Free CISA Practice Test 2026 (Set 2): Full 150-Question Mock Exams

Question 1Information System Auditing Process

A friend who works for a competitor asks an IS auditor about security weaknesses found during a recent audit of the auditor's client. According to the ISACA Code of Professional Ethics, the auditor should:

Correct answer: A. keep the information confidential unless required by law
The Code requires members to keep information obtained during their work confidential unless disclosure is required by legal authority. Removing the client's name does not make sharing acceptable, because the details could still be misused or traced back.

Question 2Governance & Management of IT

According to common IT governance frameworks, which of the following is a governance activity rather than a management activity?

Correct answer: C. Evaluating, directing and monitoring IT
Governance evaluates stakeholder needs, sets direction and monitors overall performance, usually through the board. Planning, building, running and delivering services are management activities carried out within that direction.

Question 3IS Operations & Business Resilience

An IS auditor reviewing the business continuity program at Fairview Insurance notes several conditions. Which is the GREATEST concern?

Correct answer: D. The plan has never been reviewed or approved by senior management
Senior management approval shows ownership of continuity risk and secures the funding and authority needed to carry out the plan. Using an outside template is common and acceptable as long as the content is tailored, so it is far less serious than a plan with no management backing.

Question 4Protection of Information Assets

An IS auditor finds that all employees, including developers and system administrators, receive the same general security awareness course. What is the auditor's GREATEST concern?

Correct answer: D. Privileged staff may not learn the risks that are specific to their roles
Developers and administrators face threats tied to their duties, such as insecure coding or misuse of privileges, which general training does not cover. Course length for general staff is a minor usability issue compared with knowledge gaps among high-risk users.

Question 5IS Operations & Business Resilience

An IS auditor wants to determine whether a company is running more copies of a software product than it has licenses for. Which approach would provide the MOST reliable evidence?

Correct answer: B. Compare automated discovery scan results with purchased license records
Discovery tools show what is actually installed, and comparing that with license entitlements reveals any shortfall. Manager confirmations rely on people's knowledge and often miss installations, so they are far less reliable.

Question 6Protection of Information Assets

A company plans to switch its new intrusion prevention system from detection-only mode to inline blocking mode. What should the IS auditor be MOST concerned about?

Correct answer: B. Whether signatures are tuned to limit false positives
In blocking mode the IPS drops traffic it considers malicious, so untuned signatures can block legitimate business transactions. Placement matters, but an untuned device will disrupt operations wherever it sits.

Question 7IS Acquisition, Development & Implementation

The steering committee of a software project wants an objective measure that compares the value of work completed with both the planned schedule and the actual cost. Which technique should the IS auditor recommend?

Correct answer: D. Earned value analysis
Earned value analysis compares the value of work completed with planned work and actual cost, so it shows both schedule and cost variance. The critical path method identifies which tasks drive the end date but does not measure spending.

Question 8Governance & Management of IT

An IS auditor finds that the IT steering committee is made up only of IT managers. Which of the following is the GREATEST risk?

Correct answer: C. IT priorities may not reflect the needs of the business
Without senior business representation, the committee cannot ensure that IT investments and priorities support business strategy. Missing minutes is a documentation weakness, but it is less serious than the committee lacking the right members.

Question 9Information System Auditing Process

An IS auditor is starting an audit of an order-to-cash application. What should the auditor do FIRST?

Correct answer: B. Understand the business process the application supports
Understanding the business process, its objectives and risks lets the auditor identify the key controls and plan suitable tests. Testing input controls before gaining that understanding risks spending effort on controls that do not matter most.

Question 10IS Operations & Business Resilience

Ironwood Securities needs a recovery point objective of zero for its trade records. Which solution BEST meets this requirement?

Correct answer: C. Synchronous replication to a second data center a short distance away
Synchronous replication commits each write at both sites before confirming it, so no committed transaction is lost. Asynchronous replication is cheaper and supports longer distances, but it always leaves a gap of unsent data, which breaks a zero RPO.

Question 11Protection of Information Assets

A distribution company wants to show that its staff know their security duties. Which of the following provides an IS auditor with the BEST evidence that employees have been made aware of their information security responsibilities?

Correct answer: A. Signed acknowledgments of the acceptable use policy
A signed acknowledgment shows that each employee received and accepted the policy, giving individual evidence of awareness. Publishing the policy on the intranet makes it available but does not show that anyone read it.

Question 12IS Operations & Business Resilience

Management suspects that staff are using unapproved cloud applications to process company data. Which method would BEST help an IS auditor identify the extent of this shadow IT?

Correct answer: B. Analyze web proxy or cloud access logs for unapproved services
Proxy and cloud access logs show actual traffic to cloud services, including free ones that never appear on a bill. Purchase card reviews find only paid subscriptions, so they miss much of the shadow IT in use.

Question 13Protection of Information Assets

Field sales staff carry laptops that store customer contracts and pricing data. Which control BEST protects this data if a laptop is lost or stolen?

Correct answer: A. Full-disk encryption with pre-boot authentication
Full-disk encryption keeps the data unreadable without the key, even if the drive is removed and attached to another machine. A BIOS password can be bypassed by removing the drive, so it does not protect the stored data.

Question 14IS Acquisition, Development & Implementation

A healthcare company is deploying new servers to host a patient scheduling application. The IS auditor finds the servers were built with the vendor's default settings and accounts. What should the auditor recommend before go-live?

Correct answer: C. Harden the servers to an approved security baseline and verify it
Servers should be configured to an approved hardening baseline and checked before production use, because default settings and accounts are well known to attackers. Changing only the default passwords leaves unneeded services and other weak settings in place.

Question 15Governance & Management of IT

Which of the following provides the BEST evidence that an information security policy has the support of the organization?

Correct answer: D. It was approved and issued by senior management
Senior management approval shows commitment and gives the policy authority across the organization. Posting the policy makes it available, but availability alone does not show that leadership backs it.

Question 16Information System Auditing Process

An IS auditor is assigned to audit a container platform but lacks the technical knowledge to assess it. According to ISACA standards, what should the auditor do?

Correct answer: D. Inform audit management and obtain the needed expertise
ISACA standards require auditors to have the skills and knowledge needed for each engagement, so the auditor should raise the gap and obtain training or expert support. Having the platform team test its own controls would weaken the independence of the evidence.

Question 17IS Operations & Business Resilience

Valley Water has replaced its tape backups with real-time replication to a secondary data center, arguing that replication now gives full protection. What is the IS auditor's PRIMARY concern?

Correct answer: A. Corrupted or deleted data would be copied to the second site at once
Replication copies every change, including errors, malicious deletion and ransomware encryption, so it cannot replace point-in-time backups. Bandwidth costs matter for design, but they do not create the risk of losing every good copy of the data.

Question 18Protection of Information Assets

During an audit of a security awareness program, an IS auditor notes that the training content has not been changed in three years, although the company has seen several new phishing techniques. Which recommendation is MOST appropriate?

Correct answer: B. Review and refresh the content regularly to cover current threats
Awareness training only helps if it prepares staff for the threats they actually face, so content must be refreshed as attack methods change. Making the old course more frequent repeats outdated material and leaves the new techniques uncovered.

Question 19Governance & Management of IT

During a review of IT roles, an IS auditor notes that one person serves as both database administrator and security administrator. Which of the following is the PRIMARY risk?

Correct answer: D. The person could grant access and alter data undetected
Combining these roles lets one person create privileges and then use them to change data, defeating segregation of duties. Workload is a staffing issue, while the real control concern is misuse that goes undetected.

