CISA Practice Exam 52 — 20 Questions

Question 1

Which of the following is the PRIMARY reason for an external IS audit to be more independent than an internal audit?

Accepted Answer

External auditors are not employees of the organization. External auditors are not employees, reducing organizational pressures and biases.

Answer

External auditors follow stricter standards

Answer

External auditors have more industry knowledge

Answer

External auditors have more resources

Question 2

An IS auditor is planning an audit of an organization's IT infrastructure. Which of the following is the PRIMARY benefit of using a risk-based approach?

Accepted Answer

It focuses audit efforts on areas with the highest risk.. A risk-based approach allows the auditor to focus on areas with higher risk, thereby optimizing the use of audit resources and ensuring that significant risks are addressed.

Answer

It ensures that all controls are tested equally.

Answer

It reduces the overall cost of the audit.

Answer

It guarantees the detection of material misstatements.

Question 3

Which of the following is the PRIMARY purpose of audit working papers?

Accepted Answer

To provide a basis for the audit report. Working papers document audit procedures, evidence, and conclusions to support the audit opinion.

Answer

To facilitate peer review of the audit

Answer

To serve as a legal record of the audit

Answer

To store historical data for future audits

Question 4

Which document is typically included in the permanent file of audit documentation?

Accepted Answer

Organizational chart. The permanent file contains information that is relevant for multiple audits, such as organizational charts and key contracts.

Answer

Management representation letter

Answer

Current year audit program

Answer

Working papers for testing

Question 5

In a risk-based audit approach, which of the following BEST describes how an IS auditor should prioritize audit coverage?

Accepted Answer

Allocate more audit resources to areas with higher risk and lower control effectiveness. A risk-based approach focuses on areas with higher inherent risk and weaker controls to maximize effectiveness.

Answer

Focus on areas where management has requested review

Answer

Concentrate solely on areas with the highest inherent risk

Answer

Focus equally on all areas of the audited entity

Question 6

An IS auditor is performing a walkthrough of a purchase-to-pay process. The auditor selects a sample of purchase orders and traces them through the system to verify that controls are properly designed and implemented. This is an example of:

Accepted Answer

Walkthrough. A walkthrough involves tracing a transaction through the entire process to confirm understanding and assess control design. It combines inquiry, observation, and inspection.

Answer

Analytical procedure

Answer

Test of controls

Answer

Substantive testing

Question 7

Which human resource control is PRIMARILY intended to detect fraud in IT operations?

Accepted Answer

Mandatory vacation. Mandatory vacation forces employees to take time off, during which irregularities may be discovered.

Answer

Separation of duties

Answer

Job rotation

Answer

Background checks

Question 8

During the planning phase of an IS audit, which of the following is the PRIMARY purpose of conducting a risk assessment?

Accepted Answer

To identify high-risk areas for audit focus. A risk assessment identifies high-risk areas to prioritize audit efforts and allocate resources effectively.

Answer

To determine the audit budget

Answer

To obtain management approval

Answer

To select the audit team members

Question 9

During an audit, the auditor identifies a control deficiency that could result in a material misstatement. According to ISACA guidelines, this is classified as:

Accepted Answer

Material weakness. A material weakness is a deficiency that could result in a material misstatement.

Answer

Finding

Answer

Deficiency

Answer

Observation

Question 10

An IS auditor finds that a control deficiency could lead to a material misstatement if combined with another deficiency. How should this be classified?

Accepted Answer

Material weakness. A material weakness is a deficiency, or combination, that results in a reasonable possibility of material misstatement.

Answer

Deficiency

Answer

Observation

Answer

Significant deficiency

Question 11

Which THREE of the following are required components of a SMART recommendation? (Select three.)

Accepted Answer

Specific. SMART stands for Specific, Measurable, Achievable, Relevant, Time-bound.

Answer

Auditable

Answer

Cost-effective

Question 12

Which of the following is the BEST example of an analytical procedure used during an IS audit?

Accepted Answer

Comparing current period IT expenses to prior periods and investigating significant variances.. Analytical procedures involve evaluating financial information by studying plausible relationships among data. Comparing current period expenses to prior periods is a typical example.

Answer

Observing the data center's physical security controls.

Answer

Reviewing a sample of change requests for proper authorization.

Answer

Interviewing the IT manager about change management procedures.

Question 13

Which of the following audit types is performed by an independent third-party auditor and is typically required for regulatory compliance?

Accepted Answer

External audit. External audits are conducted by third-party auditors to provide independent assurance, often required by regulations or standards.

Answer

Operational audit

Answer

IS audit

Answer

Internal audit

Question 14

An IS auditor is performing a compliance audit of data privacy regulations. The auditor finds that the organization's privacy policy is not fully aligned with regulatory requirements. Which of the following is the auditor's BEST course of action?

Accepted Answer

Report the finding as a non-compliance issue and recommend updates to the policy.. The auditor should report the non-compliance finding and recommend corrective actions, as the primary goal of a compliance audit is to identify gaps.

Answer

Ignore the issue because the policy is only a minor deviation.

Answer

Draft a new privacy policy for the organization.

Answer

Conclude that the organization is compliant because the policy exists.

Question 15

An IS auditor is evaluating the effectiveness of controls over a critical financial application. Which TWO of the following are appropriate audit procedures to test the design and implementation of controls? (Select TWO.)

Accepted Answer

Performing a walkthrough of the control process.. Walkthroughs and inspection of documentation are common procedures to evaluate design and implementation.

Answer

Performing a penetration test on the application.

Answer

Sending a confirmation letter to the vendor.

Answer

Calculating the return on investment for the application.

Question 16

Which IT sourcing model involves using an external provider to manage some IT functions while retaining others in-house?

Accepted Answer

Co-sourcing. Co-sourcing is a hybrid model where certain IT functions are outsourced and others are kept in-house.

Answer

Cloud services

Answer

Insourcing

Answer

Outsourcing

Question 17

An IT steering committee is reviewing a proposed project to migrate critical applications to the cloud. Which of the following is the PRIMARY role of the IT steering committee in this decision?

Accepted Answer

To ensure the project aligns with business strategy. The IT steering committee ensures that IT investments align with business strategy. They are responsible for strategic alignment and approving major projects based on business value.

Answer

To perform the technical feasibility study

Answer

To select the cloud service provider

Answer

To manage the project budget and schedule

Question 18

Which TWO of the following are components of the IT balanced scorecard?

Accepted Answer

Financial perspective. The IT balanced scorecard typically includes financial, customer, internal process, and learning and growth perspectives.

Answer

Technology perspective

Answer

Compliance perspective

Answer

Security perspective

Question 19

According to ISO/IEC 38500, a board member insists on approving all IT acquisitions above a certain threshold. Which principle of corporate governance of IT does this support?

Accepted Answer

Acquisition. ISO/IEC 38500's acquisition principle requires that IT acquisitions are made for valid reasons, based on appropriate analysis, and with clear accountability.

Answer

Responsibility

Answer

Human Behavior

Answer

Strategy

Question 20

An IT auditor is reviewing the alignment of IT with business strategy. Which THREE of the following are indicators of effective IT strategy alignment? (Select THREE.)

Accepted Answer

IT steering committee includes business leaders. Strategic alignment is demonstrated when IT initiatives support business objectives, governance mechanisms are in place, and IT performance is measured.

Answer

IT budget is determined solely by IT department

Answer

IT department has its own independent strategy