Free Certified Information Systems Auditor® (CISA®) exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Certified Information Systems Auditor® (CISA®) exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1What should primarily determine the content of an internal audit plan under the Global Internal Audit Standards?

   1. A. A documented assessment of organizational strategies, objectives, and risks
   2. B. The order in which managers request audits during the year
   3. C. The age of each information system, regardless of its risk
   4. D. An equal annual allocation of audit hours to every department

   Answer: A

   Explanation: The standard says the chief audit executive must "base the internal audit plan on a documented assessment of the organization’s strategies, objectives, and risks." The plan is therefore tied to assessed organizational risk and objectives, rather than a uniform schedule or request order.

   Reference: Global Internal Audit Standards — Standard 9.4 Internal Audit Plan, Requirements, p. 66

2. 2An enterprise is designing governance for information and technology. What scope does COBIT address?

   1. A. Enterprise information and technology governance and management
   2. B. Only technical configuration inside the IT department
   3. C. Only external financial statement audit procedures
   4. D. Only certification of individual IT professionals

   Answer: A

   Explanation: ISACA describes COBIT as "the premier framework for the governance and management of enterprise IT." Its scope is enterprise governance and management of information and technology, not only a technical department's configurations.

   Reference: COBIT 2019 Framework: Governance and Management Objectives — Why COBIT, opening description

3. 3A business case compares building a new information system in-house with buying a vendor solution. What should the comparison include?

   1. A. Development and maintenance costs, schedule, benefits, and risks
   2. B. Only the first-year purchase price of each option
   3. C. Only the project manager's preferred technology
   4. D. Only the number of vendors responding to a request

   Answer: A

   Explanation: PMI's example says an IT business case includes "the development and maintenance costs, schedule, benefits and risks of building it in-house" along with comparison data for a vendor option. Those factors support a reasoned acquisition decision.

   Reference: Making the Case — Making the Case, Texas Department of Public Safety example

4. 4An IT auditor is checking whether an organization can identify every managed server and workstation. Which record directly addresses that question?

   1. A. An inventory of managed hardware
   2. B. A catalog of software licenses
   3. C. A map of external data flows
   4. D. A list of supplier services

   Answer: A

   Explanation: NIST states, "Inventories of hardware managed by the organization are maintained." This directly covers managed servers and workstations; the other records track different asset classes or relationships.

   Reference: NIST Cybersecurity Framework 2.0 — Core, ID.AM-01, p. 16

5. 5An access review finds that a user retains permissions no longer needed for assigned duties. Which access-control principle is most directly violated?

   1. A. Least privilege
   2. B. Segregation of duties
   3. C. Availability
   4. D. Nonrepudiation

   Answer: A

   Explanation: The CSF says access permissions should incorporate "the principles of least privilege and separation of duties." Excess permissions violate least privilege because the user has more access than needed.

   Reference: NIST Cybersecurity Framework 2.0 — Core, PR.AA-05, p. 20

6. 6During planning of an assurance engagement, what is the purpose of assessing risks in the activity under review?

   1. A. To identify and prioritize risks that shape engagement objectives and scope
   2. B. To replace the need to identify evaluation criteria for the activity
   3. C. To decide which audit findings management must accept in advance
   4. D. To set the organization’s risk tolerance for senior management

   Answer: A

   Explanation: The Standards state that "The engagement risk assessment allows internal auditors to identify and prioritize the risks to determine the engagement objectives and scope." It guides what the assurance work will address; it does not set management's tolerance or preapprove findings.

   Reference: Global Internal Audit Standards — Principle 13 Plan Engagements Effectively, p. 93

7. 7Why should an enterprise tailor its COBIT governance solution to its own environment?

   1. A. To integrate the standards, regulations, and practices relevant to that enterprise
   2. B. To ensure every enterprise uses identical controls regardless of context
   3. C. To replace all business objectives with technology objectives
   4. D. To remove the need to monitor governance outcomes

   Answer: A

   Explanation: ISACA says COBIT 2019 provides guidance to "integrate the industry standards, guidelines, regulations and best practices unique to your enterprise into your governance solution using COBIT." Tailoring addresses relevant obligations and practices.

   Reference: COBIT 2019 Framework: Governance and Management Objectives — Why COBIT, Easy Integration

8. 8What should a system project's business case state about the benefit expected from the investment?

   1. A. Measurable benefits linked to the underlying business need
   2. B. Benefits only after the technology has been purchased
   3. C. A promise that all potential benefits will occur
   4. D. Only the technical features requested by developers

   Answer: A

   Explanation: PMI guidance says a business case should "State measurable benefits that specifically relate to the organization's core need." This connects the proposed system to business value that can be assessed.

   Reference: Delivering Project Benefits: A Practical Plan for Success — What Does Your Business Case Say About Benefits?

9. 9Which inventory is most directly used to identify the versions of applications and system software managed by an organization?

   1. A. A register of physical facilities
   2. B. An inventory of software, services, and systems
   3. C. A list of approved network routes
   4. D. A record of third-party contacts

   Answer: B

   Explanation: The CSF calls for "Inventories of software, services, and systems managed by the organization" to be maintained. That inventory identifies managed software; the other records have different subjects.

   Reference: NIST Cybersecurity Framework 2.0 — Core, ID.AM-02, p. 16

10. 10A person can both create and approve the same sensitive transaction. Which principle is the access design failing to support?

    1. A. Separation of duties
    2. B. Data availability
    3. C. Credential federation
    4. D. Network segmentation

    Answer: A

    Explanation: The CSF explicitly calls for access permissions to incorporate "separation of duties." Combining creation and approval eliminates the independent role separation.

    Reference: NIST Cybersecurity Framework 2.0 — Core, PR.AA-05, p. 20