standard changes
• D. Require post-implementation review and retrospective approval with documented justification for each emergency change

43. An organization performs full backups weekly and incremental backups daily. If a server fails on a Thursday (3 days after the last full backup), what is required to fully restore data to the most recent point?

• A. Only the original full backup from initial system setup
• B. Only the most recent incremental backup
• C. No backups are needed if the system has RAID storage
• D. The last full backup plus each incremental backup taken since, applied in sequence

44. During a review of an organization's incident management process, an IS auditor finds that security incidents are resolved but root cause analysis is rarely performed. What is the MOST significant long-term risk?

• A. Recurring incidents from the same underlying cause, since the true source of the problem is never addressed
• B. Faster incident closure times going forward
• C. Increased helpdesk ticket volume in the short term only
• D. Improved compliance with service level agreements

45. An IS auditor reviewing capacity management notes that a critical database server has consistently run at 95% CPU utilization for the past quarter with no capacity plan in place. What is the MOST significant risk?

• A. Users will need additional training on the application
• B. The server may be under warranty expiration soon
• C. Performance degradation or an outage as demand grows, potentially disrupting critical business operations
• D. The vendor may increase software licensing costs

46. An organization's business continuity plan (BCP) specifies a recovery time objective (RTO) of 4 hours for its order-processing system. What does this RTO represent?

• A. The frequency at which backups must be taken
• B. The total time allotted for annual disaster recovery testing
• C. The maximum acceptable amount of data loss measured in time
• D. The maximum acceptable time the system can be unavailable before causing unacceptable business impact

47. An incident and a problem are distinguished in service management. What is the difference?

• A. An incident is an unplanned interruption requiring restoration of service, while a problem is the underlying cause requiring elimination
• B. An incident is more severe than a problem by definition
• C. A problem is a customer complaint and an incident is a system fault
• D. The two terms are interchangeable

48. An organization maintains a hot site for disaster recovery. What characterizes it relative to a cold site?

• A. It is an empty facility with power and connectivity only
• B. It requires no testing because it mirrors production
• C. It costs less than a cold site because it is shared
• D. It is fully equipped and current, enabling resumption within a short period, at substantially higher cost than an empty facility requiring build-out

49. A system has a recovery point objective of four hours and a recovery time objective of eight hours. What do these mean?

• A. Up to four hours of data may be lost, and the system must be restored to service within eight hours of the disruption
• B. The system must be restored within four hours and may lose eight hours of data
• C. Backups run every eight hours and are retained for four hours
• D. The system may be unavailable for four hours per month

50. A disaster recovery plan is tested using a walkthrough rather than a full interruption test. What is the limitation?

• A. It validates understanding and documentation but does not demonstrate that the technical recovery actually works under real conditions
• B. It is more disruptive than a full interruption test
• C. It cannot involve business stakeholders
• D. It provides equivalent assurance to a full test at lower cost

51. An organization applies capacity management to its infrastructure. What is the audit-relevant objective?

• A. Reducing the number of servers regardless of demand
• B. Ensuring resources meet current and projected demand so availability commitments are met without unnecessary expenditure
• C. Eliminating the need for performance monitoring
• D. Ensuring all systems run at maximum utilization

52. An auditor reviews backup practices and finds backups run nightly and complete successfully. What further evidence is essential?

• A. Evidence that restoration from those backups has been tested successfully, since a backup that cannot be restored provides no recovery capability
• B. The brand of backup software in use
• C. The physical size of the backup media
• D. The number of backup jobs configured

53. A business impact analysis has been completed. What does it establish that a risk assessment does not?

• A. The criticality of each process and the maximum tolerable outage, which drive recovery objectives
• B. The likelihood of each threat occurring
• C. The technical configuration of recovery infrastructure
• D. The cost of cyber insurance premiums

54. An organization conducts a disaster recovery exercise in which staff actually shift live production processing to the alternate recovery site for several hours to validate that recovery procedures work under real operating conditions, rather than simply talking through the plan in a conference room. Which type of DR test is being performed, and how does it differ from a structured walkthrough?

• A. A tabletop discussion, which is functionally identical to a structured walkthrough
• B. A checklist review, which only confirms that recovery documentation exists
• C. A parallel or simulation test, which exercises actual recovery procedures and processing rather than only discussing them
• D. A paper-based audit, which relies solely on reviewing prior test reports

55. A critical order-processing application runs across two active servers behind a load balancer, configured so that if one server fails, the other automatically continues processing all transactions without interruption to users. What availability design does this describe?

