CISA Domain 5B-1 Practice Test 002

This practice test covers Domain 5 (Protection of Information Assets) Subdomain B-1 (Security Awareness Training and Programs) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5B-1 Security Awareness Training and Programs Practice Test 002

10 questions • Single best answer

Question 1

A public university's chief audit executive assigns an IS auditor to evaluate a newly launched security awareness program covering faculty, staff, and student workers. The program includes monthly videos, posters, and an annual quiz, but no documentation explains how training topics were selected. What should the IS auditor do FIRST?

A. Test a sample of annual quiz results to measure how well participants retained key concepts B. Determine whether program content was derived from a documented assessment of human-related risks C. Benchmark the program's delivery methods against those used by peer higher-education institutions in the region D. Recommend that management adopt a recognized awareness framework to guide future topic selection

Question 2

An insurance carrier's help desk reset an executive's password after an attacker impersonated him by phone. Management responded by requiring all help-desk agents to complete a new voice-phishing awareness module. Which of the following provides the IS auditor with the BEST evidence that the training is effective?

A. Signed acknowledgments from help-desk agents confirming they completed the voice-phishing module B. Post-training assessment scores showing every agent passed with a score above 90 percent C. A content review confirming the module addresses current voice-phishing and pretexting techniques D. Results of unannounced pretext calls showing agents consistently applied caller verification procedures

Question 3

During a security awareness audit at a regional hospital network, the IS auditor documents several observations. Clinical and administrative staff complete identical annual e-learning modules, and completion rates exceed 97 percent across all eleven facilities. Which observation represents the MOST significant risk to the organization?

A. Staff with broad EHR access receive no training on verifying callers who request patient information B. Awareness posters displayed in nursing stations and staff break rooms have not been updated in over a year C. Completion reports are distributed to department managers quarterly rather than on a monthly basis D. The e-learning platform does not record how much time employees spend completing each module

Question 4

At a government revenue agency, the CISO designs the security awareness program while human resources administers delivery and tracks completion. The IS auditor finds that neither function reports program results to senior management, and employees who ignore mandatory training face no consequences. Which recommendation is MOST appropriate?

A. Transfer full ownership of the program to human resources to consolidate administration B. Implement automated reminders for employees who have not completed required training C. Establish senior management oversight with defined accountability and enforcement for noncompliance D. Require the CISO to present detailed completion statistics to the audit committee at each annual meeting

Question 5

An audit manager at a multinational manufacturer is scoping an engagement on the security awareness program after a business email compromise led to a fraudulent wire transfer. Audit hours are limited, and the program covers more than 20,000 employees worldwide. Which area should receive the HIGHEST priority in the audit scope?

A. Training coverage and payment-verification awareness for finance and accounts payable staff B. Completion rates for annual general awareness training across all global manufacturing sites C. The learning management system's configuration settings and administrator access controls D. Alignment of training materials with the corporate brand and internal communication standards

Question 6

A cloud services provider runs quarterly phishing simulations and reports a steadily declining click rate to the board as proof of program success. The IS auditor notes that the same three email templates have been rotated for two years and are never updated. Which conclusion is MOST appropriate?

A. The program is operating effectively because click rates have consistently declined across all quarters reviewed B. The simulation frequency should be increased to monthly to further improve employee vigilance C. The board metric is adequate but should be supplemented with training completion data D. The declining rate may reflect template familiarity rather than improved resistance to real attacks

Question 7

An IS auditor reported that a pharmaceutical company's remote workforce received no training on securing home networks or recognizing MFA push-fatigue attacks. During follow-up, management provides a new training module and a completion report showing that 92 percent of remote staff finished it. What should the IS auditor do NEXT?

A. Close the finding because the completion rate exceeds the target management originally agreed to B. Verify that the module addresses the reported risks and review trends in MFA push-denial reporting C. Escalate to the audit committee because completion has not yet reached 100 percent of all remote staff D. Expand the follow-up scope to include awareness training delivered to on-site employees

Question 8

A wealth management firm's security awareness curriculum was last updated three years ago, yet recent threat intelligence shows attackers using AI-generated voice clones of executives to request urgent fund transfers from staff. The IS auditor is drafting recommendations on the awareness program. Which recommendation is MOST appropriate?

A. Replace the existing curriculum with a commercial off-the-shelf awareness training platform B. Require dual approval for all fund transfers regardless of the amount or the requester's seniority C. Establish a process to periodically update training content based on emerging threat intelligence D. Add a one-time mandatory module on deepfake detection technologies for all employees

Question 9

A telecommunications company's awareness training instructs employees to report suspicious emails using a dedicated button. The IS auditor finds that the security operations center never acknowledges reports, that 40 percent of reported messages are never triaged, and that report volumes have declined steadily all year. Which conclusion is MOST appropriate?

A. Declining report volumes indicate that phishing attempts against the company have decreased B. Awareness training content should be expanded to place more emphasis on reporting obligations C. The security operations center should be staffed to triage all reports within a defined service level D. The broken reporting feedback loop is likely undermining employee reporting behavior

Question 10

An IS auditor at an online retailer wants to determine whether employees apply data-handling awareness training in daily work. The retailer's data loss prevention tool logs every blocked attempt to email unencrypted customer files to external addresses. Which audit approach provides the BEST assurance about the program's impact?

A. Analyze DLP event trends by department before and after training delivery to identify behavior change B. Interview a sample of employees across departments to confirm their understanding of data-handling requirements C. Review the data-handling module to verify that it reflects the current data classification policy D. Compare the number of configured DLP rules against the vendor's recommended baseline settings

Related Posts