CISA Domain 5B Practice Test 001

This practice test covers Domain 5 (Protection of Information Assets) Subdomain B (Security Event Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA Practice Test — 5B (Security Event Management)

10 questions • Single best answer

Question 1

An internal auditor at a government agency is evaluating the security awareness program after a series of successful phishing incidents. Management points to annual mandatory training and signed acknowledgment forms as evidence the program is effective. Which of the following would provide the BEST evidence that the awareness program is actually reducing security risk?

A. Completion records confirming that nearly all employees finished the annual training module on time. B. Results from periodic simulated phishing campaigns showing a steadily declining click-through rate over time. C. Signed acknowledgment forms confirming each employee received and read the security awareness policy. D. Confirmation that the awareness training content is formally reviewed, updated, and re-approved each year by the information security team.

Question 2

A healthcare organization's security operations center detects ransomware actively encrypting files across several production servers in real time. The incident response team has been alerted and is assembling to respond. Which of the following should the team do FIRST to limit the immediate impact of this incident?

A. Isolate the affected servers from the network to stop the malware from spreading further. B. Notify affected patients and regulators about the potential compromise of protected health information. C. Rebuild the encrypted servers from the most recent known-good backups to restore operations. D. Capture a full forensic image of each affected server to preserve evidence for analysis.

Question 3

During the investigation of a suspected data theft, an IS auditor reviews how the forensics team handled the departing employee's laptop. The auditor notes there is no documentation recording who accessed the seized device, when, and for what purpose after it was collected. Which of the following is the auditor's GREATEST concern?

A. The forensic analysis was performed by internal staff rather than an accredited external forensics provider. B. The forensic image was stored on the same storage array used for routine production backups. C. A gap in the chain of custody may render the collected evidence inadmissible in legal proceedings. D. The investigation was initiated by management before the legal department had been formally notified.

Question 4

A financial services firm's SIEM generates thousands of alerts each day, and analysts report that the overwhelming majority are false positives, causing genuine threats to be overlooked. An IS auditor is assessing the monitoring function. Which of the following recommendations would BEST improve the effectiveness of the security monitoring process?

A. Increase the number of analysts staffing the security operations center across all shifts. B. Extend the log retention period so that historical events remain available for later investigation. C. Forward all raw log data to a third-party managed security service for parallel review. D. Tune correlation rules and alert thresholds based on the organization's risk and asset criticality.

Question 5

A manufacturing company suffers a fraudulent wire transfer after an attacker impersonated the CFO in an urgent email directing finance staff to release funds immediately. An IS auditor is recommending controls to prevent recurrence. Which of the following would BEST mitigate the risk of this business email compromise attack?

A. Deploying updated anti-malware software on all endpoints used by finance department staff. B. Implementing out-of-band verification, such as a callback, for payment requests above a defined threshold. C. Requiring finance staff to change their email account passwords more frequently than other users. D. Encrypting all outbound email sent from the finance department to external business recipients.

Question 6

An IS auditor is reviewing an organization's security testing program. Management asserts that quarterly automated vulnerability scans of all external-facing systems demonstrate that the environment is secure against real attacks. Which of the following is the MOST appropriate conclusion for the auditor to reach regarding this assertion?

A. Vulnerability scans confirm security because they identify every exploitable weakness present in the systems. B. Quarterly scanning is excessive, and annual scanning of external-facing systems would be sufficient. C. Scanning alone does not validate exploitability; penetration testing is needed to assess real-world resilience. D. The scans should be replaced entirely by continuous automated monitoring of inbound network traffic.

Question 7

Following a major security breach, an organization restored operations quickly and formally closed the incident. Six months later a nearly identical breach occurred through the same unpatched vulnerability. An IS auditor is reviewing the incident response process. Which of the following control weaknesses MOST likely contributed to the recurrence?

A. The incident response team did not conduct a post-incident review to identify and remediate root causes. B. The incident response plan document had not been formally distributed to and acknowledged by every employee across the organization. C. The organization did not purchase cyber insurance coverage before the first incident occurred. D. The help desk was not staffed around the clock to receive incident reports from users.

Question 8

An IS auditor observes a forensic investigator responding to a live compromised server that is still powered on and running. The investigator immediately shuts the system down to preserve the hard drive before collecting any other data. Which of the following is the auditor's MOST significant concern with this approach?

A. Shutting the server down interrupts business services that depend on the affected system. B. The investigator did not first obtain written management approval to access the server. C. The hard drive should have been encrypted before the forensic image was created. D. Powering the server off destroys volatile data such as memory contents and active network connections.

Question 9

During an audit of a retailer's security monitoring practices, the IS auditor finds that critical system logs are stored only locally on each server and that administrators can edit or delete them. Which of the following findings should the auditor consider the MOST significant regarding the log management process?

A. Log files are retained for ninety days rather than the twelve months certain regulations require. B. Administrators can modify or delete local logs, undermining their integrity and reliability as evidence. C. Log entries are recorded in local server time rather than a synchronized coordinated universal time source. D. Log storage consumes significant disk capacity on the production servers over extended periods.

Question 10

An IS auditor is evaluating a company's incident response procedures. The auditor notes that all reported security events are handled in the order they are received, regardless of their nature, severity, or the systems affected. Which of the following recommendations would MOST improve the incident response process?

A. Require that every reported security event be escalated directly to executive management. B. Increase the frequency of incident response tabletop exercises to at least twice per year. C. Establish a severity classification scheme so incidents are prioritized by business impact and urgency. D. Outsource all initial incident triage activities to an external managed detection provider.

Related Posts

Leave a Comment Cancel Reply