CISA Practice Questions & Practice Test

What is the primary benefit of conducting regular system security assessments in the context of maintaining information system security?

• A.To optimize system resource allocation
• B.To improve system performance metrics
• C.To ensure compliance with industry standards
• D.To identify and address security control deficiencies and vulnerabilities

Why: Understand the benefits of regular system assessments Conducting regular system assessments helps to identify and address security control deficiencies, which is a critical aspect of maintaining operational assurance, as stated in NIST SP 800-12r1. Source: NIST SP 800-12r1

What is the primary purpose of developmental testing and evaluation in systems development processes and practices?

• A.To identify defects in the system and ensure that they are properly addressed
• B.To assess the system's performance and scalability
• C.To validate that the controls are implemented correctly and are consistent with the established information security and privacy architectures
• D.To evaluate the system's usability and user experience

Why: Evaluate systems development processes and practices The primary purpose of developmental testing and evaluation is to validate that the controls are implemented correctly and are consistent with the established information security and privacy architectures. Source: NIST SP 800-37r2

What is the benefit of conducting assessments during the systems development life cycle?

• A.To identify defects in the system and ensure that they are properly addressed
• B.To assess the system's performance and scalability
• C.To validate that the controls are implemented correctly and are consistent with the established information security and privacy architectures
• D.To avoid unnecessary delays or costly repetition of assessments during the authorization process

Why: Evaluate systems development processes and practices The benefit of conducting assessments during the systems development life cycle is to avoid unnecessary delays or costly repetition of assessments during the authorization process. Source: NIST SP 800-37r2

The IS auditor is evaluating the systems development processes and practices of an organization to ensure alignment with information security and privacy architectures. What should the IS auditor do FIRST in this evaluation?

• A.A. Conduct a design review to identify potential security and privacy vulnerabilities
• B.B. Perform regression testing to ensure that changes to the system have not introduced new security risks
• C.C. Assess the organization's systems development life cycle (SDLC) to ensure it is properly defined and aligned with the organization's information security and privacy architectures
• D.D. Develop a plan to conduct regular security assessments and penetration testing

Why: Evaluate systems development processes and practices The correct answer is to assess the control assessments conducted during the SDLC to identify deficiencies and areas for improvement. This is because deficiencies identified early in the SDLC can be resolved in a more cost-effective manner (NIST SP 800-37r2). Source: NIST SP 800-37r2

What is the primary benefit of conducting security risk assessments during the systems development life cycle (SDLC)?

• A.To identify potential security risks and develop mitigation strategies
• B.To evaluate system performance and optimize resource allocation
• C.To develop a plan to conduct regular security audits and compliance checks
• D.To implement a robust planning process to manage project timelines and budgets

Why: Evaluate systems development processes and practices The correct answer is to identify potential security risks and develop mitigation strategies. This is because conducting assessments during the SDLC can help identify potential security risks and develop mitigation strategies (NIST SP 800-37r2). Source: NIST SP 800-37r2

The IS auditor is evaluating the access controls of a cloud-based system and notices that the organization is using a single-factor authentication method. What should the IS auditor consider FIRST?

• A.A. Recommend implementing a multi-factor authentication method without evaluating the current method
• B.B. Evaluate the effectiveness of the current single-factor authentication method in the context of the organization's security requirements
• C.C. Assess the organization's risk management framework to determine the impact of single-factor authentication
• D.D. Review the organization's incident response plan to ensure it addresses authentication-related incidents

Why: Evaluate access controls The IS auditor should first evaluate the effectiveness of the current single-factor authentication method, as this will provide a basis for understanding the risks associated with the current method.

The IS auditor is reviewing the systems maintenance processes of an organization and finds that the organization is not conducting regular performance and security assessments. What should the IS auditor recommend to ensure that the organization's systems maintenance processes are effective?

• A.A. Conduct a one-time system assessment to identify performance and security issues
• B.B. Implement a continuous monitoring strategy to identify and address performance and security weaknesses
• C.C. Develop a plan to provide security awareness training to users and operators
• D.D. Update the organization's security policy to include stricter penalties for bypassing security controls

Why: Evaluate systems maintenance processes and practices The correct answer is to implement a continuous monitoring strategy to identify and address security control weaknesses. This is because continuous monitoring can help ensure that security controls are operating as intended and identify areas for improvement, which is a key aspect of maintaining operational assurance (NIST SP 800-12r1). Source: NIST SP 800-12r1

What should the IS auditor do to maintain operational assurance in accordance with IS audit standards?

• A.Conduct periodic vulnerability assessments
• B.Perform continuous monitoring of system activity
• C.Conduct a review of system documentation
• D.Develop a business continuity plan

Why: Maintaining operational assurance is crucial for IS audit standards The correct option is to perform continuous monitoring of system activity, as it is one of the methods to maintain operational assurance, according to NIST SP 800-12r1 Source: NIST SP 800-12r1