CISA Practice Test.

1. During the planning phase of an IS audit, an IS auditor discovers that a business process has never been formally risk-assessed. What should the auditor do FIRST?

• A. Perform a risk assessment of the process to determine audit scope and priority
• B. Exclude the process from the audit since no risk assessment exists
• C. Immediately report the missing risk assessment to the audit committee as a finding
• D. Ask management to sign off on the process as low risk before proceeding

2. An IS auditor is evaluating evidence gathered during fieldwork. Which characteristic of evidence is MOST important when the auditor must rely on it to support a significant audit finding?

• A. The evidence was easy and inexpensive to obtain
• B. The evidence confirms the auditor's initial expectations
• C. The evidence was provided directly by the process owner
• D. The evidence is sufficient, reliable, and relevant to the audit objective

3. An IS auditor finds that a control was operating effectively for 10 of 12 months tested, with two months showing exceptions due to a since-corrected configuration error. What is the MOST appropriate conclusion?

• A. The control can be rated fully effective because it is now corrected
• B. The control exceptions should be reported along with root cause, remediation, and residual risk during the exception period
• C. The finding should be dropped since the issue is already fixed
• D. The sample size is too small to draw any conclusion

4. Which sampling method is MOST appropriate when an IS auditor wants every item in the population to have an equal chance of selection, without bias from the auditor's judgment?

• A. Discovery sampling only
• B. Haphazard sampling
• C. Judgmental sampling
• D. Statistical (random) sampling

5. During an audit, management disagrees with a draft finding and provides additional documentation not previously available to the auditor. What is the BEST course of action?

• A. Escalate immediately to the audit committee without reviewing the documentation
• B. Ignore the new documentation since the audit fieldwork is complete
• C. Remove the finding automatically to maintain a good working relationship with management
• D. Evaluate the new evidence objectively and revise the finding if warranted before finalizing the report

6. An organization's internal audit charter grants the CISA-certified auditor authority to review all IT systems but is silent on access to third-party service providers used for payroll processing. What is the BEST way to address this gap?

• A. Assume authority extends automatically to any vendor touching company data
• B. Rely solely on the vendor's own internal audit reports without independent verification
• C. Update the audit charter or contractual right-to-audit clauses to explicitly cover third-party providers
• D. Decline to audit any process that involves a third party

7. An IT steering committee is reviewing whether a proposed enterprise system project aligns with the organization's strategic objectives. This activity is a core function of which governance concept?

• A. Configuration management
• B. Change management
• C. IT governance and strategic alignment
• D. IT service level management

8. A company's IT risk register lists a risk as 'high likelihood, high impact' but no owner or treatment plan is assigned. From a governance perspective, what is the MOST significant concern?

• A. The risk register format does not use a heat map
• B. Without an assigned owner and treatment plan, accountability for managing the risk to an acceptable level is unclear
• C. The risk should be removed from the register since it lacks an owner
• D. High likelihood and high impact risks cannot coexist in a valid register

9. Which of the following BEST describes the purpose of segregation of duties (SoD) within an IT organization's governance structure?

• A. To eliminate the need for management review of transactions
• B. To reduce the number of employees required to run IT operations
• C. To ensure no single individual can both perform and conceal an error or irregularity through incompatible functions
• D. To guarantee compliance with all software licensing agreements

10. An organization outsources its data center operations. Under an effective IT governance framework, which statement about accountability is MOST accurate?

• A. Accountability for the outsourced function transfers entirely to the service provider
• B. The organization retains ultimate accountability for outcomes even though operational responsibility is delegated to the provider
• C. No governance oversight is needed once a contract is signed
• D. Accountability is shared equally and cannot be defined further

11. A CIO wants to measure whether IT investments are delivering expected business value. Which approach BEST supports this governance objective?

• A. Tracking IT spend against budget only
• B. Establishing a benefits realization framework with defined metrics tied to business objectives
• C. Counting the number of IT projects completed each year
• D. Relying on vendor satisfaction surveys

12. An IS auditor is reviewing a new system development project and notes that user acceptance testing (UAT) was skipped due to schedule pressure. What is the MOST significant risk of this omission?

• A. The project may be delivered slightly under budget
• B. System documentation will automatically be more accurate
• C. Business requirements may not be validated, increasing the risk the system fails to meet user needs in production
• D. The development team will need to write less code

13. During a post-implementation review, an IS auditor finds that the project's original business case benefits were never re-measured after go-live. What should the auditor recommend?

• A. No action is needed since the system is functioning technically
• B. Cancel the project retroactively
• C. Perform a benefits realization assessment comparing actual outcomes to the original business case
• D. Rewrite the business case to match whatever was delivered

14. Which system development life cycle (SDLC) phase is MOST critical for identifying and documenting security requirements to avoid costly rework later?

• A. Requirements definition
• B. Post-implementation support
• C. Decommissioning
• D. Final user training

15. An organization is migrating from a legacy system to a new ERP. Which data conversion control provides the STRONGEST assurance that all records were migrated completely and accurately?

• A. A verbal confirmation from the project manager that migration is complete
• B. Independent reconciliation of record counts and control totals between the old and new systems
• C. Reviewing the migration tool's marketing documentation
• D. Confirming the new system's user interface looks similar to the old one

16. A project team wants to select a system development methodology that allows for iterative delivery and frequent stakeholder feedback on a project with evolving requirements. Which approach is MOST appropriate?

• A. Traditional waterfall model with a single delivery at project end
• B. Agile methodology with iterative sprints and regular stakeholder review
• C. A big-bang cutover with no phased releases
• D. A methodology with no defined requirements process

17. An IS auditor reviewing change management for a production ERP system notes that emergency changes are deployed without prior testing but are documented after the fact. What is the BEST recommendation?

• A. Allow emergency changes to bypass all documentation requirements permanently
• B. Eliminate the emergency change process entirely
• C. Require the same multi-week testing cycle for emergency changes as standard changes
• D. Require post-implementation review and retrospective approval with documented justification for each emergency change

18. An organization's business continuity plan (BCP) specifies a recovery time objective (RTO) of 4 hours for its order-processing system. What does this RTO represent?

• A. The frequency at which backups must be taken
• B. The total time allotted for annual disaster recovery testing
• C. The maximum acceptable amount of data loss measured in time
• D. The maximum acceptable time the system can be unavailable before causing unacceptable business impact

19. During a review of an organization's incident management process, an IS auditor finds that security incidents are resolved but root cause analysis is rarely performed. What is the MOST significant long-term risk?

• A. Recurring incidents from the same underlying cause, since the true source of the problem is never addressed
• B. Faster incident closure times going forward
• C. Increased helpdesk ticket volume in the short term only
• D. Improved compliance with service level agreements

20. An organization performs full backups weekly and incremental backups daily. If a server fails on a Thursday (3 days after the last full backup), what is required to fully restore data to the most recent point?

• A. Only the original full backup from initial system setup
• B. Only the most recent incremental backup
• C. No backups are needed if the system has RAID storage
• D. The last full backup plus each incremental backup taken since, applied in sequence

21. Which of the following is the PRIMARY reason organizations conduct periodic disaster recovery (DR) testing rather than relying solely on a documented DR plan?

• A. To satisfy an annual budget requirement
• B. To validate that the plan actually works in practice and to identify gaps before a real disaster occurs
• C. To reduce the need for a documented plan going forward
• D. To replace the need for offsite data backups

22. An IS auditor reviewing capacity management notes that a critical database server has consistently run at 95% CPU utilization for the past quarter with no capacity plan in place. What is the MOST significant risk?

• A. Users will need additional training on the application
• B. The server may be under warranty expiration soon
• C. Performance degradation or an outage as demand grows, potentially disrupting critical business operations
• D. The vendor may increase software licensing costs

23. Which access control model grants permissions based on a user's assigned job function rather than granting permissions to each individual user directly?

