Isaca CISA Exam Dumps

Certified Information Systems Auditor

Isaca CISA Sample Questions

Question # 1

Which of the following techniques would provide the BEST assurance to an IS auditor that all necessary data has been successfully migrated from a legacy system to a modern platform?

A. Review of logs from the migration process
B. Data analytics
C. Interviews with migration staff
D. Statistical sampling

Show Answer

Question # 2

An audit of the quality management system (QMS) begins with an evaluation of the: 

A. organization’s QMS policy
B. sequence and interaction of QMS processes
C. QMS processes and their application
D. QMS document control procedures

Show Answer

Question # 3

What is BEST for an IS auditor to review when assessing the effectiveness of changes recently made to processes and tools related to an organization's business continuity plan (BCP)?

A. Updated Inventory of systems
B. Full test results
C. Completed test plans
D. Change management processes

Show Answer

Question # 4

Which of the following provides an IS auditor the MOST assurance that an organization is compliant with legal and regulatory requirements?

A. Senior management has provided attestation of legal and regulatory compliance
B. Controls associated with legal and regulatory requirements have been identified and tested
C. There is no history of complaints or fines from regulators regarding noncompliance
D. The IT manager is responsible for the organization s compliance with legal and regulatory requirements.

Show Answer

Question # 5

Which of the following practices BEST ensures that archived electronic information of permanent importance is accessible over time? 

A. Acquire applications that emulate old software.
B. Periodically test the integrity of the information.
C. Regularly migrate data to current technology.
D. Periodically backup the archived data.

Show Answer

Question # 6

Which of the following would be the MOST appropriate reason for an organization to purchase fault-tolerant hardware? 

A. Improving system performance
B. Reducing hardware maintenance costs
C. Minimizing business loss
D. Compensating for the lack of contingency planning

Show Answer

Question # 7

Which of the following findings should be of GREATEST concern to an IS auditor reviewing system deployment tools for a critical enterprise application system? 

A. Change requests do not contain backout plans.
B. There are no documented instructions for using the tool.
C. Access to the tool is not approved by senior management.
D. Access to the tool is not restricted.

Show Answer

Question # 8

An accounts receivable data entry routine prevents the entry of the same customer with different account numbers. Which of the following is the BEST way to test if this programmed control is effective? 

A. Implement a computer-assisted audit technique (CAAT).
B. Compare source code against authorized software.
C. Review a sorted customer list for duplicates.
D. Attempt to create a duplicate customer.

Show Answer

Question # 9

An IS auditor is evaluating the risk associated with moving from one database management system (DBMS) to another. Which of the following would be MOST helpful to ensure the integrity of the system throughout the change?

A. Preserving the same data inputs
B. Preserving the same data interfaces
C. Preserving the same data classifications
D. Preserving the same data structure

Show Answer

Question # 10

Which of the following is found in an audit charter?

A. Audit objectives and scope
B. Required training for audit staff
C. The process of developing the annual audit plan
D. The authority given to the audit function

Show Answer

Question # 11

An IS auditor finds a number of system accounts that do not have documented approvals Which of the following should be performed FIRST by the auditor?

A. Have the accounts removed immediately
B. Obtain sign-off on the accounts from the application owner
C. Document a finding and report an ineffective account provisioning control
D. Determine the purpose and risk of the accounts

Show Answer

Question # 12

Which of the following physical controls will MOST effectively prevent breaches of computer room security?

A. Photo IDs
B. CCTV monitoring
C. Retina scanner
D. RFID badge

Show Answer

Question # 13

Which of the following is the MOST effective control for protecting the confidentiality and integrity of data stored unencrypted on virtual machines?

A. Restrict access to images and snapshots of virtual machines
B. Limit creation of virtual machine images and snapshots
C. Monitor access To stored images and snapshots of virtual machines
D. Review logical access controls on virtual machines regularly

Show Answer

Question # 14

Which of the following technologies has the SMALLEST maximum range for data transmission between devices?

A. Near-field communication (NFC)
B. Long-term evolution (LTE)
C. Bluetooth
D. Wi-Fi

Show Answer

Question # 15

Which of the following should the IS auditor do FIRST to ensure data transfer integrity for Internet of Things (loT) devices?

A. Verify access control lists to the database where collected data is stored.
B. Determine how devices are connected to the local network.
C. Confirm that acceptable limits of data bandwidth are defined for each device.
D. Ensure that message queue telemetry transport (MQTT) is used. 

