CISA Domain 5B-5 Practice Test 002

This practice test covers Domain 5 (Protection of Information Assets) Subdomain B-5 (Security Incident Response Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5B-5 Security Incident Response Management Practice Test 002

10 questions • Single best answer

Question 1

An internal auditor at a municipal water utility reviews twelve months of security incident tickets and finds that similar malware events were rated low severity by one analyst and critical by another, with only some escalated to the operations director. The incident response policy leaves severity ratings to analyst discretion. Which recommendation is MOST appropriate?

A. Require the operations director to review and approve the severity rating of every new ticket B. Define documented, impact-based severity criteria with escalation thresholds for each level C. Provide additional malware analysis training to all security operations analysts on each shift D. Implement automated malware quarantine so that severity ratings no longer affect containment

Question 2

An IS auditor is assessing whether a national insurance company's incident response plan would work during a real breach. The plan was approved by the CISO last year, all responders have signed acknowledgment forms, and contact lists were updated last month. Which of the following provides the BEST evidence that the plan is effective?

A. The CISO's formal approval of the plan and its alignment with a recognized framework B. Signed acknowledgment forms showing that every responder has read the current plan C. An updated contact list verified against the human resources directory last month D. Results of a recent simulation exercise, with identified gaps tracked to remediation

Question 3

During fieldwork at a regional hospital, an IS auditor reviewing server logs notices repeated successful logins to the patient records database from an unfamiliar foreign IP address within the past hour. The hospital has a documented incident response procedure. What should the IS auditor do FIRST?

A. Report the activity immediately to the designated incident contact under the hospital's procedure B. Disable the affected database account to stop further unauthorized access to patient records C. Continue reviewing the logs to determine the full extent of the activity before reporting it to anyone D. Record the observation as a finding and include it in the draft audit report for management

Question 4

An audit manager reviewing a state revenue department's incident response program notes that three significant incidents were contained within target times last year and each ticket was closed once systems were restored. No post-incident reviews were performed, and two of the incidents shared the same initial attack vector. Which finding is MOST significant?

A. Incident tickets were closed without documented sign-off from the affected system owners B. Containment time targets were not benchmarked against peer government agencies C. Lessons learned were not captured, allowing a known root cause to recur D. The incident response team does not include a dedicated forensic investigator

Question 5

A logistics company's incident response plan requires the security team to obtain approval from the affected business unit head before isolating any compromised server. During a recent ransomware event, approval took six hours because the business unit head was traveling, and the infection spread to additional servers. Which recommendation is MOST appropriate?

A. Require all business unit heads to designate an alternate who must respond to approval requests within one hour B. Grant the response lead pre-approved authority to isolate systems when defined severity criteria are met C. Deploy endpoint detection tools that automatically isolate any server showing suspicious network activity D. Revise the plan so the chief executive officer approves all isolation decisions for critical servers

Question 6

An IS auditor reviewing a credit union's handling of a recent data breach finds that members were notified 45 days after discovery, although applicable regulations require notice within 30 days. The incident response plan covers technical containment and recovery but does not mention regulatory or customer notification. Which recommendation is MOST appropriate?

A. Integrate regulatory notification steps, owners, and deadlines into the incident response plan B. Engage an external public relations firm to manage future member communications after a breach C. Require the security team to notify members directly once containment activities are completed D. Purchase cyber insurance coverage that includes regulatory penalties for late breach notification

Question 7

A board risk committee at a software company receives a quarterly security report that shows only the total number of incidents opened and closed. The audit committee chair asks the IS auditor whether this reporting adequately supports oversight of incident response performance. Which additional metric would BEST support the committee's oversight?

A. Number of security alerts generated by monitoring tools during the quarter B. Percentage of incident response staff holding professional security certifications C. Count of incident response plan pages updated during the annual review D. Average time to detect and contain significant incidents compared with targets

Question 8

An IS auditor plans to test whether a telecommunications provider escalated all major incidents within the required two hours, using a sample selected from the incident ticketing system. Interviews reveal that some after-hours incidents are coordinated by phone and email and logged later, if at all. What should the IS auditor do FIRST?

A. Select a larger sample from the ticketing system to increase confidence in the results B. Test escalation timeliness only for incidents that occurred during business hours C. Assess the completeness of the incident population before selecting the sample D. Recommend that management require all incidents to be logged in the ticketing system

Question 9

A cloud migration review at a university finds that student records will move to a software-as-a-service provider whose contract covers uptime and data backups but does not address security incidents affecting university data. The university's incident response plan assumes all systems are hosted internally. Which recommendation is MOST appropriate?

A. Amend the contract to require timely incident notification and cooperation, and update the plan B. Require the provider to supply its independent assurance report each year before contract renewal C. Retain the student records on internal servers until the provider adopts the university's response plan D. Obtain the provider's internal incident response procedures and attach them to the university's plan

Question 10

During follow-up of a prior audit at a defense contractor, management states that the recommendation to establish 24/7 incident escalation coverage has been implemented. The IS auditor obtains an on-call rotation schedule and an updated escalation policy. Which additional evidence would BEST confirm that the recommendation is operating effectively?

A. A memo from the CISO certifying that the on-call rotation is staffed every week B. Training attendance records showing on-call staff completed escalation training C. The rotation schedule reconciled to payroll records for on-call stipend payments D. Records of after-hours incidents or test calls showing timely on-call responses

Related Posts