CISA · Current ISACA job practice · Updated 2026
Free CISA Practice Exam (2026)
Full-length mock exams with the same number of questions and time as the real CISA exam. Tough, think-like-an-IS-auditor questions across all 5 domains, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
150 questions · 4 hours · same as the real exam
You have an unfinished attempt on this set.
Your score by topic
Questions 1–10Page 1 of 15
🏆
Question 1Information System Auditing Process
An IS auditor is preparing the audit program for a new engagement. Which of the following must the auditor comply with, rather than treat as advisory?
Correct answer: C. ISACA IS audit and assurance standards
ISACA standards are mandatory for anyone holding the CISA certification. Guidelines explain how to apply the standards, so an auditor may depart from them with justification. Tools and techniques papers are only examples.
ISACA standards are mandatory for anyone holding the CISA certification. Guidelines explain how to apply the standards, so an auditor may depart from them with justification. Tools and techniques papers are only examples.
Question 2Governance & Management of IT
An IS auditor is reviewing the IT strategic plan of a mid-sized insurer. Which of the following provides the BEST evidence that the plan supports the organization's goals?
Correct answer: B. The plan maps each IT initiative to a documented business objective
Mapping each IT initiative to a stated business objective shows direct alignment, which is the core purpose of an IT strategy. A plan built only by IT staff, even under the CIO, may reflect technical priorities rather than business needs.
Mapping each IT initiative to a stated business objective shows direct alignment, which is the core purpose of an IT strategy. A plan built only by IT staff, even under the CIO, may reflect technical priorities rather than business needs.
Question 3IS Operations & Business Resilience
An IS auditor finds that a company's IT asset register has not been reconciled to the physical devices in use for over two years. Which is the GREATEST risk?
Correct answer: D. Lost or stolen devices holding company data may go undetected
Assets that are not tracked cannot be protected, so a missing laptop or server holding data could go unnoticed and lead to a data exposure. Paying maintenance on retired devices wastes money, but it is a cost issue rather than a risk to company information.
Assets that are not tracked cannot be protected, so a missing laptop or server holding data could go unnoticed and lead to a data exposure. Paying maintenance on retired devices wastes money, but it is a cost issue rather than a risk to company information.
Question 4Protection of Information Assets
An IS auditor reviewing the information security program at a regional insurer finds that the security policy was drafted by the IT security manager and published on the intranet two years ago. Which of the following should be the auditor's PRIMARY concern?
Correct answer: A. The policy has not been formally approved by senior management
Without senior management approval, the policy lacks the authority needed to enforce it across the organization, which weakens every control built on it. A missed review cycle is a weakness, but an approved policy that is slightly old still carries management's mandate.
Without senior management approval, the policy lacks the authority needed to enforce it across the organization, which weakens every control built on it. A missed review cycle is a weakness, but an approved policy that is slightly old still carries management's mandate.
Question 5IS Operations & Business Resilience
Northbay Retail has asked its IT team to build a business continuity plan from scratch. Which activity should an IS auditor expect the team to complete FIRST?
Correct answer: B. Performing a business impact analysis to rank critical processes
A business impact analysis identifies which processes are critical and how long the business can tolerate their loss, and every later decision depends on it. Choosing a hot site first is tempting, but without BIA results the company cannot know whether a hot site is needed or justified.
A business impact analysis identifies which processes are critical and how long the business can tolerate their loss, and every later decision depends on it. Choosing a hot site first is tempting, but without BIA results the company cannot know whether a hot site is needed or justified.
Question 6Protection of Information Assets
An IS auditor is evaluating the effectiveness of a company's security awareness program. Which of the following provides the BEST evidence that the program is achieving its objectives?
Correct answer: A. A sustained increase in staff reporting of simulated phishing emails
A rising rate of staff reporting simulated phishing shows changed behavior, which is the real goal of awareness training. Completion rates are tempting, but they only show attendance, not whether staff apply what they learned.
A rising rate of staff reporting simulated phishing shows changed behavior, which is the real goal of awareness training. Completion rates are tempting, but they only show attendance, not whether staff apply what they learned.
Question 7IS Acquisition, Development & Implementation
A mid-size retailer's ERP project is halfway through development, and costs have risen 40% above the original estimate. The project manager plans to ask for more funding. What should the IS auditor recommend FIRST?
Correct answer: D. Re-evaluate the business case to confirm the project is still justified
When costs or benefits change significantly, the business case should be revisited to confirm the project still delivers value before more money is committed. Simply approving extra funding skips that check and may put more money into a project that is no longer worth finishing.
When costs or benefits change significantly, the business case should be revisited to confirm the project still delivers value before more money is committed. Simply approving extra funding skips that check and may put more money into a project that is no longer worth finishing.
Question 8Governance & Management of IT
Which of the following is the PRIMARY role of an IT steering committee?
Correct answer: A. Prioritizing IT investments in line with business strategy
A steering committee brings business and IT leaders together to set priorities and approve investments that support strategy. Reviewing IT general controls is an assurance task for internal audit, not a steering committee duty.
A steering committee brings business and IT leaders together to set priorities and approve investments that support strategy. Reviewing IT general controls is an assurance task for internal audit, not a steering committee duty.
Question 9Information System Auditing Process
During an audit at a retail company, the department head whose controls are under review offers the IS auditor a large personal discount on store products. What should the auditor do?
Correct answer: C. Decline the offer and tell audit management about it
Accepting a gift from the auditee creates at least the appearance of impaired independence, which the ISACA Code of Ethics requires auditors to avoid. Telling audit management keeps the matter transparent. Waiting until fieldwork ends does not remove the conflict, because the report is still pending.
Accepting a gift from the auditee creates at least the appearance of impaired independence, which the ISACA Code of Ethics requires auditors to avoid. Telling audit management keeps the matter transparent. Waiting until fieldwork ends does not remove the conflict, because the report is still pending.
Question 10IS Operations & Business Resilience
During an audit, an IS auditor learns that the marketing team pays for an online file-sharing service with a corporate card and stores customer lists in it without IT's knowledge. What should the auditor do FIRST?
Correct answer: A. Determine what data is stored there and assess the related risk
The auditor first needs to understand what data is involved and how exposed it is before reporting and recommending action. Cancelling or blocking the service are management decisions that could disrupt the business, and an auditor recommends such fixes rather than ordering or carrying them out.
The auditor first needs to understand what data is involved and how exposed it is before reporting and recommending action. Cancelling or blocking the service are management decisions that could disrupt the business, and an auditor recommends such fixes rather than ordering or carrying them out.
Question 11Protection of Information Assets
A hospital is launching a data classification program covering patient records, research data and billing files. Who should be accountable for assigning the classification level to each data set?
Correct answer: D. The data owner in the relevant business unit
Data owners understand the business value and sensitivity of their information, so they are accountable for classifying it. The security officer designs the classification scheme and advises owners, but should not decide the level for business data on their behalf.
Data owners understand the business value and sensitivity of their information, so they are accountable for classifying it. The security officer designs the classification scheme and advises owners, but should not decide the level for business data on their behalf.
Question 12IS Operations & Business Resilience
During a review of the business impact analysis at Cedar Logistics, an IS auditor notes that recovery time objectives were set solely by the IT department based on technical effort. What is the auditor's GREATEST concern?
Correct answer: B. The RTOs may not reflect how long the business can tolerate an outage
Recovery time objectives must come from business process owners, because only they can judge the impact of downtime on operations, revenue and customers. Cost is a valid later consideration, but the more basic problem is that the targets may not match business needs at all.
Recovery time objectives must come from business process owners, because only they can judge the impact of downtime on operations, revenue and customers. Cost is a valid later consideration, but the more basic problem is that the targets may not match business needs at all.
Question 13Protection of Information Assets
During a review of the security awareness program at a retail firm, an IS auditor finds that new employees attend awareness training only at the next scheduled quarterly session. What should the auditor recommend?
Correct answer: C. Require new staff to complete awareness training before receiving system access
Training new staff before they get access closes the window in which untrained users can expose systems. Running sessions monthly shortens the gap but still lets new hires work with data before they are trained.
Training new staff before they get access closes the window in which untrained users can expose systems. Running sessions monthly shortens the gap but still lets new hires work with data before they are trained.
Question 14IS Acquisition, Development & Implementation
During development of a claims system for an insurer, a business unit asks to add a mobile portal that would extend the timeline by three months. Who should approve this change?
Correct answer: B. The steering committee, after reviewing the cost and schedule impact
Significant scope changes affect cost, schedule and benefits, so they need approval from the steering committee that governs the project. The requesting manager has an interest in the change and cannot weigh its impact on the whole project, and the auditor reviews the change process rather than approving changes.
Significant scope changes affect cost, schedule and benefits, so they need approval from the steering committee that governs the project. The requesting manager has an interest in the change and cannot weigh its impact on the whole project, and the auditor reviews the change process rather than approving changes.
Question 15Governance & Management of IT
At a small retailer, the only two developers can also move code into production. Management says hiring more staff is not possible. Which of the following should the IS auditor recommend as the BEST compensating control?
Correct answer: D. Have an independent person regularly review production change logs
When duties cannot be separated, a regular review of production changes by someone independent can catch unauthorized moves. A signed code of conduct sets expectations but does not detect or prevent improper changes.
When duties cannot be separated, a regular review of production changes by someone independent can catch unauthorized moves. A signed code of conduct sets expectations but does not detect or prevent improper changes.
Question 16Information System Auditing Process
Eight months ago, an IS auditor helped design the access approval process for a new payroll system. She is now assigned to audit that system. What is the BEST course of action?
Correct answer: B. Disclose her prior involvement to audit management first
Prior design work on the area under review can impair objectivity, so the auditor should disclose it and let audit management decide whether to reassign the work. Limiting testing to other controls leaves part of the system unassessed and still does not resolve the independence issue.
Prior design work on the area under review can impair objectivity, so the auditor should disclose it and let audit management decide whether to reassign the work. Limiting testing to other controls leaves part of the system unassessed and still does not resolve the independence issue.
Question 17IS Operations & Business Resilience
An IS auditor notes that night-shift operators can add or change jobs in the production batch schedule without approval to handle urgent user requests. Which is the GREATEST concern?
Correct answer: C. Unauthorized programs could be run against production data files
Unapproved schedule changes let programs run against live data without anyone confirming they are authorized, which threatens data integrity. Missing the batch window is an availability issue, but it is less serious than unauthorized processing.
Unapproved schedule changes let programs run against live data without anyone confirming they are authorized, which threatens data integrity. Missing the batch window is an availability issue, but it is less serious than unauthorized processing.
Question 18Protection of Information Assets
A logistics company wants to classify its information so that protection levels match sensitivity. What should be done FIRST?
Correct answer: A. Build an inventory of information assets and their owners
Classification cannot be applied to assets that have not been identified, so an inventory with assigned owners comes first. DLP rules and access lists depend on knowing which data is sensitive, so they follow classification rather than lead it.
Classification cannot be applied to assets that have not been identified, so an inventory with assigned owners comes first. DLP rules and access lists depend on knowing which data is sensitive, so they follow classification rather than lead it.
