CISA Practice Questions

The most effective method to protect digital evidence is to create a forensic image of the affected system's storage media. Imaging involves creating a bit-for-bit copy of the entire drive, including deleted files and unallocated space. This process preserves the original evidence in its exact state at the time of collection. All subsequent analysis is performed on this verified copy, ensuring the original media remains unaltered and its integrity is maintained. This is a fundamental principle in digital forensics, crucial for ensuring the evidence is admissible in legal or disciplinary proceedings.

B. Powering down the affected system immediately destroys volatile evidence stored in RAM, such as running processes, network connections, and cached data, which can be critical.

C. Protecting the hardware is a necessary physical security measure for chain of custody but does not preserve the digital state of the evidence on the system.

D. Rebooting the affected system is a destructive act that clears volatile memory and alters non-volatile data by writing new log files and temporary data, contaminating the evidence.

---

1. ISACA

CISA Review Manual

27th Edition. Domain 4: Information Systems Operations and Business Resilience

Section 4.7 Incident Management. The manual emphasizes that a primary objective during evidence collection is to preserve the evidence. It specifies the use of bit-stream imaging to create a copy of the storage media for analysis

leaving the original evidence intact.

2. National Institute of Standards and Technology (NIST)

Special Publication 800-86

"Guide to Integrating Forensic Techniques into Incident Response." Section 3.2.3

"Creating a Forensic Image of Media

" states

"Creating an image is a critical step in a forensic examination. The image provides an exact duplicate of the media that the examiner can work with

leaving the original media untouched." This directly supports imaging as the best protection method.

3. Kent

K.

Chevalier

S.

Grance

T.

& Dang

H. (2006). NIST Special Publication 800-86

"Guide to Integrating Forensic Techniques into Incident Response." Section 3.1

"Initial Response

" discusses the order of volatility and warns against actions that could alter or destroy evidence. It implicitly advises against premature shutdown (Option B) or rebooting (Option D) before volatile data is captured and the system is imaged.

A feasibility study's primary purpose is to determine the viability of a proposed project. The cost-benefit analysis is the core component of assessing economic feasibility. It provides the fundamental justification for the expenditure by comparing the total expected cost of the project against its total expected benefits. Omitting this analysis means the organization lacks the essential financial data to determine if the acquisition will provide a positive return on investment (ROI). Without this, a sound business decision to approve and fund the project cannot be made, making its omission the most critical concern.

A. Alternatives for financing are considered after the project's value is established; they address how to pay, not if the investment is worthwhile.

B. The financial stability of vendors is a crucial risk factor in the procurement process, but it is secondary to first establishing the project's own economic viability.

C. Vendor reputation is an important qualitative factor for due diligence and risk mitigation, but it does not replace the quantitative financial justification for the project.

1. ISACA. (2019). CISA Review Manual

27th Edition. Domain 3: Information Systems Acquisition

Development

and Implementation

Section 3.2.2 Project Initiation. The manual emphasizes that a feasibility study assesses the benefits and costs to create a business case

which is the primary justification for a project.

2. Valacich

J. S.

& George

J. F. (2020). Modern Systems Analysis and Design (9th ed.). Pearson. Chapter 5

"Initiating and Planning Systems Development Projects

" states that assessing economic feasibility through cost-benefit analysis is a required and critical activity in any project's initial phase.

3. Project Management Institute. (2017). A Guide to the Project Management Body of Knowledge (PMBOK® Guide) (6th ed.). Section 1.2.6.1 Business Case. The guide identifies the business case

which includes a cost-benefit analysis

as the document that establishes the validity and justification for a project's existence.

The most appropriate role for an IS auditor in a Control Self-Assessment (CSA) program is that of a facilitator. In this capacity, the auditor leverages their expertise in risk management and control frameworks to guide and support business process owners in evaluating their own control environments. The auditor's function is to provide the methodology, training, and facilitation skills necessary for the business units to effectively conduct the self-assessment. This collaborative approach empowers management and staff, who are the control owners, while ensuring the CSA process is structured and effective. The auditor does not perform the assessment but rather enables the business to do so, maintaining the principle of business ownership of controls.

B. Improving process productivity is a management objective and a potential byproduct of effective controls, not the auditor's primary scope in a CSA.

C. Performing detailed audit procedures describes a traditional audit; in a CSA, the auditor's role is to guide the business in performing its own assessment.

D. The auditor's presence is to support and facilitate the process; it does not absolve other team members of their audit and control responsibilities.

1. ISACA. (2019). CISA Review Manual

27th Edition. Section 1.4.4 Control Self-Assessment (CSA)

p. 53. The manual states

"In a CSA program

the audit role is one of a consultant or facilitator... The IS auditor’s role may be to act as a facilitator in CSA workshops."

