CISA

One question per exam domain, 5 in all, each with the answer, the reasoning behind it, and the public source it was written from. Read them here with no account. These are original questions written against the published exam outline, not real exam items.

1. Question 1 · Information Systems Auditing Process

   Management suspects a payroll clerk altered timekeeping records and asks audit to secure evidence from her powered-off workstation, in a locked office, before confronting her. What should the auditor do FIRST?

   1. ANotify the clerk and request a written explanation before collecting evidence
   2. BHave the desktop team copy her home folder to a network share for audit review
   3. CImage the drive using a write blocker and start a documented chain of custody
   4. DBoot the machine with the clerk's credentials and search for the altered records
   Show answer and explanation

   Correct answer

   Image the drive using a write blocker and start a documented chain of custody

   Preserving an unaltered copy and documenting custody keeps the evidence admissible and defensible, and every later analytical step depends on that copy existing first. Booting the system as the user modifies timestamps and other artifacts and destroys the very record being sought. A file copy performed by IT loses metadata, unallocated space, and any independent custody trail, and puts collection in the hands of a party outside the investigation team. Alerting the subject before evidence is secured invites destruction of the material the engagement depends on.

   Source: NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response

2. Question 2 · Governance and Management of IT

   Cobalt Mutual developers hold standing write access to the production policy database and apply fixes outside the release pipeline. The IS auditor is assessing the integrity of policy and premium records. What is the GREATEST risk?

   1. AProduction data used during defect investigation may expose unmasked policyholder information to the developers involved.
   2. BSchema differences between the development and production databases may go undetected until a later production release fails.
   3. CThe same individuals can author, approve, and apply a production change and alter the evidence of it, so bad changes go undetected.
   4. DDefect resolution time cannot be measured against the agreed service level because these fixes bypass the ticket queue entirely.
   Show answer and explanation

   Correct answer

   The same individuals can author, approve, and apply a production change and alter the evidence of it, so bad changes go undetected.

   When one person can originate, authorize, and execute a change to financial records and also holds the access needed to modify the audit trail of that change, the organization has lost the independent check that makes the records reliable, which is the greatest risk to record integrity. Undetected schema drift between environments is a real operational concern but causes defects rather than concealed unauthorized changes. Exposure of unmasked policyholder data is a genuine confidentiality issue, and would be the answer if the question asked about privacy, but the stated objective here is integrity of policy and premium records. Loss of service level measurement is a process management weakness with no direct effect on whether the recorded data is correct.

   Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

3. Question 3 · IS Acquisition, Development, and Implementation

   A software company releases to production twice a week. Management proposes that audit review the product once a year, after the annual release summary. What should the IS auditor recommend INSTEAD?

   1. AAssess controls built into the process, such as traceability, code review and release approval
   2. BAttend daily stand-ups and approve each user story before it enters a sprint, for continuous coverage
   3. CRequire a move from iterative delivery to a stage-gated waterfall so review points are fixed
   4. DRely on the annual external penetration test as the primary assurance over development
   Show answer and explanation

   Correct answer

   Assess controls built into the process, such as traceability, code review and release approval

   Where releases are frequent and small, assurance has to come from the controls embedded in the pipeline rather than from inspection of individual deliverables, because any point-in-time review is stale within days. Testing traceability, review and approval controls gives coverage over every release, not one. Approving user stories would put the auditor into the delivery decision and destroy independence, which is a self-review threat regardless of how helpful it feels. Forcing a methodology change asks the business to alter how it delivers value in order to suit the audit calendar, which is not audit's decision to make. A yearly penetration test detects a narrow class of defects at one moment and says nothing about whether change control operated across the other 51 weeks.

   Source: NIST SP 800-218, Secure Software Development Framework (SSDF) Version 1.1

4. Question 4 · IS Operations and Business Resilience

   At a grain co-op, when an overnight settlement job aborts, the on-duty operator may correct the input file and rerun it immediately, recording this only in a handwritten shift notebook. What is the GREATEST risk?

   1. AThe application team may never learn of the abort and so not investigate the defect
   2. BA rerun may extend the batch window and delay online services opening to members
   3. CThe handwritten notebook may be hard to interpret if an investigation is ever needed
   4. DOperators can change settlement data with no independent review or system record
   Show answer and explanation

   Correct answer

   Operators can change settlement data with no independent review or system record

   The controlling issue is that an operator can change settlement data and reprocess it with nothing independent recording what was changed, which removes accountability over financial transactions and makes error or fraud indistinguishable from routine recovery. An extended batch window is an availability inconvenience with a visible symptom. Illegible handwriting is a weakness in the same deficient record rather than a separate risk. Losing the defect signal is a genuine problem management gap and would be a valid secondary finding, but recurring aborts are far less damaging than undetectable changes to the money.

   Source: NIST SP 800-92: Guide to Computer Security Log Management

5. Question 5 · Protection of Information Assets

   A media company enforces multifactor authentication (MFA), but 40 accounts are exempt. Six are domain administrator accounts, exempted because MFA prompts interfere with automation scripts. Which is the GREATEST risk?

   1. AThe admin accounts rely on passwords alone, so one theft grants domain control
   2. BExemptions were granted for legacy apps that cannot support modern authentication
   3. CNo compensating control is documented for any of the 40 exempt accounts
   4. DThe exemption list has no review schedule, so entries persist unchecked
   Show answer and explanation

   Correct answer

   The admin accounts rely on passwords alone, so one theft grants domain control

   Risk is a function of likelihood and impact, and exempting the highest privilege accounts concentrates the greatest possible impact behind the weakest authenticator, which inverts the intent of the control. Absent periodic review of the list allows exemptions to persist, a legitimate finding but secondary to which accounts are on it. Legacy application constraints explain why some exemptions exist and would still be a lower concern if they covered only limited service identities. Missing compensating controls compounds the exposure, yet the decisive factor is the privilege level of the accounts left unprotected, not the paperwork around them.

   Source: NIST SP 800-63B: Digital Identity Guidelines, Authentication and Lifecycle Management