CISA Exam Questions

A senior auditor is reviewing work papers prepared by a junior auditor indicating that a finding was removed after the auditee said they corrected the problem. Which of the followi...

Which of the following is MOST important to ensure when developing an effective security awareness program?

Which of the following is the MOST important reason to implement version control for an end-user computing (EUC) application?

Which of the following provides the BEST evidence that outsourced provider services are being properly managed?

Which of the following would BEST help to ensure that potential security issues are considered by the development team as part of incremental changes to agile-developed software?

The waterfall life cycle model of software development is BEST suited for which of the following situations?

Which of the following is the GREATEST impact as a result of the ongoing deterioration of a detective control?

During an external review, an IS auditor observes an inconsistent approach in classifying system criticality within the organization. Which of the following should be recommended a...

Which of the following environments is BEST used for copying data and transformation into a compatible data warehouse format?

What is the PRIMARY purpose of documenting audit objectives when preparing for an engagement?

Which of the following should be the IS auditor's PRIMARY focus when evaluating an organization's offsite storage facility?

An IS auditor finds that firewalls are outdated and not supported by vendors. Which of the following should be the auditor's NEXT course of action?

An IS auditor is conducting a physical security audit of a healthcare facility and finds closed-circuit television (CCTV) systems located in a patient care area. Which of the follo...

An organization that has decided to approve the use of end-user computing (EUC) should FIRST ensure:

Data from a system of sensors located outside of a network is received by the open ports on a server. Which of the following is the BEST way to ensure the integrity of the data bei...

Which of the following is a core functionality of a configuration and release management system?

Which of the following is the MOST important consideration when evaluating the data retention policy for a global organization with regional offices in multiple countries?

Which of the following is the GREATEST advantage of vulnerability scanning over penetration testing?

An organization has introduced a capability maturity model to the system development life cycle (SDLC) to measure improvements. Which of the following is the BEST indication of suc...

Which of the following is the MOST important factor when an organization is developing information security policies and procedures?

Which of the following is a threat to IS auditor independence?

Which of the following should be an IS auditor's GREATEST concern when assessing an IT service configuration database?

An organization is permanently transitioning from onsite to fully remote business operations. When should the existing business impact analysis (BIA) be reviewed?

Which of the following threats is mitigated by a firewall?

Which of the following is the GREATEST advantage of maintaining an internal IS audit function within an organization?

An organization has decided to purchase a web-based email service from a third-party vendor and eliminate its own email server infrastructure. What type of cloud computing environm...

Which of the following is the GREATEST advantage of utilizing guest operating systems in a virtual environment?

During a routine internal software licensing review, an IS auditor discovers instances where employees shared license keys to critical pieces of business software. Which of the fol...

When building or upgrading enterprise cryptographic infrastructure, which of the following is the MOST critical requirement for growing business environments?

An organization's business continuity plan (BCP) should be:

An organization's IT risk assessment should include the identification of:

Which of the following BEST enables an IS auditor to prioritize financial reporting spreadsheets for an end-user computing (EUC) audit?

Which of the following should be of GREATEST concern to an IS auditor when using data analytics?

Which of the following is the BEST control to help ensure that security requirements are considered throughout the life cycle of an agile software development project?

Which of the following is the BEST disposal method for flash drives that previously stored confidential data?

Which of the following is MOST helpful for understanding an organization's key driver to modernize application platforms?

Which of the following BEST describes the role of the IS auditor in a control self-assessment (CSA)?

Which of the following is the PRIMARY objective of cyber resiliency?

Which of the following is MOST important to define within a disaster recovery plan (DRP)?

Which of the following provides the BEST evidence that all elements of a business continuity plan (BCP) are operating effectively?

An IS auditor is reviewing the service management of an outsourced help desk. Which of the following is the BEST indicator of how effectively the service provider is performing thi...

Which of the following is the BEST preventive control to protect the confidentiality of data on a corporate smartphone in the event it is lost?

Which of the following would be MOST important to include in an IS audit report?

Which of the following should be an IS auditor's PRIMARY focus when evaluating the response process for cyber crimes?

Which of the following is the PRIMARY objective of implementing privacy-related controls within an organization?

A database administrator (DBA) should be prevented from:

Which of the following BEST enables an IS auditor to combine and compare access control lists from various applications and devices?

An organization is migrating its HR application to an Infrastructure as a Service (IaaS) model in a private cloud. Who is PRIMARILY responsible for the security configurations of t...

Which type of device sits on the perimeter of a corporate or home network, where it obtains a public IP address and then generates private IP addresses internally?

An IS auditor observes that a large number of departed employees have not been removed from the accounts payable system. Which of the following is MOST important to determine in or...