2. ISACA. (2015). "Implementing a Control Self-assessment Program." ISACA Journal

Volume 4. This article clarifies

"The role of internal audit in a CSA program is that of a facilitator... Internal audit provides the methodology

training and facilitation skills to help the business assess its risks and controls."

3. Engel

R.

& Hunton

J. E. (2008). "An Examination of the Effect of Control Self-Assessment on an Auditor's Control Risk Assessments." Auditing: A Journal of Practice & Theory

27(1)

117-134. https://doi.org/10.2308/aud.2008.27.1.117. This academic paper discusses the evolving role of auditors in CSA

highlighting the shift from direct testing to a more collaborative and facilitative partnership with management.

The primary purpose of a parallel run is to validate the new system's processing and outputs by comparing them directly against the results of the legacy system (its predecessor). Both systems are run simultaneously using the same live input data for a defined period. This comparative process ensures the new system is accurate, reliable, and performs as expected before the old system is decommissioned. It serves as a final, real-world validation, minimizing the risk of business disruption during the transition.

A. To train the end users and supporting staff on the new system

While users gain experience during a parallel run, this is a secondary benefit. The primary method for education is dedicated training programs.

B. To verify the new system provides required business functionality

This is too general. While a parallel run does verify functionality, its specific and primary purpose is the direct comparison and validation against the old system.

C. To reduce the need for additional testing

A parallel run is a form of testing (live validation) and does not replace or reduce the need for earlier phases like unit, integration, or system testing.

1. ISACA CISA Review Manual

27th Edition. Domain 3: Information Systems Acquisition

Development

and Implementation

Section 3.5.4 System Conversion. The manual describes parallel conversion as running the old and new systems simultaneously to compare and verify the new system's results against the old. This direct comparison is the core of the validation process.

2. ISACA

"Glossary of Terms

" (www.isaca.org/glossary). The definition of "Parallel Run" emphasizes the comparison of results between the old and new systems to verify the new system's functionality and accuracy before the old system is discontinued.

3. Valacich

J. S.

& George

J. F. (2020). Modern Systems Analysis and Design (9th ed.). Pearson. Chapter 12

"Designing the User and System-to-System Interfaces

" discusses implementation strategies. It states that parallel installation involves running both the old and new systems concurrently to check that the new system's output is comparable to the old system's

thus validating its performance.

The principle of least privilege is a fundamental security concept requiring that users be granted only the access and permissions necessary to perform their job duties. In this scenario, providing administrator rights to most users on an externally facing system containing sensitive data is a severe violation of this principle. Administrator privileges inherently grant the ability to alter system configurations, modify or delete data, and change security settings. This creates the greatest risk of unauthorized changes, whether malicious or accidental, which directly compromises the integrity, availability, and confidentiality of the system and its data.

A. While administrators can export logs, this is a specific action. The ability to make any unauthorized change is a much broader and more significant risk.

B. Viewing sensitive data is a function of the system for both user types. The core issue highlighted is the risk from excessive privileges, not authorized access.

D. Installing software is a subset of the actions an administrator can perform. The overarching risk is the general capability to make unauthorized changes, which includes more than just software installation.

---

1. ISACA

CISA Review Manual

27th Edition. Domain 4: Information Systems Operations

Maintenance and Service Management

Section 4.4 Logical Access. The manual emphasizes that access rights should be granted based on the "need-to-know" and "need-to-do" principles

and that powerful privileges (such as administrator rights) must be strictly controlled to prevent unauthorized activities that could compromise the system.

2. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5. Security and Privacy Controls for Information Systems and Organizations

Control AC-6 "Least Privilege." This control states: "The organization employs the principle of least privilege

allowing only authorized accesses for users...that are necessary to accomplish assigned tasks." The discussion section notes that this prevents users from making unauthorized changes or performing functions outside their roles.

3. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE

63(9)

1278-1308. This foundational academic paper introduces the principle of least privilege

stating

"Every program and every user of the system should operate using the least set of privileges necessary to complete the job." The rationale is to limit the damage that can result from an accident or error. (DOI: https://doi.org/10.1109/PROC.1975.9939

Section I.A.3).

Before implementing any technical controls to prevent the leakage of sensitive information, an organization must first formally define what constitutes "sensitive information." This is achieved by developing and implementing an information classification scheme. This scheme categorizes data based on its level of sensitivity, criticality, and value to the organization (e.g., public, internal, confidential, restricted). This classification provides the essential foundation and criteria upon which all subsequent security controls, including email Data Loss Prevention (DLP) systems, are built and configured. Without a classification scheme, any control would be arbitrary and ineffective as it would lack a clear basis for identifying and protecting the targeted information.

