CISA

One question per exam domain, 5 in all, each with the answer, the reasoning behind it, and the public source it was written from. Read them here with no account. These are original questions written against the published exam outline, not real exam items.

1. Question 1 · Information Systems Auditing Process

   Management suspects a payroll clerk altered timekeeping records and asks audit to secure evidence from her workstation before confronting her. The machine is powered off in a locked office. What should the auditor do FIRST?

   1. ANotify the clerk of the concern and request a written explanation before any evidence is collected
   2. BAsk the desktop team to copy the user's home folder to a network share so the audit team can review it
   3. CCreate a forensic image of the drive using a write blocker and start a documented chain of custody
   4. DBoot the machine using the clerk's credentials and search the file system for the altered timekeeping records
   Show answer and explanation

   Correct answer

   Create a forensic image of the drive using a write blocker and start a documented chain of custody

   Preserving an unaltered copy and documenting custody keeps the evidence admissible and defensible, and every later analytical step depends on that copy existing first. Booting the system as the user modifies timestamps and other artifacts and destroys the very record being sought. A file copy performed by IT loses metadata, unallocated space, and any independent custody trail, and puts collection in the hands of a party outside the investigation team. Alerting the subject before evidence is secured invites destruction of the material the engagement depends on.

   Source: NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response

2. Question 2 · Governance and Management of IT

   Cobalt Mutual developers hold standing write access to the production policy database, applying fixes outside the release pipeline. The IS auditor is assessing integrity of policy and premium records. What is the GREATEST risk?

   1. AProduction data used during defect investigation may expose unmasked policyholder information to the developers involved.
   2. BSchema differences between the development and production databases may go undetected until a later production release fails.
   3. CThe same individuals can author, approve, and apply a production change and alter the evidence of it, so bad changes go undetected.
   4. DDefect resolution time cannot be measured against the agreed service level because these fixes bypass the ticket queue entirely.
   Show answer and explanation

   Correct answer

   The same individuals can author, approve, and apply a production change and alter the evidence of it, so bad changes go undetected.

   When one person can originate, authorize, and execute a change to financial records and also holds the access needed to modify the audit trail of that change, the organization has lost the independent check that makes the records reliable, which is the greatest risk to record integrity. Undetected schema drift between environments is a real operational concern but causes defects rather than concealed unauthorized changes. Exposure of unmasked policyholder data is a genuine confidentiality issue, and would be the answer if the question asked about privacy, but the stated objective here is integrity of policy and premium records. Loss of service level measurement is a process management weakness with no direct effect on whether the recorded data is correct.

   Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

3. Question 3 · IS Acquisition, Development, and Implementation

   Kestrel Analytics releases to production twice a week. Management proposes that audit review the product once a year, after the annual release summary. What should the IS auditor recommend INSTEAD?

   1. AAudit should assess the repeatable controls built into the development process, such as traceability, code review and release approval
   2. BAudit should attend the daily stand-ups and approve each user story before it may enter a sprint, giving continuous coverage
   3. CAudit should require the team to abandon iterative delivery for a stage-gated waterfall model so that review points are unambiguous and fixed
   4. DAudit should rely on the annual external penetration test as its primary source of assurance over the development process
   Show answer and explanation

   Correct answer

   Audit should assess the repeatable controls built into the development process, such as traceability, code review and release approval

   Where releases are frequent and small, assurance has to come from the controls embedded in the pipeline rather than from inspection of individual deliverables, because any point-in-time review is stale within days. Testing traceability, review and approval controls gives coverage over every release, not one. Approving user stories would put the auditor into the delivery decision and destroy independence, which is a self-review threat regardless of how helpful it feels. Forcing a methodology change asks the business to alter how it delivers value in order to suit the audit calendar, which is not audit's decision to make. A yearly penetration test detects a narrow class of defects at one moment and says nothing about whether change control operated across the other 51 weeks.

   Source: NIST SP 800-218, Secure Software Development Framework (SSDF) Version 1.1

4. Question 4 · IS Operations and Business Resilience

   At Prairie Grain Co-op, when an overnight settlement job aborts the on-duty operator may correct the input file and rerun the chain immediately, recording it only in a handwritten shift notebook. What is the GREATEST risk?

   1. AThe application team may never learn that the job aborted and so may not investigate the underlying defect
   2. BA rerun may extend the overnight batch window and delay the morning opening of online services to members
   3. CThe handwritten shift notebook may prove difficult to read or interpret if an investigation is ever required at a later date
   4. DOperators can alter production settlement data with no independent review and no system-generated record of the change
   Show answer and explanation

   Correct answer

   Operators can alter production settlement data with no independent review and no system-generated record of the change

   The controlling issue is that an operator can change settlement data and reprocess it with nothing independent recording what was changed, which removes accountability over financial transactions and makes error or fraud indistinguishable from routine recovery. An extended batch window is an availability inconvenience with a visible symptom. Illegible handwriting is a weakness in the same deficient record rather than a separate risk. Losing the defect signal is a genuine problem management gap and would be a valid secondary finding, but recurring aborts are far less damaging than undetectable changes to the money.

   Source: NIST SP 800-92: Guide to Computer Security Log Management

5. Question 5 · Protection of Information Assets

   Northlight Media enforces multifactor authentication, but 40 accounts are on the exemption list, six of them domain administrator accounts exempted because prompts interfere with automation scripts. Which is the GREATEST risk?

   1. AThe most privileged accounts rest on a password alone, so one compromise gives admin control
   2. BExemptions were granted to accommodate legacy applications unable to support modern authentication
   3. CNo compensating control has been documented for any of the forty accounts on the exemption list
   4. DThe exemption list is not reviewed on a defined schedule, so entries persist without reconsideration
   Show answer and explanation

   Correct answer

   The most privileged accounts rest on a password alone, so one compromise gives admin control

   Risk is a function of likelihood and impact, and exempting the highest privilege accounts concentrates the greatest possible impact behind the weakest authenticator, which inverts the intent of the control. Absent periodic review of the list allows exemptions to persist, a legitimate finding but secondary to which accounts are on it. Legacy application constraints explain why some exemptions exist and would still be a lower concern if they covered only limited service identities. Missing compensating controls compounds the exposure, yet the decisive factor is the privilege level of the accounts left unprotected, not the paperwork around them.

   Source: NIST SP 800-63B: Digital Identity Guidelines, Authentication and Lifecycle Management