Free Isaca Cybersecurity Audit Certificate Actual Exam Questions

A - gotta apply all the increments, so it adds up time-wise.

A imo, because restoring incrementals means starting with the full backup, then applying each incremental in sequence, which definitely drags the process out more than the others.

Not A, because KPIs track outcomes, not early risk signals like KRIs do.

C, because KPIs show performance outcomes, not early risk signals.

B/C? The API’s biggest risk is probably identity spoofing since attackers can pretend to be legit users, but overall CIA (C) still matters because a breach usually hits all three areas.

I’m thinking B could be more critical since a poorly secured API often means attackers can impersonate users or apps easily, leading to identity spoofing. That risk feels more direct than resource contention or just availability.

Maybe C since purple teams combine defense and attack insights to improve security.

C/D? Purple team makes sense since they combine both sides, but black team sometimes handles deeper integration too. Not 100%, but yellow and red feel off here.

C. Standards are usually the mandatory rules that ensure policy compliance, not just a recommended minimum. Baselines set minimum security levels but standards make them enforceable.

Option A defines the minimum level you can’t go below, so fits better.

Probably D again, but thinking from a different angle—timely and reliable access is really about making sure the data and systems are up when users need them, which directly ties to availability. Without that, things like reporting or identity management won’t work properly. So even though options A, B, and C are important, they’re secondary because they rely on the system actually being accessible first. This makes D the clear primary benefit.

It’s D because without availability, users can’t access the system when needed, which is the foundation for any data-related benefit to happen. No availability means none of the other options even matter.

B, because you need to secure the scene before making any changes.

B evidence must be preserved early to ensure integrity before cleanup starts.

C imo, because if there’s no protocol to disclose serious breaches, some incidents might stay hidden and lead to unknown risks piling up undetected. This can keep vulnerabilities under the radar longer.

It’s A for me. Without established procedures and guidelines, the whole process of identifying risks can be inconsistent or missed altogether. Even if roles are clear (B), without a proper framework, people might not know what to look for or how to act on potential threats. So, lacking procedures sets the foundation for unidentified risks way more than just unclear responsibilities.

Makes sense to pick C here. Asymmetric encryption is pretty slow compared to symmetric, so it's usually reserved for things like securely sharing symmetric keys rather than encrypting data directly. Options A and B would involve lots of data, which isn’t practical with asymmetric. D doesn't seem right either since symmetric keys—not asymmetric keys—are what get distributed using asymmetric encryption. So C fits best.

Actually, going with C makes the most sense here. Asymmetric algorithms are too slow for encrypting large amounts of data, so they’re mostly used to securely exchange symmetric keys, which then handle the bulk encryption. Options A and B don’t fit since these tasks rely on faster symmetric ciphers. And D is off because asymmetric keys don’t need distributing the way symmetric ones do. So C stands out as the practical use in real-world applications.

C imo, sticking to schedules is key in change management because delays can cause all sorts of knock-on problems for the business. If changes don’t happen on time, it can disrupt other dependent processes and slow down progress. While minimizing disruptions (B) is important, a change done late or early can still throw things off even if it’s smooth. So ensuring change happens as planned is a fundamental goal that supports keeping the business stable overall. Communication (A) and ROI validation (D) are more like parts of the bigger picture but not the primary goal themselves.

It’s B because the main point of change management is to keep everything running without hiccups. While communication and schedules matter, stopping business disruptions is the top priority here.

Option C, encryption secures data even if the device is physically compromised.

Maybe A is better since password-based access control can stop unauthorized users from even logging in, which seems like the first line of defense if the computer’s stolen. Encryption helps but only if the data’s encrypted properly and keys aren’t stored locally.

It’s C because SSH provides end-user services like secure login and file transfer, which is the core of the Application layer. The Session layer helps but SSH’s main role is definitely higher up.

C, since SSH encrypts data and provides user services, fitting Application layer best.

Maybe B, since it’s the only one that clearly involves script injection into websites.

I’d drop A outright because it’s too vague—“malicious code” could mean anything, not necessarily scripts on a trusted site. D is definitely about databases, not injecting scripts into the website itself. C is just about flooding a site, so no script injection there. B fits best since cross-site scripting is literally about injecting malicious scripts into trusted websites to mess with users. But does this question assume the attack affects the site’s code or just the users visiting? Because that might change how we think about it.

D. Also, Diffie-Hellman and DSS both rely on larger numbers, so they naturally take more processing power. Secret key cryptography (C) isn't even public key, so it doesn't fit here. ECC is designed to give strong security with smaller keys, making it faster and less demanding on resources. So it makes sense that D is the best pick for efficient public key cryptography.

Option D stands out because it offers strong security with smaller keys, unlike Diffie-Hellman or DSS which require larger keys and more processing power. That’s why it’s more efficient overall.

This one definitely feels like C. VPN and IPsec are more about securing connections or networks, not about opening command-line shells directly. SFTP is for file transfers, so it doesn't fit the "command-line shell session" part. SSH is the standard tool used to remotely log in securely via a shell, so it matches best here.

Maybe C, since VPN and IPsec handle network layers, not direct shell access.