CISA Multiple Select — 60 Questions

Question 1

Which TWO of the following are types of audit evidence recognized in IS audit practice?

Accepted Answer

Observation. In IS audit practice, evidence is classified by how it is obtained and its reliability, and two recognized types here are Observation (B) and Re-performance (D). Observation (B) is valid because auditors directly witness processes, controls, or personnel performing activities, yielding first-hand evidence about how a control actually operates. Re-performance (D) is valid because the auditor independently executes the control or procedure (for example, recalculating a depreciation schedule or re-running an access review) and compares the result to the client's output, producing highly reliable evidence. The remaining options do not belong: Assumption (A), Conjecture (C), and Hypothesis (E) are speculative or unverified propositions, not evidence types, since audit evidence must be based on actual observation, inspection, inquiry, confirmation, recalculation, or re-performance rather than supposition.

Answer

Assumption

Answer

Conjecture

Answer

Hypothesis

Question 2

Which THREE of the following are key considerations when selecting a software development methodology for a project?

Accepted Answer

Regulatory compliance requirements. Regulatory compliance requirements (Option B) are a key consideration because the chosen methodology must support necessary audit trails, documentation, and control frameworks (e.g., SOX, HIPAA, PCI DSS). A methodology like Waterfall provides rigid phase-gate documentation, while Agile may require adaptation (e.g., SAFe) to satisfy compliance evidence demands. Failure to align methodology with regulatory needs can lead to non-compliance findings during a CISA audit.

Answer

Availability of project management software

Answer

Programming language preferences

Question 3

An IS auditor is evaluating how an organization enforces segregation of duties (SoD) within its enterprise resource planning (ERP) system. Management states that SoD conflicts are identified during user provisioning. Which TWO of the following audit procedures would BEST determine whether SoD controls operate effectively on an ongoing basis? (Choose two.)

Accepted Answer

Examine a sample of users provisioned in the last quarter to confirm that conflicting access was not granted.. Effective SoD assurance requires both design and operating evidence. Reviewing the conflict ruleset confirms that the detection logic covers the right combinations of duties, while testing recently provisioned users confirms the control actually prevented conflicts in practice. Together they address whether the control is correctly defined and whether it operates as intended. Password policy, backups, and interviews do not provide direct evidence about conflicting access assignments in the ERP system.

Answer

Verify that the ERP system's database backups complete successfully each night.

Answer

Confirm that the ERP system's password policy enforces complexity and expiration requirements.

Answer

Interview the ERP administrator to confirm that SoD conflicts are taken seriously.

Question 4

Which THREE of the following are characteristics of a SMART recommendation? (Select three.)

Accepted Answer

Measurable. A SMART recommendation must be Measurable (A), meaning it includes quantifiable criteria or metrics (e.g., a percentage, count, or threshold) so progress and success can be objectively verified. It must also be Time-bound (C), specifying a deadline or timeframe (e.g., "within 90 days") so the recommendation has a defined completion point. Finally, it must be Specific (D), clearly stating the exact action, system, or process to be changed rather than a vague aspiration. The unmarked options do not belong: General (B) contradicts the specificity requirement of SMART, and Subjective (E) is wrong because SMART criteria rely on objective, verifiable evidence rather than personal opinion.

Answer

General

Answer

Subjective

Question 5

During a firewall rule review, an IS auditor identifies several rules that allow any-to-any traffic. Which THREE of the following should the auditor recommend as the MOST appropriate actions?

Accepted Answer

Obtain business justification for each any-to-any rule. Option A is correct because an IS auditor must first obtain business justification for each any-to-any rule, since a rule may be required for a legitimate business or technical purpose and cannot be judged in isolation. Option B is correct because the fundamental remediation for overly permissive rules is to replace any-to-any rules with specific source, destination, port, and protocol rules that enforce least privilege and reduce the attack surface. Option E is correct because any any-to-any rule that lacks a valid business justification should be removed, as it represents unnecessary exposure with no documented need. Option C is not appropriate because immediately deleting all any-to-any rules without review could disrupt legitimate business traffic and cause outages, violating change management and availability requirements. Option D is not the most appropriate action because increasing logging only detects misuse after the fact; it does not remediate the excessive permissiveness that the auditor should recommend eliminating.

Answer

Immediately delete all any-to-any rules without review

Answer

Increase logging for any-to-any rules to detect misuse

Question 6

Which THREE of the following are essential components of a change management process?

