CISA Domain 5B-5 Practice Test 001

This practice test covers Domain 5 (Protection of Information Assets) Subdomain B-5 (Security Incident Response Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5B-5 Security Incident Response Management Practice Test 001

10 questions • Single best answer

Question 1

During an audit of a global e-commerce retailer, the IS auditor reviews the incident response plan approved 18 months ago. The plan documents detection and containment procedures but contains no severity classification criteria, and responders determine escalation individually during each event. Which finding is MOST significant to report?

A. Plan approval is 18 months old, which exceeds the annual review cycle required by corporate policy B. Containment steps are described generically without reference to specific system platforms C. Severity criteria are undefined, so escalation and management notification depend on individual judgment D. Escalation decisions made by individual responders are not consistently recorded in the incident ticketing system

Question 2

An IS auditor is engaged to assess a regional bank's incident response capability shortly after a ransomware event affecting a branch file server. Management provides post-incident reports, ticket extracts, and remediation plans. The auditor has not previously reviewed this program. What should the IS auditor do FIRST?

A. Obtain the approved incident response plan and classification criteria in effect during the event B. Interview the responders who performed containment to reconstruct the event timeline C. Test whether endpoint detection signatures were current on the affected file server D. Evaluate whether the remediation plan addresses the root cause identified by management

Question 3

A healthcare provider asserts that all high-severity security incidents during the prior quarter were escalated to executive management within the two-hour window defined in policy. The IS auditor must validate this assertion as part of an information security program audit. Which of the following provides the BEST evidence?

A. Management's quarterly incident summary report as presented to the enterprise risk committee B. Escalation timestamps from the ticketing platform reconciled to detection times C. Signed attestations from the incident response manager covering each high-severity incident logged D. Interview notes confirming that escalation calls occurred for each of the incidents sampled

Question 4

A manufacturing company outsources security monitoring to a managed security service provider. The contract requires the provider to notify the company of confirmed incidents, but the IS auditor finds no defined notification timeframes and no obligation for the provider to support forensic investigation. Which recommendation is MOST appropriate?

A. Require the provider to submit monthly summaries of all detected and closed incidents B. Obtain an independent assurance report covering the provider's monitoring control environment C. Perform an annual on-site assessment of the provider's security operations center D. Amend the contract to define notification timeframes and forensic support obligations

Question 5

A post-incident review of a payment card data breach at a retail chain shows that containment and eradication were completed, affected systems were restored, and the case was formally closed. No lessons-learned session was held and no control changes were proposed. Which conclusion is MOST appropriate?

A. The incident response process lacks a functioning improvement phase, so recurrence risk remains B. The incident was closed prematurely because no root cause analysis was performed before closure C. Restoration activities were completed without validating the integrity of the recovered production data D. Breach reporting obligations to the acquiring bank and card brands were likely not satisfied

Question 6

An IS auditor evaluates whether a government agency can respond effectively to a major cyber incident outside business hours. The agency maintains a documented response plan, an on-call roster, and current contact lists for key personnel. Which control provides the BEST assurance that after-hours response will be effective?

A. A quarterly review confirming that on-call roster contact details remain accurate and complete B. A monitoring contract guaranteeing alert delivery to the on-call responder within fifteen minutes C. Periodic simulation exercises of after-hours scenarios with documented results and follow-up actions D. An escalation matrix approved by agency leadership defining decision authority at each severity level

Question 7

During an audit of an enterprise IT function, the IS auditor notes that the system administrators who manage production servers also declare incidents closed and record the stated root cause. Closure requires no independent validation, and the security function receives only a monthly count of closed incidents. Which finding is MOST significant?

A. Monthly reporting to the security function omits incident-level detail for closed items B. Administrators can close incidents on systems they manage without independent validation C. Root cause information recorded by administrators may lack sufficient technical detail for analysis D. Incident records are retained in a platform that administrators themselves are able to modify

Question 8

An IS auditor plans to test the effectiveness of a financial institution's incident response process over the past year. The institution logged 2,400 incidents, of which 60 were classified high severity. The objective is to evaluate whether escalation and closure requirements were met. Which testing approach is MOST appropriate?

A. Select a random statistical sample drawn across the full population of 2,400 logged incidents B. Test the entire population using automated analysis of ticket status fields and timestamps C. Review management's control self-assessment results and corroborate the exceptions it identified D. Test all 60 high-severity incidents and select a sample from the remaining lower-severity population

Question 9

An IS auditor reviewing a technology company's incident response program finds that responders reimage compromised workstations immediately upon confirming malware in order to restore user productivity. No memory or disk images are captured beforehand, and the procedures are silent on evidence handling. What is the auditor's BEST course of action?

A. Recommend that all reimaging be suspended until a forensic imaging capability is procured B. Report that malware eradication procedures are operating as designed and are effective C. Report that evidence preservation requirements are not addressed in the response procedures D. Recommend that legal counsel approve each individual reimaging decision before responders proceed

Question 10

A cloud migration review at an insurance company finds that incident response responsibilities for a newly adopted SaaS platform were never reassigned. The internal security team assumes the provider responds to application-layer incidents, while the provider's contract limits its obligations to underlying infrastructure. Which finding should the IS auditor report as MOST significant?

A. Accountability for responding to application-layer incidents is undefined between the two parties B. The internal team lacks the administrative access needed to contain incidents in the application C. The provider agreement was executed without prior review by the internal audit function D. Incident response procedures were not updated to reflect the newly migrated environment

Related Posts

Leave a Comment Cancel Reply