CISA Domain 5B-6 Practice Test 002

This practice test covers Domain 5 (Protection of Information Assets) Subdomain B-6 (Evidence Collection and Forensics) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5B-6 Evidence Collection and Forensics Practice Test 002

10 questions • Single best answer

Question 1

An external IS auditor engaged by a pharmaceutical company's audit committee learns that an employee may have copied clinical trial data to a personal cloud storage account. The IT team proposes immediately reimaging the employee's laptop to prevent further leakage. What should the IS auditor recommend FIRST?

A. Disable the employee's network and cloud access, then reimage the laptop to contain exposure B. Isolate the laptop and have a qualified examiner create a verified forensic image first C. Interview the employee to establish what data was copied before taking action on the device D. Request the cloud provider's access logs to confirm whether the data was actually uploaded

Question 2

During an audit of a regional insurer's fraud investigation unit, the IS auditor samples seized storage devices. Evidence bags are sealed and labeled, and hash values were recorded at acquisition, but custody logs show gaps of several days with no recorded handler. Which risk is MOST significant?

A. Hash values may no longer match because the devices were stored for an extended period B. Investigators may have breached internal policy on evidence storage, access, and retention C. Seals and labels may be insufficient to identify which case each storage device belongs to D. The organization may be unable to demonstrate evidence integrity if the matter is litigated

Question 3

A logistics firm's security operations team responds to a production server suspected of running memory-resident malware. An IS auditor reviewing the incident procedure notes that the first documented step is to power down the server and remove its disk for imaging. Which recommendation is MOST appropriate?

A. Revise the procedure to capture volatile data such as memory and network connections first B. Revise the procedure to require a hardware write blocker whenever the disk is imaged C. Revise the procedure to require management approval before production servers are shut down D. Revise the procedure to require hashing the disk image immediately after acquisition

Question 4

An IS auditor at a telecommunications provider assesses forensic readiness. Security logs from critical systems are retained for 30 days, while investigations typically begin 60 to 90 days after suspicious activity occurs, often triggered by customer complaints. Which recommendation BEST improves the organization's ability to investigate incidents?

A. Increase the frequency of log reviews so suspicious activity is detected within 30 days B. Implement a security information and event management tool to correlate logged events C. Align log retention and protection requirements with realistic investigation timelines D. Engage an external forensic firm on retainer to perform investigations when complaints arise

Question 5

Management of a private university asks the internal IS auditor to lead a forensic investigation into suspected grade tampering by a database administrator. The audit department has no trained forensic examiners, and the matter may result in termination and legal action. What is the IS auditor's BEST course of action?

A. Lead the investigation using standard audit procedures and document all evidence carefully B. Recommend engaging qualified forensic specialists while the auditor assists within a defined scope C. Decline any involvement because forensic investigations fall outside the internal audit charter D. Collect the evidence personally to preserve it, then transfer the case to law enforcement

Question 6

An IS auditor reviewing a closed investigation at a credit union finds that the examiner performed all analysis on a working copy of a disk image. The report records the hash of the original acquired image, but no hash was computed for the working copy before analysis began. Which concern is MOST relevant to the reliability of the findings?

A. There is no assurance that the analyzed copy is identical to the original acquired image B. The original image may have been altered because it was not stored on write-once media C. The analysis may be incomplete because a working copy omits deleted files and slack space D. The examiner should have analyzed the original image directly to ensure admissibility

Question 7

A retail company relying on a software-as-a-service platform for customer orders suffers a suspected account takeover. The investigation team discovers that the provider retains detailed access logs for only seven days and releases them only after a formal legal request. Which recommendation is MOST appropriate for the IS auditor to make?

A. Require the provider to deliver an annual SOC 2 Type 2 report that covers its logging controls B. Configure the company's SIEM to alert on unusual login activity within the SaaS platform C. Perform periodic reviews of SaaS user accounts to identify unauthorized or dormant access D. Negotiate contract terms covering log retention, evidence access, and investigation support

Question 8

An IS auditor at a manufacturing company is supporting an investigation into whether a purchasing manager approved payments to a fictitious vendor. Investigators have gathered several types of evidence from different sources across the organization. Which of the following provides the MOST reliable evidence of who approved the payments?

A. A signed statement from the manager's assistant describing how payments were usually approved B. Screenshots of the approval screens captured by the accounts payable supervisor C. System-generated audit trail entries extracted from the ERP under controlled conditions D. Email messages forwarded to the investigator by a colleague who suspected the manager

Question 9

A hospital suspects that a nurse used a personally owned smartphone, enrolled in its bring-your-own-device program, to photograph patient records. The security team wants to seize the phone during the nurse's shift and image it immediately to preserve evidence before anything is deleted. What should the IS auditor determine FIRST?

A. Whether policy and legal authority permit the organization to access and examine the device B. Whether the mobile device management tool can remotely wipe the corporate container C. Whether the forensic team has tools capable of imaging the smartphone's operating system D. Whether the photographs were transmitted to any external party or social media platform

Question 10

The audit committee of a federal agency asks the IS auditor to evaluate whether its digital forensic investigations would withstand legal challenge. The auditor samples five closed cases and reviews examiner workpapers, chain of custody forms, tool records, and final reports issued to management. Which finding is MOST significant?

A. Examiners use different commercial forensic tool suites depending on the type of case B. Final reports are sent to legal counsel before being reviewed by the security director C. Two cases exceeded the agency's 30-day target for completing forensic analysis D. Examiners' tools and methods are not validated or documented to ensure repeatability

Related Posts