• A. Role-based access control (RBAC)
• B. Mandatory access control (MAC)
• C. Discretionary access control (DAC)
• D. Rule-based routing

24. An IS auditor discovers that terminated employees' network accounts remain active for an average of 30 days after departure. What is the MOST significant risk this presents?

• A. Increased software licensing costs only
• B. Slower network performance due to unused accounts
• C. Unauthorized access to systems and data by former employees or others using their still-active credentials
• D. Increased helpdesk password reset requests

25. An organization wants to evaluate IT performance from multiple perspectives, including financial return, internal process efficiency, customer satisfaction, and organizational learning, rather than relying on financial metrics alone. Which management tool is BEST suited to this objective?

• A. A balanced scorecard incorporating multiple performance perspectives
• B. A single return-on-investment calculation for the IT department
• C. A capability maturity model assessment of IT processes
• D. An annual IT budget variance report

26. During system development, a project manager wants to estimate the relative size and effort of a proposed application based on the number and complexity of its inputs, outputs, inquiries, and internal data structures, independent of the programming language to be used. Which estimation technique is being applied?

• A. Program evaluation and review technique
• B. Earned value management
• C. Critical path method
• D. Function point analysis

27. A software delivery organization distinguishes between activities that build quality into its development process and activities that inspect deliverables for defects before release. Which pairing correctly labels these two sets of activities?

• A. Quality control for process design; quality assurance for defect inspection
• B. Both are quality assurance; quality control applies only to manufacturing
• C. Quality assurance for process-focused prevention; quality control for product-focused detection
• D. Both are quality control; quality assurance is a governance-board activity only

28. An organization is acquiring a smaller competitor and plans to integrate its systems within a year. From an IT governance perspective, what should due diligence PRIMARILY assess before the deal closes?

• A. Whether the target's staff prefer the acquirer's collaboration tools
• B. The target's IT risks, including security posture, licensing obligations, and integration compatibility
• C. Whether the acquirer's data center has spare rack space for the target's servers
• D. Whether the target's brand colors can be applied to the acquirer's intranet

29. A financial services firm requires employees in sensitive treasury-system roles to take an uninterrupted two-week vacation each year, during which their duties are performed by others. What is the PRIMARY control rationale for this requirement?

• A. It reduces payroll costs by spreading work across more employees
• B. It allows managers to evaluate whether the role can be eliminated
• C. It ensures compliance with occupational health regulations on rest periods
• D. It increases the chance that concealed irregularities or fraud will surface while another person performs the duties

30. An organization is negotiating a service level agreement with a cloud provider for a business-critical application. Which SLA characteristic MOST enables effective ongoing governance of the provider's performance?

• A. A statement that the provider will use its best efforts to maintain availability
• B. A commitment to industry-leading service expressed in the marketing schedule
• C. Objectively measurable service targets with regular performance reporting and defined remedies for misses
• D. A clause allowing the customer to terminate for convenience at any time

31. An IS auditor is planning an engagement and must decide how much testing to perform. What primarily drives that decision?

• A. The preferences of the audited business unit
• B. The number of staff available in the audit function
• C. The size of the department's budget
• D. The assessed risk of the area under review, since audit effort is allocated where misstatement or control failure would matter most

32. An IS auditor gathers evidence through several methods on the same control. Which evidence is generally considered most reliable?

• A. Evidence the auditor obtains directly through independent observation or reperformance
• B. A written representation from the process owner
• C. A system-generated report supplied by the auditee without validation
• D. An internal procedure document describing how the control should operate

33. What distinguishes a test of control design from a test of operating effectiveness?

• A. Design testing asks whether a properly functioning control would address the risk, while effectiveness testing asks whether it actually operated as intended over the period
• B. Design testing is performed by the auditee and effectiveness testing by the auditor
• C. Design testing uses sampling and effectiveness testing uses inquiry
• D. The two are interchangeable descriptions of the same procedure

34. An auditor uses attribute sampling to test whether change approvals were obtained. What is being measured?

• A. The average time taken to approve a change
• B. The monetary value of unapproved changes
• C. The total number of changes in the population
• D. The rate of deviation from the control, expressed as a proportion of items lacking the attribute

35. An auditor discovers a control deficiency mid-engagement. What is the appropriate immediate action?

• A. Withhold the finding until the report is issued in all cases
• B. Correct the deficiency personally to demonstrate the remediation
• C. Document the condition, criteria, cause and effect, and communicate significant matters to management on a timely basis rather than only in the final report
• D. Expand the engagement scope to every adjacent system

36. An internal audit function reports administratively to the chief information officer and functionally to the audit committee. Why does the functional reporting line matter?

• A. Because independence requires that audit conclusions and resourcing are not controlled by the management whose activities are audited
• B. Because administrative reporting is prohibited
• C. Because the audit committee performs the fieldwork
• D. Because the audit committee approves individual audit test steps

37. An auditor is asked to review a system they helped configure two years ago. What is the concern?

• A. There is no concern once two years have passed
• B. The concern applies only to external auditors
• C. The prior involvement makes the auditor the best-qualified reviewer
• D. Self-review impairs objectivity, so the assignment should be reallocated or the impairment disclosed and mitigated

38. An organization uses continuous auditing techniques. What capability does this add?

• A. Automated testing of transactions or configurations as they occur, shortening the interval between a control failure and its detection
• B. Elimination of the need for an annual audit plan
• C. A guarantee that no control failures occur
• D. Replacement of management's own monitoring responsibilities

39. An IT governance framework assigns decision rights for technology investment. Who should hold ultimate accountability?

• A. The IT department, which understands the technology
• B. The external service provider delivering the systems
• C. The internal audit function
• D. The board and executive management, since IT investment allocates enterprise resources against enterprise objectives

40. An enterprise architecture is maintained and kept current. What audit-relevant benefit does it provide?

• A. A documented view of systems, data flows and dependencies that supports impact analysis, scoping and identification of single points of failure
• B. A guarantee that all systems are patched
• C. Automatic compliance with data protection regulation
• D. Elimination of the need for a business impact analysis

41. An organization outsources application hosting to a third party. Where does accountability for the controls reside?

• A. With the regulator that approved the arrangement
• B. Accountability is shared equally regardless of the contract
• C. With the organization, which can delegate the activity but not the accountability, and must obtain assurance over the provider's controls
• D. With the provider, which assumes full accountability under the contract

42. An auditor reviews a third-party assurance report covering a service provider. What must be checked beyond the opinion?

• A. Whether the report's scope, period and control objectives cover the services relied upon, and how complementary user entity controls are addressed
• B. Only whether the opinion is unqualified
• C. Only the identity of the reporting auditor
• D. Only the report's issue date

43. Management accepts a risk that exceeds the organization's stated appetite. What should the auditor do?

• A. Remove the finding, since management has accepted the risk
• B. Report the matter externally to the regulator immediately
• C. Override the decision and require remediation
• D. Confirm the acceptance was made at an appropriate authority level and documented, and escalate to the audit committee if the residual risk remains unacceptable

44. An organization defines key performance indicators and key risk indicators for IT. What is the distinction?

• A. The two are the same metrics reported to different audiences
• B. Performance indicators measure achievement of objectives, while risk indicators are forward-looking signals that exposure is rising
• C. Risk indicators measure past performance and performance indicators predict the future
• D. Risk indicators apply only to financial risk

45. A project delivers a system that meets its specification but not the business need. What control weakness does this most likely indicate?

• A. Inadequate requirements definition and stakeholder involvement at the outset
• B. Insufficient unit testing during construction
• C. Weak production change management
• D. Inadequate backup procedures

46. What is the purpose of user acceptance testing in a system implementation?

• A. To verify that individual code modules function correctly
• B. To measure system performance under peak load
• C. To confirm the vendor has been paid
• D. To confirm the system meets business requirements from the user's perspective before it is accepted into production

47. An organization plans a parallel changeover from an old system to a new one. What is the principal advantage over a direct cutover?

