CISA Domain 5A-9 Practice Test 002

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-9 (Mobile, Wireless, and Internet-of-Things Devices) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-9 Mobile, Wireless, and Internet-of-Things Devices Practice Test 002

10 questions • Single best answer

Question 1

During an audit of a commercial real estate firm's smart building program, an IS auditor finds that internet-connected HVAC controllers and badge readers share a flat network with the corporate finance and HR systems. The building management vendor connects remotely to maintain the devices. Which finding is MOST significant?

A. Device firmware versions are recorded in a spreadsheet rather than an asset database B. The vendor's remote maintenance sessions are scheduled outside business hours C. Building devices generate high volumes of logs that are not retained beyond 90 days D. Compromise of a building device or vendor link offers a path to corporate systems

Question 2

A consulting firm allows staff to access client documents and email on personally owned phones. An IS auditor learns that when employees resign, IT cannot remove corporate data without performing a full factory reset, which most departing staff routinely refuse. Which recommendation is MOST appropriate?

A. Require employees to sign an agreement to delete corporate data upon resignation B. Use MDM containerization so corporate data can be selectively wiped from devices C. Prohibit departing employees from using their phones during their notice period D. Disable departing employees' network accounts thirty days before their final day

Question 3

A distribution company installed 300 IP security cameras across its warehouses. Installation guidance from the vendor recommended changing default administrator passwords, and management asserts this was done, so an IS auditor needs to verify the assertion across the camera population. Which of the following is the BEST evidence?

A. Results of an authenticated configuration scan of all cameras matched to the asset inventory B. A signed memo from the installation contractor confirming default passwords were changed C. The vendor's installation guide showing the recommended password change procedure D. An interview with the facilities manager responsible for overseeing the installation

Question 4

An IS auditor reviewing a grocery chain's warehouse wireless network finds that handheld scanners connect using a single WPA2 pre-shared key that has not changed in three years. Former employees and temporary staff have known the key, and the network carries inventory and pricing data. Which recommendation is MOST appropriate?

A. Change the pre-shared key annually and communicate it only to current supervisors B. Reduce wireless signal strength so coverage does not extend beyond warehouse walls C. Implement 802.1X authentication with individual device or user credentials D. Hide the network name so that the warehouse wireless network is not broadcast

Question 5

A home healthcare agency reports that two tablets used by visiting nurses were stolen from a vehicle. The devices contained patient visit notes, and investigation shows they were not encrypted even though the agency's policy requires encryption. Which control would have BEST mitigated this exposure?

A. Requiring nurses to store tablets out of sight when vehicles are left unattended B. MDM enforcement of device encryption with noncompliant devices blocked from access C. A remote wipe capability that IT can trigger once the theft has been reported D. Annual training reminding staff of the mobile device encryption requirement

Question 6

An audit manager at a food processing company is planning a review of operational IoT devices used for temperature monitoring and production line automation. Management cannot state how many devices are deployed or which networks they connect to. What should the audit manager do FIRST?

A. Obtain or develop a complete inventory of IoT devices and their data flows B. Perform vulnerability scans across the production network to locate weaknesses C. Review the device vendor contracts for security and support obligations D. Assess the encryption used by sensors when transmitting temperature readings

Question 7

An IS auditor reviews a regional bank's mobile application used by commercial clients to approve payments. Testing on a rooted Android device shows that session tokens and account numbers are stored unencrypted in the app's local storage and remain valid for twelve hours. Which finding is MOST significant?

A. The application does not display a warning banner when it runs on rooted devices B. Twelve-hour token lifetimes exceed the bank's preferred session timeout of four hours C. Plaintext tokens could be extracted to authorize payments from a compromised device D. Account numbers are displayed in full rather than masked on the app's summary screen

Question 8

A medical device manufacturer is selecting a supplier of connected sensors for its patient monitoring product. During a procurement review, the IS auditor learns that the leading supplier's sensors cannot receive firmware updates after deployment, although they are the lowest-cost option evaluated. Which recommendation is MOST appropriate?

A. Accept the supplier because firmware update capability can be added in a later model B. Require the supplier to provide penetration test results for the current firmware C. Purchase additional spare sensors so that vulnerable units can be replaced as needed D. Include secure update capability and support commitments as mandatory requirements

Question 9

A software company's sales staff often work from airports, hotels, and client sites, where they must use whatever wireless network is available. After an attacker's lookalike access point captured a salesperson's credentials, the IS auditor is evaluating controls that would protect traffic on any network staff use. Which control provides the BEST protection?

A. Instructing staff to connect only to networks whose names match the venue B. Issuing mobile hotspots and asking staff to prefer them over public wireless networks C. Enforcing an always-on VPN that connects before any other traffic is permitted D. Requiring staff to change their passwords after each trip involving public Wi-Fi

Question 10

An IS auditor at a pharmaceutical company reviews MDM reports showing that 45 corporate-managed phones used by executives are jailbroken. The MDM tool sends an email alert to the help desk, but the devices retain full access to email and research files. Which conclusion is MOST appropriate?

A. Controls are adequate because the help desk is notified of every jailbroken device B. Controls are ineffective because detection is not linked to access restriction C. Controls are adequate because executives are trusted users with business needs D. Controls are ineffective because the MDM tool should prevent all jailbreak attempts

Related Posts