.png)
CISA Practice Questions
Certified Information Systems Auditor
Last Update 4 days ago
Total Questions : 1524
Dive into our fully updated and stable CISA practice test platform, featuring all the latest Isaca Certification exam questions added this week. Our preparation tool is more than just a Isaca study aid; it's a strategic advantage.
Our free Isaca Certification practice questions crafted to reflect the domains and difficulty of the actual exam. The detailed rationales explain the 'why' behind each answer, reinforcing key concepts about CISA. Use this test to pinpoint which areas you need to focus your study on.
Which of the following is an IS auditor's BEST recommendation for mitigating risk associated with inadvertent disclosure of sensitive information by employees?
After areas have been appropriately scoped, what is the IS auditor's NEXT step in the selection for sampling?
Which of the following should be the GREATEST concern for an IS auditor performing a post-implementation review for a major system upgrade?
Which of the following is the MOST important consideration of any disaster response plan?
Which of the following is the GREATEST risk associated with lack of IT involvement in the organization's strategic planning initiatives?
Who should be the FIRST to evaluate an audit report prior to issuing it to the project steering committee?
Which type of testing is used to identify security vulnerabilities in source code in the development environment?
Which of the following is MOST important to consider when defining disaster recovery strategies?
Which of the following measures BEST mitigates the risk of data exfiltration during a cyberattack?
Which of the following BEST demonstrates alignment of the IT department with the corporate mission?
An IT governance body wants to determine whether IT service delivery is based on consistently effective processes. Which of the following is the BEST approach?
Using swipe cards to limit employee access to restricted areas requires implementing which additional control?
An IS auditor is reviewing an organizations release management practices and observes inconsistent and inaccurate estimation of the size and complexity of business application development projects. Which of the following should the auditor recommend to address this issue?
The process of applying a hash function to a message and obtaining and ciphering a digest refers to:
Which of the following technology trends can lead to more robust data loss prevention (DLP) tools?
A cloud access security broker (CASB) administers the user access of a Software as a Service {SaaS) on behalf of the customer organization. When conducting an audit of the service, which of the following is MOST important for the IS auditor to confirm?
When reviewing an organization's information security policies, an IS auditor should verify that the policies have been defined PRIMARILY on the basis of:
During a new system implementation, an IS auditor has been assigned to review risk management at each milestone. The auditor finds that several risks to project benefits have not been addressed. Who should be accountable for managing these risks?
Which of the following would be a result of utilizing a top-down maturity model process?
An IS auditor will be testing accounts payable controls by performing data analytics on the entire population of transactions. Which of the following is MOST important for the auditor to confirm when sourcing the population data?
An IS auditor has been asked to perform a post-implementation review of a newly developed system. When reviewing the testing phase results, the auditor observed that separate modules of the system tested correctly in the user acceptance testing (UAT) phase, but some features did not work as expected when moved to production. Which of the following was MOST likely omitted prior to implementation?
An IS auditor finds ad hoc vulnerability scanning is in place with no clear alignment to the organization's wider security threat and vulnerability management program.
Which of the following would BEST enable the organization to work toward improvement in this area?
Which of the following protocols should be used when transferring data via the internet?
Which of the following should be the PRIMARY purpose of conducting tabletop exercises when re-viewing a security incident response plan?
Which of the following is the GREATEST risk associated with utilizing spreadsheets for financial reporting in end-user computing (EUC)?
Which of the following would be of GREATEST concern to an IS auditor reviewing the feasibility study for a new application system?
Which of the following job scheduling schemes for operating system updates is MOST likely to adequately balance protection of workstations with user requirements?
A business application's database is copied to a replication server within minutes. Which of the following processes taking place during business hours will MOST benefit from this architecture?
Which type of security testing is MOST efficient for finding hidden errors in software and facilitating source code optimization?
An IS auditor is planning a review of an organizations cybersecurity incident response maturity Which of the following methodologies would provide the MOST reliable conclusions?
When reviewing an organization's finalized risk assessment process, what would be the MAIN reason for an IS auditor to compare acceptable risk level with residual risk?
A security review focused on data loss prevention (DLP) revealed the organization has no visibility to data stored in the cloud. What is the IS auditor's BEST recommendation to address this
issue?
Which of the following is the BEST recommendation to prevent fraudulent electronic funds transfers by accounts payable employees?
Which of the following is the BEST source of information for assessing the effectiveness of IT process monitoring?
During recent post-implementation reviews, an IS auditor has noted that several deployed applications are not being used by the business. The MOST likely cause would be the lack of:
Which of the following is the PRIMARY benefit of effective implementation of appropriate data classification?
A national bank recently migrated a large number of business-critical applications to the cloud. Which of the following is MOST important to ensuring the resiliency of the applications?
An IS auditor finds that a number of key patches have not been applied in a timely manner due to re-source constraints. Which of the following is the GREATEST risk to the organization in this
situation?
Which of the following risk scenarios is BEST mitigated through the use of a data loss prevention (DLP) tool?
Which of the following should be of GREATEST concern to an IS auditor assessing the effectiveness of an organization's information security governance?
Which of the following is the MOST important reason for an organization to automate data purging?
An organization has decided to reengineer business processes to improve the performance of overall IT service delivery. Which of the following recommendations from the project team should be the GREATEST concern to the IS auditor?
During the planning phase of a data loss prevention (DLP) audit, management expresses a concern about mobile computing. Which of the following should the IS auditor identify as the
associated risk?
An organization saves confidential information in a file with password protection and the file is placed in a shared folder. An attacker has stolen this information by obtaining the password through social engineering. Implementing which of the following would BEST enable the organization to prevent this type of incident in the future?
IS management has recently disabled certain referential integrity controls in the database management system (DBMS) software to provide users increased query performance. Which of the following controls will MOST effectively compensate for the lack of referential integrity?
Which of the following would MOST likely impair the independence of the IS auditor when performing a post-implementation review of an application system?
An IS auditor discovers an option in a database that allows the administrator to directly modify any table. This option is necessary to overcome bugs in the software, but is rarely used. Changes to tables are automatically logged. The IS auditor's FIRST action should be to:
An IS auditor finds that firewalls are outdated and not supported by vendors. Which of the following should be the auditor's NEXT course of action?