• A. It eliminates the need for data conversion
• B. It is the least costly changeover approach
• C. It requires no user training on the new system
• D. Both systems run concurrently so results can be compared and the old system remains available as a fallback, reducing implementation risk

48. An auditor reviews a data conversion from a legacy system. What control most directly addresses conversion completeness?

• A. Retaining a backup of the legacy database
• B. Restricting access to the conversion tool
• C. Reconciliation of record counts and control totals between source and target, with documented investigation of differences
• D. Encryption of the data in transit during conversion

49. A developer requires access to the production environment to resolve an urgent defect. What compensating control is appropriate?

• A. Time-limited, approved and logged emergency access with independent review of the actions taken afterward
• B. Permanent production access for the development team
• C. Granting access without logging to avoid slowing the fix
• D. Allowing the developer to disable audit logging during the change

50. A change management process requires approval before deployment. What does an auditor test to conclude the control operated?

• A. A sample of production changes traced back to documented approval, plus a search for changes that reached production without a corresponding record
• B. Only the change management policy document
• C. Only the list of approved change requests
• D. Only the number of changes deployed in the period

51. An organization uses agile development. How does this affect the auditor's approach to controls?

• A. The control objectives remain the same while the evidence changes form, appearing in backlogs, automated pipeline gates and iteration records rather than phase-gate documents
• B. The auditor should require the organization to adopt a waterfall method
• C. Only the final release requires any control evidence
• D. Control objectives no longer apply in an agile environment

52. A business impact analysis has been completed. What does it establish that a risk assessment does not?

• A. The criticality of each process and the maximum tolerable outage, which drive recovery objectives
• B. The likelihood of each threat occurring
• C. The technical configuration of recovery infrastructure
• D. The cost of cyber insurance premiums

53. A system has a recovery point objective of four hours and a recovery time objective of eight hours. What do these mean?

• A. Up to four hours of data may be lost, and the system must be restored to service within eight hours of the disruption
• B. The system must be restored within four hours and may lose eight hours of data
• C. Backups run every eight hours and are retained for four hours
• D. The system may be unavailable for four hours per month

54. An organization maintains a hot site for disaster recovery. What characterizes it relative to a cold site?

• A. It is an empty facility with power and connectivity only
• B. It requires no testing because it mirrors production
• C. It costs less than a cold site because it is shared
• D. It is fully equipped and current, enabling resumption within a short period, at substantially higher cost than an empty facility requiring build-out

55. A disaster recovery plan is tested using a walkthrough rather than a full interruption test. What is the limitation?

• A. It validates understanding and documentation but does not demonstrate that the technical recovery actually works under real conditions
• B. It is more disruptive than a full interruption test
• C. It cannot involve business stakeholders
• D. It provides equivalent assurance to a full test at lower cost

56. An auditor reviews backup practices and finds backups run nightly and complete successfully. What further evidence is essential?

• A. Evidence that restoration from those backups has been tested successfully, since a backup that cannot be restored provides no recovery capability
• B. The brand of backup software in use
• C. The physical size of the backup media
• D. The number of backup jobs configured

57. An organization applies capacity management to its infrastructure. What is the audit-relevant objective?

• A. Reducing the number of servers regardless of demand
• B. Ensuring resources meet current and projected demand so availability commitments are met without unnecessary expenditure
• C. Eliminating the need for performance monitoring
• D. Ensuring all systems run at maximum utilization

58. An incident and a problem are distinguished in service management. What is the difference?

• A. An incident is an unplanned interruption requiring restoration of service, while a problem is the underlying cause requiring elimination
• B. An incident is more severe than a problem by definition
• C. A problem is a customer complaint and an incident is a system fault
• D. The two terms are interchangeable

59. An auditor evaluates logical access controls. What does the principle of least privilege require?

• A. Each account holds only the access necessary for its function, and no more, for as long as it is needed
• B. Administrators require no access restrictions
• C. All users share a common access profile for consistency
• D. Access is granted broadly and revoked when misuse is detected

60. An auditor reviews user access recertification. What is the control's purpose?

• A. Periodic confirmation by an accountable owner that each user's access remains appropriate, catching accumulation from role changes and departures
• B. Confirming that the access management system is licensed
• C. Testing whether users can access systems from remote locations
• D. Verifying that users remember their passwords

61. Data is classified into sensitivity levels. What does classification primarily enable?

• A. Automatic encryption of all organizational data
• B. Proportionate application of controls, so protection effort matches the consequence of disclosure or loss
• C. Elimination of the need for access controls
• D. Compliance with all applicable regulations by itself

62. An organization encrypts data at rest in a database. What risk does this address, and what does it not?

• A. It protects against exposure of the underlying storage media or files, but not against an attacker or user operating through an authorized application session
• B. It removes the need for access controls on the database
• C. It protects data in transit across the network
• D. It protects against all forms of unauthorized data access

63. An auditor reviews the physical security of a data centre. Which control best addresses tailgating?

• A. A mantrap or interlocking door arrangement permitting one authenticated person through at a time
• B. A visitor sign-in log at reception
• C. Closed circuit television covering the entrance
• D. A door alarm sounding when held open

64. Media containing sensitive data is decommissioned. What disposal control is appropriate?

• A. Deleting the files and reformatting the drive
• B. Sanitization or destruction appropriate to the media type and data sensitivity, with documented evidence of completion
• C. Storing the media indefinitely in a locked room
• D. Returning the media to the original vendor without further action

65. An auditor examines security event logging. Beyond generating logs, what is essential?

• A. That logs are generated at the highest verbosity for all systems
• B. That logs are protected from alteration, retained for an adequate period and actually reviewed or monitored for indicators requiring action
• C. That logs are stored on the same system that generates them
• D. That log files are deleted regularly to control storage cost

66. An organization deploys multi-factor authentication. What makes an authentication scheme genuinely multi-factor?

• A. The factors come from different categories such as something known, something possessed and something inherent
• B. The password must exceed a minimum length
• C. Authentication is required at more than one system
• D. Two separate passwords are required

67. An auditor assesses a data loss prevention deployment. What limits its effectiveness?

• A. Its inability to inspect any network traffic
• B. Its incompatibility with encryption of any kind
• C. Its dependence on accurate data identification and on covering the channels actually used, since unclassified data or an uncovered channel passes unexamined
• D. The requirement that it be deployed only on servers

68. An auditor is asked to provide an opinion where testing was limited because records were unavailable. What is the appropriate reporting treatment?

• A. Disclose the scope limitation and its effect on the conclusion rather than issuing an unqualified opinion
• B. Issue an unqualified opinion based on the testing that was possible
• C. Omit the affected area from the report without comment
• D. Delay the report indefinitely until records appear

69. An auditor uses computer-assisted audit techniques to test an entire population rather than a sample. What is the primary benefit?

• A. Management review of the results becomes unnecessary
• B. The need to understand the control is removed
• C. Sampling risk is eliminated for that test, since every item is examined rather than an inference drawn from a subset
• D. The reliability of the source data no longer matters

70. Management proposes a remediation action for an audit finding. What should the auditor evaluate before accepting it?

• A. Whether the action addresses the root cause rather than the symptom, and whether the owner and target date are specific enough to be followed up
• B. Whether the action is the least expensive option available
• C. Whether the action was proposed by senior rather than junior management
• D. Whether the action can be completed before the report is issued

71. An organization's control self-assessment programme is in place. How does it relate to internal audit's work?

• A. It engages process owners in evaluating their own controls, and internal audit may rely on it only after validating its quality and objectivity
• B. It is performed by internal audit on behalf of process owners
• C. It has no relationship to the audit plan
• D. It replaces the need for internal audit testing entirely

72. An auditor finds that a critical vendor has no documented exit plan. Why is this a governance concern?

• A. Because concentration in a provider without a transition path leaves the organization unable to exit on acceptable terms if service or the relationship deteriorates
• B. Because it prevents the vendor from being paid
• C. Because it invalidates the vendor's assurance report
• D. Because exit plans are required by all data protection regulation

73. An organization measures IT value delivery. What does an auditor look for beyond project delivery metrics?

• A. Whether the project team was the largest available
• B. Whether the project used the most current technology available
• C. Whether the project finished under budget regardless of scope
• D. Whether expected benefits were defined, tracked and realized after implementation, since on-time delivery of an unused system creates no value

74. While planning an IS audit of a payment-processing application, an IS auditor must decide which potential control weaknesses would be significant enough to warrant reporting to senior management if confirmed. Which audit concept PRIMARILY guides this determination?