Question 19Governance & Management of IT
A bank plans to outsource its core processing to a third-party provider. During contract review, which clause is MOST important from an IS audit perspective?
Correct answer: D. A clause giving the bank the right to audit the provider's controls
The bank remains accountable for outsourced processing, so it needs a contractual right to audit or obtain assurance over the provider's controls. Volume discounts affect cost but give no assurance that the service is controlled.
The bank remains accountable for outsourced processing, so it needs a contractual right to audit or obtain assurance over the provider's controls. Volume discounts affect cost but give no assurance that the service is controlled.
Question 20Information System Auditing Process
An IS auditor is developing the annual IS audit plan for a bank that has limited audit resources. What should the auditor do FIRST?
Correct answer: A. Assess risks to the business processes and supporting IT
A risk assessment directs limited resources to the areas that pose the greatest risk to business objectives. Prior findings are one input to that assessment, but on their own they ignore new systems and recent changes in the business.
A risk assessment directs limited resources to the areas that pose the greatest risk to business objectives. Prior findings are one input to that assessment, but on their own they ignore new systems and recent changes in the business.
Question 21IS Operations & Business Resilience
An IS auditor finds that the disaster recovery plan sets a recovery time objective of 72 hours for order processing, while the business impact analysis states a maximum tolerable downtime of 48 hours. What should the auditor recommend?
Correct answer: C. Reduce the recovery time objective so it falls within the 48-hour MTD
The RTO must be shorter than the MTD, otherwise the business may suffer unacceptable harm before recovery is complete. Raising the MTD to fit the plan reverses the logic, since MTD is set by business impact and not by what IT can currently deliver.
The RTO must be shorter than the MTD, otherwise the business may suffer unacceptable harm before recovery is complete. Raising the MTD to fit the plan reverses the logic, since MTD is set by business impact and not by what IT can currently deliver.
Question 22Protection of Information Assets
A help desk agent at a logistics company reset a password after a caller claimed to be a traveling executive who urgently needed access. The account was later misused. Which control would BEST have prevented this?
Correct answer: D. A mandatory identity verification procedure for all password reset requests
The attack relied on pretexting, so the best preventive control is a verification step the agent must follow regardless of urgency or seniority. Call recording and reset reports are detective and would only reveal the misuse after it happened.
The attack relied on pretexting, so the best preventive control is a verification step the agent must follow regardless of urgency or seniority. Call recording and reset reports are detective and would only reveal the misuse after it happened.
Question 23IS Acquisition, Development & Implementation
An IS auditor reviews the feasibility study for a new inventory system at a distribution company. The study analyzes only one option: building the system in-house. What is the auditor's GREATEST concern?
Correct answer: D. A more cost-effective solution may have been overlooked
A feasibility study should compare alternatives such as buying a package, building, or changing the process, so management can choose the most cost-effective option. Missing program specifications or test plans are not a concern here because they belong to later SDLC phases.
A feasibility study should compare alternatives such as buying a package, building, or changing the process, so management can choose the most cost-effective option. Missing program specifications or test plans are not a concern here because they belong to later SDLC phases.
Question 24Governance & Management of IT
An organization wants to show its board how IT contributes to business value beyond financial results. Which of the following would BEST meet this goal?
Correct answer: B. A balanced scorecard with customer, process, financial and growth views
An IT balanced scorecard measures performance across several perspectives, so it shows value beyond cost alone. A budget-versus-actual report is useful but covers only the financial view.
An IT balanced scorecard measures performance across several perspectives, so it shows value beyond cost alone. A budget-versus-actual report is useful but covers only the financial view.
Question 25Information System Auditing Process
Which component of audit risk can an IS auditor directly reduce by changing the nature, timing and extent of audit procedures?
Correct answer: C. Detection risk
Detection risk is the risk that the auditor's own procedures fail to find a material error, so more or better testing lowers it. Control risk depends on the organization's controls, which the auditor evaluates but does not change.
Detection risk is the risk that the auditor's own procedures fail to find a material error, so more or better testing lowers it. Control risk depends on the organization's controls, which the auditor evaluates but does not change.
Question 26IS Operations & Business Resilience
A batch job that posts customer payments abended midway, and the operator restarted it from the beginning. As a result, several payments were posted twice. Which control would BEST prevent this from happening again?
Correct answer: D. Documented restart procedures that use checkpoints in the job
Checkpoint and restart procedures let the job resume from the last successful point, so records already processed are not posted again. Supervisor approval adds oversight, but the supervisor could still approve a full rerun that creates the same duplicates.
Checkpoint and restart procedures let the job resume from the last successful point, so records already processed are not posted again. Supervisor approval adds oversight, but the supervisor could still approve a full rerun that creates the same duplicates.
Question 27Protection of Information Assets
A retail chain collected customer mobile numbers only to send delivery updates. The marketing team now plans to use the same numbers for promotional text campaigns. What should be the IS auditor's PRIMARY concern?
Correct answer: C. The new use may go beyond the purpose customers agreed to
Privacy principles such as purpose limitation require personal data to be used only for the purposes stated when it was collected. Reusing it for marketing without fresh consent creates legal and reputational exposure, which outweighs data quality or capacity issues.
Privacy principles such as purpose limitation require personal data to be used only for the purposes stated when it was collected. Reusing it for marketing without fresh consent creates legal and reputational exposure, which outweighs data quality or capacity issues.
Question 28IS Operations & Business Resilience
Pinecrest Insurance has defined a recovery point objective of 2 hours for its claims database, but it relies only on a full backup taken each night. Which recommendation BEST addresses this gap?
Correct answer: B. Add log shipping or replication so data loss stays within two hours
The RPO sets the maximum acceptable data loss, so backup or replication must happen at least as often as the RPO. Sending the media offsite sooner protects the existing backup but does nothing about the up to 24 hours of data that could still be lost.
The RPO sets the maximum acceptable data loss, so backup or replication must happen at least as often as the RPO. Sending the media offsite sooner protects the existing backup but does nothing about the up to 24 hours of data that could still be lost.
Question 29Protection of Information Assets
The accounts payable team of a manufacturing company received an email, appearing to come from a long-standing supplier, asking that future payments be sent to a new bank account. Which control should an IS auditor expect to be MOST effective against this type of fraud?
Correct answer: C. Calling the supplier on a known number to confirm any change to bank details
Out-of-band confirmation using contact details already on file defeats a spoofed or compromised email account, because the fraudster does not control that channel. Dual approval is tempting, but both approvers would see the same convincing email and approve the payment.
Out-of-band confirmation using contact details already on file defeats a spoofed or compromised email account, because the fraudster does not control that channel. Dual approval is tempting, but both approvers would see the same convincing email and approve the payment.
Question 30IS Acquisition, Development & Implementation
A bank's project team asks the IS auditor to design the access control module for a new loan system because of the auditor's control expertise. What is the BEST response?
Correct answer: A. Advise on control requirements and let the project team do the design
Auditors add value during development by advising on control requirements, but designing the controls themselves would impair independence when the system is later audited. Refusing all involvement until production is also poor practice, since control gaps are cheaper to fix early.
Auditors add value during development by advising on control requirements, but designing the controls themselves would impair independence when the system is later audited. Refusing all involvement until production is also poor practice, since control gaps are cheaper to fix early.
Question 31Governance & Management of IT
While reviewing a new customer loyalty application, an IS auditor notes that it collects national ID numbers, although the program only needs names and email addresses. Which of the following is the auditor's PRIMARY concern?
Correct answer: B. The collection may breach the data minimization privacy principle
Collecting personal data beyond what the stated purpose requires conflicts with data minimization and increases legal and breach exposure. Extra storage is a minor operational effect compared with privacy noncompliance.
Collecting personal data beyond what the stated purpose requires conflicts with data minimization and increases legal and breach exposure. Extra storage is a minor operational effect compared with privacy noncompliance.
Question 32Information System Auditing Process
An order entry screen rejects any quantity field that contains letters and does not allow the record to be saved. How is this control BEST classified?
Correct answer: A. Preventive control
The edit check stops invalid data before it is recorded, which makes it preventive. A detective control would only identify the bad data after it had been entered, for example through an exception report.
The edit check stops invalid data before it is recorded, which makes it preventive. A detective control would only identify the bad data after it had been entered, for example through an exception report.
Question 33IS Operations & Business Resilience
An IS auditor is reviewing a nightly interface that sends employee hours from the time-keeping system to the payroll system. Which control BEST ensures that all records are transferred completely?
Correct answer: C. Reconciling record counts and hash totals between both systems
Comparing record counts and control totals from the sending and receiving systems shows directly whether any records were lost or added. A weekly error log review comes late and will not reveal records that were dropped without generating an error.
Comparing record counts and control totals from the sending and receiving systems shows directly whether any records were lost or added. A weekly error log review comes late and will not reveal records that were dropped without generating an error.
Question 34Protection of Information Assets
A company is building a new staffed data center and wants water-based fire protection that limits the chance of water damage from a broken pipe or a single faulty sensor. Which system is MOST appropriate?
Correct answer: D. Preaction sprinklers that need two triggering events
A preaction system keeps the pipes dry until the detection system signals a fire, and water flows only when a sprinkler head also activates, so a single fault does not flood equipment. Wet-pipe systems hold water in the pipes at all times, so a leak or damaged head can soak equipment directly.
A preaction system keeps the pipes dry until the detection system signals a fire, and water flows only when a sprinkler head also activates, so a single fault does not flood equipment. Wet-pipe systems hold water in the pipes at all times, so a leak or damaged head can soak equipment directly.
Question 35IS Operations & Business Resilience
An IS auditor finds that the database server holding a company's customer orders uses a RAID 0 disk array to improve performance. What is the PRIMARY risk?
Correct answer: D. The loss of any one disk will make all data on the volume unavailable
RAID 0 stripes data across disks with no mirroring or parity, so it gives no fault tolerance and one disk failure loses the whole volume. The parity and mirroring options describe RAID 5 and RAID 1, which are the levels that would actually protect the data.
RAID 0 stripes data across disks with no mirroring or parity, so it gives no fault tolerance and one disk failure loses the whole volume. The parity and mirroring options describe RAID 5 and RAID 1, which are the levels that would actually protect the data.
Question 36Protection of Information Assets
While auditing an interest calculation system at a bank, an IS auditor discovers that fractions of a cent from rounding on thousands of accounts are being credited to a single internal account. This is an example of which technique?
Correct answer: A. Salami technique
The salami technique takes very small amounts from many transactions so that each change goes unnoticed while the total grows. Data diddling is tempting, but it means changing data before or during input rather than skimming tiny amounts through rounding.
The salami technique takes very small amounts from many transactions so that each change goes unnoticed while the total grows. Data diddling is tempting, but it means changing data before or during input rather than skimming tiny amounts through rounding.
Question 37Governance & Management of IT
Which of the following should determine the classification level of a customer data set?
Correct answer: B. The business data owner accountable for the data set
The data owner understands the data's business value and sensitivity and is accountable for assigning its classification. The security manager defines the classification scheme, but does not decide the level for each business data set.