Question 20Information System Auditing Process

A payments system processes high-value international wire transfers that are attractive targets for fraud. Before any controls are considered, this exposure is BEST described as:

Correct answer: C. inherent risk
Inherent risk is the risk that exists before any controls are taken into account, and high-value wire transfers carry high inherent risk. Residual risk is what remains after controls are applied, so it does not fit a description that ignores controls.

Question 21IS Operations & Business Resilience

A billing job started on schedule at 2:00 a.m. even though the upstream job that loads usage data had not finished. As a result, customers were billed using incomplete data. Which control would BEST prevent this?

Correct answer: A. Defining a dependency so billing runs only after the load succeeds
A dependency in the scheduler stops the billing job from starting until the load job completes successfully, however long it takes. A later start time only reduces the chance of overlap and still fails when the load runs long.

Question 22Protection of Information Assets

A file transfer system uses asymmetric encryption to exchange a session key and then uses symmetric encryption for the file itself. What is the MAIN reason for this design?

Correct answer: C. It pairs fast bulk encryption with secure key exchange
Symmetric algorithms are efficient for large volumes of data, while asymmetric algorithms solve the problem of sharing a secret key over an untrusted network. Nonrepudiation comes from digital signatures, not from this encryption pattern.

Question 23IS Acquisition, Development & Implementation

An IS auditor reviewing an e-commerce project finds that the functional requirements were written by the IT team and never approved by business management. Design work has already started. What is the GREATEST risk?

Correct answer: A. The system may not meet the needs of the business
Requirements define what the business needs, so without business approval the system may be built to the wrong specification, which is costly to fix later. Delays in design are possible but are a smaller concern than delivering a system that does not serve the business.

Question 24Governance & Management of IT

A company plans to acquire a new HR system from an external vendor. Which of the following should be done FIRST?

Correct answer: B. Define and document the business and technical requirements
Clear requirements are needed before vendors can be approached and compared fairly; they form the basis of the RFP and the evaluation criteria. Sending an RFP first means vendors respond without knowing what the business actually needs.

Question 25Information System Auditing Process

After a malware outbreak, the IT team restores affected servers from clean backups and patches the exploited flaw. These actions are BEST classified as:

Correct answer: A. corrective controls
Corrective controls reduce the impact of an incident and restore normal operations, as restoring from backup and fixing the flaw do here. Patching can also prevent a repeat, but in this scenario it responds to an event that has already occurred.

Question 26IS Operations & Business Resilience

Ashford Logistics uses two different carriers for its data center internet links to provide redundancy. An IS auditor learns that both circuits enter the building through the same underground conduit. What is the MAIN risk?

Correct answer: C. A single cut to the conduit could disable both links at the same time
Redundancy needs diverse routing all the way into the building, and a shared conduit is a single point of failure that one excavation can break. Uneven load sharing affects performance, but it does not threaten a total loss of connectivity.

Question 27Protection of Information Assets

An IS auditor reviewing recent security incidents finds several carefully crafted emails sent only to the chief executive and chief financial officer, referring to real board matters. This attack is BEST described as:

Correct answer: B. whaling.
Whaling is spear phishing aimed at senior executives, often using details about their real responsibilities. Vishing uses voice calls, so it does not match an attack carried out through tailored emails.

Question 28IS Operations & Business Resilience

An IS auditor finds that records rejected by the interface between the order system and the warehouse system are written to an error file, but no one is assigned to review it. Which is the GREATEST risk?

Correct answer: D. Rejected orders may never be corrected and processed for shipping
If no one follows up on rejected records, valid customer orders can be silently lost and never shipped. Disk space growth is an operational nuisance that monitoring can catch, but it does not directly affect business transactions.

Question 29Protection of Information Assets

A pharmaceutical distributor wants assurance that trading partners cannot deny sending electronic purchase orders. Which approach BEST achieves this?

Correct answer: A. Signing each order with the sender's private key
Only the sender holds its private key, so a valid signature proves origin and provides nonrepudiation as well as integrity. A shared symmetric key is known to both parties, so either one could have created the message.

Question 30IS Acquisition, Development & Implementation

A government agency must build a tax calculation system. The requirements are fixed by law, well documented and unlikely to change during the project. Which development approach is MOST suitable?

Correct answer: B. Waterfall SDLC with sequential, approved phases
The waterfall model works best when requirements are stable and well understood at the start, because each phase builds on the approved outputs of the last. Agile and prototyping suit requirements that are unclear or expected to change, which is not the case here.

Question 31Governance & Management of IT

During due diligence on a small start-up that will provide a critical payment service, which of the following should be of GREATEST concern to the IS auditor?

Correct answer: A. The vendor has limited funding and an uncertain future
If the vendor of a critical service fails financially, the company may lose the service with little warning, which threatens continuity. Location and working methods are minor matters compared with the risk of the provider ceasing to exist.

Question 32Information System Auditing Process

An IS auditor finds that IT general controls over program changes are ineffective. How does this MOST affect the audit of the related application controls?

Correct answer: D. Reliance on automated application controls is reduced
Weak change controls mean automated controls may have been altered without authorization, so the auditor cannot rely on them as much and should expand substantive testing. Cancelling the audit is wrong, because the weakness increases the need for assurance.

Question 33IS Operations & Business Resilience

During a business continuity review at Greenleaf Bakery Group, an IS auditor learns that only one systems engineer knows how to rebuild the core ERP environment, and the steps are not written down. What is the BEST recommendation?

Correct answer: A. Document the rebuild steps and cross-train at least one other person
Written procedures and a trained backup remove the dependency on one person, who may be unavailable during a disaster for many reasons. A retention bonus may keep the engineer employed, but it does not help if that person is ill, travelling or affected by the same event.

Question 34Protection of Information Assets

Three months after a programmer left a utility company, a monthly batch job deleted payroll records because code he had hidden in it detected that his employee number was no longer in the file. This is BEST described as a:

Correct answer: C. logic bomb.
A logic bomb is hidden code that runs when a specific condition is met, such as a date or a missing record. A Trojan horse also hides inside legitimate software, but its defining feature is disguise rather than a trigger condition.

Question 35IS Operations & Business Resilience

During a review of IS operations, an IS auditor finds that the organization has no inventory of the interfaces between its applications. Which is the GREATEST risk?

Correct answer: A. Changes to one system may break interfaces that no one tests
Without a list of interfaces, change impact analysis can miss connected systems, so a change can disrupt data flows nobody knew to test. Weak documentation is a concern, but it matters mainly because of the operational failures it can lead to.

Question 36Protection of Information Assets

An analyst must send a confidential report so that only the intended recipient can read it. Using asymmetric cryptography, which key should be used to encrypt the report?

Correct answer: D. The recipient's public key
Data encrypted with the recipient's public key can be decrypted only with the recipient's private key, which only the recipient holds. Encrypting with the sender's private key proves origin, but anyone with the sender's public key could read the report.

Question 37Governance & Management of IT

An IS auditor finds that business units heavily overuse shared IT services because all IT costs are absorbed by a central budget and no unit sees what it consumes. Which governance mechanism would BEST encourage efficient use?

Correct answer: B. A chargeback model that allocates IT costs to business units by usage
Chargeback makes each unit see and pay for what it uses, which aligns demand with business value. A bigger central budget hides the cost even more and does nothing to change behavior.

Question 38Information System Auditing Process

During a forensic investigation, an IS auditor seizes the hard drive from a suspect's laptop. Which of the following is MOST important to keep the evidence admissible?