• A. A cold standby recovery configuration
• B. High-availability clustering with automatic failover
• C. A scheduled maintenance window strategy
• D. A manual disaster recovery invocation procedure

56. Over time, an organization's virtualized data center has accumulated hundreds of virtual machines, many created for short-term projects and never decommissioned, with no complete inventory of what is running or why. What is the PRIMARY risk this situation creates?

• A. Cloud computing costs are always higher than on-premises computing regardless of utilization
• B. The hypervisor software will refuse to run additional virtual machines once a fixed limit is reached
• C. Virtual machines cannot be created faster than physical servers under any circumstances
• D. Unmanaged, unpatched virtual machines increase the attack surface and may go unmonitored for security and compliance issues

57. A nightly batch process that updates customer account balances calculates a control total of all transaction amounts before processing and compares it to a control total calculated after processing completes. What does a match between these two totals PRIMARILY provide assurance of?

• A. That the batch job completed and processed the input data without unexplained loss or duplication
• B. That the customer account balances are accurate as of the date of processing
• C. That no unauthorized person accessed the batch processing server
• D. That the application code contains no logical defects

58. An organization moves an application from on-premises infrastructure to a cloud provider's infrastructure-as-a-service offering. Under the shared responsibility model typically used by such providers, which party is generally responsible for securing the guest operating system and application running on the provisioned virtual machines?

• A. The customer remains responsible for the guest operating system, application, and data, while the provider secures the underlying physical infrastructure
• B. Neither party is responsible until a security incident actually occurs
• C. Responsibility is transferred entirely to any third-party auditor engaged to review the environment
• D. The cloud provider is solely responsible for all layers, including the guest operating system

59. An organization has a business continuity plan covering people, facilities, and manual workaround procedures for critical business processes, and separately maintains a plan focused specifically on restoring IT systems and data supporting those processes. How do these two plans relate to one another?

• A. The IT-focused disaster recovery plan is a supporting component that enables the broader business continuity plan's process-recovery objectives
• B. The two plans address entirely unrelated risks and are never coordinated
• C. They are identical documents required to be maintained separately only for regulatory formality
• D. The business continuity plan is unnecessary once an IT disaster recovery plan exists

60. An IS auditor reviewing endpoint protection finds that antivirus software is installed on all workstations but signature updates have not been applied in over four months due to a misconfigured update service. What is the MOST significant consequence of this finding?

• A. Users will be unable to log in to their workstations until updates resume
• B. Workstations will run noticeably faster without frequent signature updates
• C. The antivirus software will automatically uninstall itself after a period of inactivity
• D. Endpoints have reduced ability to detect malware variants identified since the last update, increasing infection risk

61. A project team wants to select a system development methodology that allows for iterative delivery and frequent stakeholder feedback on a project with evolving requirements. Which approach is MOST appropriate?

• A. Traditional waterfall model with a single delivery at project end
• B. Agile methodology with iterative sprints and regular stakeholder review
• C. A big-bang cutover with no phased releases
• D. A methodology with no defined requirements process

62. Which system development life cycle (SDLC) phase is MOST critical for identifying and documenting security requirements to avoid costly rework later?

• A. Requirements definition
• B. Post-implementation support
• C. Decommissioning
• D. Final user training

63. An IS auditor is reviewing a new system development project and notes that user acceptance testing (UAT) was skipped due to schedule pressure. What is the MOST significant risk of this omission?

• A. The project may be delivered slightly under budget
• B. System documentation will automatically be more accurate
• C. Business requirements may not be validated, increasing the risk the system fails to meet user needs in production
• D. The development team will need to write less code

64. An organization is migrating from a legacy system to a new ERP. Which data conversion control provides the STRONGEST assurance that all records were migrated completely and accurately?

• A. A verbal confirmation from the project manager that migration is complete
• B. Independent reconciliation of record counts and control totals between the old and new systems
• C. Reviewing the migration tool's marketing documentation
• D. Confirming the new system's user interface looks similar to the old one

65. During a post-implementation review, an IS auditor finds that the project's original business case benefits were never re-measured after go-live. What should the auditor recommend?

• A. No action is needed since the system is functioning technically
• B. Cancel the project retroactively
• C. Perform a benefits realization assessment comparing actual outcomes to the original business case
• D. Rewrite the business case to match whatever was delivered

66. An organization plans a parallel changeover from an old system to a new one. What is the principal advantage over a direct cutover?