The data owner understands the data's business value and sensitivity and is accountable for assigning its classification. The security manager defines the classification scheme, but does not decide the level for each business data set.
Question 38Information System Auditing Process
At a small credit union, one employee both posts customer payments and reconciles the bank account because of staff limits. Which of the following is the BEST compensating control?
Correct answer: D. Independent supervisory review of each reconciliation
A manager's independent review of each reconciliation provides a check on the person who also posts payments, which addresses the segregation of duties gap. Job rotation every few years is too infrequent to detect errors or fraud in a timely way.
A manager's independent review of each reconciliation provides a check on the person who also posts payments, which addresses the segregation of duties gap. Job rotation every few years is too infrequent to detect errors or fraud in a timely way.
Question 39IS Acquisition, Development & Implementation
A logistics company uses prototyping to build a new dispatch application, with users refining screens over several iterations. What is the PRIMARY risk the IS auditor should raise?
Correct answer: C. Controls may be overlooked because the focus is on what users see
Prototyping centers on what users see and want, so edit checks, audit trails and other controls can be missed in the final system. Excessive documentation is not the risk, because prototyping usually produces too little of it.
Prototyping centers on what users see and want, so edit checks, audit trails and other controls can be missed in the final system. Excessive documentation is not the risk, because prototyping usually produces too little of it.
Question 40IS Operations & Business Resilience
The finance team uses a large spreadsheet with complex formulas to calculate monthly revenue accruals that are posted to the general ledger. Which finding should concern an IS auditor MOST?
Correct answer: B. Formula changes are made without version control or independent review
Without change control and an independent check, a formula error or deliberate change could misstate the ledger with no one noticing. A business user building the tool is common and acceptable when proper controls exist, so it is not the main concern.
Without change control and an independent check, a formula error or deliberate change could misstate the ledger with no one noticing. A business user building the tool is common and acceptable when proper controls exist, so it is not the main concern.
Question 41Protection of Information Assets
During a data center walkthrough, an IS auditor notes that the environmental monitor shows relative humidity holding at about 15 percent. Which risk is MOST directly increased?
Correct answer: C. Damage to components from electrostatic discharge
Very low humidity allows static charge to build up, and the resulting discharges can damage sensitive electronic components. Corrosion and condensation are risks of humidity that is too high, not too low.
Very low humidity allows static charge to build up, and the resulting discharges can damage sensitive electronic components. Corrosion and condensation are risks of humidity that is too high, not too low.
Question 42Governance & Management of IT
An IS auditor reviewing the enterprise risk management program finds that each IT manager sets personal risk acceptance thresholds. Which of the following should the auditor recommend?
Correct answer: A. Senior management should define risk appetite for the enterprise
Risk appetite is set by the board and senior management so that risk decisions across the enterprise are consistent. Having internal audit set thresholds would impair its independence, because it would later audit its own decisions.
Risk appetite is set by the board and senior management so that risk decisions across the enterprise are consistent. Having internal audit set thresholds would impair its independence, because it would later audit its own decisions.
Question 43Information System Auditing Process
Which of the following is the PRIMARY purpose of an IS audit charter?
Correct answer: B. Set out the audit function's authority, scope and duties
The charter is approved at the highest level and gives the audit function its mandate, including authority, scope and responsibility. Detailed test steps belong in individual audit programs, which change for each engagement.
The charter is approved at the highest level and gives the audit function its mandate, including authority, scope and responsibility. Detailed test steps belong in individual audit programs, which change for each engagement.
Question 44IS Operations & Business Resilience
Harbor Bank runs its payment application on a two-node active-passive cluster. An IS auditor notes that both nodes sit in the same rack and draw power from a single power distribution unit. What is the MAIN concern?
Correct answer: A. The shared power unit is a single point of failure for both nodes
Clustering is meant to remove single points of failure, but if both nodes depend on one power unit, a single fault takes down the whole service. Failover speed may be worth testing, yet it matters little when one power fault can stop both nodes at once.
Clustering is meant to remove single points of failure, but if both nodes depend on one power unit, a single fault takes down the whole service. Failover speed may be worth testing, yet it matters little when one power fault can stop both nodes at once.
Question 45Protection of Information Assets
A company has engaged an external firm to perform a penetration test of its internet-facing applications. Which of the following should an IS auditor verify FIRST?
Correct answer: C. Management has formally approved the test scope and rules of engagement
Written management approval of scope and rules of engagement protects the organization legally and sets limits that avoid harm to systems. Tester certifications matter, but testing without authorization is a serious problem no matter how qualified the testers are.
Written management approval of scope and rules of engagement protects the organization legally and sets limits that avoid harm to systems. Tester certifications matter, but testing without authorization is a serious problem no matter how qualified the testers are.
Question 46IS Acquisition, Development & Implementation
An IS auditor reviews a Scrum project for a new customer portal at a telecom company. The product owner seldom attends sprint reviews, and developers accept completed stories themselves. What is the auditor's GREATEST concern?
Correct answer: B. Delivered features may not reflect actual business needs
In Scrum the product owner represents the business and accepts work against agreed criteria. When developers accept their own stories, nobody independently confirms the features meet business needs. Not finishing the full backlog is a schedule matter, and agile expects scope to be reprioritized.
In Scrum the product owner represents the business and accepts work against agreed criteria. When developers accept their own stories, nobody independently confirms the features meet business needs. Not finishing the full backlog is a schedule matter, and agile expects scope to be reprioritized.
Question 47Governance & Management of IT
An IS auditor finds that the information security policy was last reviewed four years ago, although the company has since moved most workloads to the cloud. Which of the following is the GREATEST risk?
Correct answer: D. The policy may not address current threats and business practices
A policy that was not updated after a major change may leave cloud risks and new requirements unaddressed, weakening the whole control framework. Missing acknowledgments matter less when the policy itself is out of date.
A policy that was not updated after a major change may leave cloud risks and new requirements unaddressed, weakening the whole control framework. Missing acknowledgments matter less when the policy itself is out of date.
Question 48Information System Auditing Process
An IS auditor wants to estimate the rate at which change requests in a ticketing system are missing the required approval. Which sampling method is MOST appropriate?
Correct answer: A. Attribute sampling
Attribute sampling estimates how often a characteristic, such as a missing approval, occurs in a population, which suits compliance testing. Variable sampling, mean per unit and difference estimation measure amounts and are used in substantive testing.
Attribute sampling estimates how often a characteristic, such as a missing approval, occurs in a population, which suits compliance testing. Variable sampling, mean per unit and difference estimation measure amounts and are used in substantive testing.
Question 49IS Operations & Business Resilience
A company has inconsistent customer address data across its billing, CRM and shipping systems. Which role should be accountable for defining the data quality rules for customer data?
Correct answer: B. The business data owner responsible for customer information
The business data owner understands how the data is used and is accountable for its quality, classification and access rules. A custodian or DBA carries out technical tasks on the owner's behalf but should not decide what makes the data correct.
The business data owner understands how the data is used and is accountable for its quality, classification and access rules. A custodian or DBA carries out technical tasks on the owner's behalf but should not decide what makes the data correct.
Question 50Protection of Information Assets
A data center relies on a diesel generator that takes about 90 seconds to reach full output after a utility power failure. No other power protection is installed. What is the IS auditor's PRIMARY concern?
Correct answer: D. Systems will lose power before the generator takes over
Without an uninterruptible power supply to bridge the gap, servers shut down abruptly during the startup delay, causing outages and possible data corruption. Fuel quality and capacity planning matter, but they do not cause an interruption on every utility failure the way this gap does.
Without an uninterruptible power supply to bridge the gap, servers shut down abruptly during the startup delay, causing outages and possible data corruption. Fuel quality and capacity planning matter, but they do not cause an interruption on every utility failure the way this gap does.
Question 51IS Operations & Business Resilience
A company wants to keep nightly backup windows short while ensuring that a restore after a failure needs as few backup sets as possible. Which approach BEST meets both goals?
Correct answer: D. A weekly full backup with differential backups each night
With differentials, a restore needs only the last full backup and the latest differential, while nightly jobs stay smaller than full backups. Weekly full plus incremental gives the shortest nightly window, but a restore may need the full set plus up to six incrementals, which slows recovery and adds failure points.
With differentials, a restore needs only the last full backup and the latest differential, while nightly jobs stay smaller than full backups. Weekly full plus incremental gives the shortest nightly window, but a restore may need the full set plus up to six incrementals, which slows recovery and adds failure points.
Question 52Protection of Information Assets
An organization wants a penetration test that will also evaluate how well its security operations team detects and responds to a real attack. Which type of test would BEST meet this objective?
Correct answer: A. A double-blind test in which the security team is not told about the test
In a double-blind test the defenders are not told in advance, so their detection and response are tested under realistic conditions. A blind test limits what the testers know, but the security team is aware and may react differently than in a real attack.
In a double-blind test the defenders are not told in advance, so their detection and response are tested under realistic conditions. A blind test limits what the testers know, but the security team is aware and may react differently than in a real attack.
Question 53Governance & Management of IT
Which of the following is the PRIMARY benefit of a well-maintained enterprise architecture?
Correct answer: C. It helps align technology investments with business needs
Enterprise architecture describes current and target states of business and technology so that investments support business goals and avoid duplication. Standardizing on fewer platforms can be an outcome, but it is not guaranteed and is not the main purpose.
Enterprise architecture describes current and target states of business and technology so that investments support business goals and avoid duplication. Standardizing on fewer platforms can be an outcome, but it is not guaranteed and is not the main purpose.
Question 54Information System Auditing Process
An IS auditor needs to estimate the total dollar value by which inventory records in a warehouse system are overstated. Which sampling approach is MOST suitable?
Correct answer: A. Variable sampling
Variable sampling is used to estimate a monetary amount or other quantity, such as the total value of an overstatement. Attribute sampling only gives a rate of occurrence, so it cannot tell the auditor how large the misstatement is in dollars.
Variable sampling is used to estimate a monetary amount or other quantity, such as the total value of an overstatement. Attribute sampling only gives a rate of occurrence, so it cannot tell the auditor how large the misstatement is in dollars.
Question 55IS Acquisition, Development & Implementation
Data entry clerks at a utility company often transpose digits when keying customer account numbers, so payments post to the wrong accounts. Which control would BEST detect this error at input?
Correct answer: B. A check digit verified on the account number
A check digit is a calculated digit added to a number, and it detects transposition and transcription errors when the number is keyed. A record count only confirms how many items were processed, so a payment posted to the wrong account would still pass.
A check digit is a calculated digit added to a number, and it detects transposition and transcription errors when the number is keyed. A record count only confirms how many items were processed, so a payment posted to the wrong account would still pass.
Question 56IS Operations & Business Resilience
An IS auditor is evaluating how an organization plans server capacity for its core banking application. Which information should the capacity plan be PRIMARILY based on?
Correct answer: B. Historical usage trends combined with forecast business growth
Good capacity planning projects future demand by combining measured usage trends with expected business changes such as new products or customers. A single month-end peak shows current stress but says nothing about how demand will change.