Accepted Answer

Impact analysis. Impact analysis (B) is essential because it identifies the potential effects, risks, and dependencies of a proposed change on systems, services, and users before implementation, allowing informed decision-making. A rollback plan (C) is essential because it defines the documented procedure and criteria for reverting a change if it fails or causes unintended consequences, minimizing downtime and restoring the prior known-good state. Change request approval (E) is essential because it provides formal authorization from the Change Advisory Board (CAB) or designated authority, ensuring changes are reviewed, prioritized, scheduled, and aligned with business and IT governance. Options A and D do not belong: immediate implementation without review (A) bypasses the required assessment and authorization steps, and bypassing testing for urgent changes (D) skips validation that the change works as intended and does not introduce regressions, both of which violate core change management controls even under emergency change procedures.

Answer

Immediate implementation without review

Answer

Bypassing testing for urgent changes

Question 7

Which TWO of the following are key objectives of a post-implementation review of a new system?

Accepted Answer

Identify lessons learned for future projects. Option C is correct because a post-implementation review (PIR) is fundamentally a lessons-learned exercise: it captures what went well and what did not during the project so that future projects can avoid repeating mistakes and replicate successes. Option E is correct because the PIR's primary purpose is to confirm that the delivered system actually satisfies the business and user requirements defined in the original scope, often through user feedback and acceptance criteria verification. Options A, B, and D, while potentially useful activities, are not key objectives of a PIR: updating the disaster recovery plan is a separate operational/BCP task, budget variance assessment is typically part of project closure or earned value management, and vendor performance evaluation is usually handled through contract management or procurement reviews.

Answer

Update the disaster recovery plan

Answer

Assess the project budget variance

Answer

Evaluate vendor performance

Question 8

Which TWO of the following are benefits of using a version control system in software development?

Accepted Answer

Rollback to previous versions. Version control systems (e.g., Git, SVN) allow developers to revert code to a previous commit or tag, enabling recovery from bugs or regressions. This rollback capability is a core feature that preserves the history of the codebase and supports safe experimentation.

Answer

Generate test cases

Answer

Eliminate all bugs

Answer

Automate deployment

Question 9

Which TWO of the following are BEST indicators that a system development project is at risk of failure?

Accepted Answer

Frequent scope changes. Frequent scope changes (A) are a classic early warning sign of project failure because uncontrolled scope creep invalidates baselines, disrupts design and testing, and causes cost and schedule overruns. An unrealistic schedule (D) is also a strong risk indicator, since compressing effort below what the work actually requires forces shortcuts in analysis, coding, and testing, leading to defects and missed milestones. In contrast, clear communication (B), robust testing (C), and high team morale (E) are all positive project health indicators that reduce risk rather than signal failure.

Answer

Clear communication

Answer

Robust testing

Answer

High team morale

Question 10

An organization is evaluating its business continuity plan (BCP) to ensure alignment with the IT disaster recovery plan. Which TWO of the following are critical elements that should be included in the BCP to support effective business resilience?

Accepted Answer

Procedures for manual operations during system unavailability.. Option B is correct because a BCP must define manual workaround procedures (e.g., paper-based processing, offline approvals) so that essential business functions can continue while IT systems are unavailable, directly supporting business resilience during a disaster. Option D is correct because the BCP must include up-to-date contact information for key stakeholders, business unit owners, and emergency response teams so that activation, escalation, and coordination can occur quickly when an incident strikes. Option A is not the best fit because application recovery priorities belong primarily to the IT disaster recovery plan, which the BCP aligns with rather than duplicates. Option C is not a critical BCP element; a hardware and software license inventory is an asset management concern and does not by itself ensure continuity of business operations. Option E is also not appropriate because detailed network restoration procedures are technical DR runbooks, not business continuity content.

Answer

A list of all critical IT applications with their recovery priorities.

Answer

A complete inventory of hardware and software licenses.

Answer

Detailed step-by-step procedures for restoring network connectivity.

Question 11

Which TWO of the following are examples of analytical procedures used as audit evidence? (Select two.)

Accepted Answer

Ratio analysis. Ratio analysis (A) is a classic analytical procedure because it evaluates financial information by comparing relationships among accounts (e.g., current ratio, gross margin percentage) to identify unusual fluctuations or inconsistencies that may indicate misstatement. Trend analysis (D) is likewise analytical, as it compares financial data across periods (e.g., year-over-year revenue growth) to spot significant variances requiring further audit attention. Both fall under the analytical procedures defined in auditing standards (e.g., AU-C 520), which involve evaluations of financial information through analysis of plausible relationships among financial and nonfinancial data. By contrast, inquiry of management (B) is a form of audit evidence obtained through questioning, not analysis; inspection of documents (C) is a substantive test of details involving examination of records; and observation of process (E) is a procedure of watching a process or procedure being performed, none of which constitute analytical procedures.