Show Answer

Question # 16

Which of the following is the MOST likely cause of a successful firewall penetration?

A. Use of a Trojan to bypass the firewall
B. Loophole m firewall vendor's code
C. Virus infection
D. Firewall misconfiguration by the administrator

Show Answer

Question # 17

Which of the following should be the FIRST step when drafting an incident response plan for a new cyber-attack scenario?

A. Create a new incident response team.
B. Identify relevant stakeholders.
C. Schedule response testing.
D. Create a reporting template.

Show Answer

Question # 18

The CIO of an organization is concerned that the information security policies may not be comprehensive. Which of the following should an IS auditor recommend be performed FIRST?

A. Determine if there is j process to handle exceptions to the policies
B. Establish a governance board to track compliance with the policies
C. Obtain a copy of their competitor's policies
D. Compare the policies against an industry framework.

Show Answer

Question # 19

Which of the following is MOST influential when defining disaster recovery strategies?

A. Annual loss expectancy
B. Maximum tolerable downtime
C. Data classification scheme
D. Existing server redundancies

Show Answer

Question # 20

Which of the following is MOST important for an IS auditor to verify when evaluating an organization's firewall?

A. Logs are being collected in a separate protected host.
B. Access to configuration files is restricted.
C. Insider attacks are being controlled.
D. Automated alerts are being sent when a risk is detected.

Show Answer

Question # 21

An IS auditor is reviewing the change management process in a large IT service organization. Which of the following observations would be the GREATEST concern?  

A. Emergency software releases are not fully documented after implementation
B. User acceptance testing (UAT) can be waived in case of emergency software releases
C. Code is migrated manually into production during emergency software releases
D. A senior developer has permanent access to promote code for emergency software releases

Show Answer

Question # 22

Code changes are compiled and placed in a change folder by the developer. An implementation learn migrates changes to production from the change folder. Which of the following BEST indicates separation of duties is in place during the migration process? 

A. A second individual performs code review before the change is released to production.
B. The implementation team does not have access to change the source code.
C. The implementation team does not have experience writing code.
D. The developer approves changes prior to moving them to the change folder.

Show Answer

Question # 23

Which of the following should be an IS auditor's GREATEST concern when reviewing an outsourcing arrangement with a third-party cloud service provider to host personally identifiable data? 

A. The data is not adequately segregated on the host platform.
B. Fees are charged based on the volume of data stored by the host.
C. The outsourcing contract does not contain a right-to-audit clause.
D. The organization's servers are not compatible with the third party's infrastructure

Show Answer

Question # 24

To ensure the integrity of a recovered database, which of the following would be MOST useful?

A. Database defragmentation tools
B. Application transaction logs
C. A copy of the data dictionary
D. Before-and-after transaction images

Show Answer

Question # 25

An IS auditor will be testing accounts payable controls by performing data analytics on the entire population of transactions. Which of the following is MOST important for the auditor to confirm when sourcing the population data?

A. There is no privacy information in the data.
B. The data is taken directly from the system.
C. The data can be obtained in a timely manner.
D. The data analysis tools have been recently updated.

Show Answer

Question # 26

An IS auditor assessing the controls within a newly implemented call center would FIRST 

A. test the technical infrastructure at the call center.
B. review the manual and automated controls in the call center.
C. gather information from the customers regarding response times and quality of service.
D. evaluate the operational risk associated with the call center.

Show Answer

Question # 27

Which of the following is the GREATEST threat to Voice-over Internet Protocol (VoIP) related to privacy? 

A. Call recording
B. Incorrect routing
C. Eavesdropping
D. Denial of service (DoS)

Show Answer

Question # 28

Which of the following is the MOST effective sampling method for an IS auditor to use for identifying fraud and circumvention of regulations? 

A. Discovery sampling
B. Stop-or-go sampling
C. Statistical sampling
D. Variable sampling

Show Answer

Question # 29

A review of IT interface controls finds an organization does not have a process to identify and correct records that do not get transferred to the receiving system. Which of the following is......... 

A. Implement software to perform automatic reconciliations of data between systems
B. Automate the transfer of data between systems as much as feasible.
C. Enable automatic encryption, decryption and electronic signing of data files
D. Have coders perform manual reconciliation of data between systems

Show Answer

Question # 30

Which of the following should MOST concern an IS auditor reviewing an intrusion detection system (IDS)?

A. Number of false negatives
B. Legitimate traffic blocked by the system
C. Number of false positives
D. Reliability of IDS logs

Show Answer

Question # 31

When using a wireless device, which of the following BEST ensures confidential access to email via web mail?

