CISA Practice Exam — Free Isaca Certification Prep

Join Us Among the Stars

Sign Up & unlock 100% of Exam Questions

Log in / Sign up

No Strings Attached!

1803Practice Questions

3Study Modes

Free

TopicSort

Question 1

Protection of Information Assets

Which of the following tests would provide the BEST assurance that a health care organization is handling patient data appropriately?

A Compliance with industry standards and best practice
B Compliance with action plans resulting from recent audits
C Compliance with local laws and regulations
D Compliance with the organization's policies and procedures

Question 2

Information Systems Acquisition, Development and Implementation

Question 3

Protection of Information Assets

Question 4

Information System Auditing Process

Question 5

Information System Auditing Process

Question 6

Information Systems Acquisition, Development and Implementation

Question 7

Information Systems Operations and Business Resilience

Question 8

Protection of Information Assets

Question 9

Information System Auditing Process

Question 10

Information Systems Operations and Business Resilience

Question 11

Information Systems Operations and Business Resilience

Question 12

Protection of Information Assets

Question 13

Information Systems Acquisition, Development and Implementation

Question 14

Protection of Information Assets

Question 15

Information System Auditing Process

Question 16

Protection of Information Assets

Question 17

Information System Auditing Process

Question 18

Protection of Information Assets

Question 19

Information Systems Operations and Business Resilience

Question 20

Information System Auditing Process

Question 21

Information System Auditing Process

Question 22

Information System Auditing Process

Question 23

Information System Auditing Process

Question 24

Information Systems Operations and Business Resilience

Question 25

Information System Auditing Process

Page 1 of 73 • Questions 1-25 of 1803

1 2 3 4 5

→

Know a question that should be here? Contribute to this exam

Evaluating application development projects against a defined maturity model enables an IS auditor to determine whether:

A effective security requirements have been designed
B the development function’s processes are efficient
C the development function follows a robust process
D the development project is likely to achieve its objectives

An IS auditor reviewing the threat assessment for a data center would be MOST concerned if:

A neighboring organizations' operations have been included.
B the exercise was completed by local management.
C all identified threats relate to external entities.
D some of the identified threats are unlikely to occur.

Which of the following is the BEST audit procedure to determine whether a firewall is configured in compliance with the organization's security policy?

A Reviewing the system log
B Reviewing the actual procedures
C Reviewing the parameter settings
D Interviewing the firewall administrator

Which of the following should an IS auditor do FIRST when assessing the level of compliance for an organization in the banking industry?

A Review internal documentation to evaluate adherence to external requirements.
B Confirm there are procedures in place to ensure organizational agreements address legal requirements
C Determine whether the organization has established benchmarks against industry peers for compliance.
D Identify industry-specific requirements that apply to the organization.

Question 6

Information Systems Acquisition, Development and Implementation

Question 7

Information Systems Operations and Business Resilience

Question 8

Protection of Information Assets

Question 9

Information System Auditing Process

Question 10

Information Systems Operations and Business Resilience

Question 11

Information Systems Operations and Business Resilience

Question 12

Protection of Information Assets

Question 13

Information Systems Acquisition, Development and Implementation

Question 14

Protection of Information Assets

Question 15

Information System Auditing Process

Question 16

Protection of Information Assets

Question 17

Information System Auditing Process

Question 18

Protection of Information Assets

Question 19

Information Systems Operations and Business Resilience

Question 20

Information System Auditing Process

Question 21

Information System Auditing Process

Question 22

Information System Auditing Process

Question 23

Information System Auditing Process

Question 24

Information Systems Operations and Business Resilience

Question 25

Information System Auditing Process

Which of the following is the BEST indication to an IS auditor that management's post-implementation review was effective?

A Internal audit follow-up was completed without any findings.
B Lessons learned were documented and applied.
C Post-implementation review is a formal phase in the system development life cycle (SDLC).
D Business and IT stakeholders participated in the post-implementation review.

Which of the following is the BEST way for management to ensure the effectiveness of the cybersecurity incident response process?

A Periodic tabletop exercises involving key stakeholders
B Periodic update of incident response process documentation
C Periodic cybersecurity training for staff involved in incident response
D Periodic reporting of cybersecurity incidents to key stakeholders

The use of which of the following is an inherent risk in the application container infrastructure?

A Shared data
B Shared registries
C Shared kernel
D Host operating system

What should an IS auditor review FIRST to verify that an organization’s IT strategy is effectively implemented?

