CISA Domain 5B-2 Practice Test 002

This practice test covers Domain 5 (Protection of Information Assets) Subdomain B-2 (Information System Attack Methods and Techniques) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5B-2 Information System Attack Methods and Techniques Practice Test 002

10 questions • Single best answer

Question 1

An external IS auditor at a regional credit union analyzes interest postings and finds that fractions of a cent from thousands of accounts are consistently credited to a single dormant account. The rounding routine was modified two years ago by a programmer outside the formal change process. Which attack technique does this evidence MOST likely indicate?

A. A logic bomb set to execute when a date condition is met B. Data diddling performed on transaction records before they enter the system C. A salami technique that diverts small amounts over many records D. A trapdoor that allows the programmer to bypass authentication

Question 2

During an audit of a SaaS provider's identity controls, an IS auditor reviews an incident in which an attacker holding a stolen password repeatedly triggered push notifications until an engineer approved one at 2 a.m. Simple approve-or-deny push MFA remains the standard for all remote access. Which recommendation MOST effectively addresses the attack technique used?

A. Adopt number matching or phishing-resistant MFA that requires contextual user confirmation B. Increase password complexity requirements and shorten the password rotation interval C. Deliver targeted awareness training on recognizing and promptly reporting unexpected push prompts D. Lock accounts after five failed password attempts within any one-hour period

Question 3

A hospital reports that a recent ransomware attack encrypted its file servers and also deleted backup snapshots stored on a network share reachable with domain administrator credentials. An IS auditor is assessing residual exposure before management approves changes to the recovery strategy. Which finding is MOST significant?

A. Endpoint antivirus signatures were updated weekly rather than daily on all clinical workstations B. Several clinical staff had not completed phishing awareness training in the past year C. The incident response plan lacked a documented procedure for ransom payment decisions D. Backups shared the production authentication domain, letting attackers destroy recovery copies

Question 4

An IS auditor at an engineering consultancy reviews a threat intelligence report stating that attackers compromised an industry association website frequently visited by staff and injected code exploiting outdated browser plug-ins. No related phishing emails were observed. Which control would provide the BEST assurance against this attack technique?

A. Email gateway sandboxing of attachments and embedded links before delivery B. Timely browser and plug-in patching enforced through central endpoint management C. Blocking all external websites not included on an approved business-use allow list D. Annual penetration testing of the consultancy's own public-facing website

Question 5

An audit manager is scoping a review of a retail chain's new mobile payment API. Management states that the API passed automated vulnerability scanning, but developers acknowledge that customer record identifiers in requests are sequential and can be altered by the client. What should the audit manager do FIRST when planning tests related to attack techniques?

A. Include testing of server-side authorization over each object request in the audit scope B. Accept the clean vulnerability scan results as sufficient evidence of API security C. Recommend that developers immediately replace sequential identifiers with random UUID values D. Request deployment of a web application firewall before audit fieldwork begins

Question 6

During a review of a government agency's server environment, an IS auditor learns that a contractor account with standard privileges gained domain administrator rights within hours of a phishing compromise. Logs show the attacker abused a scheduled task that runs with system privileges from a writable directory. Which evidence would BEST confirm the root cause?

A. An interview with the contractor about the phishing email that was received B. A vulnerability scan report listing missing operating system security patches on the server C. Configuration and permission records for the scheduled task and its directory D. The agency's privileged access management policy and approval procedures

Question 7

A multinational manufacturer's finance clerk transferred funds after receiving a call that convincingly imitated the CFO's voice, followed by a confirming email from a lookalike domain. The IS auditor finds that urgent payment requests are approved when the clerk recognizes the requester. Which recommendation is MOST appropriate?

A. Deploy email filtering that blocks domains closely resembling the corporate domain B. Require finance staff to complete deepfake recognition training every quarter C. Record all inbound calls to finance staff for later forensic voice analysis D. Require out-of-band verification through known contacts before releasing payments

Question 8

A financial services firm's incident report shows that attackers used a reverse-proxy phishing site to capture employees' passwords and session cookies, then accessed corporate email without triggering MFA prompts. Management concludes that the MFA product failed and proposes replacing the vendor. What is the IS auditor's BEST course of action?

A. Support the vendor replacement because MFA did not prevent the account compromise B. Explain that session token theft bypasses MFA and evaluate phishing-resistant options C. Recommend shortening password expiration to limit the usefulness of stolen credentials D. Conclude that the incident was caused by user error and close the related finding

Question 9

An IS auditor reviewing an insurer's vulnerability management program notes that management relies only on monthly patching and signature-based antivirus. A recent industry alert describes an actively exploited zero-day vulnerability in a widely used file transfer product the insurer operates for client data exchange. Which conclusion is MOST appropriate?

A. Controls are adequate because the vendor patch will be applied in the next monthly cycle B. Risk is low because signature-based antivirus will detect the exploit code once delivered C. Controls are insufficient because no compensating detective or isolation layer exists D. The product must be decommissioned immediately until the vendor completes its review

Question 10

A third-party security assessment at a hotel chain used simulated attacks and produced four confirmed findings. The IS auditor must decide which finding to emphasize in the audit report to the board, considering likely attacker paths, data sensitivity, and potential business impact. Which finding is MOST significant?

A. Guest Wi-Fi permits network access to the property management system's database segment B. Several staff workstations display a browser warning for an expired internal certificate C. The public website reveals web server version details in its HTTP response headers D. Simulated phishing produced a 6 percent click rate, down from 11 percent last year

Related Posts