CISA Practice Questions 1 — 50 Questions

Question 1

A company is migrating from a legacy system to a cloud-based ERP. Which of the following is the MOST important control to ensure data integrity during data conversion?

Accepted Answer

Reconciliation of control totals. Reconciliation of control totals is the most important control because it directly verifies that the sum of key fields (e.g., total account balances, record counts) in the source system matches the target cloud-based ERP after conversion. This ensures no data is lost, duplicated, or corrupted during the extraction, transformation, and loading (ETL) process, which is critical for maintaining data integrity in a migration from a legacy system.

Answer

Automated backup

Answer

User acceptance testing

Answer

Parallel running

Question 2

An organization uses a chargeback model to allocate IT costs to business units. What is a PRIMARY benefit of this approach?

Accepted Answer

Encourages responsible consumption of IT resources. Chargeback increases transparency and encourages business units to use IT resources efficiently.

Answer

Reduces total IT costs

Answer

Eliminates the need for an IT steering committee

Answer

Simplifies IT budgeting process

Question 3

Which TWO of the following are types of audit evidence recognized in IS audit practice?

Accepted Answer

Observation. In IS audit practice, evidence is classified by how it is obtained and its reliability, and two recognized types here are Observation (B) and Re-performance (D). Observation (B) is valid because auditors directly witness processes, controls, or personnel performing activities, yielding first-hand evidence about how a control actually operates. Re-performance (D) is valid because the auditor independently executes the control or procedure (for example, recalculating a depreciation schedule or re-running an access review) and compares the result to the client's output, producing highly reliable evidence. The remaining options do not belong: Assumption (A), Conjecture (C), and Hypothesis (E) are speculative or unverified propositions, not evidence types, since audit evidence must be based on actual observation, inspection, inquiry, confirmation, recalculation, or re-performance rather than supposition.

Answer

Assumption

Answer

Conjecture

Answer

Hypothesis

Question 4

Refer to the exhibit. An IS auditor is reviewing backup error logs. The error indicates a failed backup due to a missing file. What is the MOST likely cause?

Accepted Answer

A file in the source volume was moved or deleted during the backup window. The error indicates a failed backup due to a missing file. The most likely cause is that a file in the source volume was moved or deleted during the backup window. Backup processes that use file-level snapshots or open-file managers (e.g., Volume Shadow Copy Service on Windows) capture a point-in-time view; if a file is moved or deleted after the snapshot is taken but before it is read by the backup agent, the backup will fail with a 'missing file' error. This is a classic race condition in file-level backups without proper snapshot consistency.

Answer

The backup job was scheduled during peak hours causing timeout

Answer

The destination path '\BackupServer01\Backup\Shares' is invalid

Answer

Insufficient disk space on the backup destination

Question 5

After issuing the final audit report, the IS auditor should perform follow-up procedures. What is the PRIMARY purpose of follow-up?

Accepted Answer

To verify that corrective actions have been implemented effectively. Follow-up ensures that management has taken corrective actions to address the findings and that the risks have been mitigated.

Answer

To update the permanent audit file

Answer

To close the audit engagement

Answer

To identify new risks for the next audit

Question 6

An organization uses a cloud-based ERP system to manage financial transactions. The system is accessed by employees in finance, procurement, and sales departments. The IS auditor is reviewing the user access review process. The access review is performed quarterly by the IT manager using a report generated by the ERP system. The report lists all users and their roles. The IT manager manually checks off users who are still employed and approves the report. The auditor notes that the IT manager does not have detailed knowledge of job functions in each department. Additionally, the ERP system allows role combinations that may create segregation of duties conflicts, such as a user having both 'create purchase order' and 'approve purchase order' roles. The company's policy requires segregation of duties reviews to be performed by business process owners. Which of the following is the BEST recommendation?

Accepted Answer

Assign the access review to business process owners from each department. The core issue is that the IT manager lacks the business process knowledge to assess whether role combinations create segregation of duties (SoD) conflicts. Company policy explicitly requires SoD reviews to be performed by business process owners. Assigning the access review to business process owners from each department (Option C) directly aligns with policy and ensures that those with functional knowledge evaluate whether role assignments violate SoD rules, such as a user having both 'create purchase order' and 'approve purchase order' roles.

Answer

Increase the frequency of access reviews to monthly

Answer

Implement an automated tool to identify segregation of duties conflicts

Answer

Require the IT manager to obtain confirmation from each department head

Question 7

An organization has implemented a business continuity plan (BCP) and disaster recovery plan (DRP). During a recent full interruption test, the IT team discovered that the recovery time objective (RTO) for a critical application was not met. What is the MOST likely reason for this failure?