• A. It eliminates the need for data conversion
• B. It is the least costly changeover approach
• C. It requires no user training on the new system
• D. Both systems run concurrently so results can be compared and the old system remains available as a fallback, reducing implementation risk

67. A change management process requires approval before deployment. What does an auditor test to conclude the control operated?

• A. A sample of production changes traced back to documented approval, plus a search for changes that reached production without a corresponding record
• B. Only the change management policy document
• C. Only the list of approved change requests
• D. Only the number of changes deployed in the period

68. An auditor reviews a data conversion from a legacy system. What control most directly addresses conversion completeness?

• A. Retaining a backup of the legacy database
• B. Restricting access to the conversion tool
• C. Reconciliation of record counts and control totals between source and target, with documented investigation of differences
• D. Encryption of the data in transit during conversion

69. A developer requires access to the production environment to resolve an urgent defect. What compensating control is appropriate?

• A. Time-limited, approved and logged emergency access with independent review of the actions taken afterward
• B. Permanent production access for the development team
• C. Granting access without logging to avoid slowing the fix
• D. Allowing the developer to disable audit logging during the change

70. What is the purpose of user acceptance testing in a system implementation?

• A. To verify that individual code modules function correctly
• B. To measure system performance under peak load
• C. To confirm the vendor has been paid
• D. To confirm the system meets business requirements from the user's perspective before it is accepted into production

71. A project delivers a system that meets its specification but not the business need. What control weakness does this most likely indicate?

• A. Inadequate requirements definition and stakeholder involvement at the outset
• B. Insufficient unit testing during construction
• C. Weak production change management
• D. Inadequate backup procedures

72. An organization uses agile development. How does this affect the auditor's approach to controls?

• A. The control objectives remain the same while the evidence changes form, appearing in backlogs, automated pipeline gates and iteration records rather than phase-gate documents
• B. The auditor should require the organization to adopt a waterfall method
• C. Only the final release requires any control evidence
• D. Control objectives no longer apply in an agile environment

73. A new order-management system must exchange data in real time with an existing inventory system and a separate billing system. Beyond testing each system individually, what additional testing is essential before go-live?

• A. Interface testing to confirm data is correctly transmitted, received, and interpreted between the connected systems
• B. Usability testing limited to the order-management system's screens
• C. A code-freeze period with no testing activity at all
• D. Testing only the billing system, since it is the final system in the data flow

74. A large systems integration project has multiple interdependent activities. The project manager identifies the sequence of dependent tasks that determines the shortest possible time to complete the project, and any delay to a task in that sequence delays the entire project. What is this sequence called?

• A. The critical path
• B. The change freeze window
• C. The scope baseline
• D. The stakeholder register

75. Business stakeholders have reviewed a system's functional specifications and formally documented their agreement that the specifications accurately capture what the business needs. What is the PRIMARY purpose of obtaining this sign-off before development begins?

• A. To establish an agreed baseline of requirements, reducing the risk of scope disputes and rework later in the project
• B. To eliminate the need for user acceptance testing once the system is built
• C. To satisfy a requirement that only applies to government-sector system implementations
• D. To transfer legal liability for the entire project from the vendor to the business stakeholders

76. During a code review of a web application, a reviewer flags that user-supplied input is concatenated directly into database query strings without validation or parameterization. What is the PRIMARY risk this practice introduces?

• A. Increased licensing costs for the database platform
• B. Injection attacks that could allow unauthorized access to or manipulation of data
• C. Slower application performance under normal user load
• D. Difficulty in translating the application into other languages

77. An organization migrating to a new ERP system has completed the technical data conversion but has not defined what will happen if critical post-conversion validation reveals unacceptable data errors after go-live. What should the project team have established BEFORE go-live to address this gap?

• A. A documented fallback and rollback plan for reverting to the legacy system if conversion problems are discovered
• B. A marketing communication plan announcing the new system to external customers
• C. A help desk staffing schedule for the first week after go-live
• D. A long-term decommissioning schedule for legacy hardware five years in the future

78. A change control board reviews a proposed enhancement to a production financial system and must decide whether to approve, defer, or reject the change before it proceeds to development. Which of the following is the board's PRIMARY responsibility in this review?

