ISACA CISA Practice Exams
Last updated on Oct 21,2026- Exam Code: CISA
- Exam Name: Certified Information Systems Auditor
- Certification Provider: ISACA
- Latest update: Oct 21,2026
Which of the following findings from a database security audit presents the GREATEST risk of critical security exposures?
- A . Legacy data has not been purged.
- B . Admin account passwords are not set to expire.
- C . Default settings have not been changed.
- D . Database activity logging is not complete.
Which of the following should be of GREATEST concern to an IS auditor conducting an audit of an organization that recently experienced a ransomware attack?
- A . Antivirus software was unable to prevent the attack even though it was properly updated
- B . The most recent security patches were not tested prior to implementation
- C . Backups were only performed within the local network
- D . Employees were not trained on cybersecurity policies and procedures
An IS auditor evaluating the change management process must select a sample from the change log.
What is the BEST way to the auditor to confirm the change log is complete?
- A . Interview change management personnel about completeness.
- B . Take an item from the log and trace it back to the system.
- C . Obtain management attestation of completeness.
- D . Take the last change from the system and trace it back to the log.
An organization considering the outsourcing of a business application should FIRST:
- A . define service level requirements.
- B . perform a vulnerability assessment.
- C . conduct a cost-benefit analysis.
- D . issue a request for proposal (RFP).
An IS audit manager is preparing the staffing plan for an audit engagement of a cloud service provider.
What should be the manager’s PRIMARY concern when being made aware that a new auditor in the department previously worked for this provider?
- A . Independence
- B . Professional conduct
- C . Subject matter expertise
- D . Resource availability
Controls related to authorized modifications to production programs are BEST tested by:
- A . tracing modifications from the original request for change forward to the executable program.
- B . tracing modifications from the executable program back to the original request for change.
- C . testing only the authorizations to implement the new program.
- D . reviewing only the actual lines of source code changed in the program.
Which of the following is MOST important to consider when reviewing an organization’s defined data backup and restoration procedures?
- A . Business continuity plan (BCP)
- B . Recovery point objective (RPO)
- C . Mean time to restore (MTTR)
- D . Mean time between failures (MTBF)
Which of the following is the PRIMARY reason for an IS auditor to perform a risk assessment?
- A . It helps to identify areas with a relatively high probability of material problems.
- B . It provides a basis for the formulation of corrective action plans.
- C . It increases awareness of the types of management actions that may be inappropriate
- D . It helps to identify areas that are most sensitive to fraudulent or inaccurate practices
An IS auditor is reviewing the backup procedures in an organization that has high volumes of data with frequent changes to transactions.
Which of the following is the BEST backup scheme to recommend given the need for a shorter restoration time in the event of a disruption?
- A . Differential backup
- B . Full backup
- C . Incremental backup
- D . Mirror backup
Which of the following findings would be of GREATEST concern when reviewing project risk management practices?
- A . There are no formal milestone sign-offs.
- B . Qualitative risk analyses have not been updated.
- C . Ongoing issues are not formally tracked.
- D . Project management software is not being used.