CISA Certified Information Systems Auditor MCQ 5

Question 1

An IS auditor reviewing a cloud environment finds that the organization has not classified its data before migrating to the cloud. The PRIMARY risk is:

Accepted Answer

Sensitive data may be stored without appropriate security controls

Answer

Without data classification, the organization cannot apply appropriate security controls, potentially exposing sensitive or regulated data in the cloud.

Question 2

During a follow-up audit, an IS auditor finds that management agreed to a corrective action but implemented a different, untested solution instead. The auditor should:

Accepted Answer

Assess whether the alternative solution adequately addresses the original risk

Answer

The auditor's responsibility is to verify that the original risk is addressed, regardless of whether the solution matches what was originally agreed upon.

Question 3

Which of the following BEST describes the role of an IS auditor when management asks for advice on selecting a new security tool?

Accepted Answer

The auditor may provide general criteria but should avoid selecting specific products to preserve independence

Answer

IS auditors can advise on criteria and frameworks without selecting specific products, preserving independence while still adding value.

Question 4

An IS auditor finds that a company uses a single sign-on (SSO) solution for all enterprise applications. The GREATEST risk associated with SSO is:

Accepted Answer

A compromised SSO credential grants access to all connected applications

Answer

SSO creates a single point of failure — if the credential is compromised, the attacker gains access to every application connected to the SSO system.

Question 5

When assessing IT general controls (ITGCs), an IS auditor is PRIMARILY concerned with controls over:

Accepted Answer

Infrastructure, access management, change management, and operations

Answer

ITGCs are entity-level controls covering the IT environment — including infrastructure security, logical access, change management, and IT operations — that support all applications.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Certified Information Systems Auditor MCQ 5