A. Requiring nondisclosure agreements is a legal/contractual control that acts as a deterrent but does not technically prevent data leakage; it is not a prerequisite for configuring technical controls.

B. An acceptable use policy is a high-level administrative control. While important, it relies on an underlying information classification scheme to give specific meaning to terms like "sensitive data."

D. Notifying employees about monitoring is a crucial step for legal and privacy compliance during the implementation of the control, but it is not the first task. The organization must first decide what to monitor, which is determined by the classification scheme.

---

1. ISACA

CISA Review Manual

27th Edition (2019). Domain 5: Protection of Information Assets

Section 5.2.1 Information Classification. The manual states

"The initial step in protecting information assets is to classify the information... Classification provides the foundation for information security governance." This establishes classification as the foundational first step.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives (2018). APO14 Managed Data

APO14.02 Define and maintain data and information architecture. This practice includes activities for establishing a data classification scheme to ensure that data handling and security measures are commensurate with the data's value and sensitivity.

3. von Solms

B.

& von Solms

R. (2004). The 10 deadly sins of information security management. Computers & Security

23(5)

371-376. https://doi.org/10.1016/j.cose.2004.05.002. The article emphasizes that a lack of a proper information classification scheme is a fundamental failure ("sin") in information security management

as it is impossible to protect assets if their value and sensitivity are unknown.

When an organization outsources its information systems functions, it transfers the operational activities but retains ultimate accountability for governance and meeting business objectives, including disaster recovery. The organization must ensure that the vendor's disaster recovery plan (DRP) aligns with its own business requirements, such as Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO). This requires ongoing collaboration, oversight, and joint administration to ensure the plan is adequate, tested, and effectively integrated with the organization's overall business continuity strategy. Abdicating this responsibility introduces significant risk.

A. Discontinuing maintenance of the DRP is a dereliction of duty. Outsourcing transfers execution, not the ultimate responsibility for ensuring business resilience.

C. While a third-party evaluation can provide assurance, delegating the entire evaluation function is not the primary responsibility; management must own and oversee the process.

D. Delegating evaluation to internal audit would impair their independence. Internal audit's role is to provide objective assurance, not to perform management's functions.

---

1. ISACA

CISA Review Manual

27th Edition. Chapter 4: Information Systems Operations and Business Resilience

Section 4.6

"Outsourced IS Environments." The manual states

"When services are outsourced

the organization is ultimately responsible for ensuring that the third party’s BCP meets its business requirements... The IS auditor should verify that the organization has a process for monitoring the third party’s BCP." This monitoring and verification process necessitates coordination.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. Management Objective DSS04

"Managed Continuity." Practice DSS04.05

"Test and review the BCP

" specifies the need to "Include relevant external parties (e.g.

service providers

business partners

customers) in the tests where appropriate." This inclusion directly implies coordination with the outsourcing vendor.

3. ISACA

COBIT 2019 Framework: Governance and Management Objectives. Management Objective APO10

"Managed Vendors." Practice APO10.05

"Monitor vendor performance and compliance

" states that the organization should "Periodically review vendor performance... against contracted service levels

and ensure compliance with requirements." This includes requirements for disaster recovery capabilities.

4. Hsu

C.

Lee

J.

& Wu

C. (2013). An empirical study of the impact of IT outsourcing on information system disaster recovery planning. Information & Management

50(6)

306-315. This study emphasizes that successful DR in an outsourced environment depends on strong contract management and continuous monitoring

which are forms of coordination and administration between the client and the vendor. (DOI: https://doi.org/10.1016/j.im.2012.08.005)

Referential integrity is a preventive control that ensures relationships between database tables remain consistent, preventing the creation of "orphan" records (e.g., an order record with a customer ID that does not exist in the customer table). By disabling this control, management has accepted the risk of such data inconsistencies occurring. The most effective compensating control is a detective control that periodically checks for and identifies these very inconsistencies. A periodic table link check serves this exact purpose by running queries to find records with invalid foreign keys, allowing for subsequent correction.

A. More frequent data backups: Backups are a corrective control for disaster recovery or major data loss; they do not detect or prevent the specific data consistency errors introduced by disabling referential integrity.

C. Concurrent access controls: These controls manage simultaneous data access and modification to prevent issues like lost updates. They do not validate the logical relationships between data in different tables.

D. Performance monitoring tools: These tools measure system responsiveness and resource utilization. They would confirm the performance gains but do nothing to mitigate the data integrity risk that was created.

---

1. ISACA

CISA Review Manual

27th ed.

