CISA Domain 5B-4 Practice Test 002

This practice test covers Domain 5 (Protection of Information Assets) Subdomain B-4 (Security Monitoring Tools and Techniques) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5B-4 Security Monitoring Tools and Techniques Practice Test 002

10 questions • Single best answer

Question 1

An external auditor reviewing a pharmaceutical manufacturer's security monitoring finds that intrusion detection sensors are deployed only at the internet perimeter. Traffic between the corporate network and the plant control network is not monitored, although the latest threat assessment rates lateral movement as the top risk. Which recommendation is MOST appropriate?

A. Increase the update frequency of attack signatures on the existing perimeter intrusion detection sensors B. Replace the perimeter intrusion detection sensors with inline intrusion prevention appliances C. Extend network monitoring to internal segment boundaries based on the documented threat assessment D. Require quarterly penetration tests of the plant network to identify lateral movement paths

Question 2

An IS auditor at a regional insurance carrier is evaluating whether the SIEM correlation rules for credential-stuffing and privilege-escalation attacks operate as intended. The security operations manager states that all rules are enabled and were configured by the vendor during implementation. Which of the following is the BEST evidence of rule effectiveness?

A. Results of controlled simulated attack events showing that alerts were generated and escalated B. Vendor implementation documentation describing the correlation logic contained in each rule C. Screenshots from the SIEM console showing that each relevant rule is configured and enabled D. Interviews with senior analysts confirming that the rules have produced alerts in the past year

Question 3

During an audit of a municipal government's security operations, an IS auditor notes that firewalls, domain controllers, and cloud workloads send logs to the SIEM using their own local clocks. Several sources differ by up to twelve minutes, and no common time source is configured. What is the PRIMARY risk created by this condition?

A. Increased SIEM storage consumption caused by duplicate events being ingested from several sources B. Greater analyst alert fatigue because rules generate more low-priority notifications than necessary C. Noncompliance with log retention requirements because records are archived on inconsistent calendar dates D. Inability to accurately correlate related events and reconstruct the sequence of a security incident

Question 4

A federal agency's SIEM administrators can modify correlation rules, suppress alerts, and purge stored events. An IS auditor finds that these administrators also perform alert triage, and no one outside the security operations team reviews administrative activity on the platform. Which control provides the BEST assurance over the integrity of monitoring data?

A. Requiring SIEM administrators to sign an annual acceptable use and confidentiality acknowledgment B. Forwarding events to write-once storage and having an independent function review SIEM admin actions C. Rotating SIEM administrator duties among security operations staff members on a quarterly schedule D. Restricting SIEM administrator logins to the agency's internal network during business hours only

Question 5

While testing an online retailer's detection controls, an IS auditor discovers that the SOC raised the failed-login alert threshold from five attempts to fifty attempts per account last quarter to reduce false positives. No change ticket or risk assessment for the change can be located. What should the IS auditor do FIRST?

A. Determine whether the threshold change was authorized and whether its detection impact was assessed B. Recommend that the SOC immediately restore the original alert threshold of five failed login attempts C. Report the undocumented threshold change as a high-risk finding in the draft audit report D. Perform a simulated brute-force attack to confirm whether the new threshold still detects it

Question 6

A hospital network's security committee receives monthly monitoring reports from the SOC showing the number of alerts closed per analyst and the average ticket closure time. An IS auditor is asked to recommend a metric that better reflects whether monitoring is effective. Which metric is MOST appropriate?

A. Total volume of security events ingested by the SIEM platform each month across all log sources B. Percentage of SIEM correlation rules reviewed and updated by the engineering team each quarter C. Proportion of confirmed incidents first identified by internal monitoring rather than outside parties D. Average number of alerts escalated from tier-one analysts to tier-two analysts during each monitoring shift

Question 7

An IS auditor reviewing an e-commerce company's payment environment confirms that file integrity monitoring is installed on all checkout web servers and generates alerts when page scripts change. The alerts are sent to a shared mailbox, and no staff member has been assigned to review it for the past five months. Which conclusion is MOST appropriate?

A. The control is designed and operating effectively because alerts are generated for all relevant changes B. The control is acceptable because quarterly vulnerability scans compensate for missed integrity alerts C. The control is a preventive control failure because unauthorized script changes were not blocked D. The control is not operating effectively because generated alerts are not reviewed or acted upon

Question 8

An internal audit team at a logistics company is planning an audit of a recently deployed endpoint detection and response platform. Management states that the tool was purchased after a ransomware incident at a competitor and has been rolled out to most laptops and servers. What should the lead IS auditor do FIRST?

A. Select a sample of endpoints and confirm that the detection agent is installed and reporting B. Understand the monitoring objectives and risk assessment that determined the platform's scope C. Obtain the vendor's independent assurance report covering its cloud management console D. Arrange a simulated ransomware exercise to evaluate the platform's detection capabilities

Question 9

A payment processor keeps SIEM events online for thirty days and then moves them to low-cost archive storage, where they are kept for one year to meet regulatory requirements. An IS auditor learns that no archived logs have ever been retrieved, and the archive format differs from the current SIEM version. Which recommendation is MOST appropriate?

A. Extend the online retention period in the SIEM to one year to eliminate the archive tier B. Encrypt the archived log files to protect their confidentiality while they remain in storage C. Periodically test retrieval of archived logs to verify that they are complete and readable D. Document a formal risk acceptance for the archive approach signed by the security manager

Question 10

During fieldwork at a state-chartered bank, an IS auditor reviewing SOC tickets finds a high-severity alert from yesterday indicating possible bulk export of customer records from a core banking database. An analyst closed it as a false positive with no notes or supporting investigation. What is the IS auditor's BEST course of action?

A. Promptly notify appropriate management so the alert is investigated, and document the observation B. Analyze the database logs personally to determine whether customer records were actually exported C. Include the improperly closed alert as a finding in the final audit report issued after fieldwork D. Expand the sample of closed alerts to determine whether the issue is systemic before telling anyone

Related Posts