ISACA CISA Practice Exam

• A. Move the override findings to a separate letter addressed to the CFO
• B. Let the CFO review the wording of findings that concern the override
• C. Report the override findings and escalate the request to the audit committee Correct answer
• D. Keep the override findings in the working papers and exclude them from the report

Option C is correct because the auditor must report significant findings regardless of pressure from the sponsor, and escalating the request to the audit committee preserves independence and the committee's oversight. Options A, B and D let the CFO, the party concerned by these findings, suppress or shape them, which compromises the audit's integrity.

• A. To approve the annual audit budget and staffing levels
• B. To define the audit function's authority and responsibility Correct answer
• C. To list the controls the audit function reviews each year
• D. To specify the test procedures applied in each planned audit

Option B is correct because the charter formally establishes the audit function's purpose, authority, responsibility and accountability, and gives it the standing to operate independently. Budget, the annual list of reviews and test procedures are handled in resourcing decisions, the audit plan and audit programs, not the charter.

• A. Perform independent testing of the provider's controls over customer data
• B. Assess whether the SOC 2 scope and exceptions cover the relevant controls Correct answer
• C. Schedule an on-site review of the provider's customer data controls
• D. Obtain a bridge letter covering the period since the report ended

Option B is correct because the auditor should first determine whether the SOC 2 report can be relied on: that its scope covers the services and controls relevant to customer data and that any exceptions do not affect them. Independent testing, on-site visits and a bridge letter may follow, but only once the report's coverage and gaps are known.

• A. Rank the applications by their annual maintenance cost
• B. Prioritize applications by the date of their last audit
• C. Assign audit hours to each application in proportion to its transaction volume
• D. Rate each application's risk using consistent likelihood and impact criteria Correct answer

Option D is correct because a risk-based plan starts with a consistent risk assessment of each auditable unit using the same likelihood and impact criteria, so priorities can be compared. Cost, time since the last audit and transaction volume are single factors that do not by themselves measure risk.

• A. Provider data center availability matching current payroll uptime
• B. Contract terms returning payroll data in a usable format at exit
• C. Cross-border employee data transfers complying with privacy laws Correct answer
• D. Provider staff screening matching in-house hiring standards

Option C is correct because moving payroll to a provider that hosts data in another country makes cross-border transfers of employee personal data subject to privacy and data-residency laws, and a breach of those laws carries legal and regulatory exposure that outweighs the other issues. Availability, exit data formats and staff screening (A, B, D) are valid contract and service concerns but are manageable operational matters, not the most significant risk here.

• A. Obtain legal counsel's assessment of the new country's data laws and add the applicable requirements to the register Correct answer
• B. Extend the planned quarterly register review to cover every jurisdiction where the retailer sells
• C. Designate a compliance owner for each jurisdiction and report gaps to the board
• D. Test existing controls against the home-country requirements already in the register

Option A is correct because the retailer has been selling in the new country for four months with no assessment of its consumer data laws, so the immediate need is to learn which requirements apply and record them in the register. Extending the review, assigning owners or testing against home-country rules (B, C, D) either wait for the next cycle or leave the unassessed jurisdiction unaddressed.

• A. Audit committee
• B. IT steering committee Correct answer
• C. Change advisory board
• D. Project management office

Option B is correct because the IT steering committee is the cross-functional body of business and IT leaders that prioritizes IT investments and monitors their alignment with business strategy. The audit committee provides independent oversight, the change advisory board approves changes, and the PMO supports project delivery methods, none of which set investment priorities.

• A. Add business-plan alignment as a standing measure on the quarterly IT balanced scorecard
• B. Convene the IT steering committee to reassess the IT portfolio against the revised business plan Correct answer
• C. Have the CIO revise the IT strategy for board approval ahead of the annual refresh cycle
• D. Require business unit heads to submit new IT requirements through the project management office

Option B is correct because the gap is that the portfolio no longer reflects the revised business plan and the body that governs that alignment has not met. Reconvening the steering committee to reassess the portfolio fixes the cause directly. A scorecard measure, an early CIO-only strategy revision, or routing requirements through the PMO (A, C, D) do not restore business involvement in prioritization.

• A. Approved additions were never reflected in the progress baselines Correct answer
• B. The project manager reports to the CIO, not a business executive
• C. Minutes record the approvals but not members' dissenting views
• D. The committee meets monthly, not at each phase gate

Option A is correct because baselines are the yardstick for measuring progress, so approved scope additions that never reached the budget and schedule baselines make earned value and variance reporting meaningless and hide overruns from the committee. Options B, C and D are governance weaknesses, but none of them directly undermines the project's ability to control cost and time.

