20 free CISA practice questions

Correct answer: B · A risk assessment ranking each area by its impact on business goals

ISACA lists risk-based audit planning in Domain 1 and asks CISA candidates to conduct audits under a risk-based IS audit strategy. When the hours cannot cover every area, ranking areas by their risk to the organization's goals sends the time where a control failure would hurt most. Auditing in order of the last audit date ignores whether an area is risky at all, although time since the last review can be one input to the risk ranking. Department heads' requests can be weighed, but letting them set the plan undermines audit objectivity. Building the plan around the team's current expertise leaves high-risk areas unaudited; a skill gap is solved with training or outside help.

Look for this next time: When audit hours are limited, a risk assessment decides which areas go into the plan.

Correct answer: D · Backup job logs the auditor pulls directly from the provider's system

Audit evidence is generally more reliable when the auditor obtains it directly rather than through others, and when it is a complete system record rather than a summary or statement prepared by the auditee's staff. Job logs the auditor pulls from the provider's backup system meet both conditions and cover the whole quarter. A spreadsheet prepared by the payroll manager is a secondary summary that could leave out or misstate failures. A spoken assurance is the weakest of the four, because it leaves nothing to test. Screenshots forwarded by an internal coordinator pass through other hands and show only selected moments, so they are harder to rely on than the complete logs.

Look for this next time: Complete system records the auditor obtains directly generally outweigh summaries, screenshots, or statements from the auditee.

Correct answer: A · Give the audit to another auditor who had no part in designing the controls

Reviewing your own design work creates a self-review problem: the auditor would be judging decisions she helped make and may be less likely to see their weaknesses. CISA candidates are expected to conduct audits in accordance with IS audit standards, which call for objectivity. Giving the audit to someone with no part in the design removes the conflict, and she can still serve as a source of information. Her knowledge of the controls is the cause of the conflict, not a cure for it. A written statement from the IT team, whose controls are under review, does not restore objectivity. Skipping the audit leaves the controls untested, and audit involvement in design is not a substitute for testing.

Look for this next time: An auditor should not lead the audit of controls she helped design; assign it to someone independent of that work.

Correct answer: C · Look for evidence that the reviews took place, then close or escalate

ISACA's CISA task list includes post-audit follow-up to evaluate whether the identified risk has been sufficiently addressed. That calls for evidence: here, records showing the monthly reviews happened after June 30 and that rule changes were actually checked. If the evidence holds, the finding can be closed; if not, the auditor reports or escalates it. The director's email is a claim, not evidence that the control operates. Waiting for the next full audit leaves a known risk unverified for months. A risk acceptance statement is a different path that management may choose, but it is not how an auditor confirms that an agreed fix was made.

Look for this next time: Follow-up means testing that the agreed action happened and works, not accepting management's word for it.

Correct answer: C · Business leaders had no role in setting or approving the IT priorities

ISACA's CISA tasks include evaluating the IT strategy for alignment with the organization's strategies and objectives. A plan written and approved only inside IT gives no evidence that it reflects the business's goals, so its priorities may serve IT rather than the organization. Business involvement, for example a steering committee of business and IT leaders that approves priorities, is how alignment is usually shown. A three-year horizon is not a weakness in itself. Project-level budgets belong in project planning, not necessarily in the strategy. A strategy is not a project, so a project management method is beside the point.

Look for this next time: Alignment needs business involvement: an IT strategy approved only by IT gives no evidence that it serves the organization's goals.

Correct answer: A · Faulty or unauthorized code could go live with no one else checking it

NIST describes separation of duty as the principle that no user should be given enough privileges to misuse a system on their own. When one person both writes code and moves it into production, an error or a deliberate unauthorized change can go live with no second person checking it. That is the risk to report, with options such as giving deployment to a separate role or, where the team is too small, compensating controls such as an independent review of every change after deployment. Workload is a management concern, not a control failure. Nothing in the scenario links the setup to system performance. License counts have nothing to do with who deploys code.

Look for this next time: One person who can both change code and deploy it can put unauthorized or faulty changes into production unchecked.