• A. Materiality, because it defines the threshold at which a weakness or error becomes significant to stakeholders
• B. Inherent risk, because it reflects the susceptibility of the process to error before controls are considered
• C. Detection risk, because it reflects the chance that audit procedures fail to identify an existing error
• D. Sampling risk, because it measures the chance that the sample is not representative of the population

75. An IS auditor wants to estimate the total monetary value of errors in a population of automatically generated customer invoices. Which sampling approach is MOST appropriate for this objective?

• A. Attribute sampling, because it measures the rate of deviation from a prescribed control
• B. Variable sampling, because it estimates the monetary amount or quantitative value of a population characteristic
• C. Judgmental sampling, because the auditor can focus on the invoices most likely to contain errors
• D. Discovery sampling, because it is designed to find at least one example of a rare event

76. An audit manager reviews a completed IS audit file and finds procedures, evidence obtained, and conclusions recorded for each objective. What is the PRIMARY purpose served by this audit documentation?

• A. To satisfy the auditee that the audit was conducted with minimal disruption to operations
• B. To transfer ownership of identified control weaknesses from management to the audit function
• C. To eliminate the need for an exit meeting by making all findings self-explanatory
• D. To provide a defensible record that supports the audit conclusions and enables supervisory review of the work performed

77. During fieldwork, the operations manager verbally assures an IS auditor that failed overnight batch jobs are always remediated the same day. Before relying on this assertion to close the audit objective, what should the auditor do?

• A. Corroborate the assertion with independent evidence such as job logs and incident records
• B. Include the assertion in the report as a management representation requiring no further work
• C. Accept the assertion because it was provided by the manager accountable for the process
• D. Escalate the matter to the audit committee as an unsupported management claim

78. A prior-year audit reported that database administrators shared a single privileged login. During the follow-up review, management states that the issue has been fully remediated. What should the IS auditor do NEXT?

• A. Close the finding, because management has formally confirmed remediation
• B. Reopen the entire prior audit to revalidate all of its original findings
• C. Perform testing to verify that individual accounts are now in use and the shared login is disabled
• D. Downgrade the finding's risk rating to reflect management's attention to the issue

79. An audit director is building the annual IS audit plan and must choose which auditable areas to cover with limited resources. Which factor should MOST influence the prioritization?

• A. The preferences expressed by the managers of each business unit
• B. The length of time since each area was last audited
• C. The availability of auditors with prior experience in each area
• D. The relative risk each area poses to the organization's objectives

80. An IS auditor concludes that the IT general controls supporting a financial reporting application are poorly designed and unreliable. How should this conclusion affect the remainder of the audit approach?

• A. Discontinue the audit until management redesigns the control environment
• B. Reduce total testing, because weak controls make further procedures unlikely to change the conclusion
• C. Rely on analytical procedures alone, since detailed testing would duplicate the control weaknesses
• D. Increase substantive testing of the data and transactions, because control reliance is not justified

81. For a given audit area, the IS auditor assesses both inherent risk and control risk as high. To keep overall audit risk at an acceptable level, what must the auditor do?

• A. Accept a higher overall audit risk, since inherent and control risk are outside the auditor's influence
• B. Reassess inherent risk downward to offset the elevated control risk
• C. Lower detection risk by performing more extensive and more reliable audit procedures
• D. Transfer the engagement to an external audit firm with greater resources

82. An IS auditor lacks the specialized knowledge needed to evaluate a complex actuarial model and engages an external expert to assess it. Which statement BEST describes the auditor's remaining responsibility?

• A. The auditor remains responsible for the audit conclusions and must assess the expert's competence, objectivity, and the reasonableness of the work
• B. Responsibility for that portion of the audit transfers to the expert once the engagement letter is signed
• C. The auditor must disclaim any opinion on areas where expert work was used
• D. The auditor may rely on the expert only if the expert is employed by the same firm

83. An IS auditor wants ongoing assurance that a live claims-processing system handles transactions correctly, and arranges for fictitious transactions belonging to a dummy business unit to flow through production processing alongside real data. Which technique is being used?

• A. Integrated test facility, which processes fictitious entities' transactions within the production system
• B. Test data method, which runs prepared transactions through a copy of the application
• C. Snapshot technique, which captures transaction images at defined processing points
• D. Parallel simulation, which reprocesses real data through auditor-controlled software

84. An IS auditor needs to identify potential duplicate vendor payments across an entire year of accounts payable transactions held in a large database. Which approach is MOST efficient and effective?

• A. Review the application's user manual to confirm a duplicate-check feature exists
• B. Use generalized audit software to analyze the full population for matching invoice numbers, amounts, and vendors
• C. Interview accounts payable staff about their procedures for preventing duplicates
• D. Select a random sample of payments and manually trace each to supporting invoices

85. At the conclusion of fieldwork, the IS audit team schedules a closing meeting with auditee management before the report is issued. What is the PRIMARY purpose of this meeting?

• A. To obtain management's signature accepting responsibility for all identified risks
• B. To confirm the factual accuracy of findings and give management an opportunity to respond
• C. To negotiate which findings will be removed from the final report
• D. To assign remediation deadlines that the audit function will enforce

86. A draft audit finding states that quarterly user access reviews were not performed for a core banking application, but the finding does not describe what could happen as a result. Which element of a well-structured finding is missing?

• A. The criteria, which state what should have occurred
• B. The condition, which states what was actually observed
• C. The cause, which explains why the deviation happened
• D. The effect, which explains the risk or consequence of the deviation

87. Based on a sample of change tickets, an IS auditor concluded that a change-approval control was operating effectively. Later, full-population analysis showed the control actually failed frequently. Assuming the sampled items were evaluated correctly, which risk materialized?

• A. Inherent risk, because the process was naturally prone to failure
• B. Non-sampling risk, because the auditor misapplied the audit procedure
• C. Fraud risk, because the exceptions were deliberately concealed from the auditor
• D. Sampling risk, because the sample drawn was not representative of the population

88. An IS auditor evaluating an organization's control environment wants to identify the single strongest influence on whether employees take internal controls seriously. Which factor should the auditor examine?

• A. The frequency of disciplinary actions recorded by human resources
• B. The number of control-related policies published on the intranet
• C. The demonstrated commitment of senior leadership to ethical conduct and control compliance
• D. The sophistication of the automated monitoring tools in use

89. To demonstrate that a reconciliation control operates daily, management gives the IS auditor a report generated from the application by the same team that performs the control. Applying professional skepticism, what should the auditor do before using this report as evidence?

• A. Accept the report because system-generated output is inherently reliable
• B. Evaluate the integrity of the report by verifying its source, parameters, and completeness
• C. Ask the team to certify the report's accuracy in writing before relying on it
• D. Reject the report outright because it originates from the auditee

90. An IT steering committee is documented as responsible for approving major technology investments, but in practice the CIO regularly approves large projects unilaterally without committee review. From a governance perspective, what is the MOST significant concern?

