CISA Domain 5B-2 Practice Test 001

This practice test covers Domain 5 (Protection of Information Assets) Subdomain B-2 (Information System Attack Methods and Techniques) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5B-2 Information System Attack Methods and Techniques Practice Test 001

10 questions • Single best answer

Question 1

A state transportation agency's IS auditor reviews six months of incident records and identifies repeated SQL injection attempts against a public-facing permit portal. Developers state that input validation was added shortly after the first incident, but no code review or retest evidence is available. Which finding should the IS auditor report as MOST significant?

A. Security incident records were not escalated to the agency risk committee within the required timeframes B. The permit portal was placed into production without a formal penetration test being performed C. Remediation of the injection weakness was never independently verified or evidenced D. Corrective code changes were made by the development team rather than the security function

Question 2

During an audit of a manufacturing company, an IS auditor learns that a fraudulent wire transfer resulted from an email that appeared to originate from the chief financial officer. Finance staff confirmed the payment instruction by replying directly to the original message before releasing funds. What should the IS auditor recommend FIRST?

A. Verify payment instruction changes out-of-band using independently held contact details B. Deploy an email gateway capability that quarantines messages sent from newly registered domains C. Increase the frequency of social engineering awareness training delivered to finance personnel D. Require dual authorization for all outbound wire transfers exceeding a defined monetary threshold

Question 3

A cloud-based insurance platform records a surge of failed logins across thousands of customer accounts, followed by a small number of successful logins from unfamiliar locations. The security team attributes the activity to credentials exposed in an unrelated third-party breach. Which control provides the BEST assurance against this attack technique?

A. Locking accounts automatically after a defined number of consecutive failed login attempts B. Password complexity standards mandating minimum length, character variety, and periodic expiry C. Rate limiting authentication requests that originate from a single source network address D. Phishing-resistant multifactor authentication applied to all customer account logins

Question 4

An IS auditor reviewing a utility company's response to a recent breach finds that an intruder maintained access for four months by using legitimate administrator credentials and scheduled tasks. Antivirus and perimeter firewall logs generated no alerts at any point during that period. Which of the following findings is MOST significant?

A. Antivirus signature definitions on domain controllers were refreshed weekly instead of daily B. Privileged account activity was not monitored for anomalous behavior patterns C. The perimeter firewall rule base had not been formally reviewed within the preceding twelve months D. Scheduled task creation rights were held by several members of the server administration team

Question 5

An online brokerage experienced a distributed denial-of-service attack that made trading functions unavailable to clients for three hours. Management states that an upstream traffic scrubbing service has since been contracted and that the exposure is now fully addressed. What is the IS auditor's BEST course of action to conclude on the remediation?

A. Review test results demonstrating that traffic diversion to the scrubbing service works as designed B. Obtain the executed service agreement and confirm the bandwidth protection thresholds purchased C. Inspect the provider's independent assurance report covering the design of its control environment D. Interview network engineers about their experience responding during the original service outage

Question 6

During a healthcare provider audit, an IS auditor determines that a departing database administrator copied patient records to personal cloud storage two weeks before resigning. Data loss prevention tooling was deployed across endpoints but had remained in monitor-only mode since installation. Which recommendation is MOST appropriate?

A. Require exit interviews that include written acknowledgment of confidentiality obligations B. Revoke administrative system access immediately upon submission of a resignation notice C. Encrypt the patient record database at rest using centrally managed cryptographic keys D. Enable blocking rules for sensitive data transfers to personal and removable storage

Question 7

A post-incident review at a software firm reveals that malicious code reached production through a compromised third-party build dependency. The IS auditor notes that dependencies are pulled automatically from public repositories at build time with no version pinning. Which control would provide the BEST assurance against recurrence of this attack technique?

A. Delivering security awareness training to developers that covers software supply chain risk B. Verifying dependency integrity against an approved internal artifact repository C. Performing dynamic application security testing prior to each production release D. Obligating vendors contractually to disclose security breaches within a defined period

Question 8

An IS auditor reviews the results of a red team exercise performed at a payments processor. The report shows that lateral movement succeeded using credentials cached on user workstations, and business management has formally accepted the risk, citing remediation cost. What should the IS auditor do NEXT?

A. Recommend that the red team exercise be repeated using a broader engagement scope B. Close the observation as resolved because management has formally accepted the risk C. Evaluate whether the acceptance decision was made at an appropriate authority level D. Require the security team to remediate credential caching before the audit report is issued

Question 9

An IS auditor testing a telecommunications company's service desk observes that agents reset account passwords once a caller supplies an employee number and date of birth. Two recent account takeovers began with calls of this type, and call recordings are retained for only seven days. Which finding is MOST significant?

A. Call recordings are retained for a period too short to support subsequent forensic investigation B. Service desk agents do not receive annual refresher training covering social engineering techniques C. Password resets are handled manually by agents rather than through an automated self-service portal D. Identity verification relies on information that is widely known or readily obtainable

Question 10

An audit manager is planning a review of a logistics company's defenses against current attack techniques. The environment includes warehouse automation systems, a customer-facing web portal, and several outsourced carrier integrations. Which approach provides the BEST basis for determining which attack scenarios the audit should prioritize?

A. Mapping plausible threat scenarios to critical business processes and known exposures B. Reviewing the most recent industry breach reports published by major security vendors C. Testing controls against the attack types identified during the previous year's audit cycle D. Interviewing the security operations team about the alert types investigated in recent months

Related Posts

Leave a Comment Cancel Reply