Correct answer: D · Now, before signing, while the terms can still be negotiated

ISACA's CISA tasks include evaluating whether IT vendor selection and contract management meet business, legal, and regulatory requirements. Security requirements, breach notice, and audit rights are easiest to secure before the contract is signed, while the provider is still competing for the business. Waiting for the first annual review means a year of storing customer records with no enforceable terms. Learning which terms were needed from an incident is the costliest way to find out. Renewal may be years away, leverage is not reliably greater then, and the records are exposed in the meantime.

Look for this next time: Put security, breach notice, and right-to-audit terms into a vendor contract before it is signed.

Correct answer: B · The business owner accountable for the customer account data

NIST defines the information owner as the official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal. Deciding how sensitive the data is falls within that responsibility, so the business owner sets the classification. The database administrator is a custodian who carries out the controls the owner sets. The IS auditor evaluates the scheme; setting classifications would mean auditing decisions the auditor made. The help desk processes access requests and has no authority over how sensitive the data is.

Look for this next time: The data owner classifies data; custodians such as administrators protect it, and auditors evaluate the result.

Correct answer: A · Reconcile record counts and control totals between the old and new systems

ISACA lists system migration and data conversion in Domain 3. Comparing record counts and control totals, such as the sum of account balances, between the source and the target shows whether every record arrived and whether values changed on the way; any difference points to the records to investigate. A vendor's statement about its tool is a claim, not evidence about this conversion. Store managers' impressions are informal and cover a tiny, unsystematic slice of the data. A system that starts and accepts logins can still hold missing or altered records.

Look for this next time: Reconciling counts and control totals between the source and the target is the core test of a complete, accurate conversion.

Correct answer: D · User acceptance testing by the claims business users

User acceptance testing is carried out by the people who will use the system, against the business requirements, and their sign-off is the evidence that the system does what the business needs. ISACA lists system readiness and implementation testing in Domain 3. Regression testing checks that fixes did not break existing functions, and developers run it against technical expectations. Load testing shows whether the system handles peak volume, not whether it meets the requirements. A code review checks code quality and can catch defects, but it does not show that the business accepts the system.

Look for this next time: User acceptance testing by business users, against the business requirements, is the sign-off that a system is fit for use.

Correct answer: B · The RPO is not met, because up to about a day of orders could be lost

NIST defines the recovery point objective as the point in time to which data must be recovered after an outage. Here the business can afford to lose at most four hours of data, but with one nightly backup and nothing in between, a failure late in the day would lose nearly a full day of orders. A 24-hour backup cycle cannot meet a four-hour RPO. How fast the system restarts is the recovery time objective, a different measure, and the scenario says nothing about it. Testing backups is good practice, but a tested backup that is 23 hours old still loses 23 hours of data.

Look for this next time: Backups or replication must run at least as often as the RPO allows; the RTO is about restart time, not data loss.

Correct answer: C · A business impact analysis that ranks processes by the impact of disruption

NIST describes a business impact analysis as the process of analyzing operational functions and the effect a disruption might have on them. Its results, such as which processes matter most and how long each can be down, set the priorities and recovery objectives that the continuity strategy has to meet. Buying a hot site first risks paying for systems that could wait, or missing the ones that cannot. Server procedures written before priorities are known may cover the wrong systems first. A full interruption test with no plan in place risks a real outage and tests nothing that has been designed.

Look for this next time: A business impact analysis comes first, because it sets the priorities and recovery objectives that the plan and the site choice must meet.

Correct answer: C · A record of the change, with approval and review done after the fact

ISACA lists IT change, configuration, and patch management in Domain 4. An emergency procedure lets an urgent fix go in before the normal approval, but it does not remove control: the change should be recorded, then approved and reviewed after the fact within a set time. Treating emergency changes as exempt from records would let unauthorized changes hide behind the word emergency. Prior approval from the change board is exactly the step the emergency path exists to skip. Rolling back a working fix to finish paperwork would bring the outage back.

Look for this next time: Emergency changes skip prior approval, not control: expect a record plus approval and review after the fact.