Correct answer: C. Maintaining a documented chain of custody for the drive
A documented chain of custody shows who handled the evidence and when, which is needed for it to be accepted in legal proceedings. Working on the original drive risks altering it, so analysis should be done on a verified forensic image.

Question 39IS Acquisition, Development & Implementation

A retailer adopts rapid application development (RAD) to deliver a loyalty app within a fixed three-month window. What is the MOST important concern for the IS auditor?

Correct answer: B. Quality and controls may be reduced to meet the deadline
RAD uses time-boxing and prototypes to deliver fast, so there is pressure to cut testing, documentation and controls to hit the fixed date. Excessive documentation is unlikely, since RAD usually produces less of it than traditional methods.

Question 40IS Operations & Business Resilience

A business impact analysis at Northgate Clinics rates the laboratory interface as non-critical. An IS auditor notes that the critical patient billing system cannot run without results from that interface. What should the auditor recommend?

Correct answer: D. Reassess the interface rating based on the processes that depend on it
A system that a critical process depends on must be recovered within that process's RTO, so its rating should reflect the dependency. Waiting for next year's cycle leaves the recovery plan with a gap that could stop billing during a disaster.

Question 41Protection of Information Assets

An IS auditor reviewing the incident response plan of an online retailer finds no procedure for handling a distributed denial-of-service attack. Which element would be MOST important to add?

Correct answer: B. Contacts and steps for coordinating with the internet service provider
A DDoS attack floods the site with traffic from many sources, so mitigation usually depends on filtering by the ISP or a protection service, and the plan needs those contacts ready. Restoring from backup does not help because the attack affects availability, not the data itself.

Question 42Governance & Management of IT

An IS auditor reviewing an outsourcing contract notes that it does not address whether the provider may use subcontractors. Which of the following is the PRIMARY risk?

Correct answer: C. Data may reach parties not bound by the agreed controls
Without subcontracting terms, sensitive data and processing may pass to fourth parties that the company has not assessed or bound to its security and audit requirements. Higher fees are a commercial issue, not a control failure.

Question 43Information System Auditing Process

Which of the following BEST describes an integrated audit?

Correct answer: A. An audit combining financial, operational and IS review work
An integrated audit combines financial, operational and IS audit disciplines to assess the overall controls over a business process. A joint audit by internal and external teams describes who does the work, not the combined scope.

Question 44IS Operations & Business Resilience

Senior management wants a program to manage the risk of end-user computing tools such as spreadsheets and desktop databases. What should an IS auditor recommend as the FIRST step?

Correct answer: D. Build an inventory of these tools and rate their criticality
An inventory with risk ratings shows which tools support important processes, so controls can be focused where they matter most. Moving everything to IT platforms is costly, may be unnecessary for low-risk tools and cannot be planned without knowing what exists.

Question 45Protection of Information Assets

An IS auditor finds that an application stores user passwords using reversible symmetric encryption, with the key held in a configuration file on the same server. What should the auditor recommend?

Correct answer: A. Store passwords as salted hashes using a slow algorithm
Passwords only need to be verified, not recovered, so a salted one-way hash removes the risk that anyone holding the key can decrypt every password. A longer key strengthens the encryption but leaves passwords reversible by anyone who obtains the configuration file.

Question 46IS Acquisition, Development & Implementation

A company is converting five years of customer accounts from a legacy billing system to a new platform. Which control BEST shows the auditor that the data was converted completely and accurately?

Correct answer: C. Reconciling record counts and control totals between the old and new systems
Comparing record counts and control totals such as balances proves that nothing was lost or changed during conversion. A vendor's written statement is weaker evidence, and waiting for users to find errors detects problems too late.

Question 47Governance & Management of IT

An IS auditor reviewing a service level agreement notes that it promises 'fast and reliable service.' Which of the following is the BEST recommendation?

Correct answer: D. Add measurable targets such as response time and availability
Service levels must be specific and measurable so performance can be monitored and enforced. A letter of commitment adds no measurable standard, so failures still could not be proven.

Question 48Information System Auditing Process

What is the MAIN advantage of statistical sampling over non-statistical sampling?

Correct answer: D. It lets the auditor quantify sampling risk objectively
Statistical sampling uses probability theory, so the auditor can measure sampling risk and state a confidence level. It still needs judgment, for example in setting tolerable error, and it does not always give a smaller sample.

Question 49IS Operations & Business Resilience

During a disaster recovery test at Bluewater Shipping, the team restored the ERP application servers first, but users could not log in for several hours. Which weakness in the plan is MOST likely?

Correct answer: B. It did not set the recovery order for directory and login services
Applications depend on shared services such as directory, DNS and authentication, which must be restored first. A plan that ignores these dependencies will fail even when the application steps work. Lower capacity at the recovery site might slow the system, but it would not stop users from logging in.

Question 50Protection of Information Assets

A company relies only on signature-based antivirus software. An IS auditor is concerned about malware that changes its code each time it spreads. Which control would BEST address this concern?

Correct answer: C. Adding behavior-based tools that flag suspicious activity
Polymorphic malware changes its signature, so tools that look for known patterns struggle to detect it, while behavior-based tools focus on what the code does. More frequent signature updates still depend on the malware having been seen and catalogued before.

Question 51IS Operations & Business Resilience

An IS auditor finds that application logs containing customers' personal data are kept indefinitely because storage is inexpensive. What should the auditor recommend?

Correct answer: D. Set retention periods based on legal and business requirements
Retention should follow legal, regulatory and business needs, with data disposed of once it is no longer required. Encryption protects the logs but does not fix keeping personal data longer than necessary, which can breach privacy rules.

Question 52Protection of Information Assets

A software vendor publishes its installation files and their SHA-256 hash values on the same download page. Which statement BEST describes the limitation of this approach?

Correct answer: C. Anyone able to alter the file could also alter the hash
A hash detects modification only if the reference value comes from a trusted source, so posting both on one page lets an intruder replace them together. Signing the hash with the vendor's private key would add assurance of origin, and hashing is one-way, so it does not expose file contents.

Question 53Governance & Management of IT

In an IT balanced scorecard, which of the following measures BEST fits the learning and growth perspective?

Correct answer: B. Percentage of IT staff who completed planned skills training
The learning and growth perspective covers people, skills and future capability, so staff training completion fits it. User satisfaction belongs to the customer perspective.

Question 54Information System Auditing Process

When planning an attribute sample, an increase in which of the following factors results in a SMALLER required sample size?

Correct answer: C. Tolerable error rate
A higher tolerable error rate means the auditor can accept more deviations, so fewer items need to be tested. Raising the confidence level, the reliability required or the expected error rate all increase the sample size.

Question 55IS Acquisition, Development & Implementation

While reviewing the selection of a new payroll package, the IS auditor notes that the evaluation criteria and their weightings were defined after vendor proposals were received. What is the auditor's PRIMARY concern?

Correct answer: A. The criteria may have been set to favor a preferred vendor
Evaluation criteria and weightings should be set before proposals arrive so the selection stays objective. Defining them afterward allows them to be shaped around a favored vendor. A longer evaluation is an efficiency issue rather than a threat to a fair selection.

Question 56IS Operations & Business Resilience

The latest disaster recovery test at Crestview Bank shows that the core banking system took 11 hours to recover, while its approved RTO is 4 hours. Management calls the test a success because the system was eventually restored. What should the IS auditor do?

