العربية

CISA — Certified Information Systems Auditor: free practice test

Start with 10 free questions to see what needs more practice. Finish to see your score, weakest units and every option explained.

450 on the 200–800 scale This is your practice accuracy. It cannot be converted to the exam’s scaled score or used to determine whether you pass.

Back to CISA — Certified Information Systems Auditor

Practice test questions with answers and explanations

Try the questions in the test above first, then open each one here to see the correct answer and why every other option is wrong.

01A payment processor's IT director refuses audit access because the audit function has no approved mandate. What should the chief audit executive obtain first?

Practice question Unit: Information Systems Auditing Process

  1. AA technical testing checklist signed by the IT director

    A technical checklist describes planned tests but does not create an organizational mandate or compel the IT director to grant access.

  2. BA completed audit report documenting a scope limitation

    Documenting a scope limitation may be needed later if access is denied, but it does not establish the missing mandate that should come first.

  3. CA governance-approved charter granting relevant access ✓ Correct answer

    Correct. An audit charter approved by governance establishes the audit function’s mandate and relevant access rights before fieldwork proceeds (ISACA Glossary — Audit charter).

  4. DAn informal agreement with the database administrator

    An informal agreement with a DBA cannot substitute for a governance-approved organizational mandate.

Reference: ISACA Interactive Glossary — Audit charter; https://www.isaca.org/resources/glossary

02A procurement population contains routine low-value orders and a small number of high-value emergency purchases with different controls. How should the auditor improve representation of both groups?

Practice question Unit: Information Systems Auditing Process

  1. ASelect only the most recent orders regardless of category

    Selecting only the most recent orders does not ensure that both the routine and the high-value emergency subgroups are represented.

  2. BStratify the population and sample each subgroup ✓ Correct answer

    Correct. Stratification divides a heterogeneous population into more homogeneous subgroups so each can be sampled representatively (ISACA Glossary — Sampling stratification).

  3. CExclude emergency purchases because they are few

    Low frequency does not justify excluding the distinct high-value emergency group, which often carries different controls and higher risk.

  4. DCombine the groups and ignore their control differences

    Combining the groups and ignoring control differences can obscure exposure unique to one subgroup.

Reference: ISACA Interactive Glossary — Sampling stratification; https://www.isaca.org/resources/glossary

03A public service organization must choose between a digital-only service that lowers costs and assisted access needed by vulnerable users. Neither objective has priority under the approved strategy. What should the auditor recommend FIRST?

Practice question Unit: Governance and Management of IT

  1. ALaunch both models immediately and resolve conflicting targets after rollout.

    Launching both models immediately commits resources before the conflicting strategic priorities are resolved.

  2. BAsk the preferred vendor to decide which service model the organization will offer.

    A vendor may advise on feasibility and cost, but governance of competing stakeholder objectives remains an enterprise responsibility.

  3. CChoose the service with lower operating costs.

    Lower operating cost is relevant but alone cannot settle an unapproved trade-off against assisted access for vulnerable users.

  4. DAgree balanced service objectives with the relevant stakeholder groups. ✓ Correct answer

    Correct. Governance evaluates stakeholder needs and options and agrees balanced objectives before setting direction (ISACA Glossary — Governance).

Reference: ISACA Glossary, “Governance”. https://www.isaca.org/resources/glossary

04A manufacturer appoints data stewards to coordinate shared product definitions. Its charter assigns product definition approval to business owners, but stewards cannot resolve disagreements between owners and have no escalation route. What is the BEST recommendation?

Practice question Unit: Governance and Management of IT

  1. AAsk database administrators to select whichever definition is easiest.

    Database convenience does not determine the enterprise meaning of shared product data; business owners remain accountable for definitions.

  2. BRequire more frequent steward meetings without changing decision rights.

    More frequent meetings do not create decision authority when stewards lack an escalation path for owner disputes.

  3. CLet stewards approve definitions without business owner approval.

    Letting stewards approve alone bypasses the charter’s assignment of approval to business owners instead of fixing the missing dispute mechanism.

  4. DDefine an escalation path and decision authority for disputes. ✓ Correct answer

    Correct. Data governance needs connected roles and processes; a defined escalation path resolves cross-owner disputes while preserving stated approval responsibilities (ISACA Glossary — Data governance).

Reference: ISACA Glossary, “Data governance”. https://www.isaca.org/resources/glossary

05An auditor reviews a project costing $100,000 initially with net inflows of $60,000 at each of the next two year-ends. Using a 10% after-tax discount rate and no other cash flows, what is the approximate NPV?

Practice question Unit: Information Systems Acquisition, Development and Implementation

  1. APositive $9,091

    Discounting both $60,000 inflows for only one year overstates present value; the second inflow must be discounted for two years.

  2. BNegative $826

    Treating both inflows as if received at the end of year two understates the first inflow’s present value.

  3. CPositive $20,000

    Undiscounted inflows ($120,000) less the $100,000 investment equals $20,000 accounting profit, not NPV.

  4. DPositive $4,132 ✓ Correct answer

    Correct. NPV = −100,000 + 60,000/1.1 + 60,000/1.1² ≈ +4,132 (ISACA Glossary — Net present value).

Reference: ISACA Glossary — Net present value (NPV); https://www.isaca.org/resources/glossary

06A hospital change board approved a patient-portal release after reviewing cost and downtime. The record contains no consideration of available security and privacy impact analyses. What is the MOST significant approval weakness?