• A. Writing the technical specification for how the enhancement will be coded
• B. Assessing the business justification, risk, and impact of the proposed change before authorizing it to proceed
• C. Personally performing the testing of the change once development is complete
• D. Approving the annual budget for the entire development department

79. During system testing, developers use a copy of the production environment's configuration but with a completely separate database instance and network segment from live production. What is the PRIMARY control objective served by this separation?

• A. To allow developers unrestricted, unmonitored access to production data for realistic testing
• B. To prevent test activities, including invalid or malformed data, from affecting live production data and operations
• C. To eliminate the need for a formal user acceptance testing phase
• D. To reduce the total cost of software licensing across environments

80. A development team using an agile methodology holds a session at the end of each sprint to discuss what went well, what did not, and what process changes to make in the next sprint. Which agile practice is being described?

• A. Sprint retrospective
• B. Sprint planning
• C. Daily stand-up
• D. Product backlog grooming

81. An IS auditor discovers that terminated employees' network accounts remain active for an average of 30 days after departure. What is the MOST significant risk this presents?

• A. Increased software licensing costs only
• B. Slower network performance due to unused accounts
• C. Unauthorized access to systems and data by former employees or others using their still-active credentials
• D. Increased helpdesk password reset requests

82. Which access control model grants permissions based on a user's assigned job function rather than granting permissions to each individual user directly?

• A. Role-based access control (RBAC)
• B. Mandatory access control (MAC)
• C. Discretionary access control (DAC)
• D. Rule-based routing

83. Media containing sensitive data is decommissioned. What disposal control is appropriate?

• A. Deleting the files and reformatting the drive
• B. Sanitization or destruction appropriate to the media type and data sensitivity, with documented evidence of completion
• C. Storing the media indefinitely in a locked room
• D. Returning the media to the original vendor without further action

84. An auditor reviews the physical security of a data centre. Which control best addresses tailgating?

• A. A mantrap or interlocking door arrangement permitting one authenticated person through at a time
• B. A visitor sign-in log at reception
• C. Closed circuit television covering the entrance
• D. A door alarm sounding when held open

85. An auditor examines security event logging. Beyond generating logs, what is essential?

• A. That logs are generated at the highest verbosity for all systems
• B. That logs are protected from alteration, retained for an adequate period and actually reviewed or monitored for indicators requiring action
• C. That logs are stored on the same system that generates them
• D. That log files are deleted regularly to control storage cost

86. An auditor reviews user access recertification. What is the control's purpose?

• A. Periodic confirmation by an accountable owner that each user's access remains appropriate, catching accumulation from role changes and departures
• B. Confirming that the access management system is licensed
• C. Testing whether users can access systems from remote locations
• D. Verifying that users remember their passwords

87. An auditor assesses a data loss prevention deployment. What limits its effectiveness?

• A. Its inability to inspect any network traffic
• B. Its incompatibility with encryption of any kind
• C. Its dependence on accurate data identification and on covering the channels actually used, since unclassified data or an uncovered channel passes unexamined
• D. The requirement that it be deployed only on servers

88. Data is classified into sensitivity levels. What does classification primarily enable?

• A. Automatic encryption of all organizational data
• B. Proportionate application of controls, so protection effort matches the consequence of disclosure or loss
• C. Elimination of the need for access controls
• D. Compliance with all applicable regulations by itself

89. An organization deploys multi-factor authentication. What makes an authentication scheme genuinely multi-factor?

• A. The factors come from different categories such as something known, something possessed and something inherent
• B. The password must exceed a minimum length
• C. Authentication is required at more than one system
• D. Two separate passwords are required

90. An organization encrypts data at rest in a database. What risk does this address, and what does it not?

• A. It protects against exposure of the underlying storage media or files, but not against an attacker or user operating through an authorized application session
• B. It removes the need for access controls on the database
• C. It protects data in transit across the network
• D. It protects against all forms of unauthorized data access

91. An auditor evaluates logical access controls. What does the principle of least privilege require?

• A. Each account holds only the access necessary for its function, and no more, for as long as it is needed
• B. Administrators require no access restrictions
• C. All users share a common access profile for consistency
• D. Access is granted broadly and revoked when misuse is detected

92. A development team needs realistic data to test a new application feature but is prohibited from using actual customer records due to privacy requirements. The team instead uses a process that replaces sensitive values, such as names and account numbers, with fictitious but realistically formatted substitutes while preserving the data's structure and referential integrity. What technique is being used?

