CISA Domain 5B-4 Practice Test 001

This practice test covers Domain 5 (Protection of Information Assets) Subdomain B-4 (Security Monitoring Tools and Techniques) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5B-4 Security Monitoring Tools and Techniques Practice Test 001

10 questions • Single best answer

Question 1

An internal audit team at a state transportation agency is reviewing the security operations center's SIEM deployment and its coverage of in-scope systems. Testing shows that firewall, endpoint, and application logs are ingested, but authentication logs from the privileged access management platform were excluded during onboarding to contain licensing costs. Which finding is MOST significant to report?

A. Licensing cost decisions were made without a documented cost-benefit analysis approved by agency management. B. Privileged account misuse would not be detectable because those authentication events are never monitored. C. The SIEM correlation rules have not been tuned to reduce the volume of false positive alerts. D. Retention periods applied to the ingested firewall log data have not been formally approved.

Question 2

During an audit of a regional bank's security monitoring function, the IS auditor observes that the SIEM generates approximately 4,000 alerts each day and that analysts close the majority of them within seconds, leaving no investigation notes or disposition rationale. Management states that current analyst staffing levels are adequate. Which conclusion is MOST appropriate based on the evidence?

A. Analyst throughput is high, indicating that the monitoring process is operating efficiently and as designed. B. The alert volume demonstrates that detection coverage across the bank's environment is appropriately comprehensive. C. Additional analyst staffing should be obtained before any other corrective action is considered by management. D. Detection rules are poorly tuned, so genuine security incidents may be closed without meaningful analysis.

Question 3

A healthcare provider asserts that its outsourced 24/7 monitoring service reliably detects unauthorized access to clinical systems containing patient records. The IS auditor must validate this assertion before fieldwork concludes and the audit report is drafted for the audit committee. Which of the following provides the BEST evidence that the monitoring control is operating effectively?

A. Results of auditor-initiated test events traced through detection, alerting, and documented analyst response. B. The service provider's monthly dashboard summarizing the number of alerts raised and subsequently closed. C. A signed management attestation from the provider confirming that continuous monitoring coverage was maintained. D. The documented monitoring procedures and escalation matrix formally approved by the provider's management.

Question 4

While reviewing monitoring operations at a manufacturing company, an IS auditor notes that three critical database servers stopped forwarding logs to the SIEM approximately four months ago and that no one on the security team noticed the interruption. The security team states the servers have remained patched and operationally stable throughout that period. What should the IS auditor do FIRST?

A. Recommend that log forwarding agents be reinstalled and reconfigured on each of the three affected servers. B. Report the condition to the audit committee immediately as a material breakdown in security monitoring. C. Determine whether a process exists to monitor log source health and alert on collection failures. D. Review locally retained server logs to identify unauthorized activity occurring during the collection gap.

Question 5

An IS auditor evaluating a utility company's security monitoring program finds that no individual or function owns the SIEM detection use cases. Engineers add correlation rules on an ad hoc basis as issues arise, and none of the existing use cases have been reviewed since they were originally deployed two years ago. Which recommendation is MOST appropriate?

A. Require engineers to record each newly created detection use case within the change management system. B. Assign formal ownership and establish periodic review of use cases against the current threat profile. C. Engage an external security provider to independently validate the detection use cases currently deployed. D. Increase the frequency of penetration testing to confirm that existing detection rules continue to fire.

Question 6

A financial services firm has migrated a significant portion of its workloads to a public cloud platform over the past year. The IS auditor finds that the SIEM ingests cloud control-plane logs, but the correlation rules operating in production were written exclusively for the legacy on-premises environment. Which risk should the auditor highlight as MOST significant?

A. Cloud-specific attack patterns such as API key abuse would not generate alerts for analyst review. B. Cloud log volumes may exceed licensed ingestion capacity and increase the firm's ongoing operating costs. C. Duplicate events from both environments could inflate the alert statistics reported to senior management. D. On-premises correlation rules will gradually become outdated as the legacy workloads are decommissioned.

Question 7

An IS auditor is assessing whether security monitoring data would be reliable if relied upon to support a disciplinary action or a legal proceeding. Administrators of the monitored production systems also hold full administrative privileges on the organization's central log collection platform. Which control provides the BEST assurance over the integrity of the collected logs?

A. Encrypting log data in transit between the distributed collectors and the central log repository. B. Requiring dual approval before any change is made to retention policies on the central logging platform. C. Retaining collected log data for a period that satisfies all applicable regulatory and contractual requirements. D. Forwarding logs in near real time to a repository that the system administrators cannot alter.

Question 8

A national retailer outsources its security monitoring to a third-party managed provider. The contract specifies alert notification timeframes and escalation paths, but the IS auditor finds no provision granting the retailer or its auditors access to the provider's monitoring records and supporting control documentation. Which finding should the auditor consider MOST significant?

A. Notification timeframes were proposed by the provider rather than negotiated by the retailer's own management. B. Internal security staff do not possess the skills needed to independently validate the provider's alerts. C. Without a right-to-audit provision, assurance over the operation of outsourced monitoring controls is limited. D. Monitoring performance metrics are not currently reported to the retailer's board of directors.

Question 9

An IS auditor is reviewing a university's newly implemented user and entity behavior analytics tool as part of a security operations review. The tool was deployed only two weeks ago and is already configured to automatically disable any account whose activity is scored as anomalous, without prior analyst review. Which concern should the auditor raise FIRST?

A. The tool's licensing model may not scale economically to cover the university's full student population. B. Immature behavioral baselines may cause legitimate faculty and student accounts to be disabled. C. Analysts may not be adequately trained to interpret the tool's anomaly scoring methodology. D. Anomaly detection capabilities may overlap with existing signature-based detection technologies.

Question 10

Six months after an audit recommended continuous monitoring of privileged administrative sessions, the IS auditor performs follow-up procedures. Management provides a project plan showing that the monitoring tooling has been purchased and that a pilot is scheduled for the following quarter. No privileged sessions are currently being monitored. What is the auditor's BEST course of action?

A. Report the finding as unresolved and continue tracking it until session monitoring becomes operational. B. Close the finding because management has demonstrated commitment by procuring the required tooling. C. Escalate the matter directly to the board given the time elapsed since the original audit report. D. Lower the original risk rating assigned to the finding to reflect the planned pilot deployment.

Related Posts

Leave a Comment Cancel Reply