Accepted Answer

The alternate site did not have adequate processing capacity to handle the workload.. The most likely reason the RTO was not met is that the alternate site lacked sufficient processing capacity to handle the workload. RTO measures the time to restore service availability; if the failover site cannot support the required compute, memory, or I/O throughput, restoration will be delayed or fail outright. This is a common capacity planning failure in DR testing, where the alternate site is sized for minimal operations but not for the full production load.

Answer

The recovery point objective (RPO) was set too low, causing data loss.

Answer

The backup data was not encrypted, leading to corruption during restoration.

Answer

The tabletop exercise was not conducted before the full interruption test.

Question 8

An IS auditor is reviewing an organization's data classification policy. Which of the following findings is MOST critical?

Accepted Answer

Data owners have not been identified for most data assets. Without identified data owners, no one is accountable for classifying, protecting, or granting access to data assets. This foundational gap undermines the entire data classification policy, making it impossible to enforce controls like encryption or access reviews. The CISA emphasizes that data owner assignment is the first step in any data governance framework.

Answer

Employees receive data classification training only once per year

Answer

Data classification is performed manually without automated tools

Answer

Sensitive data is not encrypted at rest

Question 9

During a change management process review, an IS auditor finds that the change advisory board (CAB) approved a change that subsequently caused a major service outage. The change was classified as 'normal' with no emergency. What is the auditor's primary concern?

Accepted Answer

The CAB did not adequately assess the potential impact of the change.. The primary concern is that the CAB approved a 'normal' change without adequately assessing its potential impact, leading to a major service outage. In ITIL-based change management, the CAB is responsible for evaluating the risk, impact, and resource requirements of a change before approval. A failure in this assessment indicates a breakdown in the change management process, which is the core issue an IS auditor must address.

Answer

The service desk was not notified of the change.

Answer

The change should have been classified as emergency.

Answer

The change was not tested in a pre-production environment.

Question 10

An organization's IT department implemented a new change management process that requires all changes to be approved by a change advisory board (CAB). A critical security patch needs to be deployed within 2 hours to address an active zero-day vulnerability. The change request was submitted but the CAB is not scheduled to meet for another 24 hours. What is the BEST course of action?

Accepted Answer

Use the emergency change process to obtain expedited approval from a designated CAB member.. It aligns with the ITIL-based emergency change process, which allows for expedited approval from a designated CAB member or emergency authority when a critical security patch must be deployed within hours to mitigate an active zero-day vulnerability. This ensures the change is authorized without waiting for the full CAB meeting, maintaining security while preserving governance and audit trails.

Answer

Deploy the patch and inform the CAB after the fact during the next meeting.

Answer

Wait for the next scheduled CAB meeting to approve the change.

Answer

Deploy the patch immediately without any approval as it is a critical security fix.

Question 11

Order the steps for conducting an audit engagement from start to finish.

Accepted Answer

Step 1: Planning (scope, program), Step 2: Fieldwork, Step 3: Analysis, Step 4: Reporting with management review. Audit engagement follows: planning (scope, program), fieldwork, analysis, and reporting with management review.

Answer

Step 1: Planning, Step 2: Analysis, Step 3: Fieldwork, Step 4: Reporting

Answer

Step 1: Fieldwork, Step 2: Planning, Step 3: Analysis, Step 4: Reporting

Answer

Step 1: Planning, Step 2: Fieldwork, Step 3: Reporting, Step 4: Analysis

Question 12

Which THREE of the following are key considerations when selecting a software development methodology for a project?

Accepted Answer

Regulatory compliance requirements. Regulatory compliance requirements (Option B) are a key consideration because the chosen methodology must support necessary audit trails, documentation, and control frameworks (e.g., SOX, HIPAA, PCI DSS). A methodology like Waterfall provides rigid phase-gate documentation, while Agile may require adaptation (e.g., SAFe) to satisfy compliance evidence demands. Failure to align methodology with regulatory needs can lead to non-compliance findings during a CISA audit.

Answer

Availability of project management software

Answer

Programming language preferences

Question 13

Which of the following is a primary advantage of fixed-price contracts in systems acquisition?

Accepted Answer

Predictable cost for the buyer. The defining characteristic of a fixed-price contract is that the buyer pays a set amount regardless of the vendor's actual costs, giving the buyer cost predictability and transferring cost-overrun risk to the vendor. This predictability is the primary advantage for the acquiring organization's budgeting and financial planning.

Answer

Vendor has incentive to complete quickly

Answer

Greater flexibility to change requirements

Answer

Lower total cost compared to time-and-materials

Question 14

Which of the following is the MOST effective control to prevent unauthorized USB devices from connecting to corporate workstations?