Correct answer: B. Report that the recovery capability does not meet the approved RTO
A test succeeds only if it meets its defined objectives, and missing the RTO by 7 hours is a significant finding. Extending the RTO is a business decision that must rest on impact, not on what the current setup can deliver, so the auditor should not suggest it just to close the gap.

Question 57Protection of Information Assets

An IS auditor notes that the company's internal vulnerability scans are run without login credentials on the target systems. What is the PRIMARY risk of this approach?

Correct answer: A. Missing patches and insecure local settings may not be detected
A scan without credentials sees only what is exposed externally, so it often misses missing patches and weak local configurations. Account lockout is an operational issue that can be managed, while incomplete coverage leaves real weaknesses unreported.

Question 58Governance & Management of IT

Business units at a manufacturer consume IT resources heavily but have no visibility of the costs involved. Which of the following would BEST encourage efficient use of IT resources?

Correct answer: C. A chargeback model that bills units for actual usage
Charging business units for what they use makes costs visible and gives them a reason to consume resources responsibly. A budget freeze limits spending but gives units no insight or incentive to change their usage.

Question 59Information System Auditing Process

An IS auditor is testing customer account balances where a few accounts are very large and most are small. Which approach would MOST efficiently reduce sample size while keeping precision?

Correct answer: D. Stratifying the population by balance size
Stratification groups items of similar value, which reduces variability within each group and allows a smaller sample for the same precision. Selecting every tenth item ignores the wide spread of values, so the large balances may be missed.

Question 60IS Operations & Business Resilience

A major release of an order-processing system is scheduled to go live this weekend. Which item is MOST important for the IS auditor to confirm before the release is approved?

Correct answer: D. A tested rollback plan exists in case the release fails
A tested rollback plan lets the team quickly restore the previous working version if the release causes failures, which protects business operations. Release notes and announcements are useful, but they do not reduce the risk of a failed change.

Question 61Protection of Information Assets

An IS auditor finds that several internal applications accept client certificates without checking a certificate revocation list or an OCSP responder. What is the PRIMARY risk?

Correct answer: A. Revoked certificates may still be accepted as valid
Without revocation checking, a certificate revoked because its key was compromised or its holder left will still grant access until it expires. Expiry dates are checked during normal validation, so they are not the gap here.

Question 62IS Acquisition, Development & Implementation

A clerk at a wholesale company keys a payment to a vendor code that is not on the approved vendor master file, and the system accepts it. Which control is missing?

Correct answer: B. An existence check against the vendor master file
An existence (validity) check compares input against valid values, such as codes on an approved master file, and rejects anything not found. A hash total only detects records lost or changed after the total was calculated, so an invalid code keyed at the start would still be included.

Question 63IS Operations & Business Resilience

An IS auditor reviews three years of disaster recovery test reports at Elmwood Retail and finds the same failure, a missing restore script, reported each year. What is the MOST important recommendation?

Correct answer: D. Track test findings in an action plan with owners and target dates
Testing has value only when the issues it finds are fixed, so findings need named owners, deadlines and follow-up. Testing more often would only find the same unresolved problem sooner without making recovery any more likely to work.

Question 64Protection of Information Assets

A bank plans to run a penetration test against its live online banking platform. Which of the following represents the GREATEST risk of this test?

Correct answer: C. Testing could disrupt services that customers rely on each day
Exploiting weaknesses on a live system can cause outages or data corruption that affect customers directly, which is why scope, timing and limits must be agreed in advance. Report leakage is a real concern, but it can be controlled through handling rules and is less immediate than service disruption.

Question 65Governance & Management of IT

Management wants to know how well its IT processes perform today compared with a desired future level. Which of the following approaches is MOST suitable?

Correct answer: B. A capability assessment of key IT processes
A capability or maturity assessment rates current process performance against defined levels and shows the gap to a target. A penetration test checks technical security weaknesses, not overall process capability.

Question 66Information System Auditing Process

An IS auditor selects a proper sample but fails to spot an exception because she misread the approval policy being tested. This is an example of:

Correct answer: C. non-sampling risk
Non-sampling risk arises when the auditor reaches a wrong conclusion for reasons unrelated to the sample, such as misreading criteria or misapplying a procedure. Sampling risk is the chance that the sample itself does not represent the population.

Question 67IS Operations & Business Resilience

An IS auditor notes that server and storage upgrades are purchased only after users complain about slow performance. What should the auditor recommend?

Correct answer: A. Set utilization thresholds and monitor trends to forecast needs
Monitoring against thresholds and analyzing trends lets IT add capacity before performance affects the business. Buying a fixed buffer each year may waste money or still fall short, because it is not based on actual demand.

Question 68Protection of Information Assets

In a public key infrastructure, which component is responsible for verifying a subscriber's identity before a certificate is issued?

Correct answer: B. The registration authority
The registration authority validates the applicant's identity and passes approved requests to the certificate authority for signing. The certification practice statement describes how these steps are performed, but it is a document, not the component that carries them out.

Question 69Governance & Management of IT

An IS auditor is reviewing a company's data retention policy. Which of the following should PRIMARILY determine how long records are kept?

Correct answer: A. Legal, regulatory and business requirements
Retention periods should be driven by laws, regulations and genuine business needs, and data should not be kept longer than necessary. Storage capacity is a technical constraint that should never override legal obligations.

Question 70Information System Auditing Process

Which of the following provides the STRONGEST evidence that a nightly system reconciliation control operates effectively?

Correct answer: C. Reperforming the reconciliation for a sample of days
Reperformance gives the auditor direct, first-hand evidence that the control works and produces correct results. Observation shows only how the process ran on one occasion while the auditor watched, and staff may act differently when observed.

Question 71IS Acquisition, Development & Implementation

A distribution company uses prenumbered shipping documents. Management wants the system to flag any missing or duplicated document numbers during input. Which control BEST meets this need?

Correct answer: B. A sequence check on the document numbers
A sequence check verifies that control numbers follow in order, so gaps and duplicates are flagged. A format check only confirms the number has the right type and length, so a missing or repeated number would still pass.

Question 72IS Operations & Business Resilience

Ferncliff Pharma encrypts all its backup media. The encryption keys are held only on a key server in the primary data center. What is the GREATEST risk?

Correct answer: D. Backups may be impossible to restore if the primary site is lost
Encrypted backups are useless without their keys, so keys must be protected and available at the recovery site, for example through escrow or a secondary key server. Encryption overhead is only a performance issue, while losing the keys would make every backup unrecoverable.

Question 73Protection of Information Assets

An IS auditor needs to determine whether the operating system settings on several hundred servers comply with the company's hardening standard. Which approach is MOST efficient and reliable?

Correct answer: A. Use an automated tool to compare server settings with the baseline
An automated configuration review can check every server against the approved baseline quickly and consistently. A manual review of a small sample is slower and may miss noncompliant servers outside the sample.

Question 74IS Operations & Business Resilience

An IS auditor reviewing the service desk finds that all incidents are worked in the order they are received, with no priority assigned. Which is the GREATEST risk?

Correct answer: B. Incidents affecting critical business services may be resolved too late
Without priorities based on impact and urgency, a major outage can wait behind minor requests and cause serious business harm. Duplicate tickets add noise, but they are a symptom of poor service rather than the main exposure.

Question 75Protection of Information Assets

An e-commerce company encrypts customer card numbers in its database, but the encryption key is stored in a table within the same database. What should the IS auditor recommend?

Correct answer: D. Keep the key in a hardware security module
Anyone who gains access to the database, or a copy of it, gets both the ciphertext and the key, which defeats the encryption. Holding keys separately in a hardware security module breaks that link, while a stronger algorithm does not help when the key sits beside the data.

