CISA Practice Questions

Question 1

A company is migrating from a legacy system to a cloud-based ERP. Which of the following is the MOST important control to ensure data integrity during data conversion?

Accepted Answer

Reconciliation of control totals. Reconciliation of control totals is the most important control because it directly verifies that the sum of key fields (e.g., total account balances, record counts) in the source system matches the target cloud-based ERP after conversion. This ensures no data is lost, duplicated, or corrupted during the extraction, transformation, and loading (ETL) process, which is critical for maintaining data integrity in a migration from a legacy system.

Answer

Automated backup

Answer

User acceptance testing

Answer

Parallel running

Question 2

An organization uses a chargeback model to allocate IT costs to business units. What is a PRIMARY benefit of this approach?

Accepted Answer

Encourages responsible consumption of IT resources. Chargeback increases transparency and encourages business units to use IT resources efficiently.

Answer

Reduces total IT costs

Answer

Eliminates the need for an IT steering committee

Answer

Simplifies IT budgeting process

Question 3

Which TWO of the following are types of audit evidence recognized in IS audit practice?

Accepted Answer

Observation. In IS audit practice, evidence is classified by how it is obtained and its reliability, and two recognized types here are Observation (B) and Re-performance (D). Observation (B) is valid because auditors directly witness processes, controls, or personnel performing activities, yielding first-hand evidence about how a control actually operates. Re-performance (D) is valid because the auditor independently executes the control or procedure (for example, recalculating a depreciation schedule or re-running an access review) and compares the result to the client's output, producing highly reliable evidence. The remaining options do not belong: Assumption (A), Conjecture (C), and Hypothesis (E) are speculative or unverified propositions, not evidence types, since audit evidence must be based on actual observation, inspection, inquiry, confirmation, recalculation, or re-performance rather than supposition.

Answer

Assumption

Answer

Conjecture

Answer

Hypothesis

Question 4

Refer to the exhibit. An IS auditor is reviewing backup error logs. The error indicates a failed backup due to a missing file. What is the MOST likely cause?

Accepted Answer

A file in the source volume was moved or deleted during the backup window. The error indicates a failed backup due to a missing file. The most likely cause is that a file in the source volume was moved or deleted during the backup window. Backup processes that use file-level snapshots or open-file managers (e.g., Volume Shadow Copy Service on Windows) capture a point-in-time view; if a file is moved or deleted after the snapshot is taken but before it is read by the backup agent, the backup will fail with a 'missing file' error. This is a classic race condition in file-level backups without proper snapshot consistency.

Answer

The backup job was scheduled during peak hours causing timeout

Answer

The destination path '\BackupServer01\Backup\Shares' is invalid

Answer

Insufficient disk space on the backup destination

Question 5

After issuing the final audit report, the IS auditor should perform follow-up procedures. What is the PRIMARY purpose of follow-up?

Accepted Answer

To verify that corrective actions have been implemented effectively. Follow-up ensures that management has taken corrective actions to address the findings and that the risks have been mitigated.

Answer

To update the permanent audit file

Answer

To close the audit engagement

Answer

To identify new risks for the next audit

Question 6

An organization uses a cloud-based ERP system to manage financial transactions. The system is accessed by employees in finance, procurement, and sales departments. The IS auditor is reviewing the user access review process. The access review is performed quarterly by the IT manager using a report generated by the ERP system. The report lists all users and their roles. The IT manager manually checks off users who are still employed and approves the report. The auditor notes that the IT manager does not have detailed knowledge of job functions in each department. Additionally, the ERP system allows role combinations that may create segregation of duties conflicts, such as a user having both 'create purchase order' and 'approve purchase order' roles. The company's policy requires segregation of duties reviews to be performed by business process owners. Which of the following is the BEST recommendation?

Accepted Answer

Assign the access review to business process owners from each department. The core issue is that the IT manager lacks the business process knowledge to assess whether role combinations create segregation of duties (SoD) conflicts. Company policy explicitly requires SoD reviews to be performed by business process owners. Assigning the access review to business process owners from each department (Option C) directly aligns with policy and ensures that those with functional knowledge evaluate whether role assignments violate SoD rules, such as a user having both 'create purchase order' and 'approve purchase order' roles.

Answer

Increase the frequency of access reviews to monthly

Answer

Implement an automated tool to identify segregation of duties conflicts

Answer

Require the IT manager to obtain confirmation from each department head

Question 7

An organization has implemented a business continuity plan (BCP) and disaster recovery plan (DRP). During a recent full interruption test, the IT team discovered that the recovery time objective (RTO) for a critical application was not met. What is the MOST likely reason for this failure?

Accepted Answer

The alternate site did not have adequate processing capacity to handle the workload.. The most likely reason the RTO was not met is that the alternate site lacked sufficient processing capacity to handle the workload. RTO measures the time to restore service availability; if the failover site cannot support the required compute, memory, or I/O throughput, restoration will be delayed or fail outright. This is a common capacity planning failure in DR testing, where the alternate site is sized for minimal operations but not for the full production load.

Answer

The recovery point objective (RPO) was set too low, causing data loss.

Answer

The backup data was not encrypted, leading to corruption during restoration.

Answer

The tabletop exercise was not conducted before the full interruption test.

Question 8

An IS auditor is reviewing an organization's data classification policy. Which of the following findings is MOST critical?

