CISA Certified Information Systems Auditor 5

Question 1

Which of the following frameworks is MOST commonly used to assess IT governance and management practices in a CISA audit?

Accepted Answer

COBIT 2019

Answer

ITIL v4

Answer

ISO/IEC 27001

Answer

NIST CSF

Question 2

An auditor reviewing patch management finds that critical patches are applied within 30 days but the vendor recommends 7 days. What is the auditor's BEST conclusion?

Accepted Answer

The organization is exposed to elevated risk during the gap period

Answer

The process is acceptable since patches are eventually applied

Answer

The vendor recommendation is too aggressive and can be ignored

Answer

The process should be halted until patches are applied in real time

Question 3

When conducting an audit of logical access controls, an auditor should PRIMARILY verify that:

Accepted Answer

Access rights are based on business need and reviewed periodically

Answer

All users have administrator privileges for efficiency

Answer

Passwords are stored in plaintext for easy reset

Answer

Remote access is disabled for all employees

Question 4

An IS auditor is assessing an organization's incident response capability. Which element is MOST critical for a mature program?

Accepted Answer

Documented procedures that have been tested and rehearsed

Answer

A large dedicated security team

Answer

Purchase of the latest security tools

Answer

Annual mandatory security awareness training

Question 5

Which of the following BEST demonstrates due diligence by IT management regarding information security?

Accepted Answer

Conducting regular risk assessments and acting on findings

Answer

Purchasing cybersecurity insurance

Answer

Outsourcing all security functions to a MSSP

Answer

Publishing an acceptable use policy

Question 6

During an audit of database controls, an auditor finds that database administrators (DBAs) have unrestricted access to production data without any monitoring. The MOST significant risk is:

Accepted Answer

Unauthorized modification or exfiltration of sensitive data without detection

Answer

Database performance degradation

Answer

Increased licensing costs

Answer

Difficulty performing database upgrades

Question 7

An IS auditor reviewing a data backup process should FIRST verify that:

Accepted Answer

Backup restoration has been successfully tested

Answer

Backups are stored in the same building as production systems

Answer

Daily backups are performed for all data

Answer

Backup media is labeled correctly