A. Wired equivalent privacy (WEP)
B. Hypertext transfer protocol secure (HTTPS)
C. Simple object access protocol (SOAP)
D. Extensible markup language (XML)

Show Answer

Question # 32

A company is using a software developer for a project. At which of the following points should the software quality assurance (QA) plan be developed? 

A. Prior to acceptance testing
B. During the feasibility phase
C. As part of software definition
D. As part of the design phase

Show Answer

Question # 33

Which of the following controls will BEST ensure that the board of directors receives sufficient information about IT?

A. The CIO reports on performance and corrective actions in a timely manner.
B. Board members are knowledgeable about IT and the CIO is consulted on IT issues.
C. The CIO regularly sends IT trend reports to the board.
D. Regular meetings occur between the board the CIO and a technology committee

Show Answer

Question # 34

What is the MOST critical finding when reviewing an organization's information security management?

A. No periodic assessments to identify threats and vulnerabilities  
B. No dedicated security officer  
C. No employee awareness training and education program
D. No official charter for the information security management system

Show Answer

Question # 35

A security company and service provider have merged and the CEO has requested one comprehensive set of security policies be developed for the newly formed company. The IS auditor s BEST recommendation would be to:

A. implement the service provider's policies
B. implement the security company s policies,
C. adopt an industry standard security policy
D. conduct a policy gap assessment

Show Answer

Question # 36

Which of the following is a detective control that can be used to uncover unauthorized access to information systems?

A. Requiring long and complex passwords for system access
B. Implementing a security information and event management (SIEM) system
C. Requiring internal audit to perform periodic reviews of system access logs
D. Protecting access to the data center with multif actor authentication

Show Answer

Question # 37

Which of the following is the BEST way to ensure payment transaction data is restricted to the appropriate users?

A. Implementing two-factor authentication
B. Using a single menu for sensitive application transactions
C. Implementing role-based access at the application level
D. Restricting access to transactions using network security software

Show Answer

Question # 38

The MOST important reason why an IT risk assessment should be updated on a regular basis is to: 

A. comply with risk management policies
B. comply with data classification changes.
C. react to changes in the IT environment.
D. utilize IT resources in a cost-effective manner.

Show Answer

Question # 39

Which of the following should be done FIRST to effectively define the IT audit universe for an entity with multiple business lines?

A. Identify aggregate residual IT risk for each business line.
B. Obtain a complete listing of the entity's IT processes
C. Obtain a complete listing of assets fundamental to the entity's businesses.
D. Identify key control objectives for each business line's core processes

Show Answer

Question # 40

Which of the following factors constitutes a strength in regard to the use of a disaster recovery planning reciprocal agreement?

A. Reciprocal agreements may not be formally established in a contract.
B. The two companies might share a need for a specialized piece of equipment
C. Changes to the hardware or software environment by one company could make the agreement ineffective or obsolete.
D. A disaster could occur that would affect both companies.

Show Answer

Question # 41

An IS auditor reviewing a purchase accounting system notices several duplicate payments made for the services rendered. Which of the following is the auditor's BEST recommendation for preventing duplicate payments?

A. Implement a configuration control to enable sequential numbering of invoices.
B. Request vendors to attach service acknowledgment notices to purchase orders.
C. Implement a system control that determines if there are corresponding invoices for purchase orders.
D. Perform additional supervisory reviews prior to the invoice payments.

Show Answer

Question # 42

Due to a global pandemic, a health organization has instructed its employees to work from home as much as possible. The employees communicate using instant messaging Which of the following is the GREATEST risk in this situation?

A. Home office setups may not be compliant with workplace health and safety requirements.
B. Employee productivity may decrease when working from home.
C. The capacity of servers may not allow all users to connect simultaneously
D. Employees may exchange patient information through less secure methods.

Show Answer

Question # 43

Which of the following sampling techniques is BEST to use when verifying the operating effectiveness of internal controls during an audit of transactions?  

A. Attribute sampling
B. Statistical sampling
C. Judgmental sampling
D. Stop-or-go sampling

Show Answer

Question # 44

Which of the following will MOST likely compromise the control provided by a digital signature created using RSA encryption? 

A. Obtaining the sender's private key
B. Reversing the hash function using the digest
C. Altering the plaintext message
D. Deciphering the receiver's public key

Show Answer

Question # 45

When determining which IS audits to conduct during the upcoming year, internal audit has received a request from management for multiple audits of the contract division due to fraud findings during the prior year Which of the following is the BEST basis for selecting the audits to be performed?