Question 76Governance & Management of IT

A retailer wants to use customer purchase history, collected for order fulfillment, to train a marketing analytics model. Which of the following should the IS auditor verify FIRST?

Correct answer: D. Whether the notice or consent given covers this new use
Using personal data for a new purpose requires a lawful basis, such as consent or a compatible notice, under the purpose limitation principle. Model accuracy and budget matter to the project but do not address whether the use is permitted.

Question 77Information System Auditing Process

Which of the following BEST indicates that IS audit workpapers are adequately documented?

Correct answer: A. Another auditor could reach the same conclusions from them
Workpapers should hold enough evidence and explanation for another qualified auditor to understand the work and reach the same conclusions. Keeping every document received adds volume but does not ensure the evidence is relevant or sufficient.

Question 78IS Operations & Business Resilience

Pioneer Freight subscribes to a commercial hot site. An IS auditor learns that the provider has sold access to the same facility to many other clients in the same city. What is the auditor's PRIMARY concern?

Correct answer: C. The site may be unavailable if a regional disaster hits several clients
Hot site providers count on clients not declaring at once, but a regional event can affect many local subscribers together, so the auditor should check priority terms and client limits in the contract. Test scheduling is a real inconvenience, but it is a smaller risk than having no site during an actual disaster.

Question 79Protection of Information Assets

A penetration test performed nine months ago identified several high-risk weaknesses. During a follow-up audit, which of the following should concern the IS auditor MOST?

Correct answer: A. There is no record that the weaknesses were remediated and retested
Testing has little value if high-risk findings are not fixed and then retested to confirm the fix worked. Rotating testing firms is common practice and can bring a fresh perspective, so it is not a concern.

Question 80IS Acquisition, Development & Implementation

A telecom billing system processes call records through several stages overnight. The IS auditor wants assurance that data values are not lost or changed between processing stages. Which control BEST provides this?

Correct answer: B. Run-to-run totals checked at each processing stage
Run-to-run totals carry control figures from one processing stage to the next, so any loss or change of data between stages is detected. Check digits work only at input and cannot detect problems that occur later during processing.

Question 81Governance & Management of IT

An organization wants to start a data classification program. Which of the following should be done FIRST?

Correct answer: B. Create an inventory of data assets and their owners
An organization cannot classify data it has not identified, so an inventory of data assets with assigned owners is the starting point. Buying a labeling tool before knowing what data exists risks automating an incomplete process.

Question 82Information System Auditing Process

An IS auditor uses an integrated test facility (ITF) to test a live order processing system. What is the MAIN risk of this technique?

Correct answer: C. Test entries may distort production records and reports
ITF runs dummy transactions through live systems, so they must be reversed or excluded or they will distort production records and reports. Using live programs is the strength of ITF, not a limitation, and no separate copy of the application is needed.

Question 83IS Operations & Business Resilience

An organization is implementing a configuration management database (CMDB). From an IS auditor's perspective, what is its PRIMARY benefit?

Correct answer: B. It records configuration items and their links for impact analysis
A CMDB holds configuration items and the relationships between them, which helps assess the impact of changes and incidents. Recording incidents is the job of the service desk tool, which may link to the CMDB but serves a different purpose.

Question 84Protection of Information Assets

A customer portal uses HTTPS for the login page, but after login all other pages, including account statements, are served over plain HTTP. What is the PRIMARY concern?

Correct answer: D. Session tokens and account data travel unencrypted
Once the user moves to HTTP, session cookies and statement data are sent in clear text and can be intercepted, so protecting only the login page leaves most sensitive traffic exposed. Certificate expiry is an operational issue that does not explain why statements are exposed today.

Question 85IS Operations & Business Resilience

Oakridge Stores runs 40 branch offices spread across a large rural region, each with a small server room. Which recovery option is MOST suitable for restoring a branch whose building is damaged?

Correct answer: A. A mobile site that can be driven to the branch and set up nearby
Mobile sites are trailers or modular units that can be delivered to the affected location, which suits widely spread branches with modest systems. A hot site for every branch would cost far more than this need justifies, and a central cold site would still need equipment and would be far from the affected users.

Question 86Governance & Management of IT

An IS auditor finds that customer addresses differ across the billing, sales and support systems, causing many returned invoices. Which of the following is the BEST recommendation?

Correct answer: C. Set up data governance with clear owners and quality rules
Inconsistent data across systems usually points to missing ownership and quality standards, and data governance addresses that root cause. Manual fixes by the support team treat symptoms and leave the underlying problem in place.

Question 87Information System Auditing Process

An IS auditor writes an independent program to recalculate interest on loan accounts and compares the results with the production system's output. This technique is known as:

Correct answer: A. parallel simulation
Parallel simulation uses auditor-controlled programs to reprocess real production data and compare the results with the system's output. The test data method runs auditor-prepared transactions through the client's own programs, which is the reverse approach.

Question 88Protection of Information Assets

Management at a media company asks an IS auditor to explain the main advantage of a penetration test over a vulnerability scan. Which is the BEST response?

Correct answer: D. It shows whether weaknesses can actually be exploited
A penetration test tries to exploit weaknesses, showing their real impact and whether other controls stop the attack. Vulnerability scans, not penetration tests, are the faster option for broad and frequent coverage.

Question 89IS Acquisition, Development & Implementation

An IS auditor finds that the same supplier invoice was paid twice because it was entered once from the mailed copy and again from an emailed copy. Which control would BEST prevent this?

Correct answer: A. A duplicate check on supplier and invoice number
A duplicate check compares new entries with those already recorded, such as matching supplier and invoice number, and blocks a second entry. A record count would simply count the duplicate invoice as one more valid item.

Question 90IS Operations & Business Resilience

A release package combines twelve unrelated changes from different teams. Each change was unit tested on its own, but the package was not regression tested. Which is an IS auditor's GREATEST concern?

Correct answer: C. Interactions between the changes may cause failures in production
Changes that work alone can conflict when combined, and regression testing is meant to find those problems before go-live. Incomplete release notes hinder support, but they are less serious than a failed production release.

Question 91Protection of Information Assets

An IS auditor finds that building management IoT sensors are connected to the main corporate network and still use the manufacturer's default passwords. Which recommendation would BEST reduce the risk?

Correct answer: D. Move the sensors to an isolated network segment and change the default credentials
Segmenting IoT devices limits what an attacker can reach if one is compromised, and changing default credentials removes the easiest way in. Most IoT sensors cannot run antivirus, and broad vendor VPN access adds risk instead of reducing it.

Question 92Governance & Management of IT

After a risk assessment, management buys cyber insurance to cover losses from a possible ransomware attack. Which risk response does this represent?

Correct answer: D. Risk transfer
Insurance shifts the financial impact of a loss to a third party, which is risk transfer. It is not mitigation, because the likelihood and operational impact of an attack are not reduced.

Question 93Information System Auditing Process

An IS auditor wants a payments system to flag suspicious transfers above a set threshold so they can be examined before losses grow. Which technique is MOST suitable?

Correct answer: B. Embedded audit hooks
Audit hooks are embedded in application programs to flag selected transactions so the auditor can act before an error or irregularity grows. Parallel simulation reprocesses data after the fact, so it cannot give early warning.

Question 94IS Operations & Business Resilience

Mosaic Media hosts its critical platform in a public cloud and keeps its recovery environment in a second availability zone in the same region. Its BCP must address region-wide outages. What should the IS auditor recommend?

