CISA Exam Questions

During a database security audit, an IS auditor is reviewing the process used to input data. Which of the following is the MOST significant risk area for the auditor to focus on?

An IS auditor decides to review a data inventory list captured directly from a system instead of relying on an interview with the system owner. Which of the following provides the...

Which of the following is the BEST compensating control against separation of duties conflicts in new code development?

A global company has been using a publicly available AI tool to obtain information about global laws and regulations that could impact the business. Which of the following should b...

An external IS auditor is reviewing the continuous monitoring system for a large bank and notes several potential issues. Which of the following would present the GREATEST concern...

An organization uses an automated continuous integration/continuous deployment (CI/CD) tool to deploy changes to production. Which of the following would be an IS auditor's GREATES...

Which of the following is MOST important to ensure successful implementation when an organization decides to purchase software from available products on the market?

Job scheduling impacts system availability and reliability by:

An IS auditor is assigned to perform a post-implementation review of an application system. Which of the following would impair the auditor's independence?

Which of the following BEST describes the process of creating a digital envelope?

During a review of an organization's IT capacity management process, an IS auditor should be MOST concerned if capacity planning:

Which of the following BEST indicates an effective internal audit quality assurance and improvement program?

An IS auditor is auditing the operating effectiveness of weekly user access reviews. Of the five weekly reviews sampled, one has not been signed or dated. What is the MAIN reason t...

Which of the following is the MOST effective way for an IS auditor to ensure information is preserved when conducting a forensic investigation?

How does the emergence of quantum computing impact traditional data encryption methods?

When evaluating whether the expected benefits of a project have been achieved, it is MOST important for an IS auditor to review:

Which of the following is the PRIMARY objective of data loss prevention (DLP) mechanisms?

When determining the quality of evidence collected during an audit, it is MOST important to ensure the evidence is:

Which of the following would provide the BEST evidence that a cloud provider's change management process is effective?

When developing software with incomplete requirements, the MOST appropriate methodology to use is:

Which of the following is MOST important to ensure successful implementation when an organization decides to purchase software from available products on the market?

An IS auditor has identified that as users change departments or leave the company, their access is not adjusted. Which of the following would BEST help to address this situation?

Which of the following is the MOST important requirement in an organization's incident management response plan?

Which of the following should be an IS auditor's PRIMARY focus when auditing a file-sharing system used for collaboration among remote teams?

An IS auditor performed tests to evaluate the readiness of developed software for implementation. Which of the following test results BEST indicates that the software meets securit...

An international organization collects customer data through internet-enabled fitness devices. Which of the following would be of GREATEST concern to an IS auditor reviewing the or...

Which of the following is the PRIMARY responsibility of an IS auditor in a control self-assessment (CSA) activity?

Which of the following BEST indicates an effective internal audit quality assurance and improvement program?

Which of the following would be of GREATEST concern to an IS auditor observing public key infrastructures (PKIs) deployed in the production business environment?

Which of the following should be of MOST concern to an IS auditor who has identified several end-user computing (EUC) applications within an organization?

Outsourcing the development of business systems is MOST likely to result in the loss of:

During a review of an organization's IT capacity management process, an IS auditor should be MOST concerned if capacity planning:

IT management wants transferred staff to have current and previous role access to facilitate transitioning and training of new staff. Which of the following is the GREATEST risk to...

Which of the following information should be included in a data privacy statement displayed on a website used to process transactions?

Which of the following should be an IS auditor's MOST important consideration when auditing an organization's system capacity management processes?

An IS auditor is reviewing backup media inventory and finds the media have not been tested in seven years. Which of the following is the GREATEST risk to data retrieval?

What would be an IS auditor's BEST recommendation upon discovering that customer records in a database have not been protected?

Which of the following is the MOST important control consideration when planning the audit of an information system that uses a large language model?

Which of the following is MOST important to consider when developing a service level agreement (SLA)?

Which of the following controls should an IS auditor recommend for a small organization where a single employee performs the combined functions of server operator and application p...

Storing backup drives at an offsite location is an example of which type of control?

Which of the following BEST describes the process of creating a digital envelope?

During the review of a system disruption incident, an IS auditor notes that IT support staff were put in a position to make decisions beyond their level of authority. Which of the...

An organization-wide review shows poor employee adherence to IT access control policies. Which of the following is PRIMARILY responsible for establishing the appropriate control cu...

Which of the following would be of GREATEST concern to an IS auditor reviewing an organization's enterprise architecture (EA) by examining its EA management tool?

Which of the following would be of concern to an IS auditor reviewing development practices for sensitive proprietary code?

An IS auditor is reviewing an AI system utilized by a healthcare organization for patient pre- diagnosis. Which of the following would pose the GREATEST concern?

Which of the following is the PRIMARY benefit of Infrastructure as Code (IaC) to configuration management practices?

Which of the following is the BEST indication of an effective problem management process?

Which of the following would be of MOST concern to an IS auditor reviewing a data loss prevention (DLP) solution implementation for endpoints?