CISA Exam Questions

An IS auditor evaluating the change management process must select a sample from the change log. What is the BEST way for the auditor to confirm the change log is complete?

Which of the following is the PRIMARY benefit of monitoring IT operational logs?

Which of the following is MOST useful to an IS auditor performing a review of access controls for a document management system?

Which of the following is the BEST metric to measure the quality of software developed in an organization?

When testing the accuracy of transaction data, which of the following situations BEST justifies the use of a smaller sample size?

Which of the following staff should an IS auditor interview FIRST to obtain a general overview of the various technologies used across different programs?

When drafting a disaster recovery strategy, what should be the MOST important outcome of a business impact analysis (BIA)?

Which of the following is MOST important for an IS auditor to validate when reviewing the controls for an organization's quality management system (QMS)?

An IS auditor finds a user account where privileged access is not appropriate for the user's role. Which of the following would provide the BEST evidence to determine whether the r...

Which of the following is the PRIMARY purpose of conducting a control self-assessment (CSA)?

How is nonrepudiation supported within a public key infrastructure (PKI) environment?

Which of the following should an IS auditor do FIRST when auditing a robotics process automation (RPA) implementation?

Which of the following should an IS auditor recommend be done FIRST when an organization is planning to implement an IT compliance program?

Which of the following BEST enables an organization to standardize its IT infrastructure to align with business goals?

An organization is planning to implement a control self-assessment (CSA) program for selected business processes. Which of the following should be the role of the internal audit te...

An organization saves confidential information in a file with password protection, and the file is placed in a shared folder. An attacker has stolen this information by obtaining t...

An organization want to use virtual desktops to deliver corporate applications to its end users. Which of the following should an IS auditor recommend to prevent domain name system...

What should an IS auditor do FIRST when a follow-up audit reveals some management action plans have not been initiated?

Of the following, who should be responsible for cataloging and inventorying robotic process automation (RPA) processes?

Which of the following is the BEST recommendation by an IS auditor to prevent unauthorized access to Internet of Things (IoT) devices?

Which of the following is the BEST indication that an information security awareness program is effective?

Which of the following technologies is BEST suited to fulfill a business requirement for nonrepudiation of business-to-business transactions with external parties without the need...

Which of the following is MOST important for an IS auditor to verify when evaluating the upgrade of an organization's enterprise resource planning (ERP) application?

Which of the following is the BEST approach to help organizations address risks associated with shadow IT?

Which of the following BEST mitigates the risk associated with the deployment of a new production system?

Which of the following system redundancy configurations BEST improves system resiliency and reduces the possibility of a single cause of failure impacting system dependability?

Which of the following BEST helps data loss prevention (DLP) tools detect movement of sensitive data in transit?

An IS auditor is planning a review of an organization's cybersecurity incident response maturity. Which of the following methodologies would provide the MOST reliable conclusions?

Which of the following features would BEST address risk associated with data at rest when evaluating a data loss prevention (DLP) solution?

Recovery facilities providing a redundant combination of internet connections to the local communications loop is an example of which type of telecommunications continuity?

Which of the following should be used as the PRIMARY basis for prioritizing IT projects and initiatives?

Which of the following is the MOST efficient way to identify fraudulent activity on a set of transactions?

Which of the following should be the PRIMARY concern for the IT department head when implementing operational log management?

Which of the following should be of GREATEST concern to an IS auditor when auditing an organization's IT strategy development process?

Which of the following BEST enables an IS auditor to assess whether jobs were completed according to the job schedule?

Which of the following would MOST likely jeopardize the independence of a quality assurance (QA) team and could lead to conflict of interest?

Which of the following is the MOST important task of an IS auditor during an application post- implementation review?

An IS auditor is supporting a forensic investigation. An image of affected storage media has been captured while collecting digital forensic evidence. Which of the following techni...

When planning an internal penetration test, which of the following is the MOST important step prior to finalizing the scope of testing?

Which of the following is the MOST likely outcome for an organization that implements cloud computing?

A bank has developed an automated credit decision engine for loan applications based on defined rules. Which of the following is the BEST way to gain assurance for the design and o...

Which of the following is the PRIMARY objective of a control self-assessment (CSA)?

The PRIMARY focus for an IS auditor reviewing a job scheduling process used to manage critical transactions should be to validate which of the following?

When auditing a virtual IT system, it is MOST important to verify the security of which of the following?

Which of the following is MOST important for an IS auditor to review prior to the migration of acquired software into production?

An auditee has informed the IS auditor that there is not enough funding to implement an agreed- upon recommendation in the audit report and that there is no estimated time frame fo...

Which of the following should be of GREATEST concern to an IS auditor reviewing hardware maintenance practices in an organization whose primary business is e-commerce?

A startup organization wants to develop a data loss prevention (DLP) program. The FIRST step should be to implement:

Which of the following is the GREATEST benefit of using a capability maturity model to present audit findings related to an organization's cybersecurity posture?

A healthcare organization is implementing internet of Things (IoT) technology to receive customer health information from medical service providers at the point of data creation. W...