A Information security procedures
B The IT governance framework
C Process maturity of IT general controls
D The most recent audit results

Which of the following BEST supports an organization’s efforts to reduce the impact of ransomware attacks?

A Ensuring a payment method is available
B Conducting periodic internal and external penetration testing
C Conducting security awareness training for staff
D Developing robust backup and recovery procedures

Which of the following network topologies will provide the GREATEST fault tolerance?

A Star configuration
B Bus configuration
C Ring configuration
D Mesh configuration

Which of the following is the BEST approach to help ensure evidence from a computer forensics investigation is legally admissible?

A The incident response team reviews and analyzes the evidence, and the evidence file is then securely deleted to avoid further damage.
B The relevant data is extracted from system, firewall, and intrusion detection system (IDS) logs, then consolidated as evidence.
C The media involved is preserved using imaging, and further analysis is performed on the image instead of the original.
D The computer suspected of storing the evidence is isolated, and the incident response team is contacted for investigation.

A white box testing method is applicable with which of the following testing processes?

A Sociability testing
B Integration testing
C Parallel testing
D User acceptance testing (UAT)

Which of the following is a deterrent security control that reduces the likelihood of an insider threat event?

A Removing malicious code
B Distributing disciplinary policies
C Creating contingency plans
D Executing data recovery procedures

Which of the following auditing techniques would be used to detect the validity of a credit card transaction based on time, location, and date of purchase?

A Integrated test facility (ITF)
B Data analytics
C Hash totals
D Check sums

An organization recently migrated its data warehouse from a legacy system to a different architecture in the cloud. Which of the following should be GREATEST concern to the IS auditor reviewing the new data architecture?

A The cloud data warehouse uses a hybrid cloud architecture.
B There is increased latency in the data source synchronization to the cloud data warehouse.
C The migration analyst is not fully trained on the new tools.
D The data was not cleansed before moving from the source to the cloud data warehouse.

The FIRST step in auditing a data communication system is to determine:

A physical security for network equipment.
B business use and types of messages to be transmitted.
C traffic volumes and response-time criteria.
D the level of redundancy in the various communication paths.

An organization has an acceptable use policy in place, but users do not formally acknowledge the policy. Which of the following is the MOST significant risk from this finding?

A Violation of industry standards
B Lack of data for measuring compliance
C Noncompliance with documentation requirements
D Lack of user accountability

An IS auditor reviewing a job scheduling tool notices performance and reliability problems. Which of the following is MOST likely affecting the tool?

A Administrator passwords do not meet organizational security and complexity requirements.
B The number of support staff responsible for job scheduling has been reduced
C Maintenance patches and the latest enhancement upgrades are missing
D The scheduling tool was not classified as business-critical by the IT department.

Which of the following is the MOST important element of quality control with respect to an audit engagement?

A Increase of audit quality through multiple follow-up audits
B Responsibility of leadership for quality in audits
C Assignment of engagement teams for audits
D Resolution procedures for differences of opinion in audits

An IS audit reveals an organization has decided not to implement a new regulation by the required deadline because the cost of rapid implementation is higher than the penalty for noncompliance. Which of the following is the auditor’s BEST course of action?

A Ensure a gap analysis is conducted
B Ensure regulatory reporting is completed
C Ensure the risk register is updated
D Ensure risk acceptance is documented

Which of the following is the BEST way for an IS auditor to determine the completeness of data migration?

A Review migration logs to identify possible failures.
B Review the implemented data cleanup process.
C Reconcile migrated records with records in the source system.
D Examine formal departmental review of the data migration.

Which of the following is the BEST way to faster continuous improvement of IS audit processes and practices?

A Frequently review IS audit policies, procedures, and instruction manuals.
B Establish and embed quality assurance (QA) within the IS audit function.
C Invite external auditors and regulators to perform regular assessment of the IS audit function.
D Implement rigorous managerial review and sign-off of IS audit deliverables.

An organization outsourced its IS functions. To meet its responsibility for disaster recovery, the organization should:

A coordinate disaster recovery administration with the outsourcing vendor
B delegate evaluation of disaster recovery to a third party
C delegate evaluation of disaster recovery to internal audit
D discontinue maintenance of the disaster recovery plan (DRP)

To develop meaningful recommendations for findings, which of the following is MOST important for an IS auditor to determine and understand?

A Criteria
B Responsible party
C Impact
D Root cause

Join Us Among the Stars

CISAPreview

About the CISA Exam

Mode Selection

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25