CISA Domain 5A Practice Test 001

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A (Information Asset Security and Control) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA Practice Test — 5A (Information Asset Security and Control)

10 questions • Single best answer

Question 1

During an external audit of a commercial bank, the IS auditor finds that terminated employees' network accounts stayed active for an average of 45 days after departure because HR and IT had no integrated deprovisioning workflow. Records show several of these accounts accessed core banking systems after termination. Which of the following should be the auditor's MOST significant concern?

A. The organization has not documented and formally approved a password complexity standard applicable to all network user accounts. B. The HR and IT functions currently report to two different senior executives within the corporate organizational structure. C. Orphaned accounts of terminated employees retained active access to core banking systems, enabling unauthorized transactions. D. Periodic user access recertification reviews are performed annually rather than on the recommended semi-annual basis.

Question 2

An IS auditor reviewing a large retailer's data-at-rest protections finds that a database of customer payment records is encrypted, but the encryption keys are stored in plaintext in a configuration file on the same server that hosts the database. Which of the following is the auditor's MOST appropriate conclusion regarding this control?

A. The encryption offers limited assurance because a compromise of the server would also expose the keys protecting the data. B. The encryption is fully effective because the stored data cannot be read without decryption. C. The control is adequate provided the database uses a strong algorithm such as AES-256. D. The control is acceptable if file system permissions restrict the file to administrators.

Question 3

A government agency implements a public key infrastructure to support digital signatures for online citizen services. During the audit, the IS auditor notes there is no defined process for revoking certificates or for publishing and distributing a certificate revocation list. Which of the following risks is MOST significant?

A. Certificate issuance to individual citizens may occasionally take longer than the timeframe stated in the published service-level agreement. B. Compromised or invalid certificates could continue to be trusted without any means of detection. C. The certificate authority's private signing key may need to be renewed and re-issued more frequently than originally planned for. D. Citizens may be required to manually locate and install the root certificate on each of their personal computing devices.

Question 4

An IS auditor is reviewing a manufacturer's migration of a customer-facing application to a public cloud provider under an infrastructure-as-a-service model. Management asserts that the cloud provider is fully responsible for securing the operating systems and workloads deployed in the environment. Which of the following should the auditor do FIRST?

A. Recommend that management immediately terminate the existing contract with the cloud provider and return the application on-premises. B. Test the strength and configuration of the encryption applied to customer data stored within the provider's hosted environment. C. Request the cloud provider's most recent independent external penetration testing results and remediation status for detailed examination. D. Review the shared responsibility model in the cloud service agreement to confirm which party owns each control.

Question 5

During an audit of an insurance company, the IS auditor observes that a data loss prevention solution is deployed but configured only in monitor mode, generating alerts without blocking transfers. Analysts review the alerts weekly, and several confirmed exfiltration events went unaddressed for several days. Which finding is MOST significant?

A. Confirmed data exfiltration events were not acted upon promptly, showing the DLP program is not operationally effective. B. The deployed DLP solution operates in monitor mode rather than automatically blocking every outbound transfer of regulated data. C. Alert reviews by the analyst team are performed only weekly instead of continuously and in near real time. D. The DLP tool has not yet been upgraded to the vendor's most recent software release and signature package.

Question 6

An IS auditor examining an enterprise network finds that the internal network is entirely flat, with production servers, user workstations, and guest wireless devices all residing on a single shared segment. Firewall filtering exists only at the internet perimeter of the network. Which of the following recommendations is MOST appropriate?

A. Deploy and centrally manage endpoint antivirus software on every user workstation across the enterprise. B. Implement network segmentation to isolate production servers from user and guest traffic. C. Enforce complex passwords and periodic rotation for connecting to the guest wireless network. D. Extend the log retention period and increase logging verbosity on the perimeter firewall.

Question 7

An IS auditor reviewing a colocation data center notes that badge access to the server floor is logged, but the logs are never reviewed, and several active badges still belong to former contractors. The environmental monitoring systems are functioning normally. Which of the following is the auditor's BEST course of action?

A. Conclude that the physical access controls are adequate because all badge access events are being captured in logs. B. Recommend the installation of additional temperature and humidity monitoring sensors throughout the server floor area. C. Advise that the existing proximity badge readers be replaced with biometric fingerprint authentication devices. D. Report that physical access rights are not reviewed, allowing unauthorized personnel to retain server-floor access.

Question 8

A financial services firm asserts that its information security program is aligned with a recognized industry framework. The IS auditor finds the controls were mapped to that framework two years ago but were never reassessed, despite significant changes to the technology environment since then. Which of the following is the auditor's MOST appropriate conclusion?

A. The claimed alignment gives limited assurance because the outdated mapping no longer reflects the current environment. B. The alignment remains valid and reliable because the firm selected a widely recognized and reputable industry framework. C. The firm should promptly adopt an entirely different control framework that is better suited to the financial services sector. D. The existing control mapping is sufficient as long as the firm refreshes and re-attests it at least once every three years.

Question 9

An IS auditor assessing a logistics company's bring-your-own-device program finds that employees routinely access corporate email and file shares from personal smartphones that have no mobile device management enrollment and no remote-wipe capability configured. Which of the following risks should the auditor highlight as MOST significant?

A. Employees may incur unexpected personal mobile data charges when they access corporate resources from outside the office. B. Personal devices may run older operating system versions that the internal help desk is not currently staffed to support. C. Corporate data on a lost or stolen personal device cannot be remotely removed, risking disclosure. D. Battery performance on personal devices could degrade over time from continuously running corporate mobile applications.

Question 10

During an audit of an enterprise resource planning system at a utility company, the IS auditor finds that database administrators share a single privileged account whose activity cannot be attributed to any individual. Emergency access is granted through this shared account without any documented approval. Which of the following is the auditor's MOST significant concern?

A. Database administrators may occasionally forget the current password to the shared account. B. Shared privileged accounts prevent individual accountability and undermine the reliability of system audit trails. C. The shared privileged account password may not meet the organization's minimum length standard. D. Emergency access through the shared account could slow down routine maintenance tasks.

Related Posts

Leave a Comment Cancel Reply