Good capacity planning projects future demand by combining measured usage trends with expected business changes such as new products or customers. A single month-end peak shows current stress but says nothing about how demand will change.
Question 57Protection of Information Assets
Employees at a financial services firm often hold the data center door open for colleagues who have not badged in. Which control would MOST effectively prevent unauthorized people from entering behind an authorized person?
Correct answer: C. A mantrap that admits only one person at a time
A mantrap physically limits entry to one authenticated person per cycle, so it prevents unauthorized entry rather than only discouraging or recording it. Cameras and log reviews are detective controls that reveal the problem after access has already occurred.
A mantrap physically limits entry to one authenticated person per cycle, so it prevents unauthorized entry rather than only discouraging or recording it. Cameras and log reviews are detective controls that reveal the problem after access has already occurred.
Question 58Governance & Management of IT
A new data protection regulation takes effect in nine months. An IS auditor is asked to assess the organization's readiness. What should the auditor do FIRST?
Correct answer: B. Find out whether management has identified the new requirements
Readiness depends first on whether management understands what the regulation requires and how it applies; testing and recommendations follow from that. Drafting procedures would mean the auditor is building controls, which impairs independence.
Readiness depends first on whether management understands what the regulation requires and how it applies; testing and recommendations follow from that. Drafting procedures would mean the auditor is building controls, which impairs independence.
Question 59Information System Auditing Process
An IS auditor expects very few errors in a population of quarterly user access reviews and wants to avoid testing more items than necessary. Which sampling method BEST meets this goal?
Correct answer: D. Stop-or-go sampling
Stop-or-go sampling lets the auditor end testing at the earliest point the results support a conclusion, which prevents excessive sampling when few errors are expected. Discovery sampling is meant to find at least one instance of a rare, critical event, not to minimize testing.
Stop-or-go sampling lets the auditor end testing at the earliest point the results support a conclusion, which prevents excessive sampling when few errors are expected. Discovery sampling is meant to find at least one instance of a rare, critical event, not to minimize testing.
Question 60IS Operations & Business Resilience
At Willow Health, backup media are reused on a two-week cycle. Investigators later find that malware was planted on the file server five weeks before it activated. What is the MOST appropriate recommendation?
Correct answer: A. Use a grandfather-father-son rotation to keep older restore points
A two-week cycle means every clean copy was overwritten before the infection was found. A grandfather-father-son scheme keeps weekly and monthly generations, giving clean restore points from before the malware was planted. More daily backups would only add more infected copies within the same short window.
A two-week cycle means every clean copy was overwritten before the infection was found. A grandfather-father-son scheme keeps weekly and monthly generations, giving clean restore points from before the malware was planted. More daily backups would only add more infected copies within the same short window.
Question 61Protection of Information Assets
An IS auditor reviews the output of a recent vulnerability scan that lists a large number of critical findings on database servers. What should the auditor do FIRST?
Correct answer: C. Find out whether the findings were validated to rule out false positives
Scanners often report false positives, so the auditor should confirm the results were validated before drawing conclusions. Reporting straight to management could overstate the risk and harm the auditor's credibility if many findings prove invalid.
Scanners often report false positives, so the auditor should confirm the results were validated before drawing conclusions. Reporting straight to management could overstate the risk and harm the auditor's credibility if many findings prove invalid.
Question 62IS Acquisition, Development & Implementation
A payroll system at a manufacturing firm lets supervisors enter weekly hours. Company policy says no employee may be paid for more than 60 hours in a week. Which edit check enforces this rule?
Correct answer: A. A limit check on the hours field
A limit check rejects or flags values above a set maximum, which matches a 60-hour ceiling. An existence check confirms that an entry matches a valid value, such as a code in a master file, so it does not enforce a numeric maximum.
A limit check rejects or flags values above a set maximum, which matches a 60-hour ceiling. An existence check confirms that an entry matches a valid value, such as a code in a master file, so it does not enforce a numeric maximum.
Question 63IS Operations & Business Resilience
An IS auditor reviewing problem management notes that the service desk maintains a known error database. What is the PRIMARY benefit of this database?
Correct answer: D. It helps staff resolve repeat incidents using recorded workarounds
A known error database records problems with a known cause or workaround, so the service desk can restore service faster when the same symptoms return. It does not replace root cause analysis, because a permanent fix is still needed to remove the error.
A known error database records problems with a known cause or workaround, so the service desk can restore service faster when the same symptoms return. It does not replace root cause analysis, because a permanent fix is still needed to remove the error.
Question 64Protection of Information Assets
An IS auditor finds that data center camera footage is overwritten after seven days, while exceptions from the badge access system are reviewed once a month. What is the GREATEST concern?
Correct answer: A. Footage may be gone before flagged events are examined
When footage is deleted before badge exceptions are reviewed, the organization cannot confirm who actually entered during a suspicious event. Camera coverage is worth checking, but the mismatch between retention and review timing is the specific gap shown by the evidence.
When footage is deleted before badge exceptions are reviewed, the organization cannot confirm who actually entered during a suspicious event. Camera coverage is worth checking, but the mismatch between retention and review timing is the specific gap shown by the evidence.
Question 65Governance & Management of IT
An IS auditor finds that the software quality assurance team reports to the application development manager. Which of the following is the PRIMARY concern?
Correct answer: C. Quality findings may be played down to meet delivery deadlines
QA must be independent of the group whose work it reviews; reporting to development creates pressure to downplay defects so projects ship on time. Skill gaps can be fixed with training, but the reporting line weakens objectivity regardless of skill.
QA must be independent of the group whose work it reviews; reporting to development creates pressure to downplay defects so projects ship on time. Skill gaps can be fixed with training, but the reporting line weakens objectivity regardless of skill.
Question 66Information System Auditing Process
An IS auditor investigating possible fraud needs a sampling approach that will reveal at least one fictitious vendor payment if such payments exist. Which method is MOST appropriate?
Correct answer: D. Discovery sampling
Discovery sampling is a type of attribute sampling used when the expected rate is very low and even one occurrence, such as a fraudulent payment, is significant. Stop-or-go sampling aims to reduce sample size and is not designed to detect a single critical event.
Discovery sampling is a type of attribute sampling used when the expected rate is very low and even one occurrence, such as a fraudulent payment, is significant. Stop-or-go sampling aims to reduce sample size and is not designed to detect a single critical event.
Question 67IS Operations & Business Resilience
An IS auditor visits the offsite storage facility used by Maple Manufacturing and finds it in an adjacent building on the same industrial site as the main data center. What is the auditor's PRIMARY concern?
Correct answer: D. The facility may be hit by the same event that affects the data center
Offsite storage must be far enough away that a fire, flood or other event affecting the data center will not also destroy the backups. Climate controls matter for media life, but they are less important than the risk of losing production and backup data in the same incident.
Offsite storage must be far enough away that a fire, flood or other event affecting the data center will not also destroy the backups. Climate controls matter for media life, but they are less important than the risk of losing production and backup data in the same incident.
Question 68Protection of Information Assets
An IS auditor reviewing a security monitoring configuration notes that alerts for failed logins are generated only after a defined number of failures within a set period. What is the PRIMARY purpose of this clipping level?
Correct answer: B. To filter out routine user errors so that suspicious activity stands out
A clipping level sets a baseline of normal errors, so only activity above that threshold is flagged for review. Account lockout is a related but separate control and is not the purpose of a monitoring threshold.
A clipping level sets a baseline of normal errors, so only activity above that threshold is flagged for review. Account lockout is a related but separate control and is not the purpose of a monitoring threshold.
Question 69Governance & Management of IT
An IT service manager wants a metric that gives early warning before service levels are breached. Which of the following is the BEST choice?
Correct answer: C. Trend of open incidents nearing their resolution deadline
Incidents approaching their deadline are a leading indicator that lets managers act before an SLA is missed. Counting past breaches is a lagging measure that shows failure only after it has happened.
Incidents approaching their deadline are a leading indicator that lets managers act before an SLA is missed. Counting past breaches is a lagging measure that shows failure only after it has happened.
Question 70Information System Auditing Process
An IS auditor raises the confidence level for a statistical sample from 90% to 95%, with all other factors unchanged. What is the effect?
Correct answer: B. The required sample size increases
A higher confidence level means the auditor accepts less sampling risk, which requires a larger sample. Sampling risk actually falls as confidence rises, so the option stating it becomes higher reverses the relationship.
A higher confidence level means the auditor accepts less sampling risk, which requires a larger sample. Sampling risk actually falls as confidence rises, so the option stating it becomes higher reverses the relationship.
Question 71IS Acquisition, Development & Implementation
An accounts payable clerk adds up the vendor ID numbers on a batch of invoices before sending it for processing, and the system recalculates the sum afterward. This control is BEST described as:
Correct answer: C. A hash total to detect lost or altered records
Summing a non-financial field such as vendor IDs produces a hash total, which has no business meaning but changes if a record is lost, added or altered. A financial total sums amounts, so it would not detect a changed vendor ID when the amount stays the same.
Summing a non-financial field such as vendor IDs produces a hash total, which has no business meaning but changes if a record is lost, added or altered. A financial total sums amounts, so it would not detect a changed vendor ID when the amount stays the same.
Question 72IS Operations & Business Resilience
Help desk records show that an order processing application freezes several times a week, and each incident is closed after a technician restarts the server. What should an IS auditor recommend?
Correct answer: B. Open a problem record to find and fix the underlying cause
Repeated incidents with the same symptom point to an underlying problem that should be analyzed and fixed through problem management. Automating the restart only speeds up the workaround and leaves the cause, and the business disruption, in place.
Repeated incidents with the same symptom point to an underlying problem that should be analyzed and fixed through problem management. Automating the restart only speeds up the workaround and leaves the cause, and the business disruption, in place.
Question 73Protection of Information Assets
At a manufacturing firm, requests for access to the payroll application are approved by the help desk supervisor and then set up by the system administrator. What should the IS auditor recommend?
Correct answer: C. Have the payroll data owner approve access requests
The data owner knows who needs payroll access and is accountable for that data, so approval should rest with them. Logging requests in a ticketing tool improves record keeping but does not fix the fact that the wrong person is authorizing access.
The data owner knows who needs payroll access and is accountable for that data, so approval should rest with them. Logging requests in a ticketing tool improves record keeping but does not fix the fact that the wrong person is authorizing access.
Question 74IS Operations & Business Resilience
Ridgeway Services writes all backups to a network share that any domain administrator account can modify. Given the rise in ransomware attacks, which recommendation should the IS auditor make?
Correct answer: A. Keep at least one backup copy that is immutable or kept offline
Ransomware operators often take over admin accounts and encrypt or delete reachable backups before launching the attack. An immutable or offline copy cannot be changed with stolen credentials. Rotating passwords helps a little, but a compromised admin account would still have full access to the share.
Ransomware operators often take over admin accounts and encrypt or delete reachable backups before launching the attack. An immutable or offline copy cannot be changed with stolen credentials. Rotating passwords helps a little, but a compromised admin account would still have full access to the share.