Answer

Inquiry of management

Answer

Inspection of documents

Answer

Observation of process

Question 12

An IS auditor is assessing the security of an organization's virtualized environment. The organization uses a type 1 hypervisor and has multiple virtual machines (VMs) running on a single physical host. The auditor is concerned about the risk of VM escape, where an attacker compromises the hypervisor from within a VM. Which of the following controls are MOST effective in mitigating this risk? (Choose two.)

Accepted Answer

Ensuring the hypervisor is kept up to date with the latest security patches.. The most effective controls to mitigate VM escape are patching the hypervisor and hardening VM configurations by disabling unnecessary virtual hardware and shared folders. Patching addresses known vulnerabilities that could be exploited for escape, while reducing the attack surface limits the vectors an attacker can use. Together, these preventive measures significantly reduce the risk of a VM compromising the hypervisor.

Answer

Using a host-based intrusion detection system (HIDS) on each VM.

Answer

Regularly backing up VM images to a separate storage system.

Answer

Enabling promiscuous mode on the virtual switch to monitor all traffic.

Question 13

Which THREE of the following are key metrics to include in a disaster recovery test report? (Select exactly 3.)

Accepted Answer

Amount of data lost (actual vs. RPO). Option A is correct because a DR test report must quantify actual data loss against the Recovery Point Objective (RPO), showing whether the achieved recovery point met the agreed tolerable data-loss threshold. Option C is correct because measuring the time taken to recover each critical system validates performance against the Recovery Time Objective (RTO) and identifies systems that exceeded acceptable downtime. Option E is correct because the percentage of successful restores demonstrates the reliability and integrity of backups and recovery procedures, exposing failed or partial restores that need remediation. Option B is not a standard DR test metric; cost per incident belongs to financial or business-impact analysis rather than recovery validation. Option D is also not a key DR metric, since headcount alone does not measure recovery effectiveness, speed, or data integrity.

Answer

Cost per incident

Answer

Number of personnel involved

Question 14

Which TWO of the following are key components of an IT governance framework? (Choose two.)

Accepted Answer

IT strategy. Option D (IT strategy) is correct because an IT governance framework must define how IT is aligned with and supports the organization's business objectives, and the IT strategy is the core document that establishes this direction, priorities, and value delivery. Option E (IT steering committee) is correct because governance requires a decision-making body with assigned authority and accountability; the IT steering committee provides oversight, prioritization, and resource-allocation decisions across IT initiatives. The remaining options do not belong: a network topology diagram (A) and a hardware inventory (C) are operational/technical artifacts describing infrastructure, not governance mechanisms, and help desk procedures (B) are tactical service-management documentation rather than a governance component.

Answer

Network topology diagram

Answer

Help desk procedures

Answer

Hardware inventory

Question 15

An IS auditor is reviewing the organization's data inventory process for privacy compliance. Which TWO of the following are the MOST important elements that should be included in the data inventory?

Accepted Answer

Data elements or fields containing personal data. Option A is correct because a data inventory must identify the specific data elements or fields that contain personal data, since this is the foundational step for determining what privacy obligations (e.g., GDPR, CCPA) apply and where protection controls are needed. Option C is correct because knowing the location of personal data storage and processing—whether on-premises, in the cloud, or across jurisdictions—is essential for assessing cross-border transfer restrictions, access controls, and regulatory applicability. Options B, D, and E, while useful attributes that may be recorded in a mature inventory, are not the most important core elements; classification labels, retention periods, and consent status are downstream details that depend on first knowing what personal data exists and where it resides.

Answer

Data classification labels

Answer

Data retention periods

Answer

Data subject consent status

Question 16

An organization is migrating from a legacy system to a new ERP. Which TWO of the following are the HIGHEST risks during data migration?

Accepted Answer

Incorrect data mapping between old and new systems. Option A is correct because incorrect data mapping between the legacy and new ERP schemas directly causes fields to be transformed, truncated, or populated into the wrong target columns, producing corrupt or unusable records in the new system — a core data migration risk. Option E is correct because incomplete or inaccurate source data (missing values, duplicates, inconsistent formats) propagates defects into the ERP and undermines the integrity of the migrated dataset, regardless of how well the mapping is designed. These two are the highest risks because they directly threaten the accuracy and completeness of the migrated data itself, which is the primary objective of the migration. Option B is not a top migration risk since bandwidth affects cutover performance/throughput rather than data correctness and is typically mitigated by scheduling and sizing. Option C concerns post-migration adoption and user competence, not the integrity of the migrated data. Option D is an access-control/governance risk in the new system's design, not a data migration risk.