• A. The portal platform is assumed to have a three-year useful life
• B. The business unit that will own the portal prepared the savings estimate
• C. Projected benefits have no named owner or method of measurement Correct answer
• D. The savings are shown as net present value rather than payback period

Option C is correct because benefits that have no named owner or measurement method will not be tracked or realized, so the projected $4 million savings cannot be validated after implementation. Option A is a normal assumption, option B is common and acceptable when reviewed, and option D is a presentation choice that does not invalidate the case.

• A. the organization's staff can operate and support the proposed solution
• B. the expected benefits justify the cost of developing the solution Correct answer
• C. the proposed solution is compatible with the current technology platform
• D. the solution satisfies the regulatory requirements that apply to the business

Option B is correct because economic feasibility compares the expected benefits with the costs of developing and running the solution to decide whether it is financially justified. Option A describes operational feasibility, option C technical feasibility, and option D legal or regulatory feasibility.

• A. Stories are released to production with no recorded product owner acceptance Correct answer
• B. Detailed design specifications are not completed before coding begins
• C. Sprint scope is not fixed in a baseline plan approved before development starts
• D. Developers rotate between design, coding and testing work within a sprint

Option A is correct because release without product owner acceptance removes the key approval control over what goes into production, which is the main risk in a fast-release Scrum environment. Options B, C and D are normal characteristics of agile development (minimal upfront design, sprint-level planning, cross-functional team members) and are not deficiencies in themselves.

• A. Forgotten VMs that remain unpatched and unmonitored Correct answer
• B. Contention for the shared storage array
• C. Hypervisor licence costs exceeding the approved budget
• D. Loss of hardware redundancy after consolidation

Option A is correct because VM sprawl leaves idle, forgotten virtual machines powered on without patching, monitoring or ownership, creating an unmanaged attack surface. Storage contention, licence cost and redundancy are operational or financial concerns that the scenario does not point to and that carry less control risk.

• A. Recommend a formal asset disposal policy with sign-off
• B. Recommend deploying automated asset discovery tooling
• C. Test the asset register against a sample of physical devices
• D. Confirm whether data was wiped from the 60 retired devices Correct answer

Option D is correct because the immediate exposure is possible disclosure of data on 60 disposed laptops, so the auditor first determines whether the data was wiped. Policy, discovery tooling and register testing are useful recommendations, but they come after establishing whether the exposure has already occurred.

• A. Extend scheduler log retention to match the audit cycle
• B. Require a second operator to witness each job rerun
• C. Move job parameter changes into the standard change process Correct answer
• D. Rotate operators across shifts so no one owns a job stream

Option C is correct because production job parameter changes by operators should pass through authorisation, testing and approval in the standard change process, which closes the exposure at its source. Longer log retention, witnessing and rotation do not provide approved, reviewed change control over the parameters.

• A. Incompatible file formats between departments
• B. Slower calculation than the core financial application
• C. Higher licensing costs across the business units
• D. Undetected errors in unvalidated formulas Correct answer

Option D is correct because end-user spreadsheets typically lack validation, version control, access control and independent review, so formula errors can go undetected in critical financial figures. File format, speed and licence cost are minor concerns by comparison.

• A. The Statement of Applicability Correct answer
• B. The business impact analysis
• C. The risk treatment plan
• D. The information security policy

Option A is correct because the Statement of Applicability lists every Annex A control, whether it is applied, and the justification for including or excluding it. The business impact analysis, risk treatment plan and information security policy do not record that control-by-control selection rationale.

• A. A visitor log signed at the reception desk
• B. Closed-circuit cameras recording the entrance
• C. A mantrap that admits one person at a time Correct answer
• D. A biometric reader added beside the badge reader

Option C is correct because a mantrap (airlock) admits one person at a time and so physically stops a second person from following through on the same badge read. A visitor log and cameras only record or detect tailgating, and an added biometric reader still lets a second person walk in behind an authenticated one.

• A. Change all 14 passwords this week and schedule a manual rotation each quarter
• B. Move the credentials into a privileged access vault with automatic rotation Correct answer
• C. Consolidate the scripts on one scheduling server with restricted file permissions
• D. Reduce each account's rights to what its job needs and log every interactive logon

Option B is correct because the underlying weakness is hard-coded, static, over-privileged credentials; a privileged access vault with automatic rotation removes embedded passwords and keeps them changing. Option A is a one-off fix with manual rotation that would still leave passwords in scripts, option C only restricts file access, and option D reduces rights and adds logging without addressing the embedded, unrotated passwords.

• A. A web application firewall in front of the server Correct answer
• B. Stateful inspection on the existing firewall
• C. Egress filtering on the server's subnet
• D. Network address translation for the web server

Option A is correct because a web application firewall inspects HTTP/HTTPS request content at the application layer and can block SQL injection payloads. Stateful inspection works at the connection level, egress filtering controls outbound traffic, and NAT only translates addresses; none examines request content.