Question 75Protection of Information Assets
At a healthcare provider, system administrators have full rights on the servers where the operating system security logs for those servers are stored. Which recommendation would BEST address the risk?
Correct answer: D. Forward the logs in real time to a central server administrators cannot alter
Administrators who can edit or delete logs on their own servers could hide their actions, so the logs must be moved quickly to a place they cannot modify. Management review is helpful, but it means little if the logs could already have been altered.
Administrators who can edit or delete logs on their own servers could hide their actions, so the logs must be moved quickly to a place they cannot modify. Management review is helpful, but it means little if the logs could already have been altered.
Question 76Governance & Management of IT
A company outsourced its help desk two years ago. An IS auditor finds that no one reviews the provider's monthly SLA reports. Which of the following should the auditor recommend?
Correct answer: A. Assign a vendor manager to review the reports and track issues
Ongoing monitoring by an accountable owner is needed to confirm the provider meets agreed service levels and to act on shortfalls. Ending the contract is an extreme step that is not justified until performance has actually been evaluated.
Ongoing monitoring by an accountable owner is needed to confirm the provider meets agreed service levels and to act on shortfalls. Ending the contract is an extreme step that is not justified until performance has actually been evaluated.
Question 77Information System Auditing Process
Which of the following provides the MOST reliable evidence of the balance held in a company's escrow account?
Correct answer: C. A confirmation received directly from the escrow agent
Evidence obtained directly from an independent external source is more reliable than evidence produced or supplied by the auditee. The general ledger report is internal and could contain the same error the auditor is trying to detect.
Evidence obtained directly from an independent external source is more reliable than evidence produced or supplied by the auditee. The general ledger report is internal and could contain the same error the auditor is trying to detect.
Question 78IS Operations & Business Resilience
Policy allows on-call staff to make emergency changes to production without prior approval. An IS auditor finds that none of these changes are reviewed afterward. What should the auditor recommend?
Correct answer: D. Require documented approval and review of each change after the fact
Emergency changes are acceptable when they are documented, approved and reviewed soon after implementation, which confirms they were valid and correct. Banning emergency changes could leave critical outages unresolved, so it is not a practical recommendation.
Emergency changes are acceptable when they are documented, approved and reviewed soon after implementation, which confirms they were valid and correct. Banning emergency changes could leave critical outages unresolved, so it is not a practical recommendation.
Question 79Protection of Information Assets
An IS auditor finds that accounts belonging to several employees who left the company months ago are still active in the ERP system. Which recommendation BEST addresses the root cause?
Correct answer: D. Link HR termination events to the deprovisioning process
Linking HR termination records to access removal ensures accounts are disabled promptly when employment ends. A quarterly inactivity script helps, but it leaves a gap of weeks and misses departed users whose accounts are still being used.
Linking HR termination records to access removal ensures accounts are disabled promptly when employment ends. A quarterly inactivity script helps, but it leaves a gap of weeks and misses departed users whose accounts are still being used.
Question 80IS Acquisition, Development & Implementation
An IS auditor finds that transactions rejected by edit checks in an order entry system are deleted by operators at the end of each day without further review. What should the auditor recommend?
Correct answer: B. Hold rejected items in a suspense file until corrected and resubmitted
Rejected transactions should be logged, tracked and corrected so valid orders are not lost and errors are resolved. Supervisor approval of deletions adds oversight but still discards the transactions instead of making sure they are fixed and processed.
Rejected transactions should be logged, tracked and corrected so valid orders are not lost and errors are resolved. Supervisor approval of deletions adds oversight but still discards the transactions instead of making sure they are fixed and processed.
Question 81Governance & Management of IT
A company relies on a cloud provider's SOC 2 Type 2 report for assurance. Which of the following is MOST important for the IS auditor to confirm?
Correct answer: B. The company operates the user controls the report says it relies on
A SOC 2 report assumes the customer performs certain complementary user entity controls; if they are missing, the provider's controls alone may not protect the company. The size of the audit firm says little about whether the controls meet the company's needs.
A SOC 2 report assumes the customer performs certain complementary user entity controls; if they are missing, the provider's controls alone may not protect the company. The size of the audit firm says little about whether the controls meet the company's needs.
Question 82Information System Auditing Process
An IS auditor wants to identify duplicate supplier payments among two million accounts payable transactions. Which approach is MOST effective?
Correct answer: D. Use audit software to analyze the whole population
Generalized audit software lets the auditor test the entire population independently and quickly for matching vendor, amount and date fields. A report written by IT is less reliable because the auditor did not control its logic or the data it used.
Generalized audit software lets the auditor test the entire population independently and quickly for matching vendor, amount and date fields. A report written by IT is less reliable because the auditor did not control its logic or the data it used.
Question 83IS Operations & Business Resilience
An IS auditor is assessing the effectiveness of backups at Silverline Credit. Which evidence BEST shows that data can be recovered when needed?
Correct answer: C. Records of periodic test restores that data owners have checked
A successful test restore, checked by the people who own the data, proves the backups are readable and complete. Job logs only show that the backup process ran, and they can report success even when files were skipped or media are unreadable.
A successful test restore, checked by the people who own the data, proves the backups are readable and complete. Job logs only show that the backup process ran, and they can report success even when files were skipped or media are unreadable.
Question 84Protection of Information Assets
An IS auditor is assessing the log retention settings of a financial services company. The retention period should PRIMARILY be based on:
Correct answer: B. legal, regulatory and business requirements for the information.
Retention must meet legal and regulatory obligations and the business need to investigate past events. Storage capacity is a practical factor to plan around, but it should not decide how long logs are kept.
Retention must meet legal and regulatory obligations and the business need to investigate past events. Storage capacity is a practical factor to plan around, but it should not decide how long logs are kept.
Question 85IS Operations & Business Resilience
An IS auditor finds that several production servers have security settings that differ from the approved configuration baseline, even though no changes were requested. Which control would BEST detect such differences in the future?
Correct answer: C. Automated scans that compare server settings to the baseline
Automated configuration monitoring regularly compares live settings with the approved baseline and flags drift quickly. An annual documentation review checks paperwork rather than actual settings, so differences could go unnoticed for months.
Automated configuration monitoring regularly compares live settings with the approved baseline and flags drift quickly. An annual documentation review checks paperwork rather than actual settings, so differences could go unnoticed for months.
Question 86Governance & Management of IT
An IS auditor notes that only one network engineer understands the configuration of the company's core firewalls. Which of the following is the BEST recommendation?
Correct answer: A. Cross-train other staff and document the firewall configurations
Cross-training and documentation directly reduce dependence on one person and support continuity if the engineer leaves or is unavailable. A retention bonus may delay a departure but does not remove the single point of knowledge.
Cross-training and documentation directly reduce dependence on one person and support continuity if the engineer leaves or is unavailable. A retention bonus may delay a departure but does not remove the single point of knowledge.
Question 87Information System Auditing Process
In which of the following environments would continuous auditing techniques be MOST beneficial?
Correct answer: B. A paperless online system with high transaction volumes
Continuous auditing suits environments where large volumes of transactions are processed electronically and no paper trail exists. A monthly batch system can be tested effectively with periodic procedures, so continuous techniques add little there.
Continuous auditing suits environments where large volumes of transactions are processed electronically and no paper trail exists. A monthly batch system can be tested effectively with periodic procedures, so continuous techniques add little there.
Question 88Protection of Information Assets
Semiannual user access reviews at a bank are performed by the IT security team, which compares current access with the results of the previous review. What is the PRIMARY weakness?
Correct answer: A. Reviewers may not know what access each role requires
Business managers and data owners know what access their staff need, while the security team can only confirm that access has not changed. Reviewing more often would not help if the reviewers still cannot judge whether access is appropriate.
Business managers and data owners know what access their staff need, while the security team can only confirm that access has not changed. Reviewing more often would not help if the reviewers still cannot judge whether access is appropriate.
Question 89IS Acquisition, Development & Implementation
Payroll registers showing employee salaries are printed to a shared printer at a hospital and collected by whoever passes by. Which control would BEST address this issue?
Correct answer: C. Secure printing with distribution only to authorized recipients
The risk is unauthorized disclosure of printed output, so distribution controls such as secure release printing and authorized recipient lists address it directly. Reconciling totals confirms that output is accurate but does nothing to stop the wrong person picking up the report.
The risk is unauthorized disclosure of printed output, so distribution controls such as secure release printing and authorized recipient lists address it directly. Reconciling totals confirms that output is accurate but does nothing to stop the wrong person picking up the report.
Question 90IS Operations & Business Resilience
Oakfield University has just finished writing its first business continuity plan. Which type of test is MOST appropriate to perform first?
Correct answer: D. A structured walkthrough where team members step through the plan
A walkthrough or tabletop test is low risk and low cost, and it finds gaps in roles, steps and contact details before more demanding tests are tried. A parallel test gives stronger evidence, but running it against an untested plan wastes effort and invites avoidable errors.
A walkthrough or tabletop test is low risk and low cost, and it finds gaps in roles, steps and contact details before more demanding tests are tried. A parallel test gives stronger evidence, but running it against an untested plan wastes effort and invites avoidable errors.
Question 91Protection of Information Assets
A company's security team struggles to reconstruct the sequence of events during investigations because logs from firewalls, servers and applications appear to conflict. Which control should an IS auditor recommend FIRST?
Correct answer: D. Synchronize all system clocks to a trusted, common time source
Accurate and consistent timestamps are the basis for linking events across systems, so clock synchronization should come first. A SIEM is tempting, but its correlation will still be unreliable if the source systems record different times.
Accurate and consistent timestamps are the basis for linking events across systems, so clock synchronization should come first. A SIEM is tempting, but its correlation will still be unreliable if the source systems record different times.
Question 92Governance & Management of IT
What is the PRIMARY purpose of requiring staff in sensitive financial IT roles to take mandatory consecutive leave?
Correct answer: A. To let others perform the role and spot irregular activity
When an employee is away, someone else performs the duties, which can expose fraud or errors that depend on that person's constant presence. Better morale is a side benefit, but the control objective is detection.
When an employee is away, someone else performs the duties, which can expose fraud or errors that depend on that person's constant presence. Better morale is a side benefit, but the control objective is detection.
Question 93Information System Auditing Process
What is the PRIMARY purpose of the closing meeting held with the auditee at the end of IS audit fieldwork?
Correct answer: B. Confirm the facts behind findings and discuss recommendations
The closing meeting lets the auditor confirm that the facts behind each finding are accurate and that management understands the recommendations. Removing findings because management prefers it would compromise the auditor's independence.
The closing meeting lets the auditor confirm that the facts behind each finding are accurate and that management understands the recommendations. Removing findings because management prefers it would compromise the auditor's independence.
Question 94IS Operations & Business Resilience
Which audit procedure would BEST help an IS auditor detect unauthorized changes to production programs?
Correct answer: D. Select changed production programs and trace them to approvals
Starting from programs that actually changed in production and looking for matching approvals is the direction that reveals changes with no request behind them. Tracing approved requests forward only confirms that approved changes were made; it cannot find changes that were never requested.