• A. The steering committee meets too infrequently to be useful
• B. The CIO lacks sufficient technical expertise to approve projects alone
• C. Decision rights defined in governance documentation are not being followed in practice
• D. Technology investment decisions are being made too quickly for the organization's needs

91. A newly appointed audit committee member asks whether the upcoming IS audit will guarantee that no material control failures exist in the environment being reviewed. Which response BEST reflects professional audit standards?

• A. An audit provides reasonable assurance, not absolute assurance, due to factors such as sampling and the nature of evidence
• B. An audit guarantees detection of all material failures if the budget is sufficient
• C. An audit provides no assurance; it only documents processes as they exist
• D. An audit's assurance level depends entirely on whether management cooperates

92. Management asks the IS audit function to help strengthen access controls for a new system that the function expects to audit next year. Which arrangement BEST preserves audit independence?

• A. Auditors advise on control objectives and good practice, while management designs, implements, and owns the controls
• B. Auditors implement the access rules themselves to guarantee they meet audit expectations
• C. Auditors take temporary operational responsibility for the system until the first audit is finished
• D. Auditors decline any contact with the project until it is complete

93. An organization wants to translate its IT strategy into measurable objectives spanning financial results, customer satisfaction, internal process quality, and staff learning and growth. Which management tool is designed for this purpose?

• A. A capability maturity assessment of IT processes
• B. A total cost of ownership analysis for the IT portfolio
• C. A heat map of the IT risk register
• D. An IT balanced scorecard linking strategy to metrics across multiple perspectives

94. A board formally states the overall level and types of risk the organization is willing to accept in pursuit of its strategy, while operating management defines acceptable variation around specific performance targets. Which terms describe these two concepts, respectively?

• A. Risk capacity and risk appetite
• B. Risk tolerance and residual risk
• C. Risk appetite and risk tolerance
• D. Residual risk and inherent risk

95. An IS auditor reviews a corporate document that mandates minimum password length and complexity settings that every system must enforce. In a well-structured documentation hierarchy, what type of document is this?

• A. A policy, because it states management's high-level intent for security
• B. A guideline, because it suggests recommended practices for administrators
• C. A standard, because it specifies mandatory settings that implement policy intent
• D. A procedure, because it lists steps for configuring authentication

96. Several proposed IT initiatives compete for a limited investment budget, and executives disagree about which to fund. Which governance mechanism BEST supports a defensible selection decision?

• A. Letting the infrastructure team select initiatives based on technical elegance
• B. Portfolio management that evaluates initiatives on value, risk, and strategic alignment using consistent criteria
• C. Allocating the budget proportionally to each department's headcount
• D. Funding initiatives in the order their business cases were submitted

97. A marketing analyst requests read access to a customer data set maintained on a shared platform. Under a sound data governance model, who should APPROVE this access request?

• A. The database administrator, because they can technically grant the access
• B. The requesting analyst's direct manager, because they know the analyst's duties
• C. The data owner, because they are accountable for how the data is used and by whom
• D. The IT help desk, because access requests flow through its ticketing system

98. An organization has run a mandatory annual security-awareness course for three years. Which measure would give management the BEST evidence that the program is actually changing employee behavior?

• A. Course completion rates across all departments
• B. The number of hours of training content produced each year
• C. Employee satisfaction scores for the training modules
• D. A declining click rate on simulated phishing campaigns over successive tests

99. An IT organization assesses its processes against a recognized capability maturity model and receives ratings for each process area. What is the PRIMARY benefit of this exercise?

• A. It removes the need for internal audit to test those processes
• B. It identifies capability gaps and provides a roadmap for prioritized process improvement
• C. It certifies the organization as compliant with applicable regulations
• D. It guarantees that higher-rated processes contain no control failures

100. A board of directors receives cybersecurity information solely through a brief annual verbal update from the security officer, with no supporting metrics or independent validation. From a governance standpoint, what is the MOST significant concern?

• A. The update consumes valuable time on the board agenda
• B. Verbal delivery prevents the update from being translated for overseas directors
• C. The security officer may feel micromanaged by board attention
• D. The board cannot exercise informed oversight without regular, metric-based, and independently validated reporting

101. A single senior engineer is the only person who understands and maintains a legacy application that supports a revenue-critical process, and no current documentation exists. What is the MOST appropriate management response to this situation?

• A. Increase the engineer's compensation to reduce the likelihood of resignation
• B. Restrict the engineer's other duties so the application receives full attention
• C. Purchase key-person insurance to compensate the organization if the engineer leaves
• D. Institute cross-training, current documentation, and succession planning to remove the single point of knowledge

102. An IS auditor draws a statistical sample of purchase orders above a dollar threshold to test whether approvals were obtained. The sample shows zero exceptions, yet a data analysis run afterward on the full population reveals several unapproved purchase orders that were not selected. Which risk does this outcome illustrate?

• A. Inherent risk in the purchasing process
• B. Control risk arising from a poorly designed approval control
• C. Detection risk caused by an inappropriate audit procedure
• D. Sampling risk, because the sample did not represent the population

103. An IS auditor is determining the extent of substantive testing required for a revenue-recognition interface between an order system and the general ledger. Which factor should PRIMARILY drive the auditor's judgment on sample size and testing depth?

• A. The number of IT staff available to support the audit during fieldwork
• B. The preference of the audit committee for a specific testing methodology
• C. The materiality of the account balance and the assessed level of combined risk
• D. The total number of transactions processed by the interface annually

104. Six months after an audit report was issued, an IS auditor performs a follow-up review to determine whether management implemented agreed remediation actions for a previously reported access control weakness. Management states the actions were completed but the auditor finds no supporting evidence during the review. What should the auditor do?

• A. Accept management's verbal assurance and close the finding, since remediation was previously agreed
• B. Remove the finding from the follow-up report because responsibility now rests with management
• C. Escalate the matter directly to external regulators without further internal review
• D. Report the finding as unresolved and note that management's claim could not be corroborated

105. An IS auditor has gathered audit evidence from three sources regarding the same access-review control: a system-generated log, a signed paper attestation obtained directly from an independent reviewer, and a verbal description of the process from the control owner. Ranking reliability from most to least reliable, which ordering is MOST appropriate?

• A. Independent signed attestation, system-generated log, verbal description from the control owner
• B. Verbal description, system log, independent signed attestation
• C. System log, verbal description, independent signed attestation
• D. All three sources are equally reliable once corroborated by audit working papers

106. An audit manager is finalizing the annual IS audit plan and must allocate limited staff hours across dozens of candidate audit areas identified through a risk assessment. Which approach BEST ensures the plan focuses audit resources appropriately?

• A. Audit every area with any identified risk exposure, spreading hours evenly across all of them
• B. Select audit areas based on which business unit leaders request an audit be performed
• C. Audit only the areas that were audited in the prior year to maintain year-over-year comparability
• D. Prioritize areas with the highest combination of business impact and likelihood of risk materializing

107. During planning, an IS auditor must decide between judgmental sampling and statistical sampling to test a control over vendor master file changes. Which factor would MOST justify choosing statistical sampling over judgmental sampling in this case?

• A. The auditor wants to mathematically quantify sampling risk and project results to the population
• B. The population of vendor master file changes is very small and easy to review in full
• C. Management prefers that the auditor use professional judgment to target known problem areas
• D. The control has never previously been tested by internal or external auditors

108. An organization has a document stating that all production password changes must use a minimum of twelve characters, and a separate document describing the exact configuration steps to enforce this in the identity management system. How should these two documents be correctly classified within a governance framework?

• A. Both documents are policies, since they both relate to the same control objective
• B. Both documents are guidelines, since neither is mandatory under the framework
• C. The first is a procedure; the second is a standard that policies must reference
• D. The first is a policy setting a mandatory requirement; the second is a procedure describing how to implement it

109. Executive management wants to confirm that the organization's IT strategic plan remains aligned with overall business strategy as business priorities shift over time. Which practice BEST supports ongoing alignment rather than a one-time check?