Correct answer: C. Place backups or a recovery environment in a separate geographic region
Availability zones protect against the failure of one data center but share a region, so a region-wide event can affect all of them. A separate geographic region removes that shared exposure. An uptime commitment only provides service credits and does not restore operations.

Question 95Protection of Information Assets

An IS auditor finds that a company's SIEM generates thousands of alerts each day and that analysts close most of them without investigation. What should the auditor recommend?

Correct answer: B. Tune correlation rules and prioritize alerts based on risk
Tuning rules and ranking alerts by risk cuts noise so analysts can focus on the events that matter. Hiring more staff treats the symptom, and high volumes of false alerts would still bury real attacks.

Question 96IS Acquisition, Development & Implementation

After fixing a defect in the tax module of an accounting application, the development team wants to confirm that the fix has not broken any functions that worked before. Which testing should be performed?

Correct answer: C. Regression testing
Regression testing reruns earlier test cases after a change to confirm that existing functions still work. Unit testing would check the corrected module itself but not whether other parts of the system were affected.

Question 97Governance & Management of IT

Which of the following should own the risk that an order processing system becomes unavailable?

Correct answer: B. The business process owner
The business process owner bears the impact of an outage and has the authority to decide how the risk is treated. The IT manager may own the controls that support availability, but not the business risk itself.

Question 98Information System Auditing Process

An audit department plans to introduce continuous auditing for a procurement system. Which of the following is MOST important for it to succeed?

Correct answer: C. Reliable automated systems with defined alert criteria
Continuous auditing depends on reliable, highly automated systems and clear criteria that trigger timely alerts to auditors. Moving control ownership to audit would compromise independence, because controls remain management's responsibility.

Question 99IS Operations & Business Resilience

A company's IT team receives dozens of vendor patches each month and cannot apply them all at once. Which factor should MOST influence the order in which patches are applied?

Correct answer: A. The risk each flaw poses given system criticality and exposure
Patching should be prioritized by risk, considering how serious the flaw is and how critical and exposed the affected systems are. Patching the largest number of servers first may look efficient, but it can leave the most dangerous flaws open longer.

Question 100Protection of Information Assets

An IS auditor finds that a development team keeps dozens of powered-off virtual machine images that are restarted from time to time for testing. What is the PRIMARY concern?

Correct answer: D. The images may be missing current security patches
Dormant images miss patch cycles while powered off, so they can return to the network with known vulnerabilities. Wasted storage is a cost issue, but it does not create the security exposure that unpatched machines do.

Question 101IS Operations & Business Resilience

Kestrel Consulting uses a SaaS platform for its customer records and assumes the provider backs up all data. The contract states the provider protects only its own infrastructure. What should the IS auditor recommend FIRST?

Correct answer: A. Clarify who is responsible for backing up the data and close any gap
The first step is to make responsibility clear and close the gap, for example with the provider's backup option or a third-party backup tool. Uptime figures show availability but say nothing about whether deleted or corrupted customer data could be recovered.

Question 102Protection of Information Assets

An IS auditor notes that the security log on a key application server is set to overwrite the oldest entries when the file reaches its maximum size. Logs are reviewed weekly. What is the GREATEST risk?

Correct answer: C. Events may be overwritten before they are reviewed or archived
If the log fills between weekly reviews, older entries are lost before anyone sees them, which could hide security events. Halting the server when logs fill is a different setting that affects availability, not the risk created by overwriting.

Question 103Governance & Management of IT

An IS auditor finds that several departments use unapproved cloud file-sharing services to exchange documents with clients. Which of the following is the BEST recommendation?

Correct answer: D. Define a policy with approved options for cloud service use
A clear policy with approved, secure alternatives meets the business need while bringing cloud use under control. Blocking all internet access is extreme and would disrupt operations without fixing the cause.

Question 104Information System Auditing Process

Management disagrees with a finding in the draft IS audit report. After rechecking the evidence, the auditor is confident the finding is valid. What should the auditor do?

Correct answer: D. Keep the finding and include management's response
When the evidence supports the finding, the auditor should report it and include management's view so readers can see both positions. Softening the wording to suit management would misstate the risk and undermine the auditor's objectivity.

Question 105IS Acquisition, Development & Implementation

An online ticketing company expects traffic to rise tenfold when a major concert goes on sale. Before release, the IS auditor wants evidence that the new booking system can handle this peak. Which test BEST provides it?

Correct answer: B. Stress and volume testing under simulated peak load
Stress and volume testing pushes the system to and beyond expected peak loads to show whether it stays stable and responsive. User acceptance testing confirms functions meet business needs but is not designed to simulate ten times normal traffic.

Question 106IS Operations & Business Resilience

A legacy manufacturing control system runs on an operating system that the vendor no longer supports, so security patches are no longer released. What should an IS auditor recommend?

Correct answer: B. Isolate the system on a separate network segment and plan to replace it
Compensating controls such as network isolation reduce exposure while a supported replacement is planned. Patches built for another version are untested on this system and could crash it, stopping the production line.

Question 107Protection of Information Assets

A law firm wants to let attorneys read corporate email on their personal smartphones. Which control BEST protects firm data on these devices?

Correct answer: D. MDM enrollment with a work container and remote wipe
Mobile device management with containerization separates firm data from personal apps and allows that data to be removed if the device is lost or the attorney leaves. A signed acceptable use policy sets expectations but provides no technical protection.

Question 108Governance & Management of IT

Staff in a research unit regularly bypass the laptop encryption requirement because it slows their analysis tools. Which of the following should the IS auditor recommend?

Correct answer: C. Use a formal exception process with risk review and approval
A formal exception process makes sure deviations are risk-assessed, approved at the right level and tracked, possibly with compensating controls. Leaving it to the research manager creates inconsistent, undocumented risk decisions.

Question 109Information System Auditing Process

When presenting IS audit results to the board of directors, which of the following is MOST important to include?

Correct answer: B. The business impact and risk of each key finding
Board members need to understand how findings affect business objectives so they can set priorities and allocate resources. Detailed technical settings belong in supporting material for IT management, not in a board summary.

Question 110IS Operations & Business Resilience

To meet its backup policy, Lindenwood Analytics takes hourly snapshots of its production storage array and keeps them for 30 days on the same array. What is the MAIN weakness of this approach?

Correct answer: C. A failure of the array would destroy both the data and the snapshots
Snapshots on the same array share its hardware, so an array failure, fire or attack on the array removes the backups as well. Storage use is a capacity concern, but it does not threaten the ability to recover, and a separate copy is needed for a true backup.

Question 111Protection of Information Assets

While reviewing a SIEM implementation, an IS auditor learns that the core billing system has not yet been connected because of technical difficulties. Which is the PRIMARY concern?

Correct answer: A. Security events on the billing system may go undetected
Without its logs in the SIEM, attacks or misuse involving a critical system will not be correlated or alerted on. Project delays matter to management, but the security gap on a key system carries greater risk.

Question 112IS Acquisition, Development & Implementation

A retail chain with 300 stores will first run its new point-of-sale system at three stores under real trading conditions before rolling it out everywhere. What is the PRIMARY benefit of this approach?

Correct answer: B. Problems can be found and fixed before they reach all stores
A pilot runs the new system in real conditions at a limited number of sites, so problems can be found and fixed before they affect every store. Comparing results between old and new systems describes a parallel run, not a pilot.

Question 113Governance & Management of IT

Management asks an IS auditor, who will later audit a new vendor management process, to design the process's controls. What is the BEST response?

