ISACA CISA Practice Test

Answer choices

1. A. Buy additional capacity immediately based on user complaints.
2. B. Measure and trend peak workload and resource utilization against business demand and service thresholds.
3. C. Lower the service-level target during quarter-end periods.
4. D. Collect only annual average capacity metrics to simplify reporting.

Wrong-answer review

• A. Buy additional capacity immediately based on user complaints.: This relies on an unsupported assumption rather than obtaining evidence.
• C. Lower the service-level target during quarter-end periods.: Contract language alone does not demonstrate that the service is meeting operational or control requirements.
• D. Collect only annual average capacity metrics to simplify reporting.: This response does not adequately address the material risk or control deficiency.

Answer choices

1. A. Cross-site request forgery caused solely by weak password length.
2. B. Physical theft of the database server.
3. C. Wireless jamming of the application network.
4. D. Injection that allows attacker-controlled input to alter the intended database query.

Answer choices

1. A. Encrypt every source file before it is committed.
2. B. Require quarterly penetration testing of the repository server.
3. C. Restrict repository access according to least privilege and ensure changes are attributable to individual identities.
4. D. Move the repository to an internal network without changing permissions.

Answer choices

1. A. More controls always indicate a stronger security posture.
2. B. The board should receive only detailed technical vulnerability data.
3. C. Control-count metrics do not demonstrate that the security program is achieving risk and business objectives.
4. D. Control counts are sufficient if every business unit reports them consistently.

Answer choices

1. A. Accept the gift because the finding was already identified.
2. B. Refuse the gift and follow the organization's and audit function's ethics requirements for reporting the situation.
3. C. Accept the gift but disclose it in the final report.
4. D. Remove the finding so the gift cannot be perceived as influencing the audit.

Answer choices

1. A. Apply the highest classification to all data permanently.
2. B. Establish enterprise data-classification criteria, ownership, and governance so control requirements are applied consistently.
3. C. Allow each application administrator to classify data independently.
4. D. Encrypt all databases and stop performing classification.

Answer choices

1. A. Select only transactions from the final month because they are most recent.
2. B. Use only exceptions already identified by management.
3. C. Choose whichever items are easiest for the auditor to retrieve.
4. D. Select items across the relevant period and population using a method that gives a defensible basis for evaluating control performance.

Answer choices

1. A. Repeat the same test until it succeeds without changing the design.
2. B. Exclude identity outages from future DR scenarios.
3. C. Reassess recovery dependencies and redesign or provide alternate access so the recovery environment does not rely on the failed prerequisite.
4. D. Classify the failed test as a documentation issue only.

Answer choices

1. A. Leave the requirement unchanged and accept persistent nonperformance.
2. B. Have auditors perform the monitoring to fill the staffing gap.
3. C. Stop monitoring low-risk controls without risk approval.
4. D. Align resources with the approved risk strategy, responsibilities, and monitoring requirements or formally revise the requirements through governance.

Answer choices

1. A. A vendor presentation showing the selected platform's feature set.
2. B. A documented analysis of alternatives using defined evaluation criteria, weighting, readiness, risk, and rationale.
3. C. A project schedule showing the platform can be implemented quickly.
4. D. A post-selection technical design approved by the architecture team.