CISA Domain 5A-4 Practice Test 002

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-4 (Network and End-Point Security) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-4 Network and End-Point Security Practice Test 002

10 questions • Single best answer

Question 1

An external IS auditor engaged by a state transportation agency is reviewing the network supporting its traffic-signal control systems. Network diagrams show that the operational technology devices share a flat network with administrative workstations, although a perimeter firewall filters internet traffic. Which recommendation should the auditor make FIRST?

A. Deploy an intrusion detection sensor behind the perimeter firewall to inspect inbound traffic B. Require multifactor authentication for all administrative workstation logins and remote sessions C. Segment the operational network from administrative systems with filtered, monitored access points D. Increase the frequency of vulnerability scans across both the workstation and control environments

Question 2

During an audit of endpoint security at a regional hospital, the IS auditor obtains an endpoint detection and response (EDR) console report showing active agents on 98 percent of devices. The device inventory used to calculate this coverage figure is maintained by the EDR administration team itself. Which of the following is the BEST evidence that coverage is complete?

A. A reconciliation of EDR agent records against the CMDB and network access logs B. A signed attestation from the EDR team lead confirming the reported coverage figure C. A screenshot of the EDR console dashboard captured by the auditor during fieldwork D. A vendor service report confirming deployed agents match the purchased license count

Question 3

An audit manager reviewing a bank's firewall management process finds that rule changes are approved through the change ticketing system. However, the firewall rule base contains 340 rules, no rule review has been performed in two years, and 60 rules reference servers that were decommissioned. Which recommendation is MOST appropriate?

A. Require a second network engineer to approve each new firewall rule before it is implemented B. Replace the current firewall with a next-generation platform that provides application awareness C. Remove all rules that reference decommissioned servers and then close the audit finding D. Establish periodic rule base reviews with rule owners to validate the ongoing business need

Question 4

A manufacturing company allows design engineers to connect to the corporate network through a VPN from personal laptops. The IS auditor notes that the VPN enforces multifactor authentication and strong encryption, but no device posture checks are performed before connections are established. Which risk should the auditor consider MOST significant?

A. Engineer credentials could be intercepted while traveling over public internet connections B. Compromised or unpatched devices could introduce malware into the corporate network C. Engineers could exceed the licensed number of concurrent VPN sessions during peak periods D. Remote sessions could be hijacked because authentication tokens are shared between users

Question 5

An IS auditor at a government revenue department is testing whether critical endpoint patches are deployed within the 14-day window required by policy. Management provides a patch compliance report generated directly by the deployment tool, showing 99 percent compliance. What should the auditor do FIRST before relying on this report?

A. Validate the completeness and accuracy of the report against an independent data source B. Select a sample of endpoints and interview their users about recent patch notifications C. Compare the 14-day policy window with vendor recommendations and industry benchmarks D. Review the deployment tool's configuration settings for scheduled patch distribution

Question 6

A security operations review at an online retailer shows that the network intrusion prevention system runs in detection-only mode because blocking previously disrupted checkout traffic. Analysts receive about 4,000 alerts daily and review only a small sample of them each shift. Which recommendation is MOST appropriate?

A. Disable the signatures generating the highest alert volumes to reduce analyst workload B. Switch the system to prevention mode immediately across all monitored network segments C. Tune signatures to reduce false positives before progressively enabling blocking mode D. Hire additional analysts so that every alert generated can be reviewed each business day

Question 7

An IS auditor is evaluating network access control at a university research center. Policy states that only registered devices may connect to wired ports in laboratories, and configuration files show 802.1X authentication enabled on the core switches. Which audit procedure provides the BEST assurance that the control operates effectively?

A. Reviewing the network access control policy approval and annual review history B. Inspecting configuration files for the remaining laboratory access-layer switches C. Interviewing network administrators about how unregistered devices are handled D. Connecting an unregistered test device to sampled laboratory ports to observe the result

Question 8

A post-implementation review of a new customer portal at a credit union finds that the web server was placed on the internal network rather than in the DMZ to meet the launch deadline. A formal risk acceptance for this deviation was signed by the project manager. What is the IS auditor's BEST course of action?

A. Recommend that the web server be shut down until it has been relocated to the DMZ B. Report that the risk was accepted by someone without the appropriate authority C. Recommend that the project manager add compensating controls to the acceptance D. Accept the deviation because it was formally documented and approved before go-live

Question 9

During an audit of a pharmaceutical distributor, the IS auditor finds that 35 percent of employee workstations grant users local administrator rights. Management explains that these rights support several legacy applications and notes that antivirus software is installed on all endpoints. Which conclusion is MOST appropriate based on the evidence?

A. Antivirus software adequately mitigates the malicious software risk on these workstations B. The finding is low risk because local administrator rights affect only single workstations C. Excessive privileges increase malware and tampering risk and require a remediation plan D. Legacy application support is a valid business need that requires no further action

Question 10

An IS auditor is performing follow-up on a prior finding that internet-facing servers lacked host-based firewalls. Management reports that remediation is complete and provides an updated server hardening standard requiring host firewalls. Which action provides the BEST basis for concluding that the risk has been addressed?

A. Testing a sample of internet-facing servers to confirm host firewalls are enabled B. Reviewing the updated hardening standard to confirm it mandates host-based firewalls C. Obtaining written confirmation from the server team manager that remediation is complete D. Closing the finding because management has supplied documented remediation evidence

Related Posts

Leave a Comment Cancel Reply