Try CISA - Certified Information Security Auditor

Q1.An IS auditor at a retailer is assessing alignment between the IT policy hierarchy and control objectives. A control objective states: 'Ensure that only authorised users have access to customer payment data.' An auditor identifies that the access control policy exists but the corresponding standard does not specify how 'authorised' is defined or how access is provisioned. What is the control risk created by this gap?

• A.Access provisioning will be inconsistent and potentially unauthorised because no standard defines what 'authorised' means or the required provisioning process
• B.The policy alone is sufficient to achieve the control objective; standards are supplementary and not required
• C.Procedures are more important than standards in this situation; the organisation should create step-by-step access provisioning procedures immediately
• D.The control objective should be removed because it cannot be met without a complete policy hierarchy in place

Domain: Governance and Management of IT

Q2.An IS auditor at a media company reviews the accounts-receivable aging report produced nightly. The auditor finds that the total receivables on the aging report differ from the general ledger control account balance by $42,000. Management says the reports are produced and sent to the collections team without any reconciliation step. Which output control is ABSENT and what is the correct auditor action?

• A.A hash total control is absent; the auditor should implement the hash total in the next sprint
• B.A report-balancing control is absent; the auditor should document the finding and recommend that management implement a reconciliation step before report distribution
• C.A batch total control is absent; the auditor should halt report distribution immediately
• D.A range check is absent; the auditor should recommend that accounts over 90 days be flagged automatically

Domain: Information Systems Acquisition, Development, and Implementation

Q3.A retail company's BIA team calculates that each hour of e-commerce downtime results in $85,000 in lost sales. Additionally, legal counsel advises that a downtime event exceeding six hours could trigger regulatory reporting requirements. The reputational impact from a major downtime event is estimated to range from $500,000 to $2 million in long-term brand damage. The IS auditor reviews the BIA and finds that recovery priorities were set based solely on financial revenue loss per hour. Which BIA methodology weakness does the IS auditor MOST likely identify?

• A.The BIA should have been conducted quarterly rather than annually to capture revenue seasonality
• B.The BIA methodology is too quantitative; qualitative impacts (regulatory triggers and reputational damage) should have been weighted alongside financial impacts in establishing recovery priorities
• C.The e-commerce platform's RTO should be set to zero because any downtime is unacceptable
• D.The IS auditor should recalculate the financial impact using a different revenue model before finalising the finding

Domain: Information Systems Operations and Business Resilience

Q4.An IS auditor at a financial services firm is constructing the risk-based audit plan for the coming year. She has completed a preliminary risk assessment and identified twelve auditable entities. The CFO requests that three specific low-risk systems be included in the plan for business convenience reasons. The IS auditor's plan already covers all high- and medium-risk systems within available resource constraints. What should the IS auditor do?

• A.Explain the risk-based audit planning methodology to the CFO and, if management insists, escalate the matter to the audit committee for resolution
• B.Add the three low-risk systems to the plan without question, since CFO requests take precedence in annual audit planning
• C.Refuse to discuss the matter with the CFO, as any management input into the audit plan compromises auditor independence
• D.Remove medium-risk systems from the plan to accommodate the CFO's three requested systems within resource constraints

Domain: Information Systems Auditing Process

Q5.During a review of an energy company's data governance controls, an IS auditor finds that the company replaces primary account numbers (PAN) in its billing system with randomly generated surrogate values stored in a secure vault. The original values are retrievable only by authorised vault lookups. Which data protection technique is described, and how does it differ from encryption?

• A.Encryption — the surrogate values are ciphertext that can be reversed using a decryption key stored in the vault
• B.Tokenisation — surrogate values have no mathematical relationship to originals; recovery requires a vault lookup, not a decryption key
• C.Hashing — a one-way cryptographic function generates the surrogate and can be reversed by the vault
• D.Data masking — original values are permanently replaced and cannot be retrieved under any circumstances

Domain: Protection of Information Assets