Accepted Answer

Device control software that blocks non-approved USB devices.. Device control software (e.g., endpoint DLP or USB whitelisting tools) operates at the OS kernel or driver level to enforce a hardware ID or vendor ID allowlist, blocking any USB device not explicitly approved. This is the only option that provides a preventive, automated, and continuous control against unauthorized USB connections, regardless of user behavior or physical access.

Answer

User awareness training.

Answer

Physical security guards.

Answer

Encrypting all USB devices.

Question 15

Order the steps for performing a data backup in the correct sequence.

Accepted Answer

Identify data to be backed up, then choose backup method, then schedule the backup, then execute backup and verify integrity, then store backup offsite.. Backup process: identify data, choose method, schedule, execute/verify, and store offsite.

Answer

Identify data to be backed up, then schedule the backup, then choose backup method, then execute backup and verify integrity, then store backup offsite.

Answer

Choose backup method, then identify data to be backed up, then schedule the backup, then execute backup and verify integrity, then store backup offsite.

Answer

Identify data to be backed up, then choose backup method, then execute backup and verify integrity, then schedule the backup, then store backup offsite.

Question 16

An IS auditor is conducting a follow-up review of prior audit findings. Management has implemented a new automated control but has not yet updated the risk register to reflect the residual risk. Which of the following should the auditor do FIRST?

Accepted Answer

Verify that the new control is operating effectively through testing before concluding on residual risk.. The auditor's core duty during follow-up is to independently verify that management's remediation actually works. Testing the new control provides the evidence needed to determine whether residual risk is acceptable. Only after that verification is it appropriate to consider reporting or recommending documentation updates. Verification must precede conclusions about risk reduction.

Answer

Recommend that management update the risk register before any further audit work is performed.

Answer

Accept management's representation that the control is effective and close the finding.

Answer

Report to the audit committee that management has failed to maintain the risk register.

Question 17

An IS auditor is reviewing the backup strategy for a financial institution. The backup administrator states that full backups are taken every Sunday, and incremental backups are taken Monday through Saturday. On Thursday morning, a database server fails, and the administrator needs to restore the server to its state as of Wednesday night. Which backup sets must the administrator use to perform this restoration?

Accepted Answer

The most recent full backup and all incremental backups taken since that full backup.. In a full-plus-incremental backup strategy, a full backup captures all data, while each incremental backup captures only changes since the last backup of any type. To restore to a specific point, the administrator must restore the most recent full backup and then apply each subsequent incremental backup in the correct order. This ensures all changes are recovered. The other options incorrectly describe the restore process or assume a different backup scheme.

Answer

The most recent full backup, the differential backup, and the latest incremental backup.

Answer

The most recent full backup and the single most recent incremental backup.

Answer

Only the most recent full backup, as it contains all data up to the point of the backup.

Question 18

Which of the following is the BEST indicator of IT performance from the customer perspective in an IT balanced scorecard?

Accepted Answer

Help desk resolution time. The customer perspective in an IT balanced scorecard focuses on how users perceive IT services. Help desk resolution time directly measures service quality from the customer's viewpoint.

Answer

Number of security incidents

Answer

System availability percentage

Answer

IT budget as a percentage of revenue

Question 19

An organization uses a public key infrastructure (PKI) to issue digital certificates. The IS auditor is reviewing the certificate lifecycle management. Which of the following is the GREATEST risk if certificate revocation lists (CRLs) are not updated in a timely manner?

Accepted Answer

Compromised certificates could still be used to establish trust. If CRLs are not updated in a timely manner, a certificate that has been revoked due to compromise or misuse will still appear valid to relying parties, allowing it to be used to establish trust. This defeats the purpose of revocation and can enable man-in-the-middle or impersonation attacks. Timely CRL publication is essential for the integrity of the PKI trust model.

Answer

Certificate authorities may lose their root key

Answer

Certificates may expire without renewal

Answer

Users may not be able to verify certificate signatures

Question 20

An IS auditor is reviewing the backup strategy for a financial institution's core transaction processing system. The system processes high volumes of transactions continuously and requires a recovery point objective (RPO) of 5 minutes. The current strategy includes nightly full backups and hourly incremental backups. Which of the following should the auditor recommend as the MOST appropriate improvement?

Accepted Answer

Implement continuous data protection (CDP) with journaling to capture every transaction.. The core transaction system requires an RPO of 5 minutes, meaning no more than 5 minutes of data can be lost. Nightly full and hourly incremental backups leave up to 60 minutes of data at risk. Continuous data protection captures every change, enabling recovery to within seconds or minutes, thus meeting the RPO. Increasing incremental frequency to 15 minutes still exceeds the RPO, and other options are even less frequent. CDP is the only viable solution among the choices.

Answer

Perform full backups twice daily instead of nightly.

Answer

Increase the frequency of incremental backups to every 15 minutes.

Answer

Implement snapshot-based backups every 30 minutes.