Starting from programs that actually changed in production and looking for matching approvals is the direction that reveals changes with no request behind them. Tracing approved requests forward only confirms that approved changes were made; it cannot find changes that were never requested.
Question 95Protection of Information Assets
System administrators at a university share a single domain administrator account, and its password is kept in a team spreadsheet. Which recommendation BEST addresses the auditor's concern?
Correct answer: C. Use a privileged access tool with named checkout
A privileged access management tool issues credentials to named individuals and records their use, which restores accountability for administrative actions. Rotating or encrypting the shared password protects the secret better but still cannot show which administrator performed a given action.
A privileged access management tool issues credentials to named individuals and records their use, which restores accountability for administrative actions. Rotating or encrypting the shared password protects the secret better but still cannot show which administrator performed a given action.
Question 96IS Acquisition, Development & Implementation
A bank has tested each module of its new lending system on its own. The next step is to confirm that the credit scoring module passes data correctly to the loan approval module. Which type of testing is this?
Correct answer: A. Integration testing
Integration testing checks the interfaces between modules to confirm data passes correctly from one to the next. Unit testing has already been done here and only checks each module in isolation.
Integration testing checks the interfaces between modules to confirm data passes correctly from one to the next. Unit testing has already been done here and only checks each module in isolation.
Question 97Governance & Management of IT
In a data governance program, which of the following is the PRIMARY responsibility of a data custodian?
Correct answer: C. Running the safeguards that the data owner has specified
Custodians, often IT staff, maintain and protect data according to the owner's requirements, such as backups and access settings. Deciding who gets access is the owner's job; the custodian carries out that decision.
Custodians, often IT staff, maintain and protect data according to the owner's requirements, such as backups and access settings. Deciding who gets access is the owner's job; the custodian carries out that decision.
Question 98Information System Auditing Process
During follow-up, an IS auditor learns that management decided not to encrypt offsite backup tapes as recommended, citing cost. What should the auditor do?
Correct answer: A. Verify that senior management formally accepted the risk
Management may choose to accept a risk, but the auditor should confirm the acceptance was made and documented at an appropriate level, and report it if it exceeds risk appetite. Simply closing the finding skips that check and may leave the board unaware of a significant exposure.
Management may choose to accept a risk, but the auditor should confirm the acceptance was made and documented at an appropriate level, and report it if it exceeds risk appetite. Simply closing the finding skips that check and may leave the board unaware of a significant exposure.
Question 99IS Operations & Business Resilience
During a disaster recovery exercise, the recovery site processes a copy of the day's real transactions while the primary site continues normal operations, and the two sets of results are compared. Which type of test is this?
Correct answer: B. Parallel test
In a parallel test, recovery systems are brought up and fed real data while production keeps running, so results can be compared without disrupting the business. A full interruption test would shut down the primary site, which did not happen here.
In a parallel test, recovery systems are brought up and fed real data while production keeps running, so results can be compared without disrupting the business. A full interruption test would shut down the primary site, which did not happen here.
Question 100Protection of Information Assets
While performing fieldwork, an IS auditor notices signs that an attacker may currently be active on a payroll server. What should the auditor do FIRST?
Correct answer: A. Report it immediately to management per the incident procedure
Auditors should not take part in operational response, so the right step is to alert management promptly through the defined incident process. Disconnecting the server is a task for the incident team and could destroy evidence or disrupt payroll.
Auditors should not take part in operational response, so the right step is to alert management promptly through the defined incident process. Disconnecting the server is a task for the incident team and could destroy evidence or disrupt payroll.
Question 101IS Operations & Business Resilience
To reduce exposure, a company applies vendor security patches directly to its production servers on the day they are released. Which is an IS auditor's GREATEST concern?
Correct answer: C. Untested patches may disrupt critical applications in production
Patches should be tested in a non-production environment first, because they can conflict with applications and cause outages. Incomplete change records are a documentation weakness, but they do not directly threaten system availability.
Patches should be tested in a non-production environment first, because they can conflict with applications and cause outages. Incomplete change records are a documentation weakness, but they do not directly threaten system availability.
Question 102Protection of Information Assets
A defense contractor is selecting a fingerprint system to control entry to a room holding classified designs. Which performance measure is MOST important?
Correct answer: B. A low false acceptance rate
In a high-security area the worst outcome is admitting an unauthorized person, which is what the false acceptance rate measures. A low false rejection rate improves convenience for legitimate users but does not protect the classified designs.
In a high-security area the worst outcome is admitting an unauthorized person, which is what the false acceptance rate measures. A low false rejection rate improves convenience for legitimate users but does not protect the classified designs.
Question 103Governance & Management of IT
An organization wants a framework that separates governance from management and covers the governance of enterprise IT end to end. Which of the following BEST fits this need?
Correct answer: D. COBIT
COBIT is designed for the governance and management of enterprise information and technology and clearly separates the two. ITIL focuses on IT service management practices rather than enterprise-wide governance.
COBIT is designed for the governance and management of enterprise information and technology and clearly separates the two. ITIL focuses on IT service management practices rather than enterprise-wide governance.
Question 104Information System Auditing Process
Which of the following is the PRIMARY objective of a quality assurance and improvement program for an IS audit function?
Correct answer: A. Ensure audit work conforms to standards and adds value
A quality assurance program evaluates whether the audit function complies with professional standards and finds ways to improve its work. Completing more audits is a productivity target that could even lower quality if pursued alone.
A quality assurance program evaluates whether the audit function complies with professional standards and finds ways to improve its work. Completing more audits is a productivity target that could even lower quality if pursued alone.
Question 105IS Acquisition, Development & Implementation
An insurance company's development team copies the full production customer database, including national ID numbers, into the test environment for system testing. What should the IS auditor recommend?
Correct answer: B. Mask or anonymize sensitive fields before the data is used in testing
Test environments usually have weaker access controls, so sensitive production data should be masked or anonymized before use. Confidentiality agreements do not reduce exposure of the data itself, and a smaller unaltered sample still exposes real personal information.
Test environments usually have weaker access controls, so sensitive production data should be masked or anonymized before use. Confidentiality agreements do not reduce exposure of the data itself, and a smaller unaltered sample still exposes real personal information.
Question 106IS Operations & Business Resilience
An IS auditor reviews the report from a recent disaster recovery test at Brookside Telecom. Several systems were restored, but the test plan did not define objectives or success criteria in advance. What is the auditor's PRIMARY concern?
Correct answer: A. It cannot be shown whether the test proved adequate recovery ability
Without objectives and success criteria, such as meeting RTO and RPO targets, there is nothing to measure results against, so the test cannot prove the plan works. Missing business participation can be a weakness, but nothing in the report points to it, while the lack of criteria undermines the whole test.
Without objectives and success criteria, such as meeting RTO and RPO targets, there is nothing to measure results against, so the test cannot prove the plan works. Missing business participation can be a weakness, but nothing in the report points to it, while the lack of criteria undermines the whole test.
Question 107Protection of Information Assets
An IS auditor is reviewing the incident response plan of an insurance company. Which of the following would provide the BEST assurance that the plan will work when needed?
Correct answer: D. The plan is tested regularly and updated based on test results
Regular testing shows whether the procedures, contacts and roles work in practice, and updates fix the gaps that tests reveal. Following a recognized framework is good design, but it does not prove the plan can be carried out by the people involved.
Regular testing shows whether the procedures, contacts and roles work in practice, and updates fix the gaps that tests reveal. Following a recognized framework is good design, but it does not prove the plan can be carried out by the people involved.
Question 108Governance & Management of IT
Ultimate accountability for the governance of enterprise IT rests with which of the following?
Correct answer: A. The board of directors
The board is accountable for enterprise governance, including IT, and sets direction and oversight. The CIO is responsible for managing IT within that direction but does not hold ultimate accountability.
The board is accountable for enterprise governance, including IT, and sets direction and oversight. The CIO is responsible for managing IT within that direction but does not hold ultimate accountability.
Question 109Information System Auditing Process
What is the PRIMARY benefit of introducing a control self-assessment (CSA) program?
Correct answer: C. It increases line management's ownership of controls
CSA involves business staff in identifying and assessing their own risks and controls, which increases their ownership of those controls. It supplements independent audit rather than replacing it, and treating it as a replacement is a known CSA risk.
CSA involves business staff in identifying and assessing their own risks and controls, which increases their ownership of those controls. It supplements independent audit rather than replacing it, and treating it as a replacement is a known CSA risk.
Question 110IS Operations & Business Resilience
An IS auditor reviews an outsourcing contract for data center services and finds that the SLA describes service quality only in general terms, such as 'high availability', with no numeric targets. Which is the GREATEST concern?
Correct answer: A. The company cannot objectively tell whether the provider meets its obligations
Without measurable targets, performance cannot be monitored and the company has no clear basis to enforce penalties or demand improvement. Extra charges for unlisted services are a commercial risk, but they do not affect the ability to judge service delivery.
Without measurable targets, performance cannot be monitored and the company has no clear basis to enforce penalties or demand improvement. Extra charges for unlisted services are a commercial risk, but they do not affect the ability to judge service delivery.
Question 111Protection of Information Assets
An organization is comparing three biometric devices for general building access and wants the one with the BEST overall accuracy. Which measure should guide the choice?
Correct answer: D. The lowest crossover error rate
The crossover error rate is the point where false acceptance and false rejection are equal, so a lower value indicates better overall accuracy. Looking only at the false rejection rate ignores how often the device admits the wrong person.
The crossover error rate is the point where false acceptance and false rejection are equal, so a lower value indicates better overall accuracy. Looking only at the false rejection rate ignores how often the device admits the wrong person.
Question 112IS Acquisition, Development & Implementation
During an audit of a new HR system implementation, the IS auditor learns that user acceptance testing was performed by the developers because business staff were busy. What is the GREATEST risk?
Correct answer: B. The system may not meet the business requirements of its users
UAT confirms the system meets business requirements and should be done by users, who know the processes and own the system. Developers tend to test what they built rather than what the business needs, so requirement gaps can reach production. Keeping test scripts matters, but it is a secondary issue.
UAT confirms the system meets business requirements and should be done by users, who know the processes and own the system. Developers tend to test what they built rather than what the business needs, so requirement gaps can reach production. Keeping test scripts matters, but it is a secondary issue.
Question 113Governance & Management of IT
An IS auditor finds that the company's password requirements are documented only as guidelines. Why is this a concern?
Correct answer: C. Guidelines are optional, so staff cannot be held to them
Guidelines are advisory, so they cannot be enforced or tested as mandatory requirements; password rules belong in a standard. The other options do not describe how guidelines actually differ from standards.
Guidelines are advisory, so they cannot be enforced or tested as mandatory requirements; password rules belong in a standard. The other options do not describe how guidelines actually differ from standards.
Question 114Information System Auditing Process
Midway through an audit of an online banking platform, an IS auditor finds that a new mobile app outside the agreed scope processes the same customer transactions. What should the auditor do FIRST?