Accepted Answer

Data owners have not been identified for most data assets. Without identified data owners, no one is accountable for classifying, protecting, or granting access to data assets. This foundational gap undermines the entire data classification policy, making it impossible to enforce controls like encryption or access reviews. The CISA emphasizes that data owner assignment is the first step in any data governance framework.

Answer

Employees receive data classification training only once per year

Answer

Data classification is performed manually without automated tools

Answer

Sensitive data is not encrypted at rest

Question 9

During a change management process review, an IS auditor finds that the change advisory board (CAB) approved a change that subsequently caused a major service outage. The change was classified as 'normal' with no emergency. What is the auditor's primary concern?

Accepted Answer

The CAB did not adequately assess the potential impact of the change.. The primary concern is that the CAB approved a 'normal' change without adequately assessing its potential impact, leading to a major service outage. In ITIL-based change management, the CAB is responsible for evaluating the risk, impact, and resource requirements of a change before approval. A failure in this assessment indicates a breakdown in the change management process, which is the core issue an IS auditor must address.

Answer

The service desk was not notified of the change.

Answer

The change should have been classified as emergency.

Answer

The change was not tested in a pre-production environment.

Question 10

An organization's IT department implemented a new change management process that requires all changes to be approved by a change advisory board (CAB). A critical security patch needs to be deployed within 2 hours to address an active zero-day vulnerability. The change request was submitted but the CAB is not scheduled to meet for another 24 hours. What is the BEST course of action?

Accepted Answer

Use the emergency change process to obtain expedited approval from a designated CAB member.. It aligns with the ITIL-based emergency change process, which allows for expedited approval from a designated CAB member or emergency authority when a critical security patch must be deployed within hours to mitigate an active zero-day vulnerability. This ensures the change is authorized without waiting for the full CAB meeting, maintaining security while preserving governance and audit trails.

Answer

Deploy the patch and inform the CAB after the fact during the next meeting.

Answer

Wait for the next scheduled CAB meeting to approve the change.

Answer

Deploy the patch immediately without any approval as it is a critical security fix.

Question 11

Order the steps for conducting an audit engagement from start to finish.

Accepted Answer

Step 1: Planning (scope, program), Step 2: Fieldwork, Step 3: Analysis, Step 4: Reporting with management review. Audit engagement follows: planning (scope, program), fieldwork, analysis, and reporting with management review.

Answer

Step 1: Planning, Step 2: Analysis, Step 3: Fieldwork, Step 4: Reporting

Answer

Step 1: Fieldwork, Step 2: Planning, Step 3: Analysis, Step 4: Reporting

Answer

Step 1: Planning, Step 2: Fieldwork, Step 3: Reporting, Step 4: Analysis

Question 12

Which THREE of the following are key considerations when selecting a software development methodology for a project?

Accepted Answer

Regulatory compliance requirements. Regulatory compliance requirements (Option B) are a key consideration because the chosen methodology must support necessary audit trails, documentation, and control frameworks (e.g., SOX, HIPAA, PCI DSS). A methodology like Waterfall provides rigid phase-gate documentation, while Agile may require adaptation (e.g., SAFe) to satisfy compliance evidence demands. Failure to align methodology with regulatory needs can lead to non-compliance findings during a CISA audit.

Answer

Availability of project management software

Answer

Programming language preferences

Question 13

Which of the following is a primary advantage of fixed-price contracts in systems acquisition?

Accepted Answer

Predictable cost for the buyer. The defining characteristic of a fixed-price contract is that the buyer pays a set amount regardless of the vendor's actual costs, giving the buyer cost predictability and transferring cost-overrun risk to the vendor. This predictability is the primary advantage for the acquiring organization's budgeting and financial planning.

Answer

Vendor has incentive to complete quickly

Answer

Greater flexibility to change requirements

Answer

Lower total cost compared to time-and-materials

Question 14

Which of the following is the MOST effective control to prevent unauthorized USB devices from connecting to corporate workstations?

Accepted Answer

Device control software that blocks non-approved USB devices.. Device control software (e.g., endpoint DLP or USB whitelisting tools) operates at the OS kernel or driver level to enforce a hardware ID or vendor ID allowlist, blocking any USB device not explicitly approved. This is the only option that provides a preventive, automated, and continuous control against unauthorized USB connections, regardless of user behavior or physical access.

Answer

User awareness training.

Answer

Physical security guards.

Answer

Encrypting all USB devices.

Question 15

Order the steps for performing a data backup in the correct sequence.

Accepted Answer

Identify data to be backed up, then choose backup method, then schedule the backup, then execute backup and verify integrity, then store backup offsite.. Backup process: identify data, choose method, schedule, execute/verify, and store offsite.

Answer

Identify data to be backed up, then schedule the backup, then choose backup method, then execute backup and verify integrity, then store backup offsite.

Answer

Choose backup method, then identify data to be backed up, then schedule the backup, then execute backup and verify integrity, then store backup offsite.

Answer

Identify data to be backed up, then choose backup method, then execute backup and verify integrity, then schedule the backup, then store backup offsite.

Certified Information Systems Auditor CISA practice test

Three ways to study

Study CISA by domain

Study CISA by topic

Governance and Management of IT practice questions

Information Systems Operations and Business Resilience practice questions

Information System Auditing Process practice questions

Protection of Information Assets practice questions

Information Systems Acquisition, Development, and Implementation practice questions

CISA fundamentals practice questions

CISA scenario practice questions

CISA troubleshooting practice questions

Top CISA questions

Certified Information Systems Auditor CISA practice questions