CISA Domain 5B-1 Practice Test 001

This practice test covers Domain 5 (Protection of Information Assets) Subdomain B-1 (Security Awareness Training and Programs) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5B-1 Security Awareness Training and Programs Practice Test 001

10 questions • Single best answer

Question 1

Following several successful phishing attacks, a retail bank's internal audit team is evaluating the enterprise security awareness program. Training completion stands at 98 percent, yet phishing simulation click rates remain unchanged year over year. Which finding should the IS auditor consider MOST significant when concluding on program effectiveness?

A. High completion rates are being tracked as the sole measure of program success. B. The phishing simulation tool was not updated with newer attack templates. C. Training content was delivered through computer-based modules rather than in person. D. Completion certificates were not retained within the learning management system.

Question 2

An IS auditor wants to conclude on whether a government agency's security awareness program is effective at reducing human-related risk. The program manager offers several sources of support for the program's value. Which of the following would provide the BEST evidence that the program is achieving its intended outcome?

A. A signed acknowledgment from every employee confirming they completed the training. B. A comprehensive training curriculum that was formally reviewed and approved by the information security steering committee. C. A downward trend in phishing simulation failure rates and reported incidents over time. D. High satisfaction scores drawn from post-training feedback surveys of attendees.

Question 3

During an audit of a healthcare provider, the IS auditor finds that clinical staff frequently share login credentials and disable endpoint warnings despite completing annual security training. Management attributes this to workload pressures. What should the IS auditor do FIRST before forming a conclusion on the awareness program?

A. Recommend immediate disciplinary action against the staff who shared credentials. B. Determine whether the training content actually addresses the specific behaviors being violated. C. Conclude that the awareness program is ineffective and report it as a finding. D. Expand the audit scope to include the organization's entire access control framework.

Question 4

An IS auditor reviews an enterprise's security awareness program and notes that all employees receive the same generic annual training module. System administrators, developers, and finance staff who handle wire transfers receive no additional targeted content. Which recommendation is MOST appropriate to strengthen the program?

A. Increase the frequency of the existing generic module from annual to quarterly. B. Require all staff to pass a knowledge assessment after the generic module. C. Extend the existing generic module with a broader range of additional detailed technical security topics. D. Implement role-based training tailored to the risks of high-exposure job functions.

Question 5

A financial services firm's security awareness program is funded and delivered entirely by the IT department, with no formal ownership or oversight from senior management or the risk function. The IS auditor is assessing program governance. Which conclusion is MOST appropriate regarding this governance arrangement?

A. Lack of senior management ownership weakens accountability and organizational commitment. B. IT ownership is appropriate here because most security controls are technical and operational in nature. C. The arrangement is acceptable provided training completion targets are being met. D. Program delivery should be outsourced to an independent third-party provider.

Question 6

An audit manager is evaluating how a manufacturing enterprise reports on its security awareness program to the board. The only metric presented quarterly is the number of employees who completed training, and the board uses this figure to gauge human risk exposure. Which finding is MOST significant?

A. The metric should be reported monthly rather than on a quarterly basis. B. The board should also receive the underlying training content along with the completion data reports. C. Completion counts alone do not indicate whether risky behaviors have improved. D. Completion data should be broken down by individual business department.

Question 7

During an audit of a technology company, the IS auditor learns that new employees are granted full system access on their start date but do not receive security awareness training until the company-wide annual session, which may be months away. Which risk should the auditor highlight as MOST significant?

A. The annual session may contain outdated material by the time new hires attend it. B. New users operate with full access before understanding security responsibilities and threats. C. New employees may feel disengaged from the organization's overall security culture. D. Training delivered in large annual sessions tends to be less memorable for attendees.

Question 8

A retail organization measures its awareness program using post-course quiz scores, which average 95 percent. However, help-desk data shows repeated malware infections traced to employees opening malicious attachments. The IS auditor is evaluating whether the program's measurement approach reflects real-world behavior. Which conclusion is MOST appropriate?

A. The quiz difficulty should be increased to better differentiate employee knowledge levels. B. The malware infections are an operational issue that is unrelated to awareness training. C. A 95 percent quiz average confirms that the program content is effective overall. D. Knowledge scores do not reliably predict secure behavior in real situations.

Question 9

An IS auditor reviewing a logistics company finds that security awareness training is mandatory for employees but excludes the large population of contractors and temporary staff who access the same production systems and routinely handle sensitive shipping data. Which recommendation is MOST appropriate for the auditor to make?

A. Extend mandatory awareness training to all personnel who access company systems. B. Restrict contractors from accessing any systems that contain sensitive data. C. Require contractors to sign confidentiality agreements in place of training. D. Rely on the staffing vendors to provide their own security training to workers.

Question 10

An IS auditor previously reported that a bank's phishing simulation click rate was high and recommended targeted refresher training. During follow-up a year later, the auditor must evaluate whether the risk was sufficiently addressed. Which of the following provides the BEST evidence of effective remediation?

A. Documentation confirming that the refresher training was developed and scheduled. B. Management's written assurance that the recommended training was delivered on time. C. A measurable and sustained reduction in click rates on subsequent phishing simulations. D. An increase in the number of employees who completed the refresher module.

Related Posts

Leave a Comment Cancel Reply