• A. Delegating all strategic technology decisions permanently to the IT department without executive involvement
• B. Approving the IT strategic plan once and revisiting it only when a major system failure occurs
• C. Periodically reviewing and updating the IT strategy against evolving business objectives on a defined cycle
• D. Relying on the annual external audit to flag misalignment between IT and business strategy

110. An organization negotiating an outsourcing contract for its help desk function includes financial penalties for missed service levels but no defined process for how service performance will be measured, reported, or disputed. From a governance standpoint, what is the MOST significant weakness in this arrangement?

• A. The penalties are not large enough to motivate the vendor
• B. Without agreed measurement, reporting, and dispute mechanics, the penalty clause cannot be reliably enforced
• C. Help desk functions should never be outsourced regardless of contract terms
• D. The contract does not specify which programming languages the vendor's staff must know

111. A project team builds a matrix linking each documented business requirement to the corresponding design specification and the test case that will verify it. Which project risk does this technique PRIMARILY address?

• A. The risk that the project will exceed its approved budget
• B. The risk that a requirement is dropped or left unverified as the project moves through design and testing
• C. The risk that the project schedule will slip due to resource constraints
• D. The risk that the wrong development methodology was chosen for the project

112. After fixing a defect in a shared calculation module used by multiple parts of an application, the development team re-executes a broad set of previously passed test cases across the application before releasing the fix. What is the PRIMARY purpose of this practice?

• A. To confirm that the fix did not introduce new defects in previously working functionality
• B. To reduce the total number of test cases that will be needed in future releases
• C. To satisfy a mandatory step required before any code can be committed to version control
• D. To measure the performance of the application under peak transaction load

113. A change control board reviews a proposed enhancement to a production financial system and must decide whether to approve, defer, or reject the change before it proceeds to development. Which of the following is the board's PRIMARY responsibility in this review?

• A. Writing the technical specification for how the enhancement will be coded
• B. Assessing the business justification, risk, and impact of the proposed change before authorizing it to proceed
• C. Personally performing the testing of the change once development is complete
• D. Approving the annual budget for the entire development department

114. A quality function within a development organization defines coding standards and reviews finished deliverables for defects before release, while a separate quality function is embedded throughout the development process to prevent defects from occurring in the first place. Which pairing correctly labels these two functions?

• A. The first is quality assurance; the second is quality control
• B. The first is quality control; the second is quality assurance
• C. Both functions described are quality assurance, performed at different project stages
• D. Both functions described are quality control, performed by different teams

115. An organization migrating to a new ERP system has completed the technical data conversion but has not defined what will happen if critical post-conversion validation reveals unacceptable data errors after go-live. What should the project team have established BEFORE go-live to address this gap?

• A. A documented fallback and rollback plan for reverting to the legacy system if conversion problems are discovered
• B. A marketing communication plan announcing the new system to external customers
• C. A help desk staffing schedule for the first week after go-live
• D. A long-term decommissioning schedule for legacy hardware five years in the future

116. A project is migrating users to a new claims-processing system location by location, with each site cutting over on a staggered schedule rather than all at once. Which system conversion strategy is being used, and what is its key advantage?

• A. Direct cutover; it eliminates any dual-running cost by switching everyone off the old system on the same day
• B. Parallel changeover; it runs both systems simultaneously for every site until testing is complete
• C. Phased (or pilot) conversion; it limits exposure by allowing issues to be identified and corrected before wider rollout
• D. Abort conversion; it allows the project to be cancelled if early sites report problems

117. A large systems integration project has multiple interdependent activities. The project manager identifies the sequence of dependent tasks that determines the shortest possible time to complete the project, and any delay to a task in that sequence delays the entire project. What is this sequence called?

• A. The critical path
• B. The change freeze window
• C. The scope baseline
• D. The stakeholder register

118. An organization completed a major system implementation eighteen months ago and is only now conducting its post-implementation review. What is the MOST significant limitation of performing this review so long after go-live?

• A. The system's vendor will refuse to provide support once a post-implementation review is delayed
• B. Key project staff, documentation, and institutional knowledge about early implementation issues may no longer be available or accurate
• C. Post-implementation reviews are only valid if performed within thirty days of go-live under any circumstances
• D. The review will take longer to complete than if it had been done immediately

119. During system testing, developers use a copy of the production environment's configuration but with a completely separate database instance and network segment from live production. What is the PRIMARY control objective served by this separation?

• A. To allow developers unrestricted, unmonitored access to production data for realistic testing
• B. To prevent test activities, including invalid or malformed data, from affecting live production data and operations
• C. To eliminate the need for a formal user acceptance testing phase
• D. To reduce the total cost of software licensing across environments

120. An organization is selecting a vendor for a new customer relationship management system and issues a request for proposal (RFP) to several candidates. Which practice BEST ensures the selection process remains objective and defensible?

• A. Selecting the vendor recommended informally by an existing employee's prior employer
• B. Allowing each business stakeholder to independently choose their preferred vendor
• C. Selecting the vendor that offers the lowest price regardless of other factors
• D. Defining weighted evaluation criteria in advance and scoring all proposals consistently against them

121. During a code review of a web application, a reviewer flags that user-supplied input is concatenated directly into database query strings without validation or parameterization. What is the PRIMARY risk this practice introduces?

• A. Increased licensing costs for the database platform
• B. Injection attacks that could allow unauthorized access to or manipulation of data
• C. Slower application performance under normal user load
• D. Difficulty in translating the application into other languages

122. A new order-management system must exchange data in real time with an existing inventory system and a separate billing system. Beyond testing each system individually, what additional testing is essential before go-live?

• A. Interface testing to confirm data is correctly transmitted, received, and interpreted between the connected systems
• B. Usability testing limited to the order-management system's screens
• C. A code-freeze period with no testing activity at all
• D. Testing only the billing system, since it is the final system in the data flow

123. A development team uses a tool that tracks every change made to source code files, records who made each change, and allows any prior version to be retrieved if needed. What primary control does this tool provide?

• A. Configuration and version control over source code changes
• B. Automated functional testing of the application
• C. Real-time monitoring of production system performance
• D. Enforcement of segregation of duties between developers and end users

124. Business stakeholders have reviewed a system's functional specifications and formally documented their agreement that the specifications accurately capture what the business needs. What is the PRIMARY purpose of obtaining this sign-off before development begins?

• A. To establish an agreed baseline of requirements, reducing the risk of scope disputes and rework later in the project
• B. To eliminate the need for user acceptance testing once the system is built
• C. To satisfy a requirement that only applies to government-sector system implementations
• D. To transfer legal liability for the entire project from the vendor to the business stakeholders

125. A development team using an agile methodology holds a session at the end of each sprint to discuss what went well, what did not, and what process changes to make in the next sprint. Which agile practice is being described?

• A. Sprint retrospective
• B. Sprint planning
• C. Daily stand-up
• D. Product backlog grooming

126. During data migration to a new system, the project team runs record counts and control totals on both the source and target data sets and compares them before allowing the new system to go live. What does this control PRIMARILY provide assurance over?

• A. That the new system's user interface meets usability standards
• B. That end users have been adequately trained on the new system
• C. That the new system has adequate processing capacity for future growth
• D. That the migrated data is complete, with no records lost or unaccounted for during conversion

127. An overnight batch job that loads sales data into a data warehouse depends on an upstream job that extracts data from the point-of-sale system. One night, the extract job fails silently, but the load job still runs on schedule and processes stale data without any alert being raised. What control weakness does this scenario MOST clearly illustrate?

• A. Job scheduling lacks dependency checks and failure notifications between related jobs
• B. The point-of-sale system was not adequately load tested before deployment
• C. The data warehouse lacks sufficient storage capacity for daily loads
• D. The organization has not documented a data retention policy for warehouse data

128. An operations team implements a tool that aggregates log events from servers, network devices, and applications into a single console and correlates related events to surface a single operational incident rather than dozens of separate alerts. What is the PRIMARY operational benefit of this capability?

