CISA Domain 5A-3 Practice Test 002

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-3 (Identity and Access Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-3 Identity and Access Management Practice Test 002

10 questions • Single best answer

Question 1

An insurance company's internal audit team is testing joiner-mover-leaver controls for its claims platform. Terminations flow automatically from the HR system to the identity management tool, but 14 of 40 sampled employees who transferred departments retained their prior entitlements for more than 90 days. Which recommendation is MOST appropriate?

A. Shorten the access recertification cycle from quarterly to monthly for all claims platform users. B. Require department managers to notify IT by email whenever an employee changes job roles. C. Use HR transfer events to automatically trigger review and removal of prior role entitlements. D. Disable every transferred employee's account and reprovision access through new access requests.

Question 2

An IS auditor at a regional utility is evaluating whether privileged access to production database servers is restricted to authorized administrators. The database team provides a signed memo from the IT director confirming that only five administrators hold elevated rights. Which of the following is the BEST evidence to support the auditor's conclusion?

A. A system-generated listing of privileged accounts reconciled to approved access requests B. Written statements from each of the five administrators describing their assigned duties C. The privileged access policy approved by the chief information officer during the prior year D. Observation of an administrator logging in to the database console with elevated credentials

Question 3

A pharmaceutical company uses federated single sign-on so that staff of a contract research organization authenticate through their employer's identity provider. During the audit, the IS auditor learns that the pharmaceutical company receives no notice when contractor staff leave the partner organization. Which recommendation is MOST appropriate?

A. Require the partner to enforce 60-day password changes within its own identity provider. B. Replace federation with locally managed accounts for all partner staff on internal systems. C. Implement multifactor authentication on the pharmaceutical company's federated applications. D. Establish contractual exit notification and periodic reconciliation of partner users.

Question 4

During an audit of a payment processor's batch environment, an IS auditor finds that 30 service accounts used by scheduled jobs permit interactive logon and have passwords unchanged for four years. None of the accounts is assigned to a named owner, and none has ever been included in access reviews. Which recommendation will BEST prevent these conditions from recurring?

A. Rotate all service account passwords now and enforce automated rotation going forward. B. Assign an accountable owner to each service account and include it in periodic reviews. C. Disable interactive logon on all service accounts that support scheduled batch processing. D. Consolidate the service accounts into fewer accounts with broader batch job privileges.

Question 5

A hospital's electronic health record system provides a break-glass function that lets clinicians bypass role restrictions during emergencies. The IS auditor finds that break-glass events are logged, but no one reviews the logs, and usage has increased sharply over six months. What should the IS auditor do FIRST?

A. Analyze a sample of break-glass events to determine whether each use was clinically justified. B. Recommend disabling the break-glass function until a formal log review process is established. C. Report to the privacy officer that unauthorized disclosures of patient records have occurred. D. Recommend expanding standard clinician roles so that emergency access is rarely needed.

Question 6

A defense contractor is currently selecting a fingerprint recognition system to control access to its classified data enclave. The vendor offers adjustable sensitivity settings, and the security manager asks the IS auditor which performance consideration should carry the greatest weight. Which recommendation is MOST appropriate?

A. Configure the system to achieve the lowest equal error rate across the full user population. B. Prioritize the lowest false rejection rate to minimize disruption to authorized personnel. C. Prioritize the lowest false acceptance rate, accepting more rejections of legitimate users. D. Select the setting that provides the fastest enrollment time and highest user throughput.

Question 7

An audit manager reviews workpapers from an identity and access management audit at a telecommunications company. The IT security team defines all application roles and approves every access request because business unit leaders consider access decisions a technical matter. Which conclusion is MOST appropriate based on this evidence?

A. The arrangement is acceptable because IT security has the technical expertise to define roles. B. Approval of access requests should move to internal audit to ensure independent authorization. C. The control is effective provided IT security documents its role definitions and approvals. D. Accountability is misplaced because data owners should authorize access to their information.

Question 8

A cloud-based software company has deployed a privileged access management vault that checks out administrator credentials and records sessions. The IS auditor confirms the vault is configured correctly; however, administrators can still connect directly to production servers using locally stored SSH keys. Which recommendation is MOST appropriate?

A. Require administrators to attest monthly that they accessed production only through the vault. B. Remove direct key-based access paths so that all privileged sessions are brokered by the vault. C. Increase the frequency of reviewing recorded vault sessions to identify inappropriate activity. D. Rotate vault-managed administrator passwords after every checkout to limit credential reuse.

Question 9

An IS auditor at a national retail chain is planning tests of user deprovisioning for the point-of-sale management system. The organization terminated 1,200 employees during the audit period, and both HR termination data and system account records are available electronically. Which testing approach provides the BEST assurance?

A. Select a statistical sample of 60 terminations and verify each account's disablement date. B. Review the documented deprovisioning procedure and interview the access administrators. C. Match the full HR termination file against account activity and disablement records. D. Inspect help desk tickets for terminations processed during the final month of the period.

Question 10

During a follow-up audit at a credit union, management reports that a prior finding on shared administrator accounts was remediated by issuing individual administrator accounts. The IS auditor confirms that individual accounts exist, but the shared accounts remain enabled and one was used last week. What is the auditor's BEST course of action?

A. Report the finding as open because shared accounts still allow unattributable activity. B. Close the finding because individual accounts were issued as described in the action plan. C. Disable the shared accounts immediately to prevent further use before completing follow-up. D. Accept the remediation and recommend that shared account usage be monitored quarterly.

Related Posts