How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the CISA exam, each with detailed explanations and wrong-answer analysis.

How should I approach CISA scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Certified Information Systems Auditor CISA questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Certified Information Systems Auditor CISA practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CISA

exam code

ISACA

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1easymulti select

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related CISA topic practice pages

Governance and Management of IT practice questions

Information Systems Operations and Business Resilience practice questions

Information System Auditing Process practice questions

Information Systems Acquisition, Development, and Implementation practice questions

Protection of Information Assets practice questions

CISA fundamentals practice questions

CISA scenario practice questions

CISA troubleshooting practice questions

Practice scenarios

An IT governance framework should include which TWO key components? (Select exactly two.)

An IS auditor is evaluating an organization's SDLC controls for a new system. Which TWO of the following are key controls that should be in place during the design phase? (Select TWO.)

An IS auditor is reviewing the backup process for a critical database. Which TWO of the following are essential controls to ensure data recoverability?

An IS auditor is assessing the backup and recovery procedures for a critical database. Which TWO of the following are the MOST important controls to ensure recoverability?

An IS auditor is reviewing the design phase of a new procurement system. Which TWO of the following controls are MOST critical to include in the system design to prevent unauthorized purchases?

Which THREE of the following are acceptable methods for gathering audit evidence? (Select THREE.)

Which TWO of the following are primary objectives of a data loss prevention (DLP) strategy?

An IS auditor is reviewing a change management process. Which TWO elements should be documented in a normal change request to ensure adequate governance? (Select TWO)

Which TWO of the following are key elements of an effective incident response plan? (Select exactly 2.)

Which THREE of the following are essential components of a data classification program?

Which TWO of the following are primary objectives of a business continuity plan (BCP)?

An IS auditor is reviewing the organization's incident management process. Which THREE of the following are essential components of an effective incident response plan?

Which TWO of the following are considered essential components of an information security policy framework? (Choose two.)

An organization is implementing a change management process based on ITIL. Which THREE change types should be included in the policy?

Which TWO of the following are key benefits of using a system development life cycle (SDLC) methodology? (Select exactly two.)

An IS auditor is reviewing backup procedures for a critical database. Which THREE are key considerations for ensuring backup reliability and recoverability?

Which TWO of the following are key controls that an IS auditor should expect to find in a well-managed system development life cycle (SDLC)?

An IS auditor is assessing the vendor management process. Which TWO are key controls for managing third-party risk?

Which THREE of the following are responsibilities of the board of directors regarding IT governance? (Choose three.)

Which TWO of the following are indicators of poor project governance that an IS auditor should identify?