• A. It eliminates the need for any manual system administration
• B. It reduces alert fatigue and speeds incident detection by correlating related events into a single actionable signal
• C. It guarantees one hundred percent system uptime going forward
• D. It automatically fixes the underlying cause of any detected incident

129. An organization's backup scheme retains the most recent daily backup, the most recent weekly backup, and the most recent monthly backup, cycling older media out as newer backups are created. What is this backup rotation scheme commonly called?

• A. Continuous data protection
• B. Mirrored backup
• C. Snapshot replication
• D. Grandfather-father-son rotation

130. A critical order-processing application runs across two active servers behind a load balancer, configured so that if one server fails, the other automatically continues processing all transactions without interruption to users. What availability design does this describe?

• A. A cold standby recovery configuration
• B. High-availability clustering with automatic failover
• C. A scheduled maintenance window strategy
• D. A manual disaster recovery invocation procedure

131. An organization conducts a disaster recovery exercise in which staff actually shift live production processing to the alternate recovery site for several hours to validate that recovery procedures work under real operating conditions, rather than simply talking through the plan in a conference room. Which type of DR test is being performed, and how does it differ from a structured walkthrough?

• A. A tabletop discussion, which is functionally identical to a structured walkthrough
• B. A checklist review, which only confirms that recovery documentation exists
• C. A parallel or simulation test, which exercises actual recovery procedures and processing rather than only discussing them
• D. A paper-based audit, which relies solely on reviewing prior test reports

132. An organization has a business continuity plan covering people, facilities, and manual workaround procedures for critical business processes, and separately maintains a plan focused specifically on restoring IT systems and data supporting those processes. How do these two plans relate to one another?

• A. The IT-focused disaster recovery plan is a supporting component that enables the broader business continuity plan's process-recovery objectives
• B. The two plans address entirely unrelated risks and are never coordinated
• C. They are identical documents required to be maintained separately only for regulatory formality
• D. The business continuity plan is unnecessary once an IT disaster recovery plan exists

133. A database administrator explains that if the database server crashes mid-transaction, the database engine can use records of every change made since the last checkpoint to restore the database to a consistent state without needing to restore from a full backup. Which database feature is being described?

• A. Data partitioning
• B. Index rebuilding
• C. Schema normalization
• D. Transaction (redo) logs

134. Operations staff notice that the message queue feeding an overnight settlement process has been steadily growing in backlog over several weeks, with messages taking progressively longer to be processed even though no errors are being logged. What is the MOST significant risk if this trend is not addressed?

• A. The message queue software license will expire automatically
• B. Growing backlog may eventually cause the settlement process to miss its processing deadline or fail under peak load
• C. The trend indicates a network cabling fault that requires physical replacement
• D. The organization will be unable to add new message types to the queue

135. A service desk receives an average of two hundred tickets per day covering issues ranging from a single user's forgotten password to a complete outage of the customer-facing website. Which practice BEST ensures that limited support staff address the most business-critical issues first?

• A. Resolving tickets strictly in the order they were received, regardless of impact
• B. Assigning severity levels based on business impact and urgency, and prioritizing response accordingly
• C. Assigning all tickets to the most senior support staff member regardless of complexity
• D. Closing any ticket not resolved within one hour, regardless of its status

136. A nightly batch process that updates customer account balances calculates a control total of all transaction amounts before processing and compares it to a control total calculated after processing completes. What does a match between these two totals PRIMARILY provide assurance of?

• A. That the batch job completed and processed the input data without unexplained loss or duplication
• B. That the customer account balances are accurate as of the date of processing
• C. That no unauthorized person accessed the batch processing server
• D. That the application code contains no logical defects

137. A finance team maintains a complex spreadsheet with embedded macros that calculates quarterly revenue recognition figures reported to executive management, developed and maintained entirely by one analyst outside of any formal change control or version history. What is the MOST significant risk this end-user computing application presents?

• A. The spreadsheet software license may be more expensive than a database license
• B. Undetected calculation errors or unauthorized changes could affect figures reported to executive management without any independent review
• C. The spreadsheet will automatically stop functioning after a fixed number of uses
• D. Executive management will be unable to open the file on their own computers

138. An organization moves an application from on-premises infrastructure to a cloud provider's infrastructure-as-a-service offering. Under the shared responsibility model typically used by such providers, which party is generally responsible for securing the guest operating system and application running on the provisioned virtual machines?

• A. The customer remains responsible for the guest operating system, application, and data, while the provider secures the underlying physical infrastructure
• B. Neither party is responsible until a security incident actually occurs
• C. Responsibility is transferred entirely to any third-party auditor engaged to review the environment
• D. The cloud provider is solely responsible for all layers, including the guest operating system

139. Over time, an organization's virtualized data center has accumulated hundreds of virtual machines, many created for short-term projects and never decommissioned, with no complete inventory of what is running or why. What is the PRIMARY risk this situation creates?

• A. Cloud computing costs are always higher than on-premises computing regardless of utilization
• B. The hypervisor software will refuse to run additional virtual machines once a fixed limit is reached
• C. Virtual machines cannot be created faster than physical servers under any circumstances
• D. Unmanaged, unpatched virtual machines increase the attack surface and may go unmonitored for security and compliance issues

140. An organization's vulnerability management program identifies a critical operating system vulnerability with an available vendor-issued fix, but the fix has not yet been applied to production servers three months after release. What is the MOST significant risk of this delay?

• A. The operating system will automatically revert to an earlier, unsupported version
• B. The vendor will terminate all technical support for the affected product
• C. Server hardware warranties will be voided by the delay
• D. The known, unpatched vulnerability remains exploitable, increasing the window of exposure to attack

141. An IS auditor reviewing endpoint protection finds that antivirus software is installed on all workstations but signature updates have not been applied in over four months due to a misconfigured update service. What is the MOST significant consequence of this finding?

• A. Users will be unable to log in to their workstations until updates resume
• B. Workstations will run noticeably faster without frequent signature updates
• C. The antivirus software will automatically uninstall itself after a period of inactivity
• D. Endpoints have reduced ability to detect malware variants identified since the last update, increasing infection risk

142. A data center's environmental monitoring system tracks temperature, humidity, and airflow, and automatically triggers alerts and a gaseous fire suppression system rather than a traditional water-based sprinkler system in the server room. What is the PRIMARY reason a data center would choose gaseous suppression over a water-based system?

• A. Gaseous suppression extinguishes fire while minimizing the risk of water damage to sensitive electronic equipment
• B. Gaseous suppression systems cost less to install than any water-based alternative in every case
• C. Water-based systems are prohibited by law in all commercial data centers
• D. Gaseous suppression eliminates the need for temperature and humidity monitoring entirely

143. An organization's tape media library maintains a log of every tape's location, contents, retention period, and chain of custody as it moves between on-site storage, an off-site vault, and eventual destruction. What is the PRIMARY audit-relevant purpose of this log?

• A. To calculate the total electricity cost of running the tape library
• B. To provide accountability and traceability over physical media, supporting recoverability and preventing unauthorized loss or access
• C. To satisfy a requirement that applies only to media used for marketing materials
• D. To eliminate the need for encrypting data stored on the tapes

144. In the weeks leading up to its highest-volume sales period, a retail organization implements a temporary freeze on all non-emergency changes to its e-commerce platform. What is the PRIMARY objective of this change freeze?

• A. To permanently replace the organization's normal change management process
• B. To reduce the risk of instability or outages during the period when the platform's availability is most critical to the business
• C. To allow developers to make changes without any testing during the freeze period
• D. To satisfy a requirement that applies only once every five years

145. An organization encrypts sensitive data using symmetric encryption keys but stores those keys in a plaintext configuration file on the same server as the encrypted data, with no defined process for rotating keys periodically. What is the MOST significant weakness in this approach?

