CISA Domain 5B-3 Practice Test 001

This practice test covers Domain 5 (Protection of Information Assets) Subdomain B-3 (Security Testing Tools and Techniques) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5B-3 Security Testing Tools and Techniques Practice Test 001

10 questions • Single best answer

Question 1

A retail payment processor engages an external firm to perform annual penetration testing of its cardholder data environment, and the engagement begins next week. The IS auditor notes that the scope statement was drafted entirely by the testing firm and approved verbally by an IT operations manager, with no written authorization on file. What should the IS auditor do FIRST?

A. Determine whether the scope was authorized by management accountable for the cardholder environment B. Obtain the prior year penetration test report and evaluate whether all findings were remediated on schedule C. Recommend that the agreed scope be expanded to include social engineering and physical intrusion testing D. Evaluate whether the assigned testers hold recognized security testing certifications and relevant industry experience

Question 2

During a review of a manufacturing firm's vulnerability management process, the IS auditor finds that credentialed scans run monthly against all servers in the data center. Workstations across three plants are scanned on the same cycle, but without credentials, because the endpoint team declined to provision scanning accounts. Which conclusion is MOST appropriate regarding the workstation results?

A. Results are acceptable because unauthenticated scanning replicates the perspective of an external attacker probing the corporate network perimeter B. Results are invalid because endpoint devices in plant environments should be scanned weekly rather than on a monthly cycle C. Results likely understate exposure because missing patches and local configuration weaknesses are not reliably detected D. Results are reliable as long as the scanning tool's vulnerability signature database is updated immediately before each scheduled cycle

Question 3

An internal audit team reviews a regional bank's security testing program. Vulnerability assessment and penetration testing are performed quarterly against the production environment during a fixed maintenance window announced to operations staff in advance. Emergency changes are deployed between cycles and are not subject to any security testing before release. Which finding is MOST significant?

A. Conducting security testing directly in production could degrade the availability of customer-facing banking services B. The maintenance window is published internally in advance and is therefore known to operations and support staff C. Quarterly testing does not follow the prevailing industry convention of continuous automated vulnerability scanning D. Emergency changes reach production without security testing, leaving risk unassessed between quarterly cycles

Question 4

A healthcare provider's IS auditor is assessing the reliability of a recently completed web application security assessment performed by a specialist vendor. The vendor delivered only a summary report listing forty vulnerabilities grouped by severity rating, with no supporting detail. Which of the following would be the BEST evidence that the testing was actually performed as described?

A. Written confirmation from the provider's management that the vendor completed the agreed scope of work B. Tool logs, executed test case records, and raw output correlated to each reported finding C. The signed statement of work and the executed engagement contract covering the assessment period D. An interview with the information security manager who coordinated and oversaw the vendor assessment

Question 5

A cloud migration review at a logistics company finds that the security team runs automated configuration compliance scans against infrastructure-as-code templates before deployment. No scanning is performed against deployed workloads, and engineers retain console access that permits manual changes after provisioning. Which recommendation is MOST appropriate for the IS auditor to make?

A. Extend compliance scanning to deployed workloads so that drift from approved baselines is detected B. Replace automated template scanning with quarterly manual configuration reviews performed by the cloud engineering team C. Obtain attestation reports from the cloud service provider confirming hardening of its underlying platform infrastructure D. Require that every infrastructure-as-code template change receive documented approval from the enterprise architecture board

Question 6

An IS auditor reviews a government agency's recent red team engagement, which was commissioned to assess how well the agency would withstand a realistic intrusion. Documentation shows that the security operations center was informed of the test dates, target systems, and planned techniques several days in advance. Which control objective is MOST likely compromised?

A. Confidentiality of the sensitive vulnerability data produced during the course of the engagement B. Completeness of the technical vulnerability inventory compiled for the systems within scope C. Reliability of conclusions drawn about the effectiveness of detection and response capability D. Independence of the external testers performing the engagement against the agency's systems

Question 7

During an audit of an insurer's application security practices, the IS auditor finds that static code analysis executes on every build and results are posted to the development team's dashboard. Developers may mark any finding as accepted risk without further review, and more than sixty percent of high-severity findings have been self-accepted. Which weakness is MOST significant?

A. The static analysis tool appears to be generating an excessive volume of high-severity false positive results B. High-severity findings are accepted as risk without independent review or approval C. Dynamic application testing is not performed to complement the static analysis executed during each build D. Running code analysis on every build consumes pipeline capacity and lengthens the overall release schedule

Question 8

An IS auditor is designing procedures to conclude on whether vulnerabilities identified in an enterprise's last security testing cycle have actually been remediated. Management has provided a tracker showing that ninety percent of findings are closed, and system owners are available for discussion. Which approach provides the BEST assurance over remediation?

A. Inspecting the change tickets that record remediation actions completed by the responsible system owners B. Reviewing management's remediation tracker and reconciling each closed entry to the original findings list C. Interviewing system owners about the specific remediation steps applied to each of the affected systems D. Re-scanning a sample of affected systems and comparing current results to the original findings

Question 9

A post-implementation review of a new customer portal at an energy retailer confirms that security testing was completed and that all critical findings were closed before go-live. The auditor observes that testing covered only the portal's web tier, while the application programming interfaces and database tier were not assessed. Which question should the IS auditor pursue FIRST?

A. Whether the testing vendor applied a recognized and current web application security testing methodology B. Whether the closed critical findings were retested by an independent party before closure was approved C. How the scope boundary was set and what risk assessment supported excluding the other tiers D. How long each critical finding remained open between its initial detection and its eventual closure

Question 10

A utility company's internal security testing team has begun using an automated exploitation framework as part of its assessment toolkit. The IS auditor observes that the tool is executed against production systems connected to the supervisory control and data acquisition network, using default modules and configurations. Which risk should the auditor highlight as MOST significant?

A. Exploitation modules may disrupt operational technology systems supporting critical utility services B. Default tool configurations may fail to detect vulnerabilities specific to industrial control system protocols C. The tool's licensing terms may not permit its use against systems operated by third-party service providers D. Testing output may not be retained long enough to support subsequent audit follow-up and reporting activity

Related Posts

Leave a Comment Cancel Reply