Correct answer: B. Discuss a possible scope change with audit management
A scope change affects resources, timing and the engagement terms, so the auditor should first raise it with audit management, who can agree any change with the auditee. Expanding testing on the auditor's own decision may leave the original objectives incomplete and the change undocumented.
A scope change affects resources, timing and the engagement terms, so the auditor should first raise it with audit management, who can agree any change with the auditee. Expanding testing on the auditor's own decision may leave the original objectives incomplete and the change undocumented.
Question 115IS Operations & Business Resilience
While reviewing the business continuity plan at Granite Foods, an IS auditor finds that one third of the names in the emergency call tree belong to staff who have left the company. What is the BEST recommendation?
Correct answer: D. Assign a plan owner to review and update the plan on a set schedule
Outdated contacts show the plan is not being maintained, and a named owner with scheduled reviews fixes that root cause across the whole plan. Relying on the corporate directory is risky because email and directory systems may be down during the very event the plan covers.
Outdated contacts show the plan is not being maintained, and a named owner with scheduled reviews fixes that root cause across the whole plan. Relying on the corporate directory is risky because email and directory systems may be down during the very event the plan covers.
Question 116Protection of Information Assets
Following a suspected fraud by an employee, a company seized the employee's laptop for investigation. What is the PRIMARY purpose of maintaining a chain of custody for the laptop?
Correct answer: B. To prove the evidence was not altered while it was in custody
A documented chain of custody shows who handled the evidence and when, which supports its integrity and admissibility in legal proceedings. Recording investigator qualifications has value, but it does not prove the evidence remained unchanged.
A documented chain of custody shows who handled the evidence and when, which supports its integrity and admissibility in legal proceedings. Recording investigator qualifications has value, but it does not prove the evidence remained unchanged.
Question 117IS Operations & Business Resilience
Due to limited staff, a database administrator (DBA) also has rights to update application data in a production finance database. Which is the BEST compensating control?
Correct answer: C. Logging DBA actions to a protected log reviewed by someone independent
Activity logs that the DBA cannot alter, reviewed by someone independent, can reveal improper data changes. A self-prepared status report depends on the DBA honestly reporting their own actions, so it gives little assurance.
Activity logs that the DBA cannot alter, reviewed by someone independent, can reveal improper data changes. A self-prepared status report depends on the DBA honestly reporting their own actions, so it gives little assurance.
Question 118Protection of Information Assets
A company is implementing single sign-on so employees can reach 40 business applications with one set of credentials. Which control is MOST important to address the main risk of this design?
Correct answer: A. Multifactor authentication at the SSO login
With SSO, one compromised credential opens every connected application, so strengthening the single login with multifactor authentication addresses the biggest risk. Frequent password changes add user burden without stopping use of a stolen credential within the change window.
With SSO, one compromised credential opens every connected application, so strengthening the single login with multifactor authentication addresses the biggest risk. Frequent password changes add user burden without stopping use of a stolen credential within the change window.
Question 119Governance & Management of IT
A healthcare company plans to outsource claims processing to a provider in another country. Which of the following should be the IS auditor's PRIMARY concern?
Correct answer: D. Compliance with privacy laws in both jurisdictions
Health data is highly regulated, and moving it across borders may conflict with privacy laws in either country, creating legal and reputational risk. Time zone and currency issues are manageable business matters rather than compliance risks.
Health data is highly regulated, and moving it across borders may conflict with privacy laws in either country, creating legal and reputational risk. Time zone and currency issues are manageable business matters rather than compliance risks.
Question 120Information System Auditing Process
An IS auditor receives a full extract of the sales ledger for data analytics. Before running any tests, what should the auditor do FIRST?
Correct answer: A. Reconcile the extract to control totals from the source
Analytics results are only as reliable as the data, so the auditor must first confirm the extract is complete and accurate by reconciling it to source control totals. Deleting records with missing fields could hide errors that may themselves be audit findings.
Analytics results are only as reliable as the data, so the auditor must first confirm the extract is complete and accurate by reconciling it to source control totals. Deleting records with missing fields could hide errors that may themselves be audit findings.
Question 121IS Acquisition, Development & Implementation
A pension fund is replacing its benefit calculation system. Management says payment errors would be unacceptable and wants the lowest-risk changeover, even if it costs more. Which approach should the IS auditor support?
Correct answer: C. Parallel run of the old and new systems for a period
Running both systems in parallel lets results be compared and keeps the old system available if the new one fails, so it is the lowest-risk method, though the most costly. A phased approach still depends on each new module working correctly once its old version is switched off.
Running both systems in parallel lets results be compared and keeps the old system available if the new one fails, so it is the lowest-risk method, though the most costly. A phased approach still depends on each new module working correctly once its old version is switched off.
Question 122IS Operations & Business Resilience
The business impact analysis at Lakeshore Trading shows that its trading platform must be restored within 4 hours of a disaster. Which recovery site option is MOST appropriate?
Correct answer: D. A hot site with fully configured systems and current data in place
A 4-hour RTO needs a site that can run almost at once, with hardware, software and near-current data already in place. A warm site costs less but usually needs days to install, configure and load data, which is too slow for this target.
A 4-hour RTO needs a site that can run almost at once, with hardware, software and near-current data already in place. A warm site costs less but usually needs days to install, configure and load data, which is too slow for this target.
Question 123Protection of Information Assets
A forensic team responding to a compromised server that is still running must decide what to collect. According to the order of volatility, which should be collected FIRST?
Correct answer: D. Contents of system memory
Memory contents are lost when the system is powered off or changes state, so they are captured before less volatile sources. Disk data is important, but it persists after shutdown and can be imaged afterward.
Memory contents are lost when the system is powered off or changes state, so they are captured before less volatile sources. Disk data is important, but it persists after shutdown and can be imaged afterward.
Question 124IS Operations & Business Resilience
While testing a sales database, an IS auditor finds order records that reference customer numbers which do not exist in the customer table. Which control is MOST likely missing?
Correct answer: B. Referential integrity constraints between related tables
Referential integrity ensures that a foreign key, such as the customer number on an order, always matches an existing record in the related table. Entity integrity only ensures each record has a unique, non-empty key, so it would not stop orphan orders.
Referential integrity ensures that a foreign key, such as the customer number on an order, always matches an existing record in the related table. Entity integrity only ensures each record has a unique, non-empty key, so it would not stop orphan orders.
Question 125Protection of Information Assets
While reviewing a perimeter firewall rule set, an IS auditor identifies several issues. Which one poses the GREATEST risk?
Correct answer: C. A permit-all rule is placed above the specific rules
Firewalls process rules in order, so a permit-all rule at the top lets every packet through and makes all later restrictions meaningless. Missing annotations and informal approvals are control weaknesses, but they do not open the network the way this rule does.
Firewalls process rules in order, so a permit-all rule at the top lets every packet through and makes all later restrictions meaningless. Missing annotations and informal approvals are control weaknesses, but they do not open the network the way this rule does.
Question 126Governance & Management of IT
An IS auditor is reviewing a draft contract for outsourced data center services. Which of the following omissions would be of GREATEST concern?
Correct answer: D. No clause on returning the company's data at contract end
Without exit terms, the company may be unable to recover its data or move to another provider when the contract ends, which threatens continuity. An unnamed account manager is an administrative gap that is easy to fix.
Without exit terms, the company may be unable to recover its data or move to another provider when the contract ends, which threatens continuity. An unnamed account manager is an administrative gap that is easy to fix.
Question 127Information System Auditing Process
An IS auditor finds a weakness in a system that processes low-value transactions but feeds a mandatory regulatory report. In judging materiality, the auditor should consider:
Correct answer: C. the financial and non-financial impact of the weakness
In IS audits, materiality includes qualitative factors such as regulatory, reputational and operational impact, not just dollar amounts. A weakness in a low-value system can still be material if it affects regulatory reporting.
In IS audits, materiality includes qualitative factors such as regulatory, reputational and operational impact, not just dollar amounts. A weakness in a low-value system can still be material if it affects regulatory reporting.
Question 128IS Acquisition, Development & Implementation
At an e-commerce company, developers move their own tested code into production using shared administrator accounts. What is the IS auditor's PRIMARY concern?
Correct answer: B. Unauthorized or untested changes may reach production undetected
When developers migrate their own code without an independent release function, segregation of duties is broken and unauthorized or untested changes can reach production unnoticed. Shared accounts make this worse by removing accountability. Time spent on deployment is an efficiency issue, not a control risk.
When developers migrate their own code without an independent release function, segregation of duties is broken and unauthorized or untested changes can reach production unnoticed. Shared accounts make this worse by removing accountability. Time spent on deployment is an efficiency issue, not a control risk.
Question 129IS Operations & Business Resilience
Two regional hospitals, Eastvale and Westvale, have signed a reciprocal agreement to host each other's critical systems after a disaster. What is the IS auditor's GREATEST concern?
Correct answer: C. Either hospital may lack spare capacity or compatible systems when needed
Reciprocal agreements often fail because each party sizes and changes its systems for its own needs, leaving no room or compatibility for the partner. Training needs are real, but they matter little if the host site cannot run the systems at all, and such agreements are also hard to enforce.
Reciprocal agreements often fail because each party sizes and changes its systems for its own needs, leaving no room or compatibility for the partner. Training needs are real, but they matter little if the host site cannot run the systems at all, and such agreements are also hard to enforce.
Question 130Protection of Information Assets
A company's legal counsel informs IT that litigation involving a former business partner is reasonably expected. Which action should an IS auditor expect the company to take regarding relevant electronic records?
Correct answer: A. Place a legal hold that suspends routine deletion of those records
Once litigation is reasonably expected, normal deletion must stop for relevant records so that evidence is preserved. Following the standard retention schedule is tempting because it is policy, but it could destroy records the company is legally required to keep.
Once litigation is reasonably expected, normal deletion must stop for relevant records so that evidence is preserved. Following the standard retention schedule is tempting because it is policy, but it could destroy records the company is legally required to keep.
Question 131Governance & Management of IT
An IS auditor finds that an IT operations manager formally accepted a high-rated risk that exceeds the organization's stated risk appetite. What should the auditor do FIRST?
Correct answer: B. Report that this acceptance exceeds the manager's authority
Risks above appetite must be accepted by someone with the authority to do so, usually senior management, so the auditor should report the issue. Rejecting the decision or adding controls are management actions, not audit actions.
Risks above appetite must be accepted by someone with the authority to do so, usually senior management, so the auditor should report the issue. Rejecting the decision or adding controls are management actions, not audit actions.
Question 132Information System Auditing Process
An IS auditor tests a sample of help desk password resets to see whether staff followed the required caller identity verification steps. What type of test is this?
Correct answer: A. Compliance test
A compliance test checks whether a control operates as designed, such as whether resets followed the verification steps. Substantive and data integrity tests examine the accuracy of actual data or balances, not whether a control was followed.
A compliance test checks whether a control operates as designed, such as whether resets followed the verification steps. Substantive and data integrity tests examine the accuracy of actual data or balances, not whether a control was followed.