A. Select audits based on management's suggestion
B. Select audits based on the skill sets of the IS auditors.
C. Select audits based on collusion risk
D. Select audits based on an organizational risk assessment.

Show Answer

Question # 46

Which of the following is the BEST way to enforce the principle of least privilege on a server containing data with different security classifications?

A. Applying access controls determined by the data owner
B. Limiting access to the data files based on frequency of use
C. Using scripted access control lists to prevent unauthorized access to the server
D. Obtaining formal agreement by users to comply with the data classification policy

Show Answer

Question # 47

Which of the following would be an appropriate role of internal audit in helping to establish an organization’s privacy program? 

A. Analyzing risks posed by new regulations
B. Developing procedures to monitor the use of personal data
C. Defining roles within the organization related to privacy
D. Designing controls to protect personal data

Show Answer

Question # 48

An organization s audit charter PRIMARILY:

A. formally records the annual and quarterly audit plans
B. documents the audit process and reporting standards
C. describes the auditors' authority to conduct audits
D. defines the auditors' code of conduct

Show Answer

Question # 49

Which of the following attacks would MOST likely result in the interception and modification of traffic for mobile phones connecting to potentially insecure public Wi-Fi networks?

A. Man-in-the-middle
B. Phishing
C. Vishing
D. Brute force

Show Answer

Question # 50

In the risk assessment process, which of the following should be identified FIRST?

A. Impact
B. Threats
C. Assets
D. Vulnerabilities

Show Answer

Question # 51

Which of the following is the GREATEST concern when an organization allows personal devices to connect to its network?

A. It is difficult To enforce the security policy on personal devices
B. It is difficult to maintain employee privacy.
C. IT infrastructure costs will increase.
D. Help desk employees will require additional training to support devices.

Show Answer

Question # 52

Which of the following would be the MOST significant factor when choosing among several backup system alternatives with different restoration speeds?

A. Recovery point objective (RPO)
B. Mean time between failures (MTBFs)
C. Maximum tolerable outages (MTOs)
D. Recovery time objective (RTO)

Show Answer

Question # 53

Which of the following is the PRIMARY purpose of quality assurance (QA) within an IS audit department?

A. To ensure conclusions are reliable and no false assurance is given  
A. To ensure conclusions are reliable and no false assurance is given  
C. To enforce audit policies and identify any deviations
D. To confirm audit practice is aligned with industry standards and benchmarks

Show Answer

Question # 54

When aligning IT projects with organizational objectives, it is MOST important to ensure that the: 

A. percentage of growth in project intake is reviewed.
B. overall success rate of projects is high.
C. business cases have been clearly defined for all projects.
D. project portfolio database is updated when new systems are acquired.

Show Answer

Question # 55

An IS auditor is reviewing a network diagram. Which of the following would be the BEST location for placement of a firewall?

A. Between virtual local area networks (VLANs)
B. At borders of network segments with different security levels
C. Between each host and the local network switch/hub
D. Inside the demilitarized zone (DMZ)

Show Answer

Question # 56

Which of the following is MOST important for an IS auditor to consider during a review of the IT governance of an organization?

A. Funding allocation
B. Defined service levels
C. Risk management methodology
D. Decision making responsibilities

Show Answer

Question # 57

Which of the following situations would impair the independence of an IS auditor involved in a software development project? 

A. Determining the nature of implemented controls
B. Programming embedded audit modules
C. Being an expert advisor to the project sponsor
D. Defining end-user requirements

Show Answer

Question # 58

Which of the following is the GREATEST advantage of vulnerability scanning over penetration testing'?

A. The testing process can be automated to cover large groups of assets
B. Network bandwidth is utilized more efficiently.
C. Custom-developed applications can be tested more accurately
D. The testing produces a lower number of false positive results

Show Answer

Question # 59

When deploying an application that was created using the programming language and tools supported by the cloud provider, the MOST appropriate cloud computing model for an organization to adopt is: 

A. Platform as a Service (PaaS).
B. Software as a Service (SaaS).
C. Infrastructure as a Service (laaS).
D. Identity as a Service (IDaaS).

Show Answer

Question # 60

Which of the following is MOST likely to be included in computer operating procedures in a large data center?

A. Guidance on setting security parameters
B. Procedures for resequencing source code
C. Procedures for utility configuration
D. Instructions for job scheduling

Show Answer