ISACA CISA Practice Test

Answer choices

1. A. Keep staffing fixed to maintain consistency across incidents, for the described technical objective and its associated operational control requirements, as presented.
2. B. Define and use status, escalation, and elevation criteria so resources and management involvement change as incident needs evolve, for the described technical objective.
3. C. Automatically escalate every event to the CEO, for the described technical objective and its associated operational control requirements, as presented.
4. D. Delay escalation until recovery is complete, for the described technical objective and its associated operational control requirements, for review.

Wrong-answer review

• A. Keep staffing fixed to maintain consistency across incidents, for the described technical objective and its associated operational control requirements, as presented.: This response does not adequately address the material risk or control deficiency.
• C. Automatically escalate every event to the CEO, for the described technical objective and its associated operational control requirements, as presented.: This response is disproportionate to the evidence and could create unnecessary operational risk.
• D. Delay escalation until recovery is complete, for the described technical objective and its associated operational control requirements, for review.: This response does not adequately address the material risk or control deficiency.

Answer choices

1. A. Close the review because technical availability targets are being met, under the stated technical, operational, and governance constraints.
2. B. Recommend replacing the CRM because benefits are below forecast, for the stated security, delivery, and accountability requirements.
3. C. Compare actual outcomes and usage against the approved business case and identify causes of the benefit shortfall, within the described operational context.
4. D. Review only whether the project stayed within implementation budget, as the recommended implementation across the complete governed service lifecycle.

Answer choices

1. A. Increase the number of metrics so no operational detail is omitted, for the stated implementation and support requirements.
2. B. Link a focused set of KPIs and KRIs to business objectives, service outcomes, risk tolerance, and decision needs, within the stated policy framework.
3. C. Report only technical uptime because it is easy to measure, within the documented operational, security, ownership, and validation requirements.
4. D. Send raw monitoring data without interpretation, for the described technical objective and its associated operational control requirements, within the defined security and accountability boundaries.

Answer choices

1. A. Independent system records showing termination times and corresponding account-disable times for an appropriate sample or population, in the described situation.
2. B. A manager's verbal statement that the process usually works, under the described . information systems auditing process (18%) criteria.
3. C. A policy requiring accounts to be disabled within 24 hours, for the described technical objective and its associated operational control requirements, within this design.
4. D. A training slide explaining why timely termination is important, for the described technical objective and its associated operational control requirements, in context.

Answer choices

1. A. The control is effective because the backup software reports success, under the stated technical, operational, and governance constraints.
2. B. All backups should be considered corrupt until a disaster occurs, for the specified implementation requirement.
3. C. The database should be migrated to a different platform, for the stated . information systems operations and business resilience (26%) requirement.
4. D. Backup completion does not provide sufficient assurance of recoverability without periodic restore validation, under this approach.

Answer choices

1. A. Integrate risk-based security requirements and practices throughout the SDLC rather than adding them only at final testing, under the stated decision criteria.
2. B. Accept the approach if a qualified penetration tester is engaged, within the documented scope, ownership, and validation boundaries.
3. C. Require all developers to hold a security certification before coding begins, under the stated technical, operational, and governance constraints.
4. D. Move penetration testing earlier but leave security requirements outside design, as the proposed design for the complete governed operational workflow.

Answer choices

1. A. Leave default credentials in place because patient care devices are exempt from security controls, under the stated technical, operational, and governance constraints.
2. B. Disconnect every device from the network permanently, for the described technical objective and its associated operational control requirements, for the required business outcome.
3. C. Assess and remediate default credential risk through supported secure configuration and compensating controls where direct change is not feasible, in context.
4. D. Rely only on staff awareness not to disclose the default password, within the documented operational, security, ownership, and validation requirements.

Answer choices

1. A. Update the organization-wide risk assessment using current business, threat, supplier, and system information.
2. B. Retain the prior assessment until the next three-year strategic cycle, for the specified implementation requirement.
3. C. Perform only a penetration test of the acquired network, within the documented operational, security, ownership, and validation requirements.
4. D. Replace the risk methodology before evaluating whether the existing one is adequate, within the described operational context.

Answer choices

1. A. Ignore the interface because the scope was approved before fieldwork, for the described technical objective and its associated operational control requirements, in context.
2. B. Expand the scope informally without documenting the change, for the described technical objective and its associated operational control requirements, under the stated decision criteria.
3. C. Assess the risk, document the scope impact, and obtain appropriate approval for the necessary change to the audit plan, for this task.
4. D. Stop the entire audit until next year's planning cycle, under the described . information systems auditing process (18%) criteria.

Answer choices

1. A. Automated restarts should be prohibited for critical services, for the described technical objective and its associated operational control requirements.
2. B. The scripts should be rewritten in a different programming language, for the required operational result and control objective.
3. C. Operational resilience depends on undocumented, person-dependent automation that may not be supportable or controlled, for the stated implementation and support requirements.
4. D. The administrator should be given permanent elevated access to avoid delays, under the described . information systems operations and business resilience (26%) criteria, for review.