CISA Domain 5A-4 Practice Test 001

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-4 (Network and End-Point Security) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-4 Network and End-Point Security Practice Test 001

10 questions • Single best answer

Question 1

During an audit of a manufacturing firm, the IS auditor finds that production control systems share a single network segment with corporate email and general workstations, with no internal firewalls between them. Malware from a user endpoint recently spread to a plant server. What should the IS auditor do FIRST?

A. Recommend deploying endpoint detection and response agents on all plant servers immediately. B. Report the malware incident to the plant manager and request a temporary network shutdown. C. Assess the business impact and risk of the flat network before recommending any controls. D. Verify whether the organization's security policy requires internal network segmentation.

Question 2

An IS auditor is assessing the effectiveness of a newly deployed endpoint detection and response solution across the enterprise, covering both office-based and remote staff. Management asserts that all workstations and laptops are protected. Which of the following would provide the BEST evidence that the endpoint controls are operating effectively?

A. A vendor datasheet describing the detection and response capabilities of the EDR platform. B. Reconciliation of the EDR console's managed-agent list against the organization's asset register. C. Interviews with the security operations team confirming they monitor EDR alerts each day. D. A dashboard screenshot showing no active endpoint threats on the date of the audit.

Question 3

While reviewing perimeter firewall controls at a healthcare provider, the IS auditor examines the rule base, change tickets, and logging configuration as part of a compliance-driven audit. Several observations are noted during detailed testing. Which of the following findings would be MOST significant to the confidentiality of patient data?

A. Firewall rule changes are approved by email rather than through the formal change system. B. Firewall administrators share a single privileged account when performing maintenance tasks. C. The firewall rule base has not been reviewed to remove unused rules for eighteen months. D. An "any-to-any" rule permits all inbound Internet traffic to reach internal application servers.

Question 4

An audit of remote access reveals that employees and third-party contractors connect through a corporate VPN using only a username and password over the public Internet. Once authenticated, the VPN grants full access to the entire internal network. Which recommendation is MOST appropriate to reduce the associated risk?

A. Require multi-factor authentication and limit each VPN session to only the segments the role needs. B. Increase the minimum password length and require VPN users to change passwords more frequently. C. Deploy an intrusion detection sensor to monitor the traffic originating from VPN connections. D. Require contractors to sign confidentiality agreements before VPN credentials are issued to them.

Question 5

A retailer states that its cardholder data environment is isolated from the rest of the corporate network by internal firewalls. The IS auditor wants to confirm that this segmentation is actually effective. Which approach provides the BEST assurance that the segmentation controls are working as intended?

A. Review the firewall configuration files for rules that restrict traffic to the cardholder environment. B. Obtain the network diagram showing the cardholder data environment placed on a separate VLAN. C. Perform testing that attempts to reach the cardholder environment from other network segments. D. Interview the network engineers about how the segmentation was designed and later implemented.

Question 6

An IS auditor plans to evaluate whether endpoints are hardened according to the organization's secure configuration baseline. The environment includes several thousand laptops and desktops across many locations, and available audit time is limited. Which testing approach would be MOST effective and efficient for performing this evaluation?

A. Manually inspect a small judgmental sample of endpoints selected for the auditor by the IT team. B. Use an automated configuration-scanning tool to compare endpoints against the secure baseline. C. Review the baseline configuration document and confirm that it aligns with vendor hardening guidance. D. Distribute a self-assessment questionnaire asking end users to describe their own device settings.

Question 7

During a network security audit at a government agency, the IS auditor observes that any device connected to an open network port receives an address and reaches internal systems without authentication. A network access control tool was purchased but never enabled. What is the MOST significant risk in this situation?

A. Unauthorized devices can connect to the internal network and access sensitive information assets. B. The agency has failed to realize the value of its investment in the network access control tool. C. The network team is unable to maintain an accurate inventory of all authorized network devices. D. Visitors at the agency may consume network bandwidth that is intended for use by staff members.

Question 8

An IS auditor's prior report recommended that all firewall rule changes be reviewed and approved before implementation. During follow-up, the auditor finds a documented approval workflow now exists, but several recent changes were implemented with no recorded approvals. What is the auditor's BEST course of action?

A. Close the prior finding because a formal firewall change approval workflow has now been documented. B. Recommend that the firewall administration team be retrained on the newly documented approval workflow. C. Extend the follow-up period to give the firewall team additional time to comply with the workflow. D. Conclude the control is not operating effectively and report the exception as a remaining finding.

Question 9

An IS auditor reviewing endpoint protection finds that the central anti-malware console reports ninety-six percent of managed devices as compliant with policy. The remaining devices do not appear in the console at all, and their protection status is unknown. Which conclusion is MOST appropriate based on this evidence?

A. Endpoint protection is largely effective because the reported compliance rate exceeds ninety-five percent. B. The devices missing from the console are an unmanaged coverage gap requiring further investigation. C. The noncompliant devices should be reimaged so that anti-malware protection is restored on them. D. The anti-malware console is misconfigured and is therefore underreporting the compliant devices.

Question 10

An IS auditor evaluates a company's intrusion detection system and finds that it sends alerts to a monitored mailbox, but no one is assigned to review the alerts and no response procedures exist. Which finding should the auditor emphasize as MOST important in the report?

A. The intrusion detection system should be upgraded to an intrusion prevention system for blocking. B. Alert thresholds have not been tuned, which is likely to produce a high volume of false positives. C. Detected intrusions may go unnoticed and unaddressed because no one acts on the generated alerts. D. The monitored mailbox lacks sufficient storage capacity to retain older alert messages over time.

Related Posts

Leave a Comment Cancel Reply