Answer

Insufficient network bandwidth during cutover

Answer

Lack of user training on the new system

Answer

Lack of segregation of duties in the new system

Question 17

An IS auditor is assessing the data inventory of a financial institution to ensure compliance with privacy regulations. Which TWO of the following are essential elements that should be included in the data inventory?

Accepted Answer

The location (systems and physical) where PII is stored. Option B is correct because a data inventory must record where PII resides—both the systems (applications, databases, cloud services) and physical locations—so the organization can apply appropriate safeguards and respond to access, breach, or deletion requests under privacy regulations. Option D is correct because documenting the retention period for each type of PII ensures data is kept only as long as legally or operationally necessary and is securely disposed of when that period ends, which is a core privacy compliance requirement. Option A is not essential to the inventory itself; encryption algorithms are security controls recorded in system documentation, not identifying attributes of a data inventory. Option C is irrelevant to privacy compliance, as storage cost is a financial metric rather than a data-governance attribute. Option E is unnecessary and impractical, since the inventory should identify processing activities and roles, not list every individual employee who handles the data.

Answer

The encryption algorithm used to protect the data

Answer

The cost of storing the data

Answer

The names of all employees who process the data

Question 18

An IS auditor is selecting an appropriate audit sample. Which THREE of the following are factors that affect the sample size?

Accepted Answer

Tolerable error rate. Tolerable error rate (A) is correct because it defines the maximum deviation from the control that the auditor is willing to accept while still relying on the control; a lower tolerable rate requires a larger sample to detect deviations. Confidence level (B) is correct because it reflects how certain the auditor wants to be that the sample result is representative of the population, and higher confidence directly increases the required sample size. Expected error rate (D) is correct because the auditor's estimate of the deviation rate in the population drives sample size upward as the expected rate approaches the tolerable rate. Sampling interval (C) is not a determinant of sample size; it is derived from the sample size and population size when using systematic selection. Population standard deviation (E) applies to variables sampling for monetary amounts, not to attribute sampling for control deviations, so it is not a general factor here.

Answer

Sampling interval

Answer

Population standard deviation

Question 19

During an audit of the incident response process, the IS auditor finds that the organization relies on shared accounts for system administration. Which TWO of the following are the MOST significant risks associated with shared accounts?

Accepted Answer

Lack of individual accountability for actions performed. Option B is correct because shared accounts eliminate the one-to-one mapping between a user identity and an account, so when multiple administrators use the same credentials there is no way to attribute a specific action to a specific individual, destroying individual accountability. Option D is correct because the audit logs generated under a shared account record only the account name, not the actual person, so the resulting audit trail cannot reliably support forensic investigations or non-repudiation. Options A and C are operational inconveniences rather than the most significant risks, and option E describes a possible consequence of poor password hygiene rather than the core accountability and forensic integrity risks that an IS auditor would emphasize.

Answer

Increased complexity in password management

Answer

Increased overhead for account provisioning

Answer

Higher likelihood of password sharing outside the authorized group

Question 20

Which TWO of the following are indicators that an IS auditor may need to adjust the audit approach during fieldwork? (Select TWO.)

Accepted Answer

Inability to obtain sufficient appropriate audit evidence. Option A is correct because when an IS auditor cannot obtain sufficient appropriate audit evidence, the planned procedures are not yielding a reliable basis for conclusions, so the audit approach (for example, additional or alternative substantive testing, or revised reliance on controls) must be adjusted. Option E is correct because higher-than-expected error rates in sample testing indicate that the assessed level of control risk or the tolerable deviation/error rate may be wrong, requiring the auditor to expand testing, increase sample sizes, or reconsider the nature, timing, and extent of procedures. Option B is not correct because completing the initial risk assessment is a normal, planned phase of the audit that informs the approach rather than a fieldwork indicator that it must change. Option C is not correct because being behind schedule is a project-management or resource issue, not audit evidence or risk information that by itself dictates a change in the audit approach. Option D is not correct because a management-requested scope change is a governance/engagement matter to be evaluated and approved, not an indicator arising from fieldwork evidence that the audit approach needs adjustment.

Answer

Completion of the initial risk assessment

Answer

Audit team members are behind schedule

Answer

Management requests a change in audit scope