Correct answer: A. Give advice, but leave design decisions and ownership to management
Auditors can advise on controls, but management must design and own them so the auditor stays independent for the later audit. Refusing all involvement is unnecessary and loses the value of early input.

Question 114Information System Auditing Process

How should an IS auditor determine when to perform follow-up on reported audit findings?

Correct answer: C. Base it on each finding's risk and the agreed due dates
Follow-up should be scheduled according to the significance of each risk and the dates management committed to. Waiting for management to report completion relies on the auditee and may leave high risks open for too long.

Question 115IS Operations & Business Resilience

A cloud provider sends monthly reports showing it met all SLA targets, and the company relies only on these reports. What should an IS auditor recommend?

Correct answer: D. Validate reported results using independent monitoring or audits
Reports prepared by the provider are not independent, so the company should confirm them with its own monitoring or through audit rights such as an assurance report. Larger penalties have little effect if missed targets are never detected.

Question 116Protection of Information Assets

Facilities staff have connected internet-enabled HVAC sensors to the main corporate network. The sensor vendor rarely releases firmware updates. What should the IS auditor recommend?

Correct answer: D. Place the sensors on an isolated network segment
Isolating IoT devices limits the damage if one is compromised and stops it from becoming a path into business systems. Monthly checks achieve little when the vendor rarely releases updates, and disabling the sensors removes a needed business function.

Question 117IS Operations & Business Resilience

An IS auditor reviews the disaster recovery plan at Ashgrove Utilities and finds detailed steps for failing over to the recovery site but none for returning operations to the primary site. What is the MOST likely impact?

Correct answer: A. The recovery site may be used far longer and at more risk than planned
Without planned return steps, the company may stay on a site built for short-term use, often with less capacity and protection, and the eventual move back may cause data loss or a second outage. Failover itself does not depend on the return steps, so it would still work.

Question 118Protection of Information Assets

At a university, database administrators are responsible for reviewing the audit logs of database activity, including their own privileged actions. What should an IS auditor recommend?

Correct answer: B. Assign the review to staff independent of the database team
People should not review records of their own activity, because they could overlook or hide improper actions. Signing off on reviews adds documentation but does not fix the lack of independence.

Question 119Governance & Management of IT

An IS auditor reviews a three-year IT strategy that consists mainly of hardware and software replacement dates. Which of the following is the auditor's PRIMARY concern?

Correct answer: D. The strategy may not support the organization's business goals
An IT strategy should describe how IT will support business goals; a list of refresh dates is an operational plan, not a strategy. Vendor support conflicts are a scheduling detail that matters far less than misalignment with the business.

Question 120Information System Auditing Process

What is the PRIMARY purpose of supervisory review of IS audit workpapers?

Correct answer: C. To ensure the evidence supports the audit conclusions
Supervisory review is a key quality control that confirms the work meets standards and that conclusions rest on sufficient, appropriate evidence. Budget tracking matters for project management but says nothing about the quality of conclusions.

Question 121IS Acquisition, Development & Implementation

Because of licensing costs, a logistics company will switch from its old warehouse system to a new one overnight, with no parallel run. What should the IS auditor consider MOST important?

Correct answer: A. A tested fallback plan to restore the old system if needed
A direct cutover leaves no safety net, so a tested fallback plan is needed to restore operations if the new system fails. Training should happen before go-live, not after, and a review in the first week is too early to judge results.

Question 122IS Operations & Business Resilience

IT has committed to a four-hour resolution target for a critical application in its SLA with the business, but no agreements set response times for the internal network and database teams. Which is the GREATEST risk?

Correct answer: C. Internal teams may not respond fast enough for the SLA to be met
Operational level agreements commit supporting teams to timelines that make the customer-facing SLA achievable. Without them, IT can miss its promise to the business even when the service desk does its part.

Question 123Protection of Information Assets

A retailer moves its order management system to an infrastructure as a service (IaaS) platform. Who is responsible for patching the guest operating systems?

Correct answer: A. The retailer, as the customer of the service
Under the IaaS shared responsibility model, the provider secures the facilities, hardware and virtualization layer, while the customer manages operating systems, applications and data. Assuming the provider patches guest systems is a common gap that leaves them exposed.

Question 124IS Operations & Business Resilience

A tabletop exercise of the business continuity plan at Silverbrook Insurance was attended only by IT staff. What is the PRIMARY weakness of this test?

Correct answer: B. Business recovery steps and decisions were not checked by their owners
Business continuity covers people, processes and decisions, not only systems, so process owners must take part to confirm manual workarounds and priorities. Tabletop tests can find technical gaps, so that option is false, and the real weakness is that the business side of the plan went unchecked.

Question 125Protection of Information Assets

An IS auditor reviewing incident records finds that similar incidents were escalated to senior management in some cases but not in others. What is the MOST likely cause?

Correct answer: A. There are no defined criteria for classifying incident severity
Clear severity criteria tie each type of incident to an escalation path, which produces consistent decisions. Staffing shortfalls may slow responses, but they would not explain why the same type of incident is escalated differently.

Question 126Governance & Management of IT

An IS auditor notes that an enterprise architecture team has documented only the current state of the organization's systems. Which of the following should the auditor recommend to make the program useful for guiding investments?

Correct answer: C. Define the target architecture and analyze the gaps
Comparing the current state with a target architecture shows the gaps that a roadmap of investments must close. Publishing diagrams shares information but gives no direction for future spending.

Question 127Information System Auditing Process

An organization introduces control self-assessment workshops for its business units. Which role is MOST appropriate for the IS auditor?

Correct answer: B. Facilitator who guides participants through the process
In CSA the auditor acts as a facilitator and adviser, while business staff own and assess their controls. Taking ownership of controls or deciding on risk acceptance would place the auditor in a management role and impair independence.

Question 128IS Acquisition, Development & Implementation

Several developers at a software firm are changing the same modules of a billing application, and fixes have been lost when one developer's copy overwrote another's. Which control BEST addresses this?

Correct answer: D. A version control tool with check-out and check-in of code
A version control tool manages check-out and check-in, keeps every version and prevents one developer's work from silently overwriting another's. Backups help recovery after a loss but do not stop conflicting changes from happening.

Question 129IS Operations & Business Resilience

A company moves its applications to an infrastructure as a service (IaaS) platform. When reviewing patching, which party should an IS auditor expect to be responsible for patching the virtual servers' operating systems?

Correct answer: A. The company, since it manages the guest operating systems
In IaaS the provider secures the facilities, hardware and virtualization layer, while the customer manages the guest operating systems and applications. Assuming the provider or a joint arrangement covers operating system patches is a common mistake that leaves servers unpatched.

Question 130Protection of Information Assets

An IS auditor must obtain assurance over security controls at a SaaS provider that does not allow customer audits. What is the BEST source of evidence?

Correct answer: B. A SOC 2 Type 2 report covering the relevant period
A SOC 2 Type 2 report gives an independent auditor's opinion on whether controls operated effectively over a period. A Type 1 report covers design at a single point in time, and an old one says little about current operation, so the auditor should rely on the Type 2 report and check its complementary user entity controls.

Question 131Governance & Management of IT

An IT department has achieved ISO 9001 certification. Which of the following BEST indicates that its quality management system remains effective over time?

Correct answer: A. Defects and complaints are analyzed to drive improvements
An effective quality system uses measurement and feedback to drive continuous improvement. A displayed certificate shows certification was achieved once, not that the system keeps working.

Question 132Information System Auditing Process

An IS auditor plans to rely on a penetration test carried out by an external security firm. What should the auditor do FIRST?

