CISA Exam Questions

When an intrusion into an organization's network is detected, which of the following should be done FIRST?

The IS quality assurance (QA) group is responsible for:

Which of the following is the MOST important responsibility of user departments associated with program changes?

What is the MAIN reason to use incremental backups?

Which of the following should an IS auditor be MOST concerned with during a post- implementation review?

Which of the following is the PRIMARY basis on which audit objectives are established?

Which of the following metrics is the BEST indicator of the performance of a web application?

Which of the following should be the FIRST step when developing a data loss prevention (DLP) solution for a large organization?

An organization wants to classify database tables according to its data classification scheme. From an IS auditor's perspective, the tables should be classified based on the:

Management is concerned about sensitive information being intentionally or unintentionally emailed as attachments outside the organization by employees. What is the MOST important...

Which of the following is the PRIMARY role of key performance indicators (KPIs) in supporting business process effectiveness?

An IT governance body wants to determine whether IT service delivery is based on consistently effective processes. Which of the following is the BEST approach?

What is the BEST control to address SQL injection vulnerabilities?

Following a merger, a review of an international organization determines the IT steering committee's decisions do not extend to regional offices as required in the consolidated IT...

Which type of attack poses the GREATEST risk to an organization's most sensitive data?

An algorithm in an email program analyzes traffic to quarantine emails identified as spam. The algorithm in the program is BEST characterized as which type of control?

An organization is disposing of a system containing sensitive data and has deleted all files from the hard disk. An IS auditor should be concerned because:

What is the PRIMARY reason to adopt a risk-based IS audit strategy?

Following the sale of a business division, employees will be transferred to a new organization, but they will retain access to IT equipment from the previous employer. An IS audito...

As part of business continuity planning, which of the following is MOST important to assess when conducting a business impact analysis (BIA)?

The operations team of an organization has reported an IS security attack. Which of the following should be the FIRST step for the security incident response team?

Following a breach, what is the BEST source to determine the maximum amount of time before customers must be notified that their personal information may have been compromised?

Which of the following information security requirements BEST enables the tracking of organizational data in a bring your own device (BYOD) environment?

Which of the following should be an IS auditor's GREATEST concern when reviewing an organization's security controls for policy compliance?

Which of the following should be the PRIMARY basis for prioritizing follow-up audits?

Which of the following is MOST likely to be a project deliverable of an agile software development methodology?

Which of the following is MOST important for an IS auditor to assess during a post- implementation review of a newly modified IT application developed in-house?

Which of the following would be of MOST concern for an IS auditor evaluating the design of an organization's incident management processes?

Which of the following is MOST important for an IS auditor to do during an exit meeting with an auditee?

Which of the following findings should be of GREATEST concern to an IS auditor assessing the risk associated with end-user computing (EUC) in an organization?

Which of the following is MOST important to consider when assessing the scope of privacy concerns for an IT project?

Which of the following is the PRIMARY reason for using a digital signature?

Which of the following is the BEST indicator for measuring performance of the IT help desk function?

Which of the following types of firewalls provide the GREATEST degree of control against hacker intrusion?

Which of the following is MOST important when planning a network audit?

Which of the following documents would be MOST useful in detecting a weakness in segregation of duties?

Which of the following IT service management activities is MOST likely to help with identifying the root cause of repeated instances of network latency?

Which of the following components of a risk assessment is MOST helpful to management in determining the level of risk mitigation to apply?

Which of the following is the BEST way to mitigate risk to an organization's network associated with devices permitted under a bring your own device (BYOD) policy?

When evaluating the design of controls related to network monitoring, which of the following is MOST important for an IS auditor to review?

Which of the following is MOST important to include in forensic data collection and preservation procedures?

Which of the following should be of GREATEST concern to an IS auditor reviewing project documentation for a client relationship management (CRM) system migration project?

Which of the following approaches would utilize data analytics to facilitate the testing of a new account creation process?

Which of the following is the MOST reliable way for an IS auditor to evaluate the operational effectiveness of an organization's data loss prevention (DLP) controls?

Which of the following should be the FIRST step in the incident response process for a suspected breach?

Which of the following is the MOST important consideration for an IS auditor when assessing the adequacy of an organization's information security policy?

An IS auditor discovers a box of hard drives in a secured location that are overdue for physical destruction. The vendor responsible for this task was never made aware of these har...

An IS audit manager was temporarily tasked with supervising a project manager assigned to the organization's payroll application upgrade. Upon returning to the audit department, th...

An IS auditor is reviewing a contract for the outsourcing of IT facilities. If missing, which of the following should present the GREATEST concern to the auditor?

An IS auditor discovers that due to resource constraints, a database administrator (DBA) is responsible for developing and executing changes into the production environment. Which...