Correct answer: D · Inventory it as an end-user tool and apply controls matched to its risk

ISACA's current outline lists shadow IT and end-user computing in Domain 4, with a task to evaluate their risk and the effectiveness of compensating controls. A spreadsheet that feeds the general ledger is high risk, so it belongs in an inventory with controls in proportion, such as version control, protected formulas, restricted access, and an independent review or reconciliation of its output. Banning every spreadsheet is out of proportion and unlikely to hold. Results that look reasonable are not evidence that the formulas are right. A shared drive adds access risk and still leaves the formulas unchecked.

Look for this next time: High-risk end-user tools need an inventory and controls in proportion to their risk, not a ban or blind trust.

Correct answer: A · A hot site with hardware and software ready to take over operations

NIST describes a hot site as a fully operational offsite facility equipped with hardware and software, and a cold site as one with the electrical and physical components of a computer facility but no computer equipment in place. Only the hot site can realistically bring the platform back within two hours. A cold site needs equipment delivered and installed first, which takes far longer. A reciprocal agreement depends on another bank's spare capacity, which may not be there during a shared disruption and is hard to test. A two-day delivery contract misses a two-hour objective by design.

Look for this next time: The tighter the recovery time objective, the more ready the recovery site must be; two hours points to a hot site.

Correct answer: B · Investigate the two logins and tie account removal to the HR exit process

ISACA lists identity and access management in Domain 5. Accounts of people who have left should be disabled promptly, because anyone who holds or guesses the credentials can use them, and logins after an employee's last day may mean misuse, so those two need investigation. The lasting fix is removal triggered by the HR exit process, backed by periodic access reviews. Password rotation does nothing about accounts that no one should be using at all. Waiting a year for the next audit leaves the accounts open. A handbook reminder removes no access.

Look for this next time: Tie account removal to the HR exit process, and treat logins after an employee's departure as possible misuse.

Correct answer: A · The supplier signs with its private key; the buyer checks with the supplier's public key

NIST's glossary, citing FIPS 186-5, says the private key is used to compute a digital signature that may be verified using the corresponding public key, and that a digital signature provides a way to verify origin authentication, data integrity, and signatory non-repudiation. Because only the supplier holds its private key, a signature that checks out with the supplier's public key shows the confirmation came from the supplier and was not altered. The buyer's public key is used to encrypt data for the buyer, not to sign for the supplier. A private key is not made public, so the buyer could never check with the supplier's private key. A secret key sent along with each message is exposed with it and cannot prove which side signed.

Look for this next time: A sender signs with its own private key, and anyone can verify the signature with the sender's public key.

Correct answer: D · Capture volatile data and image the disk under a chain of custody record

NIST SP 800-86 defines volatile data as data on a live system that is lost after the computer is powered down, so memory contents and active connections have to be captured before any shutdown. Imaging the disk preserves the stored evidence, and a chain of custody, which NIST describes as documenting each person who handled the evidence and when it was collected or transferred, supports its use in court. Restoring from backup overwrites the evidence. An antivirus scan changes files and timestamps before anything has been preserved. Shutting down at once loses the volatile data.

Look for this next time: When evidence may go to court, preserve volatile data and a disk image under a chain of custody before changing the system.

Correct answer: C · A penetration test authorized in writing, with agreed limits

NIST describes penetration testing as a method in which assessors, typically working under specific constraints, attempt to circumvent or defeat the security features of a system. That matches management's question: whether weaknesses can be chained and exploited to reach the data. A vulnerability scan lists weaknesses but does not show whether an attacker can use them end to end. A firewall rule review checks configuration against policy, not what an attacker can achieve. A tabletop exercise tests the response plan, not the defenses. Because a penetration test attacks real systems, it should be authorized in writing with agreed limits.

Look for this next time: A vulnerability scan finds weaknesses; an authorized penetration test shows whether they can be exploited.

Correct answer: B · Full disk encryption with authentication before the system boots

NIST SP 800-111 describes storage encryption as using encryption and authentication to restrict access to stored information on end user devices such as laptops, and names full disk encryption as one solution. A thief can remove the drive or start the laptop from other media and read unencrypted files, so a login password, however strong, does not protect data at rest. Antivirus protects against malicious software, not physical theft. A cable lock at the office does nothing for a laptop stolen from a car.

Look for this next time: A login password does not protect the files on a stolen device; full disk encryption does.