CISA Exam Questions

An IS auditor reviewing database security should be MOST concerned if the database administrator (DBA):

Which of the following is the PRIMARY function of an internal IS auditor when the organization acquires a new IT system to support its business strategy?

An organization has alternative links in its wide area network (WAN) to provide redundancy. However, each time there is a problem with a link, network administrators have to update...

What should an IS auditor ensure when a financial organization intends to utilize production data in the testing environment?

A financial accounting system audit determined that audit logging of transactions had been disabled by a finance employee. The IS auditor recommended that finance personnel no long...

Which of the following is MOST important for an IS auditor to consider when using an integrated test facility (ITF) to evaluate an application after a system migration?

When conducting an audit of an organization's use of AI in its customer service chatbots, an IS auditor should PRIMARILY focus on the:

Which of the following is the BEST control to help ensure the completeness of outbound transactions?

When reviewing the monitoring and prevention of sensitive data moving out of an organization's network, which of the following is MOST important for an IS auditor to verify?

When reviewing an organization's enterprise architecture (EA), which of the following is an IS auditor MOST likely to find within the EA documentation?

The PRIMARY reason for an IS auditor to perform a functional walk-through of a business process during the preliminary phase of an audit assignment is to:

Which of the following is the MOST important consideration to facilitate prosecution of a perpetrator after a cyber crime?

Which of the following should be of GREATEST concern to an IS auditor reviewing an organization's mobile device policies and controls in its corporate environment?

When conducting a post-implementation review, which of the following is the BEST way to determine whether the value from an IT project has been achieved?

An IS auditor is reviewing a decision to consolidate processing for multiple applications onto a single large server. Which of the following is the MOST significant impact from thi...

When reviewing results of a risk assessment process, the IS auditor should focus efforts on risk items and scenarios with the highest level of:

An organization is concerned about duplicate vendor payments on a complex system with a high volume of transactions. Which of the following would be MOST helpful to an IS auditor t...

Reviewing which of the following would provide the BEST indication that a project is progressing as planned?

An organization is deciding whether to move on-premise workloads to a third-party Infrastructure as a Service (IaaS) platform. Which of the following is MOST important for an IS au...

Which of the following is the PRIMARY purpose of utilizing data analytics tools in audits?

Which of the following is the MOST important reason for an IS auditor to conduct a risk assessment when developing a risk-based audit strategy?

An organization is integrating two systems for real-time API communication. Which of the following is the BEST approach to ensure secure authentication between the two applications...

An IS auditor discovers there are no documented security procedures. What should be the NEXT step?

When conducting a follow-up of previous audit findings, an IS auditor is told by management that a recommendation to make security changes to an application has not been implemente...

Which of the following types of risk would MOST likely be associated with recent vendor configuration updates that have negatively impacted internal job schedules, causing disrupti...

Which of the following is an example of a vulnerability?

A computer belonging to an organization's CEO has been infected with malware. Which of the following should be done FIRST?

When auditing the error handling process of job scheduling, it is MOST important for the IS auditor to ensure:

Which of the following is MOST important to determine when conducting an audit of an organization's data privacy practices?

Which of the following is the PRIMARY reason for an IT department to establish operational level agreements (OLAs) in pursuit of improving management of IT service levels?

An outsourced recruitment vendor processes personally identifiable information (PII) related to an organization's new hires. Which of the following would be the GREATEST concern to...

Which of the following is MOST important for an IS auditor to ensure when evaluating an organization's end-user computing (EUC) policy as part of an IT governance audit?

Which of the following is the PRIMARY purpose of conducting a stage gate review process after each phase of the software development life cycle?

Standard operating procedures for dealing with a compromised private key are found in which element of a public key infrastructure (PKI)?

Which of the following is the MOST important consideration to ensure the integrity of encrypted data?

Which of the following would BEST help an organization maintain a configuration management system for IT inventory?

Which of the following is the PRIMARY responsibility of quality control (QC) in the context of software development and application systems?

An IS auditor evaluating a policy should be MOST concerned about the lack of a:

Which of the following would be of GREATEST concern to an IS auditor when assessing the effectiveness of log management?

Data restoration tests the effectiveness of an organization's ability to:

Which of the following should be of MOST concern to an IS auditor when reviewing the protection of data?

A core system fails a week after a scheduled update, causing an outage that impacts service. Which of the following is MOST important for incident management to focus on when addre...

When planning an audit to assess controls for an application in the cloud environment, it is MOST important for an IS auditor to understand:

When auditing an organization's implementation of Zero Trust principles within its identity and access management (IAM) framework, which of the following is MOST important to revie...

Which of the following MOST significantly limits a hacker's ability to use brute force attacks to compromise an encryption scheme?

Which of the following is MOST important for an IS auditor to verify when reviewing an organization's business continuity plan (BCP)?

During audit planning for the review of an Internet of Things (IoT) implementation program, an IS auditor requests the organization's information risk policy. Which of the followin...

Which of the following is the BEST way to ensure personal data used for a data analytics project cannot be identified?

An organization is using Internet of Things (IoT) technology to support its business processes. Which of the following is the BEST approach for the use of IoT to ensure compliance...

Which of the following recommendations by an IS auditor is the BEST control to protect an organization's corporate network from the guest wireless network?