• A. Encryption always significantly degrades application performance regardless of implementation
• B. Storing keys alongside the data they protect, without rotation, undermines the protection encryption is meant to provide
• C. Symmetric encryption is inherently weaker than asymmetric encryption in all circumstances
• D. Symmetric keys cannot be used to encrypt data stored in a database

146. A web application presents a digital certificate to browsers to establish an encrypted connection, and the browser validates that certificate against a chain of trust leading back to a recognized certificate authority. What is the PRIMARY purpose of this certificate validation?

• A. To measure how quickly the web application responds to user requests
• B. To confirm the identity of the server and enable a trusted encrypted connection between the browser and server
• C. To automatically back up the website's content to a secondary location
• D. To determine how much bandwidth the website is permitted to consume

147. An IS auditor reviewing a corporate firewall's rule base finds numerous rules with no documented business justification, several that permit broad, unrestricted traffic between network segments, and rules referencing systems that were decommissioned years ago. What should the auditor recommend as the MOST appropriate response?

• A. Leave the rules in place since removing any rule risks breaking an unknown dependency
• B. Disable the firewall entirely until a replacement can be procured
• C. Add additional broad rules to compensate for the lack of documentation
• D. Conduct a periodic firewall rule review to remove unjustified, overly permissive, or obsolete rules

148. A security team deploys a device that not only detects suspicious network traffic patterns but can also automatically block or drop malicious traffic in real time before it reaches its intended target, rather than only generating an alert for later review. Which type of security control does this describe, and how does it differ from a detection-only device?

• A. An intrusion prevention system, which actively blocks malicious traffic rather than only alerting on it like an intrusion detection system
• B. An intrusion detection system, which is functionally identical to a firewall in every respect
• C. A data loss prevention system, which only classifies data without any network traffic function
• D. A vulnerability scanner, which identifies weaknesses but never interacts with live network traffic

149. After several employees fell for a simulated phishing email during a security awareness campaign, the organization now sends similar simulations quarterly and tracks click rates over time, along with providing immediate targeted training to anyone who fails a simulation. What is the PRIMARY value of continuing this practice over time rather than running it once?

• A. It guarantees that no employee will ever fall for an actual phishing attack again
• B. It satisfies a one-time training requirement that never needs to be repeated
• C. It transfers all responsibility for phishing losses from the organization to individual employees
• D. It measures whether awareness is improving over time and reinforces behavior through repeated, targeted reinforcement

150. A development team needs realistic data to test a new application feature but is prohibited from using actual customer records due to privacy requirements. The team instead uses a process that replaces sensitive values, such as names and account numbers, with fictitious but realistically formatted substitutes while preserving the data's structure and referential integrity. What technique is being used?

• A. Data masking (or de-identification) of test data
• B. Data compression to reduce test environment storage requirements
• C. Data replication to synchronize test and production environments
• D. Data archiving to move records to long-term storage

151. An organization allows employees to access corporate email and internal applications from personally owned smartphones, and enrolls each device in a platform that can enforce passcode requirements, encrypt corporate data, and remotely wipe only the corporate data if the device is lost or the employee departs. What capability is being described?

• A. A virtual private network client installed without any device enrollment
• B. Mobile device management (MDM), enforcing security policy and enabling selective remote wipe of corporate data
• C. A guest wireless network with no access to internal systems
• D. A firewall rule restricting smartphone access entirely

152. An organization evaluates a biometric fingerprint authentication system and is comparing two configurations: one tuned to more readily accept a scanned fingerprint as a match, and one tuned to be more conservative before accepting a match. Which tradeoff does adjusting this sensitivity setting PRIMARILY create?

• A. A tradeoff between the false acceptance rate and the false rejection rate of the system
• B. A tradeoff between the cost of the biometric hardware and its expected physical lifespan
• C. A tradeoff between the number of supported biometric modalities and network bandwidth usage
• D. A tradeoff between the biometric system's color display resolution and its battery life

153. An organization runs an automated tool that scans its network and systems for known weaknesses and misconfigurations, producing a report listing hundreds of potential findings ranked by severity. Separately, the organization engages a team to actively attempt to exploit those and other weaknesses to determine whether an attacker could actually gain unauthorized access. How do these two activities differ?

• A. They are the same activity performed by different job titles with no meaningful difference
• B. A vulnerability assessment identifies potential weaknesses, while a penetration test actively attempts to exploit weaknesses to demonstrate real-world impact
• C. A vulnerability assessment always costs more than a penetration test in every organization
• D. A penetration test only examines physical security controls and never network-based weaknesses

154. An organization stores customer transaction records indefinitely on production systems because no policy specifies when data should be archived or deleted, resulting in databases that are far larger than operationally necessary and that retain data well beyond any legitimate business or legal need. What should the organization implement to address this issue?

• A. A defined data retention policy specifying how long different data types must be kept and when they should be archived or securely deleted
• B. A requirement that all data be duplicated across three additional data centers
• C. A policy prohibiting any future collection of customer transaction data
• D. A rule requiring all employees to manually back up data to personal storage devices

155. A software development team building a new customer-facing application decides to identify what personal data the application will collect, minimize collection to only what is strictly necessary, and build in default privacy protections before writing any code, rather than adding privacy controls after the application is complete. What principle does this approach reflect?

• A. Privacy by design, embedding privacy protections into a system from the earliest stages of development
• B. Defense in depth, layering multiple unrelated security controls regardless of data sensitivity
• C. Least privilege, restricting employee access rights based on job function
• D. Separation of duties, dividing incompatible functions among different individuals

156. An organization's access provisioning process requires that the person requesting new system access, the manager who approves the request, and the administrator who actually grants the access in the system all be different individuals, with no single person able to perform more than one of these roles for the same request. What risk does this design PRIMARILY mitigate?

• A. The risk that a single individual could request, approve, and grant themselves unauthorized access without independent oversight
• B. The risk that access requests will take longer to process than a single-step approval
• C. The risk that the system will run out of available user account licenses
• D. The risk that the help desk will receive too many password reset requests

157. An organization's password policy requires a minimum length and a mix of character types but does not check submitted passwords against lists of commonly used or previously breached passwords, and does not limit the number of failed login attempts. Even though the policy appears strong on paper, what risk remains significant?

• A. Users could still choose common, predictable, or previously compromised passwords, and accounts remain exposed to unlimited automated guessing attempts
• B. The policy is too strict and will make it impossible for any user to remember a valid password
• C. Complex passwords always take longer to type than simple ones, reducing productivity
• D. The organization will be unable to enforce the length and complexity requirements technically

158. An organization discovers that an unauthorized wireless access point, not part of its approved network infrastructure, was connected to a network jack in a conference room, potentially allowing outsiders within range to bypass perimeter controls and access the internal network. What is this unauthorized device commonly called, and what control would MOST directly help detect it?

• A. A honeypot; detected through analysis of email phishing simulation results
• B. A rogue access point; detected through periodic wireless network scanning to identify unauthorized devices broadcasting on the network
• C. A load balancer; detected through reviewing application response time metrics
• D. A proxy server; detected through reviewing physical visitor sign-in logs

159. A security operations center subscribes to external feeds that provide up-to-date information on newly identified attack indicators, malicious IP addresses, and emerging attack techniques, and automatically correlates this information against the organization's own network traffic to flag potential matches. What is the PRIMARY benefit this integration provides?

• A. It guarantees that the organization will never experience a successful cyberattack
• B. It eliminates the need for the organization to maintain any internal security staff
• C. It enables faster identification of known threats affecting the organization by leveraging external knowledge of current attack activity
• D. It automatically negotiates lower cyber-insurance premiums with the organization's insurer