ISACA Cybersecurity Audit Certificate Practice Exams
Last updated on Oct 23,2026- Exam Code: Cybersecurity Audit Certificate
- Exam Name: ISACA Cybersecurity Audit Certificate Exam
- Certification Provider: ISACA
- Latest update: Oct 23,2026
What should be an IS auditor’s GREATEST concern when an organization’s virtual private network (VPN) is implemented on employees’ personal mobile devices?
- A . Users may access services over the VPN that are network resource intensive.
- B . Users may store the data in plain text on their mobile devices.
- C . Users may access the corporate network from unauthorized devices.
- D . Users may access services not supported by the VPN.
A cybersecurity audit reveals that an organization’s risk management function has the right to overrule business management decisions. Would the IS auditor find this arrangement acceptable?
- A . No, because the risk management function should be the body that makes risk-related decisions for the organization.
- B . Yes, because the second line of defense is generally on a higher organizational level than the first line.
- C . No, because the risk management’s oversight function would potentially lose its ability to objectively monitor and measure the business.
- D . Yes, because this arrangement ensures adequate oversight and enforcement of risk management in the organization.
What is the FIRST phase of the ISACA framework for auditors reviewing cryptographic environments?
- A . Evaluation of implementation details
- B . Hands-on testing
- C . Risk-based shakeout
- D . Inventory and discovery
What is the PRIMARY purpose of creating a security architecture?
- A . To visually show gaps in information security controls
- B . To create a long-term information security strategy
- C . To map out how security controls interact with an organization’s systems
- D . To provide senior management a measure of information security maturity
Which phase typically occurs before containment of an incident?
- A . Identification
- B . Eradication
- C . Preservation
- D . Recovery
Which control mechanism is used to detect the unauthorized modification of key configuration settings?
- A . Sandboxing
- B . Whitelisting
- C . URL filtering
- D . File integrity
One way to control the integrity of digital assets is through the use of:
- A . policies.
- B . hashing.
- C . caching.
- D . frameworks.
An IS auditor has learned that a cloud service provider has not adequately secured its application programming interface (API).
Which of the following is MOST important for the auditor to consider in an assessment of the potential risk factors?
- A . Resource contention
- B . Identity spoofing and phishing
- C . Confidentiality, integrity, and availability
- D . Denial of service
An information security procedure indicates a requirement to sandbox emails.
What does this requirement mean?
- A . Ensure the emails are encrypted and provide nonrepudiation.
- B . Provide a backup of emails in the event of a disaster
- C . isolate the emails and test for malicious content
- D . Guarantee rapid email delivery through firewalls.
Which of the following is EASIEST for a malicious attacker to detect?
- A . Use of insufficient cryptography
- B . Insecure storage of sensitive data
- C . Susceptibility to reverse engineering
- D . Ability to tamper with mobile code