ISACA CISA Practice Exams
Last updated on Oct 22,2026- Exam Code: CISA
- Exam Name: Certified Information Systems Auditor
- Certification Provider: ISACA
- Latest update: Oct 22,2026
During an audit of payment services of a branch based in a foreign country, a large global bank’s audit team identifies an opportunity to use data analytics techniques to identify abnormal payments.
Which of the following is the team’s MOST important course of action?
- A . Consult the legal department to understand the procedure for requesting data from a different jurisdiction.
- B . Conduct a walk through of the analytical strategy with stakeholders of the audited branch to obtain their buy-in.
- C . Request the data from the branch as the team audit charter covers the country where it is based.
- D . Agree on a data extraction and sharing strategy with the IT team of the audited branch.
What would be the PRIMARY reason an IS auditor would recommend replacing universal PIN codes with an RFID access card system at a data center?
- A . To improve traceability
- B . To prevent piggybacking
- C . To implement multi-factor authentication
- D . To reduce maintenance costs
A system administrator recently informed the IS auditor about the occurrence of several unsuccessful intrusion attempts from outside the organization.
Which of the following is MOST effective in detecting such an intrusion?
- A . Using smart cards with one-time passwords
- B . Periodically reviewing log files
- C . Configuring the router as a firewall
- D . Installing biometrics-based authentication
An organization’s enterprise architecture (EA) department decides to change a legacy system’s components while maintaining its original functionality.
Which of the following is MOST important for an IS auditor to understand when reviewing this decision?
- A . The current business capabilities delivered by the legacy system
- B . The proposed network topology to be used by the redesigned system
- C . The data flows between the components to be used by the redesigned system
- D . The database entity relationships within the legacy system
Which of the following is the PRIMARY reason for an IS auditor to conduct post-implementation reviews?
- A . To determine whether project objectives in the business case have been achieved
- B . To ensure key stakeholder sign-off has been obtained
- C . To align project objectives with business needs
- D . To document lessons learned to improve future project delivery
Which of the following is the MOST effective way for an organization to help ensure agreed-upon action plans from an IS audit will be implemented?
- A . Ensure sufficient audit resources are allocated,
- B . Communicate audit results organization-wide.
- C . Ensure ownership is assigned.
- D . Test corrective actions upon completion.
Which of the following is the BEST source of information tor an IS auditor to use when determining whether an organization’s information security policy is adequate?
- A . Information security program plans
- B . Penetration test results
- C . Risk assessment results
- D . Industry benchmarks
Which of the following is the PRIMARY advantage of using an automated security log monitoring tool over a manual review to monitor the use of privileged access?
- A . Increased likelihood of detecting suspicious activity
- B . Reduced costs associated with automating the review
- C . Improved incident response time
- D . Reduced manual effort of reviewing logs
An IS auditor has been tasked with auditing the inventory control process for a large organization that processes millions of data transactions.
Which of the following is the BEST testing strategy to adopt?
- A . Continuous monitoring
- B . Control self-assessments (CSAs)
- C . Risk assessments
- D . Stop-or-go sampling
Which of the following is the PRIMARY benefit of a tabletop exercise for an incident response plan?
- A . It demonstrates the maturity of the incident response program.
- B . It reduces the likelihood of an incident occurring.
- C . It identifies deficiencies in the operating environment.
- D . It increases confidence in the team’s response readiness.