CISA Domain 5B-6 Practice Test 001

This practice test covers Domain 5 (Protection of Information Assets) Subdomain B-6 (Evidence Collection and Forensics) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5B-6 Evidence Collection and Forensics Practice Test 001

10 questions • Single best answer

Question 1

A state government agency engages an IS auditor to review its digital forensics capability following a data breach. The response team copied files from the affected server using standard operating system commands and stored them on a shared network drive. Which deficiency is MOST significant from an evidence admissibility perspective?

A. The copy was stored on a network drive rather than encrypted removable media. B. The response team did not obtain written approval from legal counsel before collection. C. A bit-level forensic image was not taken, so integrity and deleted data are unverifiable. D. The files were copied by internal staff rather than a certified forensic examiner.

Question 2

During a review of a financial services firm's forensic readiness, the IS auditor examines evidence handling for a recent fraud investigation. Seized laptops were logged at collection and stored in a shared equipment room, but no records exist showing who accessed them afterward. What is the auditor's BEST course of action?

A. Report the chain of custody gap as a finding affecting evidence reliability. B. Recommend that the laptops be re-imaged and the investigation restarted from the beginning. C. Interview the investigators to reconstruct who handled the laptops during that period. D. Verify that the forensic images still match the hash values recorded at acquisition.

Question 3

An incident responder at a healthcare provider discovers an active compromise on a database server hosting protected health information that is still running. The IS auditor reviews the organization's evidence collection procedure to assess whether volatile data is preserved appropriately. Which action should the procedure require FIRST?

A. Disconnect the server from the network to halt further attacker activity. B. Copy the server's system and security event logs to protected offline storage. C. Perform a graceful shutdown before creating a forensic image of the disk. D. Capture volatile memory and active network connections from the running system.

Question 4

An IS auditor investigating unauthorized privileged access must determine which evidence best supports a conclusion that a specific administrator executed the commands. Several sources are available, and each administrator uses a uniquely assigned named account. Which of the following provides the BEST evidence of the individual's actions?

A. A signed statement from the administrator's supervisor confirming the assigned duties. B. Centrally collected session logs from a privileged access management system, protected from local modification. C. Local command history files retrieved from the affected server by another system administrator. D. A screenshot of the server console captured by the incident responder during triage.

Question 5

A manufacturing company's forensic team creates disk images during investigations and records an MD5 hash for each image. The IS auditor notes that hashes are generated only after the images are transferred to the analysis workstation, several days after acquisition. Which recommendation is MOST appropriate?

A. Generate hashes at acquisition and verify them after each transfer. B. Replace MD5 with SHA-256 to eliminate the risk of collisions in evidence files. C. Restrict access to the analysis workstation so images cannot be altered before hashing. D. Require a second analyst to independently recompute the hash on the analysis workstation.

Question 6

During an internal investigation of suspected data theft, management asks the IS auditor to personally seize and analyze the suspect's workstation because the security team lacks capacity. The auditor is also scheduled to audit the incident response function next quarter. What should the auditor do FIRST?

A. Accept the assignment and disclose the involvement in the next audit report. B. Perform the analysis under the supervision of the security team to preserve objectivity. C. Decline and advise management to engage external counsel before any evidence is collected. D. Communicate the independence impairment to audit management and obtain a decision.

Question 7

An IS auditor reviews a bank's forensic procedures and finds that investigators routinely wipe and reissue compromised endpoints once malware is removed, typically within 48 hours. Regulatory reporting may occur months later, and legal issues litigation holds through a separate process. Which finding is MOST significant?

A. Endpoint reimaging is performed by operations staff rather than the forensic team. B. Evidence is destroyed before retention and legal hold requirements can be determined. C. Malware samples are not submitted to the threat intelligence function for analysis. D. The 48-hour turnaround does not allow root cause analysis to be completed.

Question 8

A retailer that hosts its core applications with a cloud provider experiences a suspected account compromise affecting administrative accounts in the provider's management console. The IS auditor evaluates whether the organization can obtain forensic evidence from the environment. Which control provides the BEST assurance that required evidence will be available?

A. The provider holds an independent attestation report covering security operations. B. The organization's incident response plan documents escalation paths to the provider. C. Contract terms define provider support, data access, and preservation for investigations. D. Provider-side logging is enabled by default for all customer administrative activity.

Question 9

An IS auditor reviews a completed forensic investigation report that concludes an employee exfiltrated data. Supporting evidence consists of a USB device connection log entry and the employee's verbal admission recorded in an investigator's notes. Which conclusion is MOST appropriate regarding the sufficiency of evidence?

A. The evidence is insufficient because neither source demonstrates which data was transferred. B. The evidence is sufficient because the admission corroborates the USB connection log entry. C. The evidence is sufficient because system-generated logs are considered reliable evidence. D. The evidence is insufficient because verbal admissions are inadmissible in any proceeding.

Question 10

A government agency's audit committee asks whether the organization's forensic capability would withstand external scrutiny. The IS auditor finds documented procedures, trained and certified staff, a maintained evidence room, and tested imaging tools, but no investigations have been reviewed after closure for procedural compliance. Which recommendation is MOST appropriate?

A. Require external forensic specialists to lead all future high-severity investigations. B. Expand certification requirements so every responder holds a recognized forensic credential. C. Implement automated evidence tracking to replace manual chain-of-custody logs. D. Establish post-investigation quality reviews that assess adherence to evidence handling procedures.

Related Posts

Leave a Comment Cancel Reply