Practice question Unit: Information Systems Operations and Business Resilience

  1. AThe board did not require a separate approval meeting for each application module.

    Separate approval meetings per module are not required to evaluate the release’s security and privacy impacts as a whole.

  2. BThe recorded decision lacked explicit consideration of security and privacy impacts. ✓ Correct answer

    Correct. CM-3 requires that change decisions consider security and privacy impact analyses and document the approval decision (NIST SP 800-53 Rev. 5 — CM-3).

  3. CThe project manager did not present a second estimate of deployment costs.

    A second cost estimate does not supply the missing security and privacy risk basis for approval.

  4. DThe finance representative did not countersign the implementation schedule.

    A finance countersignature may be a local process preference, but it would not remedy the absence of impact consideration.

Reference: NIST SP 800-53 Rev. 5, CM-3 (smt.b; cm-3_smt.c). https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

07A hospital can tolerate a billing outage for a day, but medication orders must continue within 30 minutes. Its recovery plan lists servers alphabetically and restores them in that order. Which recommendation BEST supports the business objective?

Practice question Unit: Information Systems Operations and Business Resilience

  1. AGive all applications the same recovery target to simplify reporting to management.

    Uniform recovery targets ignore the explicitly different tolerances for billing (one day) versus medication orders (30 minutes).

  2. BSet recovery priorities from essential functions, dependencies, and recovery objectives. ✓ Correct answer

    Correct. CP-2 recovery planning prioritizes essential missions/business functions, dependencies, and recovery objectives (NIST SP 800-53 Rev. 5 — CP-2).

  3. CRestore newest servers first for current vendor support.

    Newest equipment and vendor-support currency do not establish recovery priority for medication ordering.

  4. DRestore the servers hosting the most users first to limit overall disruption.

    User count is not the same as business criticality; a low-user medication system may still be the highest priority.

Reference: NIST SP 800-53 Rev. 5, CP-2 (smt.a.1; cp-2_smt.a.2; cp-2_smt.a.4). https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

08A payments platform logs successful logins but omits batch restarts and privileged parameter changes needed to reconstruct processing failures. What should the auditor recommend to make logging useful for operational investigations?

Practice question Unit: Information Systems Operations and Business Resilience

  1. APurchase additional log storage before asking operations which events are needed.

    Buying storage before identifying required events does not fix the missing batch-restart and privileged-change records.

  2. BCoordinate investigation needs and select relevant events with a documented rationale. ✓ Correct answer

    Correct. AU-2 requires coordinating investigation/audit needs and selecting relevant events with a documented rationale (NIST SP 800-53 Rev. 5 — AU-2).

  3. CExtend login-record retention without changing the selected event types.

    Longer retention of login records cannot reconstruct event types that were never logged.

  4. DUse monthly availability percentages instead of collecting detailed records of processing events.

    Monthly availability percentages cannot reconstruct individual processing failures or privileged parameter changes.

Reference: NIST SP 800-53 Rev. 5, AU-2 (smt.b; au-2_smt.c; au-2_smt.d). https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

09A finance audit finds that one employee creates suppliers in the procurement application and releases their payments in a separate banking application. Each application passes its own role review. What should the auditor recommend?

Practice question Unit: Protection of Information Assets

  1. AAssess conflicting access across both systems and adjust authorizations ✓ Correct answer

    Correct. AC-5 separation of duties must identify and address conflicts that span applications, not only within one system (NIST SP 800-53 Rev. 5 — AC-5).

  2. BObtain the employee’s acknowledgement of the fraud policy

    A fraud-policy acknowledgement does not remove the employee’s ability to create suppliers and release their payments.

  3. CAdd a second approver for supplier creation in procurement

    A second approver inside procurement may harden one step but leaves the cross-application create-and-pay conflict unassessed.

  4. DRepeat the existing reviews independently in each application

    Repeating the same per-application role reviews will again miss the combined conflict that only appears across systems.

Reference: NIST SP 800-53 Rev. 5, AC-5, ac-5_smt.a; ac-5_smt.b; ac-5_gdn. https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

10A workstation plug-in runs in the same writable address space as the agent enforcing security policy. Testing shows the plug-in can alter the enforcement code. What should the auditor prioritize?

Practice question Unit: Protection of Information Assets

  1. AReview plug-in installation approvals at more frequent intervals

    More frequent installation-approval reviews do not isolate executing plug-in code from the enforcement agent at runtime.

  2. BIsolate security-enforcement functions from plug-in code behind a protected boundary ✓ Correct answer

    Correct. SC-3 requires isolating security functions from nonsecurity functions behind a protected boundary so plug-in code cannot corrupt enforcement (NIST SP 800-53 Rev. 5 — SC-3).

  3. CDigitally sign the plug-in while retaining its memory permissions

    Digitally signing the plug-in establishes provenance but does not prevent the permitted shared-memory modification shown in testing.

  4. DAlert administrators after the agent’s code is modified

    Alerting after the agent’s code is modified detects damage late and does not provide the isolation that protects enforcement integrity.

Reference: NIST SP 800-53 Rev. 5, SC-3, sc-3_smt; sc-3_gdn. https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

Keep preparing for CISA — Certified Information Systems Auditor

See also: Accounting & Tax Exams