• A. Data masking (or de-identification) of test data
• B. Data compression to reduce test environment storage requirements
• C. Data replication to synchronize test and production environments
• D. Data archiving to move records to long-term storage

93. An organization allows employees to access corporate email and internal applications from personally owned smartphones, and enrolls each device in a platform that can enforce passcode requirements, encrypt corporate data, and remotely wipe only the corporate data if the device is lost or the employee departs. What capability is being described?

• A. A virtual private network client installed without any device enrollment
• B. Mobile device management (MDM), enforcing security policy and enabling selective remote wipe of corporate data
• C. A guest wireless network with no access to internal systems
• D. A firewall rule restricting smartphone access entirely

94. An organization evaluates a biometric fingerprint authentication system and is comparing two configurations: one tuned to more readily accept a scanned fingerprint as a match, and one tuned to be more conservative before accepting a match. Which tradeoff does adjusting this sensitivity setting PRIMARILY create?

• A. A tradeoff between the false acceptance rate and the false rejection rate of the system
• B. A tradeoff between the cost of the biometric hardware and its expected physical lifespan
• C. A tradeoff between the number of supported biometric modalities and network bandwidth usage
• D. A tradeoff between the biometric system's color display resolution and its battery life

95. A security operations center subscribes to external feeds that provide up-to-date information on newly identified attack indicators, malicious IP addresses, and emerging attack techniques, and automatically correlates this information against the organization's own network traffic to flag potential matches. What is the PRIMARY benefit this integration provides?

• A. It guarantees that the organization will never experience a successful cyberattack
• B. It eliminates the need for the organization to maintain any internal security staff
• C. It enables faster identification of known threats affecting the organization by leveraging external knowledge of current attack activity
• D. It automatically negotiates lower cyber-insurance premiums with the organization's insurer

96. An organization encrypts sensitive data using symmetric encryption keys but stores those keys in a plaintext configuration file on the same server as the encrypted data, with no defined process for rotating keys periodically. What is the MOST significant weakness in this approach?

• A. Encryption always significantly degrades application performance regardless of implementation
• B. Storing keys alongside the data they protect, without rotation, undermines the protection encryption is meant to provide
• C. Symmetric encryption is inherently weaker than asymmetric encryption in all circumstances
• D. Symmetric keys cannot be used to encrypt data stored in a database

97. A security team deploys a device that not only detects suspicious network traffic patterns but can also automatically block or drop malicious traffic in real time before it reaches its intended target, rather than only generating an alert for later review. Which type of security control does this describe, and how does it differ from a detection-only device?

• A. An intrusion prevention system, which actively blocks malicious traffic rather than only alerting on it like an intrusion detection system
• B. An intrusion detection system, which is functionally identical to a firewall in every respect
• C. A data loss prevention system, which only classifies data without any network traffic function
• D. A vulnerability scanner, which identifies weaknesses but never interacts with live network traffic

98. A software development team building a new customer-facing application decides to identify what personal data the application will collect, minimize collection to only what is strictly necessary, and build in default privacy protections before writing any code, rather than adding privacy controls after the application is complete. What principle does this approach reflect?

• A. Privacy by design, embedding privacy protections into a system from the earliest stages of development
• B. Defense in depth, layering multiple unrelated security controls regardless of data sensitivity
• C. Least privilege, restricting employee access rights based on job function
• D. Separation of duties, dividing incompatible functions among different individuals

99. An organization's access provisioning process requires that the person requesting new system access, the manager who approves the request, and the administrator who actually grants the access in the system all be different individuals, with no single person able to perform more than one of these roles for the same request. What risk does this design PRIMARILY mitigate?

• A. The risk that a single individual could request, approve, and grant themselves unauthorized access without independent oversight
• B. The risk that access requests will take longer to process than a single-step approval
• C. The risk that the system will run out of available user account licenses
• D. The risk that the help desk will receive too many password reset requests

100. After several employees fell for a simulated phishing email during a security awareness campaign, the organization now sends similar simulations quarterly and tracks click rates over time, along with providing immediate targeted training to anyone who fails a simulation. What is the PRIMARY value of continuing this practice over time rather than running it once?

• A. It guarantees that no employee will ever fall for an actual phishing attack again
• B. It satisfies a one-time training requirement that never needs to be repeated
• C. It transfers all responsibility for phishing losses from the organization to individual employees
• D. It measures whether awareness is improving over time and reinforces behavior through repeated, targeted reinforcement