CISA Certified Information Systems Auditor 3

Question 1

An IS auditor is reviewing a disaster recovery plan (DRP). Which metric defines the maximum acceptable time to restore a system after a disruption?

Accepted Answer

Recovery Time Objective (RTO)

Answer

RTO is the target time within which a business process must be restored after a disaster to avoid unacceptable consequences.

Question 2

Which type of access control enforces permissions based on the sensitivity label of the resource and the clearance level of the user?

Accepted Answer

Mandatory Access Control (MAC)

Answer

MAC uses sensitivity labels and clearance levels set by a central authority, not the data owner, to control access.

Question 3

An auditor is assessing the change management process. Which control is MOST critical to verify?

Accepted Answer

Changes are approved before implementation

Answer

Pre-implementation approval ensures that only authorized, tested, and justified changes are made to production systems.

Question 4

In the context of IS auditing, 'audit universe' refers to:

Accepted Answer

All auditable entities within the scope of the audit function

Answer

The audit universe encompasses all potential audit subjects from which the audit plan is derived.

Question 5

Which of the following BEST describes a compensating control?

Accepted Answer

A control that mitigates risk when the primary control cannot be implemented

Answer

A compensating control is an alternative measure used to satisfy a requirement when the standard control is not feasible.

CISA - Certified Information Systems Auditor Practice Test