Correct answer: D. Assess the firm's competence, objectivity and scope
Before using the work of others, the auditor must evaluate their qualifications, independence and whether their work fits the audit objectives. Repeating the entire test would waste resources and defeat the purpose of relying on an expert.

Question 133IS Operations & Business Resilience

During a disaster scenario exercise at Hillcrest Manufacturing, the crisis team finds that the only copy of the business continuity plan is on a file server in the affected data center. What should the IS auditor recommend?

Correct answer: A. Keep current copies of the plan offsite and with key team members
The plan must be available when primary systems and buildings are not, so copies should be held offsite, in a secure location outside the affected site, and with key staff. A printed copy in the same building would likely be lost in the same event.

Question 134Protection of Information Assets

A logistics company has just closed a major malware incident and is holding a post-incident review. What is the PRIMARY purpose of this review?

Correct answer: C. To learn root causes and improve controls and procedures
A lessons-learned review looks at what went wrong and what worked so that controls and procedures can be improved. Blaming individuals discourages honest reporting and does not address the weaknesses that allowed the incident.

Question 135Governance & Management of IT

An IS auditor finds that user accounts of terminated employees often remain active for several weeks. Which of the following is the BEST recommendation?

Correct answer: A. Link HR termination notices to prompt access removal
Tying HR termination events to access removal addresses the root cause and closes the gap quickly. An annual review is a useful detective control but would still leave access open for months.

Question 136Information System Auditing Process

During an audit, the IT manager asks the IS auditor to configure missing log alerts on the firewall because the auditor knows the system well. What should the auditor do?

Correct answer: D. Recommend the control and let IT staff implement it
Auditors may advise on controls, but implementing them would mean later auditing their own work, which impairs independence. Refusing to discuss the issue goes too far, because the auditor can still explain the risk and suggest suitable controls.

Question 137IS Acquisition, Development & Implementation

During migration of customer data to a new CRM platform, the project team finds many duplicate and incomplete customer records in the legacy system. What should the IS auditor recommend?

Correct answer: B. Cleanse the data with data owner input before it is converted
Data should be cleansed before conversion, with data owners deciding how to fix or merge records, so errors are not carried into the new system. Converting as is and fixing later moves bad data into production and makes reconciliation harder.

Question 138IS Operations & Business Resilience

Two warehouse clerks update the stock level of the same item at the same time, and one clerk's update is lost. Which database control would BEST prevent this?

Correct answer: C. Record locking while an update transaction is in progress
Locking stops a second user from changing a record until the first update is committed, which prevents lost updates. A nightly reconciliation could detect the error later, but it does not prevent the wrong stock level in the first place.

Question 139Protection of Information Assets

A European insurer plans to move customer personal data to a cloud provider that replicates data across data centers in several countries. What should the IS auditor consider FIRST?

Correct answer: B. Whether cross-border transfers meet privacy laws
Privacy regulations can restrict where personal data is stored or transferred, so the legal basis for cross-border transfers must be confirmed before migration. Performance gains from replication are secondary if the transfer itself breaches regulatory requirements.

Question 140IS Operations & Business Resilience

Backup tapes holding customer financial records at Larkspur Finance are sent weekly to an offsite vault by courier in unlocked cases. The tapes are not encrypted. What is the GREATEST risk?

Correct answer: D. Sensitive data may be disclosed if a tape is lost or stolen in transit
Unencrypted media that leave the building expose confidential data to anyone who gets hold of them, which can lead to regulatory penalties and loss of trust. Physical damage affects the availability of one backup set, while a disclosure cannot be undone.

Question 141Protection of Information Assets

An IS auditor reviewing incident tickets notes that the desktop support team reimages any infected workstation as soon as malware is detected. What is the GREATEST concern with this practice?

Correct answer: B. Evidence of the cause and extent of the infection may be destroyed
Wiping the machine at once destroys evidence that shows how the malware entered and whether other systems or data were affected. Loss of user files is an inconvenience, but it is less serious than being unable to determine the scope of a breach.

Question 142Governance & Management of IT

A company is hiring a system administrator who will have privileged access to financial systems. Which of the following controls is MOST important before the person starts?

Correct answer: C. A background check suited to the sensitivity of the role
Screening before granting privileged access helps confirm the person is trustworthy and reduces insider risk. Meeting business users helps with the job but does nothing to reduce the risk that comes with privileged access.

Question 143Information System Auditing Process

An IS auditor is reviewing controls at a cloud payroll provider used by the company. Which report gives the BEST evidence that the provider's controls operated effectively over the past year?

Correct answer: A. A SOC 1 Type 2 report on the provider
A Type 2 report covers both the design and the operating effectiveness of controls over a period, which is what the auditor needs. A Type 1 report only describes control design at a single point in time.

Question 144IS Acquisition, Development & Implementation

A logistics firm is planning the post-implementation review of its new fleet management system. When is the BEST time to perform this review?

Correct answer: D. Once the system has run long enough for benefits to be measured
A post-implementation review should take place once the system has stabilized and run long enough to show whether expected benefits are being delivered. Reviewing right after go-live is tempting while the team is available, but early problems and limited data would distort the results.

Question 145IS Operations & Business Resilience

To speed up reports, a database administrator denormalized several tables so that customer details are now stored in multiple places. What should an IS auditor be MOST concerned about?

Correct answer: A. Updates may not reach every copy, leaving the data inconsistent
Storing the same data in several places means every update must reach every copy, or records will disagree and integrity suffers. Longer backups are a minor operational cost compared with unreliable customer data.

Question 146Protection of Information Assets

A business unit states that its legacy system cannot meet the corporate password standard. What is the BEST course of action?

Correct answer: C. Record a time-bound exception accepted by the risk owner
A formal exception process documents the deviation, requires management to accept the residual risk and sets a date for review or remediation. Rewriting the standard to fit one system would weaken controls across the whole organization.

Question 147IS Operations & Business Resilience

When choosing a recovery strategy, management at Cobalt Airlines compares the cost of outages over time with the cost of different recovery options. Which point represents the BEST choice?

Correct answer: D. The point where the combined outage and recovery cost is lowest
Downtime costs rise the longer an outage lasts, while recovery costs rise as recovery gets faster, so the best strategy keeps their combined total lowest. Aiming for zero outage cost means paying for instant recovery, which usually costs far more than the business impact justifies.

Question 148Protection of Information Assets

A forensic examiner creates a bit-stream image of a hard drive seized in an investigation. Which of the following BEST demonstrates that the image is an exact copy of the original drive?

Correct answer: D. Matching hash values calculated for the original drive and the image
Identical cryptographic hash values show that every bit in the image matches the original. Matching file counts and folder structures can look convincing, but they would not reveal changed content or data held in unallocated space.

Question 149Governance & Management of IT

An IS auditor plans to rely on an IT performance dashboard when reporting to the audit committee. Which of the following should the auditor do FIRST?

Correct answer: B. Verify the accuracy and source of the dashboard data
Before relying on reported metrics, the auditor must confirm the data is complete and accurate; otherwise the conclusions may be wrong. Recommending new KPIs may be useful later, but it does not show whether the current figures can be trusted.

Question 150Information System Auditing Process

Midyear, the company announces a major ERP migration that is not in the approved IS audit plan. What should the IS audit manager do?

Correct answer: C. Reassess risks and propose plan changes to the audit committee
A risk-based audit plan should be updated when significant changes occur, and revisions should go to the audit committee that approved the original plan. Dropping an audit without approval bypasses governance even if the reasoning is sound.