ISACA CISA Practice Exams
Last updated on Oct 22,2026- Exam Code: CISA
- Exam Name: Certified Information Systems Auditor
- Certification Provider: ISACA
- Latest update: Oct 22,2026
An IS auditor has been asked to advise on measures to improve IT governance within the organization.
Which at the following is the BEST recommendation?
- A . Implement key performance indicators (KPIs)
- B . Implement annual third-party audits.
- C . Benchmark organizational performance against industry peers.
- D . Require executive management to draft IT strategy
A national tax administration agency with a distributed network experiences service disruptions due to a large influx of traffic to a regional office near the end of each year.
Which of the following would BEST enable the agency to improve the performance of its servers during the busy period?
- A . Virtual firewall
- B . Proxy server
- C . Load balancer
- D . Virtual private network (VPN)
An online retailer is receiving customer complaints about receiving different items from what they ordered on the organization’s website. The root cause has been traced to poor data quality. Despite efforts to clean erroneous data from the system, multiple data quality issues continue to occur.
Which of the following recommendations would be the BEST way to reduce the likelihood of future occurrences?
- A . Assign responsibility for improving data quality.
- B . Invest in additional employee training for data entry.
- C . Outsource data cleansing activities to reliable third parties.
- D . Implement business rules to validate employee data entry.
During planning for a cloud service audit, audit management becomes aware that the assigned IS
auditor is unfamiliar with the technologies in use and their associated risks to the business. To ensure audit quality, which of the following actions should audit management consider FIRST?
- A . Conduct a follow-up audit after a suitable period has elapsed.
- B . Reschedule the audit assignment for the next financial year.
- C . Reassign the audit to an internal audit subject matter expert.
- D . Extend the duration of the audit to give the auditor more time.
An IS auditor is planning an audit of an organization’s accounts payable processes.
Which of the following controls is MOST important to assess in the audit?
- A . Segregation of duties between issuing purchase orders and making payments.
- B . Segregation of duties between receiving invoices and setting authorization limits
- C . Management review and approval of authorization tiers
- D . Management review and approval of purchase orders
A mission-critical application utilizes a one-node database server. On multiple occasions, the database service has been stopped to perform routine patching, causing application outages.
Which of the following should be the IS auditor’s GREATEST concern?
- A . Revenue lost due to application outages
- B . Patching performed by the vendor
- C . A large number of scheduled database changes
- D . The presence of a single point of failure
Which of the following is the BEST control to help ensure that security requirements are considered throughout the life cycle of an agile software development project?
- A . Documenting security control requirements and obtaining internal audit sign off
- B . Including project team members who can provide security expertise
- C . Reverting to traditional waterfall software development life cycle (SDLC) techniques
- D . Requiring the project to go through accreditation before release into production
An IS auditor plans to review all access attempts to a video-monitored and proximity card-controlled communications room.
Which of the following would be MOST useful to the auditor?
- A . Alarm system with CCTV
- B . Access control log
- C . Security incident log
- D . Access card allocation records
Which of the following provides the MOST reliable audit evidence on the validity of transactions in a financial application?
- A . Walk-through reviews
- B . Substantive testing
- C . Compliance testing
- D . Design documentation reviews
When planning a follow-up, the IS auditor is informed by operational management that recent organizational changes have addressed the previously identified risk and implementing the action plan is no longer necessary.
What should the auditor do NEXT?
- A . Report that the changes make it impractical to determine whether the risks have been addressed.
- B . Accept management’s assertion and report that the risks have been addressed.
- C . Determine whether the changes have introduced new risks that need to be addressed.
- D . Review the changes and determine whether the risks have been addressed.