Question 133IS Operations & Business Resilience
A database team takes a full backup every night and also backs up the transaction logs every 15 minutes. What is the PRIMARY purpose of the transaction log backups?
Correct answer: C. To roll forward committed transactions after a restore
Log backups let the team restore the last full backup and then reapply committed transactions up to near the point of failure, which limits data loss. They are not meant as an access audit trail, since read activity is normally not captured in them.
Log backups let the team restore the last full backup and then reapply committed transactions up to near the point of failure, which limits data loss. They are not meant as an access audit trail, since read activity is normally not captured in them.
Question 134Protection of Information Assets
A restaurant group's card payment terminals sit on the same flat network as office PCs and the guest Wi-Fi. What should the IS auditor recommend FIRST?
Correct answer: D. Segment the payment environment from other traffic
Segmentation isolates the cardholder environment so that a compromised office PC or guest device cannot reach payment systems, and it also reduces compliance scope. Antivirus on office PCs helps, but it does not stop other devices on the flat network from reaching the terminals.
Segmentation isolates the cardholder environment so that a compromised office PC or guest device cannot reach payment systems, and it also reduces compliance scope. Antivirus on office PCs helps, but it does not stop other devices on the flat network from reaching the terminals.
Question 135Governance & Management of IT
A company is planning a new mobile app that will process customer location data. When should a privacy impact assessment be performed?
Correct answer: D. During the design phase, before development begins
Assessing privacy at design allows risks to be addressed early, in line with privacy by design, when changes are cheapest. Waiting until after deployment means privacy issues are built in and costly to fix.
Assessing privacy at design allows risks to be addressed early, in line with privacy by design, when changes are cheapest. Waiting until after deployment means privacy issues are built in and costly to fix.
Question 136Information System Auditing Process
During an audit, an IS auditor finds evidence that a database administrator may be changing vendor bank details for personal gain. What should the auditor do FIRST?
Correct answer: A. Report the matter to an appropriate level of management
The auditor should promptly communicate possible fraud to an appropriate level, such as the audit committee, that is not involved in the suspected act. Disabling access is a management action that would compromise the auditor's independence and could alert the suspect.
The auditor should promptly communicate possible fraud to an appropriate level, such as the audit committee, that is not involved in the suspected act. Disabling access is a management action that would compromise the auditor's independence and could alert the suspect.
Question 137IS Acquisition, Development & Implementation
A credit union is converting member account balances from a legacy system to a new core banking platform. Which control would BEST provide assurance that all data was converted accurately?
Correct answer: B. Reconciling record counts and balance totals between both systems
Reconciling record counts and control totals between the source and target systems shows whether all data was converted completely and accurately. A vendor certification only says the tool should work and does not prove that this particular conversion did.
Reconciling record counts and control totals between the source and target systems shows whether all data was converted completely and accurately. A vendor certification only says the tool should work and does not prove that this particular conversion did.
Question 138IS Operations & Business Resilience
An IS auditor has been invited to observe a disaster recovery test at Summit Energy. The recovery team is short one database administrator and asks the auditor to help restore the database. What should the auditor do?
Correct answer: D. Decline to restore it and keep observing and recording the test results
The auditor's role in a test is to observe and evaluate, and taking part in the recovery would impair independence over the results being assessed. Disclosing the help afterward does not fix this, because the auditor would then be judging work they performed.
The auditor's role in a test is to observe and evaluate, and taking part in the recovery would impair independence over the results being assessed. Disclosing the help afterward does not fix this, because the auditor would then be judging work they performed.
Question 139Protection of Information Assets
An IS auditor is assessing a company's ability to recover from a ransomware attack that encrypts files on servers and connected network shares. Which control is MOST important?
Correct answer: C. Regularly tested backups stored offline or in immutable form
Offline or immutable backups cannot be encrypted by the malware, and testing confirms that data can actually be restored. Antivirus helps prevent infection, but it does not help the company recover once files have been encrypted.
Offline or immutable backups cannot be encrypted by the malware, and testing confirms that data can actually be restored. Antivirus helps prevent infection, but it does not help the company recover once files have been encrypted.
Question 140IS Operations & Business Resilience
A company has consolidated 40 physical servers onto a small number of virtualization hosts. Which risk should an IS auditor consider MOST significant?
Correct answer: B. A compromised hypervisor could expose every virtual machine on the host
The hypervisor controls every guest machine on a host, so one breach or misconfiguration there can affect many systems at once. Licensing changes are a cost issue and do not threaten the security or availability of the hosted systems.
The hypervisor controls every guest machine on a host, so one breach or misconfiguration there can affect many systems at once. Licensing changes are a cost issue and do not threaten the security or availability of the hosted systems.
Question 141Protection of Information Assets
Remote staff connect to the corporate network over a VPN that allows split tunneling. What is the PRIMARY risk?
Correct answer: C. Threats on the home network may reach the corporate side
Split tunneling lets a device talk to the internet and the corporate network at the same time, so a compromise on the untrusted side can pass through the device into the internal network. Traffic sent through the tunnel is still encrypted, so loss of encryption is not the issue.
Split tunneling lets a device talk to the internet and the corporate network at the same time, so a compromise on the untrusted side can pass through the device into the internal network. Traffic sent through the tunnel is still encrypted, so loss of encryption is not the issue.
Question 142Governance & Management of IT
An IS auditor reviews the quarterly IT performance report sent to the board. It contains only server uptime, patch counts and ticket volumes. Which of the following is the auditor's PRIMARY concern?
Correct answer: A. The metrics do not show IT's contribution to business goals
Boards need measures that link IT performance to business objectives and value; purely technical metrics do not support governance decisions. Reporting frequency is a lesser issue when the content itself is not meaningful to the board.
Boards need measures that link IT performance to business objectives and value; purely technical metrics do not support governance decisions. Reporting frequency is a lesser issue when the content itself is not meaningful to the board.
Question 143Information System Auditing Process
Management refuses to give an IS auditor read access to the firewall rule set, saying it is too sensitive. The evidence cannot be obtained any other way. What should the auditor do?
Correct answer: B. Document the restriction and report it as a scope limitation
When evidence cannot be obtained, the auditor must document the limitation and disclose it in the report, escalating if needed, so readers know what was not assured. A verbal description from the network manager is not sufficient evidence for a conclusion on the rules.
When evidence cannot be obtained, the auditor must document the limitation and disclose it in the report, escalating if needed, so readers know what was not assured. A verbal description from the network manager is not sufficient evidence for a conclusion on the rules.
Question 144IS Acquisition, Development & Implementation
Six months after a new procurement system went live at a manufacturing company, the IS auditor is asked to perform a post-implementation review. What is the PRIMARY objective of this review?
Correct answer: A. Determine whether the expected benefits and objectives were achieved
A post-implementation review checks whether the project delivered the benefits in the business case and met user needs, and it records lessons for future projects. Confirming defects are fixed is part of normal maintenance, not the main aim of the review.
A post-implementation review checks whether the project delivered the benefits in the business case and met user needs, and it records lessons for future projects. Confirming defects are fixed is part of normal maintenance, not the main aim of the review.
Question 145IS Operations & Business Resilience
A review of the disaster recovery plan at Copperline Mining shows detailed technical recovery steps, but the plan does not state who may declare a disaster or under what conditions. What is the MOST significant risk?
Correct answer: C. Delays in invoking the plan may push outages past tolerable downtime
Without clear authority and criteria, people may debate or wait during an incident, using up time before recovery even starts. Restore order is important, but it is already covered by the technical steps, while the missing declaration process can stall the whole plan.
Without clear authority and criteria, people may debate or wait during an incident, using up time before recovery even starts. Restore order is important, but it is already covered by the technical steps, while the missing declaration process can stall the whole plan.
Question 146Protection of Information Assets
A software company is concerned that a database administrator could copy large volumes of customer data before resigning. Which detective control would be MOST effective?
Correct answer: B. Monitoring of administrator activity for unusual data transfers
Monitoring privileged activity for abnormal transfers can spot data theft as it occurs, which is what a detective control does. Background checks and nondisclosure agreements are preventive or deterrent measures and would not reveal the copying.
Monitoring privileged activity for abnormal transfers can spot data theft as it occurs, which is what a detective control does. Background checks and nondisclosure agreements are preventive or deterrent measures and would not reveal the copying.
Question 147IS Operations & Business Resilience
A company sends its retired laptops to a third-party recycler. Which control is MOST important for an IS auditor to verify?
Correct answer: D. Data on each device is securely wiped and the wipe is documented
Unless storage is securely sanitized before devices leave company control, confidential data could be recovered by others. Updating the asset register is good practice for accuracy, but it does nothing to protect the information on the drives.
Unless storage is securely sanitized before devices leave company control, confidential data could be recovered by others. Updating the asset register is good practice for accuracy, but it does nothing to protect the information on the drives.
Question 148Protection of Information Assets
A consulting firm's office Wi-Fi uses WPA2 with a single pre-shared key that every employee knows. What is the IS auditor's PRIMARY concern?
Correct answer: A. One user's access cannot be revoked without a new key for all
With a shared key, removing one person's access means changing the key on every device, so former staff often keep access in practice. Enterprise mode with 802.1X ties access to individual credentials that can be disabled, and WPA2 does encrypt wireless traffic.
With a shared key, removing one person's access means changing the key on every device, so former staff often keep access in practice. Enterprise mode with 802.1X ties access to individual credentials that can be disabled, and WPA2 does encrypt wireless traffic.
Question 149Governance & Management of IT
An IS auditor finds that installed copies of a design application exceed the number of licenses purchased. Which of the following is the BEST recommendation?
Correct answer: B. Set up software asset management with regular license checks
A software asset management process with periodic reconciliation addresses the root cause and keeps installations within license limits over time. Buying a site license closes the current gap but may waste money and creates no ongoing control.
A software asset management process with periodic reconciliation addresses the root cause and keeps installations within license limits over time. Buying a site license closes the current gap but may waste money and creates no ongoing control.
Question 150Information System Auditing Process
The IT manager tells an IS auditor that all leavers' network accounts are disabled within 24 hours of termination. What should the auditor do NEXT?
Correct answer: D. Compare HR termination dates with account disable dates
Inquiry alone is weak evidence, so the auditor should corroborate it by comparing termination dates from HR with the dates accounts were actually disabled. An email from the same manager adds formality but is still the auditee's own assertion.
Inquiry alone is weak evidence, so the auditor should corroborate it by comparing termination dates from HR with the dates accounts were actually disabled. An email from the same manager adds formality but is still the auditee's own assertion.
The real CISA exam at a glance
150questions
4htime limit
MCQmultiple choice
75%+aim for here
Score 75% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free Governance, Risk & Audit practice tests
CISM Practice Test150 questions · Security ManagerCRISC Practice Test150 questions · IT RiskCGEIT Practice Test150 questions · IT Governance
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the CISA exam. They are not real exam questions. CISA and ISACA are trademarks of their owners. Real exam format: 150 questions · 4 hours · passing score 450 on a 200-800 scale.