CISA Exam Questions

An IS auditor wants to gain a better understanding of an organization's selected IT operating system software. Which of the following would be MOST helpful to review?

Which of the following is the PRIMARY objective of performing quality assurance (QA) in a system development process?

An IS auditor is planning a review of an organization's robotic process automation (RPA) technology. Which of the following MUST be included in the audit work plan?

Which of the following is the BEST recommendation to prevent the skimming of debit or credit card data in point of sale (POS) systems?

An IS auditor is reviewing how password resets are performed for users working remotely. Which type of documentation should be requested to understand the detailed steps required f...

Which of the following BEST supports an organization's objective of restricting the use of removable storage devices by users?

An IS auditor is reviewing the security of a web-based customer relationship management (CRM) system that is directly accessed by customers via the Internet. Which of the following...

An IS auditor is reviewing job scheduling software and notes instances of delayed processing time, unexpected job interruption, and out-of-sequence job execution. Which of the foll...

Which of the following is the BEST way to determine the adequacy of controls for detecting inappropriate network activity in an organization?

Which of the following is the PRIMARY purpose of batch processing monitoring?

Which of the following is an organization's BEST defense against malware?

Which of the following is the PRIMARY objective of IT quality assurance (QA)?

The GREATEST concern for an IS auditor reviewing vulnerability assessments by the auditee would be if the assessments are:

Which of the following is the MOST effective way to detect as many abnormalities as possible during an IS audit?

An organization has determined that a trusted insider has been able to bypass and embezzle organizational funds. Which type of audit would be MOST helpful when providing evidence t...

Which of the following BEST mitigates the risk of SQL injection attacks against applications exposed to the internet?

Which of the following activities would BEST facilitate the improvement of control owner accountability for the expected performance of security controls?

Which of the following is the MOST significant risk related to shadow IT?

An IS auditor is reviewing an organization's operational log management. Which of the following should be the auditor's GREATEST concern?

Which of the following establishes the PRIMARY difference between a business continuity plan (BCP) and a disaster recovery plan (DRP)?

Which of the following is the MOST effective control to protect the integrity of database activity logs?

Data loss prevention (DLP) tools provide the MOST protection against:

Which of the following is MOST important to have in place to manage the risk of a resource shortage when there are multiple IT investment projects in progress?

Which of the following would present the MOST significant risk within a DevOps development model?

Which of the following should be done FIRST to ensure that a data loss prevention (DLP) process is appropriately implemented?

An IS auditor has been asked to perform a post-implementation review of a newly developed system. When reviewing the testing phase results, the auditor observed that separate modul...

Vulnerability identification should begin in which phase of an in-house software development project?

From a risk management perspective, which of the following is the BEST approach when implementing a large and complex data center IT infrastructure?

The MOST significant reason for using ley performance indicators (KPIs) to track the progress of IT projects against their initial targets is that they:

If a source code is not recompiled when program changes are implemented, which of the following is a compensating control to ensure synchronization of source and object?

Which of the following is the BEST way to detect unauthorized copies of licensed software on systems?

After areas have been appropriately scoped, what is the IS auditor's NEXT step in the selection for sampling?

Which of the following is the GREATEST concern associated with IS risk-based auditing when audit resources are limited?

The quality assurance (QA) team is testing a new e-ticketing application prior to go live to ensure that sales tax is calculated and applied correctly. Which of the following shoul...

Which of the following poses the GREATEST risk to an organization when employees use public social networking sites?

When collecting digital data for forensic purposes, the GREATEST benefit associated with the use of imaging is that it:

Which of the following is the PRIMARY role of the IT steering committee?

Which of the following is the PRIMARY objective of a quality assurance (QA) and improvement program within the IS audit process?

Which of the following is the BEST source of evidence to determine whether a new system meets expected requirements?

In planning a major system development project, function point analysis would assist in:

During the forensic investigation of a cyberattack involving credit card data, which of the following is MOST important to ensure?

Which of the following is the MOST important advantage of building enterprise architecture (EA) based on open system architecture?

Which of the following is the PRIMARY reason for an airline's IT management to continuously monitor the controls for a critical integrated flight schedule and payment application?

Which of the following is the PRIMARY factor in determining a recovery time objective (RTO)?

Which of the following metrics is MOST helpful for evaluating the effectiveness of problem management practices?

An IS auditor finds that some employees are using public cloud-based AI tools. Which of the following presents the GREATEST concern?

Which of the following represents the GREATEST risk to virtualized environments?

An audit identified that a computer system is not assigning sequential purchase order numbers to order requests. The IS auditor is conducting an audit follow-up to determine if man...

Which of the following is the MOST likely root cause of shadow IT in an organization?

Which of the following is the PRIMARY reason for an IS auditor to perform a risk assessment?