2025年國際注冊信息系統(tǒng)審計師（CISA）資格考試（英文版）強化練習題及答案一Domain1–TheProcessofAuditingInformationSystems1.WhichofthefollowingbestdemonstratesthatanISauditorhasachievedindependenceinappearancewhenauditingacloud-basedERPsystem?A.Theauditor’stravelcostsarereimbursedbythecloudserviceprovider.B.TheauditengagementletterissignedbytheCIOwhoreportstotheCFO.C.Theauditorreportsfunctionallytotheboardauditcommitteeandnobusinessunitpaystheauditfee.D.Theauditfirmalsosellssecurityadd-onstothesameERPplatform.Answer:CExplanation:Independenceinappearanceisimpairedwhenathirdpartycouldreasonablyconcludethattheauditor’sobjectivityiscompromised.Functionalreportingtotheboardauditcommitteeandsegregationoffeepaymentremovetheperceptionofundueinfluence.2.Duringriskassessment,anISauditoridentifiesthattherecoverytimeobjective(RTO)forthecustomerportalisfourhours,butthecurrentdocumentedprocedurerequiressixhours.Whichisthemostappropriateinitialaction?A.Recommendimmediatepurchaseofadditionalservers.B.Reportamaterialweaknesstotheboard.C.Performacontroltesttoverifyactualrebuildtimeinasandbox.D.Accepttheriskbecausetheportalisnotrevenue-critical.Answer:CExplanation:Beforeconcludingontheseverityofthegap,theauditormustobtainevidencethroughtesting.Asandboxrebuildvalidateswhetherthedocumentedsix-hourprocedureisrealisticoriftheRTOcanactuallybemetundercontrolledconditions.3.Anorganisationusescontinuousmonitoringscriptsthattriggeralertswhenprivilegedaccountscreatenewfirewallrules.TheISauditornotesthat2%ofalertsareclosedwithoutdocumentedfollow-up.Whatisthemostpersuasivetesttodeterminewhetherthisrepresentsacontroldeficiency?A.Traceasampleofclosedalertstochangeticketsandverifyapprovals.B.Interviewthesecurityoperationsmanageraboutalertfatigue.C.Reviewthequarterlybalancedscorecardpresentedtotheboard.D.Comparethe2%ratetotheGartnerindustryaverage.Answer:AExplanation:Tracingtochangeticketsprovidesdirectevidenceofwhetherthealertclosureswerelegitimateorconstitutedanoverrideofpolicy.4.Whichofthefollowingisthemostobjectiveevidenceofdataintegrityforblockchaintransactionsusedinasupply-chainsystem?A.Digitalsignaturesofthesupply-chainmanager.B.ConsensusnodehashesanchoredtothepublicBitcoinnetwork.C.Vendorrepresentationsinservice-levelagreements.D.Monthlyreconciliationspreadsheetsmaintainedoffline.Answer:BExplanation:Animmutable,time-stampedhashonapublicnetworkprovidesindependent,third-partyverifiabilitythatisresistanttosingle-entitytampering.5.Whileauditingincidentresponse,theISauditorfindsthatthemeantimetocontainment(MTTC)decreasedfrom72hoursto18hoursafterimplementingaSOARplatform,butthenumberofrepeatincidentsincreased.Whatshouldtheauditorrecommendfirst?A.Disableautomatedcontainmenttoallowdeeperroot-causeanalysis.B.Addkeyperformanceindicatorsforroot-causeelimination.C.IncreaseSOARlicensingtocoveradditionalusecases.D.OutsourceLevel-1analysistoamanagedserviceprovider.Answer:BExplanation:Fastercontainmentispositive,butrecurringincidentsindicatethatunderlyingcausesarenotaddressed.KPIsthatincentivisepermanentfixesalignoperationalbehaviourwithcontrolobjectives.Domain2–GovernanceandManagementofIT6.TheCIOarguesthattheITbalancedscorecardalreadycontains120metricsandrefusestoaddcybersecurityindicators.Thebestjustificationforaddingafocusedsetofsecuritymetricsisthat:A.ISO27001mandatesatleastfoursecurityKPIs.B.theriskappetitestatementapprovedbytheboardincludescybersecuritytolerancethresholds.C.peercompaniespublishsecuritymetricsinannualreports.D.regulatorshaveissuedinformalguidancesuggestingdisclosure.Answer:BExplanation:Theboard-approvedriskappetiteistheprimarydriverforwhatmustbemeasuredandreported;failuretomonitoragainstthresholdsconstitutesagovernancegap.7.AnITsteeringcommitteehasapproveda“cloud-first”policy.Sixmonthslater,40%ofnewworkloadsremainon-premisedueto“datasovereigntyconcerns.”Whichgovernancemechanismhasmostlikelyfailed?A.Policyexceptionprocess.B.Post-implementationreview.C.Return-on-investmentcalculation.D.Architecturereviewboard.Answer:AExplanation:Aformalexceptionprocesswouldcapturetherationale,residualriskandapproverfordeviations,ensuringtransparencyandaccountability.8.Duringanacquisition,thepurchasingcompanydiscoversthatthetarget’sITpoliciesareinformal“wiki”pageswithoutversioncontrol.Whatisthemostcriticalnextsteptoensuregovernancecontinuity?A.Migratewikicontentintothepurchaser’spolicyportalwithtimestamps.B.Requirealltargetemployeestoattendthepurchaser’spolicytraining.C.Maptargetprocedurestothepurchaser’scontrolframeworkandidentifygaps.D.Freezealltargetsystemchangesuntilpoliciesareformallysignedoff.Answer:CExplanation:Agapanalysisprovidesthebasisforprioritisingintegrationeffortsandpreventscontrolregressionduringthetransition.9.WhichofthefollowingprovidesthestrongestevidencethatITstrategyisalignedwithenterpriseobjectives?A.TheITbudgetincreasedby12%year-over-year.B.Eachstrategicinitiativehasadefinedbusinessoutcomeowner.C.TheITbalancedscorecardisgreenfor90%ofmetrics.D.TheCIOsitsontheexecutiveleadershipteam.Answer:BExplanation:Assigningbusinessoutcomeownerscreatesaccountabilityforrealisingenterprisevalue,directlylinkingITinvestmenttoenterprisegoals.10.AmultinationalfirmcentralisesITprocurementtoachieveeconomiesofscale.AnISauditornotesthatregionalsubsidiariesarebypassingthecentralcatalogueandpurchasingSaaSwithcorporatecreditcards.Whichcontrolismosteffectivetoenforcecompliancewithoutstiflingagility?A.BlockallSaaSdomainsatthecorporatefirewall.B.Implementacloudaccesssecuritybroker(CASB)withbudget-codevalidation.C.Issueapolicystatementreiteratingtheprohibition.D.Requirepre-approvalbytheCFOforanysoftwareexpense.Answer:BExplanation:ACASBcanenforcereal-timepolicychecks,blockunapprovedappsandvalidatecost-centrecodes,balancingcontrolwithuserflexibility.Domain3–InformationSystemsAcquisition,DevelopmentandImplementation11.Agovernmentagencyisreplacinga25-year-oldlegacypensionsystem.Therequest-for-proposal(RFP)mandatesafixed-pricecontract.Whichriskismostlikelytoincrease?A.Technologyobsolescence.B.Vendorprofitmargin.C.Requirementsvolatility.D.Softwareescrowfailure.Answer:CExplanation:Fixed-pricecontractstransfercostrisktothevendor,butscopecreeporchangingregulationscanleadtodisputesandqualitycompromises.12.InanAgileproject,theproductownerrepeatedlyde-prioritisessecurityuserstoriestomeetreleasedeadlines.WhatisthefirstactiontheISauditorshouldrecommend?A.Escalatetothescrummaster.B.Addsecuritystoriestothedefinitionofdone.C.RequestariskacceptancefromtheCISO.D.Recommendrevertingtowaterfallmethodology.Answer:BExplanation:Embeddingsecuritycriteriainthedefinitionofdonemakeseveryincrementnon-deployableuntilsecuritycontrolsaresatisfied,enforcingdisciplinewithoutscheduleslippage.13.Whichtechniqueprovidesthemostassurancethatconfigurablebusinessrulesinalow-codeplatformaretraceabletostatutoryrequirements?A.Automatedunittesting.B.RequirementstraceabilitymatrixmaintainedintheALMtool.C.Peerreviewofgeneratedcode.D.Staticapplicationsecuritytesting(SAST).Answer:BExplanation:Alivingtraceabilitymatrixlinkseachruletoaspecificlegalclause,enablingimpactanalysiswhenlawschange.14.Avendordeliversacommercial-off-the-shelf(COTS)ERPwithcustomscriptsthatbypassbuilt-insegregation-of-dutieschecks.Thevendorclaimsthescriptsarenecessaryfor“performance.”WhatisthemostpersuasivetestfortheISauditor?A.Benchmarkperformancewithandwithoutscripts.B.Reviewvendorroadmapforfutureenhancements.C.Confirmthatcompensatingdetectivecontrolsareloggedandreviewed.D.Obtainalegalopiniononintellectual-propertyimplications.Answer:AExplanation:Objectiveperformancedataeithervalidatesorrefutesthevendor’sjustification,formingthebasisforrisk-basedrecommendations.15.Duringuser-acceptancetesting(UAT)ofamobilebankingapp,5%oftestcasesfail,buttheprojectsponsorsignsoffbecause“productionincidentscanbefixedviaover-the-airupdates.”Whichprincipleismostclearlyviolated?A.Preventivecontroloptimisation.B.Shift-lefttestingphilosophy.C.Minimumviableproduct(MVP)concept.D.DevSecOpsculture.Answer:BExplanation:Shift-leftemphasisesdefectpreventionearlyinthelifecycle;acceptingknowndefectsunderminesthisprincipleandincreasestotalcostofownership.Domain4–InformationSystemsOperationsandBusinessResilience16.Adata-centreoperatoradvertises“N+2”redundancyforchillers.Duringasitetour,theISauditorobservesthattwochillersaresharedwithanadjacentbuildingoperatedbyadifferentlegalentity.Whichdocumentshouldtheauditorrequestfirst?A.Maintenancelogforchillers.B.Contractualagreementgoverningsharedcapacity.C.Utilitybillstoverifycostallocation.D.Insurancepolicycoveringequipmentfailure.Answer:BExplanation:Thecontractwillclarifywhetherthe“N+2”claimisstillvalidwhendemandfromtheneighbouringentitypeaks,revealingapotentialsinglepointoffailure.17.Acompanyimplementscross-regiondatabasereplicationwithafive-secondrecoverypointobjective(RPO).WhichtestprovidesthebestevidencethattheRPOismetduringpeaktransactionvolume?A.Reviewreplicationlagmetricsfromthecloudproviderdashboard.B.Performacontrolledfailoverduringmonth-endprocessingandverifydataloss.C.ObtainaSOC2TypeIIreportfromtheprovider.D.Interviewthedatabaseadministratorabouttuningparameters.Answer:BExplanation:Alivefailoverunderpeakloadproducesempiricalevidenceofactualdataloss,whereasdashboardsmayshowaveragelagthatdoesnotcaptureburstbehaviour.18.Aransomwareattackencrypts90%offileservers.Theincident-responseplanstatesthatthecrisismanagermustconvenea“goldteam”within30minutes,butittook55minutes.After-actionreviewshowsthatthecall-treespreadsheetwasstoredonthesamefileservers.Whichcontrolfailureismostsignificant?A.Lackofofflinecommunicationchannels.B.Inadequatebackupfrequency.C.Missingtabletopexercise.D.Insufficientnetworksegmentation.Answer:AExplanation:Theinabilitytoaccessthecalltreedelayedcommand-and-control,indicatingthatcriticalcommunicationsdependencieswerenotidentifiedandprotected.19.Acontainerorchestrationplatformrestartscrashedpodsautomatically.TheISauditornotesthatpost-crashforensicartefactsarelost.Whichrecommendationbestbalancesresilienceandevidentiaryrequirements?A.Disableauto-restarttopreserveartefacts.B.Mountanephemeraldebugsidecartocapturememorydumps.C.Increaseliveness-probeintervals.D.Replicatelogstoanimmutableobjectstore.Answer:DExplanation:Centralised,tamper-evidentloggingpreservesevidencewithoutcompromisingavailability.20.Athird-partycourierhandlesoff-sitebackuptapes.Theauditorobservesthatthecourier’sGPStrackingisdisabledfor“driverprivacy.”Whichadditionalcontrolbestcompensatesforthelackofreal-timelocationdata?A.Sealtapeswithnumberedtamper-evidentsealsandverifyarrival.B.Requirethecouriertocarrycorporateliabilityinsurance.C.EncrypttapeswithAES-256.D.Rotatecouriersquarterlytoreducecollusionrisk.Answer:AExplanation:Averifiedsealprovidesassurancethatthechainofcustodywasnotbroken,evenwhencontinuoustrackingisunavailable.Domain5–ProtectionofInformationAssets21.Acompanyenforcesfull-diskencryptiononlaptops,yetalostlaptopin“sleepmode”iscompromised.Whichtechnicalcontrolshouldbeenhanced?A.Pre-bootauthentication.B.BIOSpassword.C.Screen-locktimeout.D.Firmwarewhitelisting.Answer:AExplanation:SleepmoderetainsencryptionkeysinRAM;pre-bootauthenticationensureskeysarenotavailableuntiltheuserre-authenticates.22.AwebapplicationusesJSONWebTokens(JWT)signedwithHS256andstoresthesymmetrickeyinaGitHubpublicrepository.Themostimmediateriskis:A.denialofservice.B.elevationofprivilege.C.repudiation.D.informationdisclosure.Answer:BExplanation:Anyonewiththesymmetrickeycanforgevalidtokensandimpersonateanyuser,achievingprivilegeescalation.23.Anorganisationdeploysdata-loss-prevention(DLP)agentsonendpoints.Awhistle-blowerleakssensitivedocumentsviaprintedhardcopies.Whichcontrolgapismostrelevant?A.Lackofprint-watermarking.B.Absenceofoptical-character-recognition(OCR)scanningatexitpoints.C.Weakfirewallrules.D.Inadequateemployeebackgroundchecks.Answer:BExplanation:OCRscanningofphysicalitemsleavingthefacilitycouldhavedetectedsensitivekeywordsonprintedpages.24.Asecurity-operationscentre(SOC)runsthreat-huntingqueriesevery24hours.Anadvancedpersistentthreat(APT)usesliving-off-the-landbinariesthatexecuteonlyduringthe30-minutewindowaftereachquery.Whichadjustmentbestreducesthedetectiongap?A.Increasequeryfrequencytoevery15minutes.B.Deployendpointdetectionandresponse(EDR)withbehaviouralanalytics.C.BlockPowerShellexecutionviagrouppolicy.D.Whitelistapprovedexecutables.Answer:BExplanation:Behaviouralanalyticscontinuouslymonitorsforanomalouspatterns,narrowingtheattacker’sdwelltimeregardlessofquerywindows.25.AmultinationalfirmneedstotransferemployeebiometricdatafromtheEUtotheUSforaccess-controlpurposes.WhichmechanismprovidesthemostdefensiblecompliancepostureunderGDPR?A.Bindingcorporaterules(BCRs)approvedbysupervisoryauthorities.B.Agenericdata-processingaddendum.C.VerbalassurancefromtheUSparentthatdatawillbeencrypted.D.Pseudonymisationbyremovingemployeenames.Answer:AExplanation:BCRsconstitutealegallyenforceableinstrumentrecognisedbytheEuropeanDataProtectionBoard,offeringthehighestlevelofassuranceforrestrictedtransfers.Mixed-ScenarioIntegratedQuestions26.WhileauditingaDevOpspipeline,theISauditorfindsthatcontainerimagesarebuiltnightly,scannedforvulnerabilities,andthenpromotedtoproduction.Ahigh-severityCVEisdiscoveredinabaseimagetwohoursafterpromotion.Thepipelinedoesnotsupportrollbacks.Whichcombinedcontrolbestaddressesthedeficiency?A.Immutableinfrastructurewithblue-greendeploymentsandautomatedrollbacktriggers.B.ManualapprovalgaterequiringtheCISO’ssign-off.C.Weeklypenetration-testingofproduction.D.Extendedvulnerability-scanninglicence.Answer:AExplanation:Blue-greendeploymentsallowinstantaneousrollbacktothelastknown-goodenvironment,reducingmeantimetorecoverwhilepreservingaudittrails.27.Asmart-factoryfloordeploysIoTsensorsthatauthenticateviaX.509certificates.Thecertificateauthority(CA)isair-gapped,butcertificaterevocationlists(CRLs)areupdatedonlymonthly.Acompromisedsensorcertificateislikelyto:A.remaintrustedforupto30days.B.berejectedimmediatelybecauseoftheairgap.C.triggerafactoryshutdown.D.bereissuedwithin24hoursautomatically.Answer:AExplanation:DevicescannotreceiverevocationstatusuntilthenextCRLpublishcycle,leavingawindowofexposure.28.Afinancial-s