CISA Domain 5A-9 Practice Test 001

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-9 (Mobile, Wireless, and Internet-of-Things Devices) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-9 Mobile, Wireless, and Internet-of-Things Devices Practice Test 001

10 questions • Single best answer

Question 1

An IS auditor is reviewing a manufacturing company that deployed hundreds of IoT sensors across its production floor to monitor equipment. The devices share the same network segment as corporate financial systems, and many still use vendor-default credentials. Which finding should the auditor consider MOST significant?

A. IoT sensors share a network segment with corporate financial systems, allowing lateral movement from a compromised device. B. The vendor-default credentials used by the sensors have not been documented anywhere in the organization's centralized asset inventory register maintained by operations. C. Firmware update schedules for the deployed sensors are not formally published to the operations team. D. Sensor telemetry is transmitted without compression, increasing bandwidth consumption on the plant network.

Question 2

A hospital allows clinicians to access electronic patient records from personally owned smartphones enrolled in a BYOD program. During an audit, the IS auditor learns there is no capability to remove organizational data from a device that is lost or stolen. Which control would provide the BEST assurance that patient data remains protected?

A. Requiring a complex device passcode enforced through the firm's written acceptable-use policy for all personally owned mobile devices. B. Deploying mobile device management with containerization and remote selective wipe of organizational data. C. Mandating that each clinician install commercial antivirus software on their smartphone. D. Prohibiting clinicians from taking screenshots within the clinical records application.

Question 3

During a wireless network audit at a national retail chain, the IS auditor uses a spectrum analyzer and detects an unauthorized access point broadcasting the corporate SSID from within a store location. The device is not listed in the approved wireless inventory. What should the IS auditor do FIRST?

A. Recommend that the store's guest wireless network be disabled immediately. B. Determine whether the rogue access point is connected to the internal network and could expose data. C. Reconfigure the legitimate corporate access points to use stronger enterprise authentication and encryption. D. Report the unauthorized device to the wireless equipment vendor for firmware analysis.

Question 4

An IS auditor is evaluating a bring-your-own-device program at a professional services firm. Management asserts that only compliant, enrolled devices are permitted to access corporate email and file shares. Which of the following would provide the BEST evidence that this access control is operating effectively?

A. A signed BYOD acceptable-use policy on file for each participating employee. B. The written MDM configuration standard that has been reviewed and formally approved by senior IT management. C. Conditional-access logs showing non-compliant devices were actually blocked from connecting. D. A current list of enrolled devices exported by the mobile administrator.

Question 5

An audit of a logistics company reveals that IoT tracking devices are procured directly by regional managers and connected to the corporate network without any central registration. The security team cannot produce a complete list of connected devices. Which recommendation is MOST appropriate to address this weakness?

A. Establish a centralized IoT asset inventory integrated with network access control enforcement. B. Require regional managers to email device serial numbers to security each month. C. Increase the frequency of external vulnerability scans against the company's public-facing perimeter systems. D. Deploy commercial endpoint antivirus software to each IoT tracking device.

Question 6

During a review of a corporate wireless network, an IS auditor finds that several access points are configured with WPA2 using a single pre-shared key that has not been changed in over three years and is still known to several former employees who have since left the company. Which risk is MOST significant?

A. Former employees retain the ability to authenticate to the corporate wireless network. B. WPA2 relies on AES, which imposes additional processing overhead on older client devices. C. The static pre-shared key increases the administrative burden of onboarding new staff members. D. The access point firmware may fall outside the vendor's active support and patching window.

Question 7

An IS auditor examines a mobile banking application that allows retail customers to transfer funds between accounts. The auditor wants to confirm that data exchanged between the mobile app and the backend servers cannot be intercepted or altered in transit. Which control provides the BEST assurance?

A. Requiring users to set a six-digit application PIN at first login. B. Enforcing TLS with certificate pinning between the mobile app and the backend servers. C. Displaying a session timeout warning to the user after a period of inactivity. D. Recording all completed fund-transfer transactions in the application's internal audit trail for later management review.

Question 8

A healthcare organization operates networked infusion pumps running firmware that is no longer supported by the manufacturer. The devices cannot be patched, and replacement hardware is planned but has not yet been budgeted or scheduled for the current fiscal year. What is the IS auditor's BEST course of action?

A. Recommend immediate disconnection of all networked infusion pumps until firmware replacements are funded. B. Conclude that no finding exists because a replacement program has already been planned by management. C. Evaluate whether compensating controls such as network isolation and monitoring adequately mitigate the risk. D. Recommend that the unsupported infusion pumps be excluded from the vulnerability management program.

Question 9

An IS auditor reviewing a large university network finds that any device presenting valid Wi-Fi credentials can join the internal network, regardless of its security posture. Thousands of unmanaged student laptops and IoT devices connect each day. What should the auditor recommend the organization implement FIRST?

A. A guest captive portal requiring visitors to accept usage terms before receiving limited internet access. B. Network access control that enforces posture checks and segments devices by trust level. C. A longer and more complex shared wireless passphrase rotated on a quarterly basis. D. Mandatory antivirus software installed on every student-owned laptop before connecting.

Question 10

An IS auditor tests a sample of enrolled corporate mobile devices and finds that 30 percent have disabled the required MDM agent, yet no alerts were ever generated. Management states that the MDM policy is fully documented and communicated to staff. Which conclusion is MOST appropriate?

A. The control is effective because a documented and communicated MDM policy is in place. B. The control is operating as designed since a majority of sampled devices remain compliant. C. The control design is adequate but operating effectiveness is deficient due to missing enforcement and monitoring. D. The finding is immaterial because MDM is a preventive control rather than a detective monitoring control.

Related Posts

Leave a Comment Cancel Reply