CISA Domain 5B-3 Practice Test 002

This practice test covers Domain 5 (Protection of Information Assets) Subdomain B-3 (Security Testing Tools and Techniques) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5B-3 Security Testing Tools and Techniques Practice Test 002

10 questions • Single best answer

Question 1

An audit manager at a state university plans to rely on a third-party penetration test of the student information system to reduce internal audit testing. The report lists twelve findings ranked by severity but omits the testing methodology, the tools used, the test window, and the systems actually in scope. What is the audit manager's BEST course of action?

A. Accept the report as reliable because the testing firm is independent and holds recognized certifications B. Obtain the engagement documentation describing scope, methods, and dates before relying on the results C. Reperform the full penetration test internally using the commercial tools the firm most likely used D. Report the missing methodology as a deficiency of the testing firm in the final internal audit report

Question 2

During an audit of a regional hospital's vulnerability management program, an IS auditor learns that monthly scans of clinical servers are run without credentials to avoid disrupting medical applications. Recent reports show very few high-risk vulnerabilities, and management cites this as evidence of an effective patching program. Which conclusion is MOST appropriate?

A. The scan results confirm patching is effective because the scans are performed consistently every month B. The scan frequency should increase to weekly to provide more timely evidence of the servers' patch status C. The low number of findings indicates that the clinical servers follow an appropriately hardened baseline D. The results may understate exposure because unauthenticated scans cannot detect many missing patches

Question 3

An IS auditor reviews a credit union's application security testing process. The development team runs a static analysis tool on every build, but developers can mark any finding as a false positive without review, and about 40 percent of last quarter's findings were closed this way. Which recommendation is MOST appropriate?

A. Require an independent security review and approval before any finding is closed as a false positive B. Replace the static analysis tool with a dynamic scanning tool that generates fewer false positives C. Increase the frequency of static analysis so suppressed findings are detected again more quickly D. Require developers to complete secure coding training before they are permitted to use the tool

Question 4

A government agency's chief audit executive wants assurance that the security operations center can detect and respond to a sophisticated, targeted intrusion. Quarterly vulnerability scans and an annual announced penetration test are already performed, and SOC analysts are notified before each test begins. Which testing approach would provide the BEST assurance for this objective?

A. An expanded authenticated vulnerability scan covering all agency servers and network devices B. A full-knowledge penetration test of the perimeter conducted with SOC analysts observing it C. A covert red team exercise with limited staff awareness, defined objectives, and safeguards D. A tabletop exercise in which SOC staff walk through their response to a simulated intrusion

Question 5

An insurance company's annual penetration test report states that all external-facing systems were tested and no critical issues were found. While reviewing the scope appendix, the IS auditor notices that the customer claims API hosted by a cloud provider was excluded at the request of the application owner. Which is the MOST significant concern?

A. A high-risk internet-facing system holding customer data was not subjected to security testing B. The application owner was able to influence the test scope instead of the security function C. The report's overall conclusion was not reviewed and approved by the chief information officer D. The cloud provider may not have been notified in advance that penetration testing would occur

Question 6

During an IT operations audit at a manufacturing company, an IS auditor learns that an aggressive vulnerability scan last month crashed a programmable logic controller and halted a production line for six hours. The security team scans operational technology networks using the same profiles applied to the corporate network. Which recommendation is MOST appropriate?

A. Discontinue all vulnerability scanning of operational technology to eliminate the disruption risk B. Run the existing scan profiles only on weekends, when production volumes are at their lowest C. Transfer responsibility for operational technology scanning to the equipment manufacturers D. Adopt OT-appropriate methods, such as passive monitoring, approved by operations owners

Question 7

An IS auditor at an online brokerage finds that internal penetration tests are designed and performed by the network engineering team, which also configures and maintains the firewalls being tested. Test results are reported only to the network engineering manager, who decides which findings require remediation. What is the GREATEST risk in this arrangement?

A. Testing tools may become outdated because the network team lacks a dedicated testing budget B. Lack of independence may cause weaknesses to be overlooked, understated, or left unremediated C. Network engineers may not hold recognized penetration testing certifications for this work D. The firm may breach regulations that require penetration tests to be done by external firms

Question 8

An external auditor is evaluating a payment services company's vulnerability scanning program. Management provides weekly scan reports showing that every scanned host is free of critical vulnerabilities. Before relying on these reports, which audit procedure would BEST determine whether scanning coverage is complete across the environment?

A. Reviewing the scanner configuration to confirm the vulnerability signature database is current B. Interviewing the security analysts who schedule the scans about which network ranges they target C. Reconciling the scanned hosts to the asset inventory and to independent network discovery results D. Rerunning the scan against a sample of hosts listed in the reports to confirm the reported results

Question 9

During a penetration test overseen by internal audit at a telecommunications provider, the testers gain administrative access to the production billing database through an unpatched remote vulnerability on the second day of a ten-day engagement. The approved scope permits exploitation but prohibits data modification. What should the IS auditor ensure happens FIRST?

A. The testers continue the engagement to determine the full extent of exploitable weaknesses B. The vulnerability is documented in detail for inclusion in the final penetration test report C. The testers attempt to exploit similar systems to confirm whether the weakness is widespread D. The critical finding is escalated immediately to management under the rules of engagement

Question 10

A fintech startup's new lending platform relies heavily on open-source libraries. An IS auditor reviewing pre-release security testing notes that the team performs static code analysis on in-house code and a dynamic scan of the staging environment. Which additional testing technique would MOST effectively address the remaining risk?

A. Software composition analysis to flag known vulnerabilities in the third-party components B. Fuzz testing of the application input fields to uncover unexpected crashes and error states C. An external network vulnerability scan of the production servers that will host the platform D. User acceptance testing to verify that loan workflows meet the documented business requirements

Related Posts