2019. Domain 3: Information Systems Acquisition

Development

and Implementation

Section 3.5.6 Data Migration. The manual discusses the importance of verifying data integrity after migration

which includes checking referential integrity. It states

"The IS auditor should verify that key controls

such as... referential integrity

are in place... If not

the auditor should look for compensating controls." A periodic check is a classic example of such a compensating control.

2. Elmasri

R.

& Navathe

S. B. (2017). Fundamentals of Database Systems (7th ed.). Pearson. Chapter 5

"The Relational Data Model and Relational Database Constraints

" Section 5.2.3

discusses referential integrity constraints. The text explains that if these constraints are not enforced by the Database Management System (DBMS)

applications or periodic integrity-checking utilities must be used to detect and correct violations to maintain data consistency.

3. ISACA. (2014). COBIT 5: Enabling Information. Appendix B

Detailed Guidance—Enablers

BAI08.02 Manage knowledge. This section discusses the need to "Define data quality requirements and data validation rules." When automated validation rules (like referential integrity) are disabled

periodic checks become a necessary procedure to ensure data quality meets requirements.

Risk appetite is the amount and type of risk that an organization is prepared to pursue, retain, or take. This is a strategic, high-level decision made by senior management and the board of directors. The most formal and authoritative source for an organization's intended risk appetite is its risk policies. These policies codify and communicate management's direction and intent regarding risk-taking, setting the tone and providing the guiding principles for all risk management activities across the enterprise. An IS auditor would review these policies first to understand the established and approved boundaries for acceptable risk.

B. Risk assessments identify, analyze, and evaluate specific risks; they do not define the organization's overall acceptable level of risk (appetite).

C. Prior audit reports identify historical control weaknesses and may imply a certain risk tolerance but do not formally state the organization's intended risk appetite.

D. While management defines the risk appetite, a formal, board-approved policy is the most reliable and official source, rather than a potentially informal assertion.

1. ISACA

CISA Review Manual

27th Edition

2019. Domain 2: Governance and Management of IT

Section 2.4

"IT Governance Framework

" discusses how policies are the primary means to communicate management's intent and guidance

which includes the organization's risk appetite and tolerance.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives

2018. Governance Objective EDM03

"Ensured Risk Optimization

" states that a key activity for the board/governing body is to "Set the business- and risk-related context for the enterprise

including its risk appetite." This direction is then formalized and communicated through policies.

3. Sobel

P. J.

& Reding

K. F. (2012). Enterprise Risk Management: Achieving and Sustaining Success. The Institute of Internal Auditors Research Foundation. Chapter 3

"ERM and Strategy

" explains that the board of directors is responsible for approving the risk appetite statement

which is then documented in the organization's risk management policy.

The primary objective of an audit of data conversion and migration is to ensure the integrity, accuracy, and completeness of the data in the new system. Unauthorized data modifications represent a direct and confirmed compromise of data integrity. This is the most severe issue because it means the data in the new system is unreliable, potentially leading to incorrect business decisions, financial misstatements, and a loss of trust in the system's outputs. A realized impact on data integrity is always a greater concern than procedural weaknesses or potential recovery issues.

A. A lack of formal documentation is a significant process weakness, but it is a potential risk factor, not a confirmed negative outcome like data corruption.

B. Backups not being available online impacts the recovery time objective (RTO) but does not mean backups are nonexistent; they may be stored offline.

D. Manual processes increase the likelihood of error, but this is a risk factor, not a confirmation that unauthorized modifications or errors have actually occurred.

1. ISACA

CISA Review Manual

27th Edition. Domain 3: Information Systems Acquisition

Development

and Implementation

Section 3.4.5 Data Migration. The manual emphasizes that the key objective during data migration is to ensure that data is "accurate

complete and valid." Unauthorized modification (C) is a direct violation of this core objective

making it a greater concern than process control weaknesses (A

D) or recovery planning (B).

2. Weber

R. (2012). Information Systems Control and Audit. Pearson Education. Chapter 17

Auditing Computer Applications. The text discusses application controls and the audit of system implementations. It highlights that substantive testing

which would uncover actual data modifications

provides direct evidence of problems

whereas evaluating process documentation (A) or the nature of the process (D) are tests of controls that indicate potential risk. A confirmed data integrity issue is a substantive finding and thus of higher concern.

3. The University of Texas at Austin

McCombs School of Business. Courseware for MIS 373: IT Auditing and Security. In modules covering the System Development Life Cycle (SDLC) audit

a primary audit objective for the implementation phase is to verify the integrity of converted data. The course materials stress that evidence of data corruption or unauthorized changes is a critical finding that must be prioritized.