Certified Information Systems Auditor CISA Actual Exam Questions

1. Which of the following is most helpful for information systems auditors when evaluating control effectiveness?

2.  Due to cost constraints, the company postponed the replacement date for supporting core application hardware.

Which of the following is the biggest risk?

3.  The information systems auditor is reviewing the maintenance contract for a core banking application.

Which of the following can minimize the impact of bankruptcy of application vendors?

4.  A company plans to have automated data feeds from third-party service providers into enterprise data warehousing.

Which of the following is the best way to prevent receiving bad data?

5.  Which of the following attacks is best suited for intrusion detection systems (IDS) checking?

6.  The information system auditor found that the accounts payable clerk had direct access to the file after the payment file was generated.

The most significant risk to the business is that the money may be:

7.  An information system auditor who is conducting an application development review is attending a meeting of the development team.

Which of the following actions the auditor may impair his independence?

8.  The company's operational procedures require urgent changes to be approved for business within 7 days of the occurrence. The Information Systems Auditor indicates that the manager verifies process compliance by performing a monthly review via uncompleted urgent change.

In this case, which one is the biggest risk?

9.  During the physical security audit, the information system auditor received a contactless proximity card that allowed to access to three specific floors of the corporate office building.

Which of the following questions should be the biggest concern?

10.  Several portable computers containing customer-sensitive data were stolen from the staff's office because they were unattended.

Which of the following is the best advice for an information systems auditor to protect data when it prevents similar incidents from happening again?

11.  The advantage of object-oriented system development is that it:

12.  Which of the following should be the most important factor driving a single application availability requirement when developing a disaster recovery plan?

13.  Information system auditors have identified separation of duties in enterprise resource planning (ERP) systems.

Which of the following is the best way to prevent repetitive configuration from occurring?

14.  In order to develop a robust data security program, the first step you should take is:

15.  Which of the following is the most appropriate indicator of the effectiveness of change management?

16.  Which of the following is the best way to identify fraudulent activity in a transaction processing system?

17.  Information system auditors should primarily review which of the following to understand the main drivers of the project?

18.  When reviewing the security policy, the information system auditor found that there was no mention that the employee should return all the company's smartphones once the employment relationship was terminated.

The biggest risk caused by this situation is the unreturned equipment:

19.  For information systems auditors, which of the following is critical to assessing fire prevention measures in a manpowered data center located on the upper floors of a multi-story building?

20.  The information system auditor did not find out which of the following terms can be identified by the risk of an error?

21.  A system that is undergoing acceptance testing is also making small changes to the program that can be banned by what requirements of the acceptance test strategy:

22.  In conducting vulnerability assessments, information systems auditors found a high-risk vulnerability in a public-facing web server for processing online customers paying for orders with credit cards.

Information system auditors should first:

23.  Which of the following is most important when evaluating the retention period for a cloud provider's client data backup?

24.  The main purposes of testing an alternate site that is part of a disaster recovery plan are:

25. Which of the following should be based on the IT Disaster Recovery Time Objective (RTO)

26.  In the actual difficult audit review process, if the Business Impact Analysis (BIA) did not proceed, the auditor should first:

27.  When evaluating the virtual server environment, the information system auditor learned that the production server, development server and management console are all hosted on the same physical host.

Which of the following is the primary concern of the auditor?

28.  Which of the following is a major consideration for information systems auditors when reviewing software license management?

29.  Information systems auditors have found that software systems that are still in use are outdated for years and are no longer supported. The auditee stated that it still takes six months for the software to run on the current version.

Which of the following is the best way to reduce the direct risks associated with using an unsupported version of the software?

30.  During the review of the IT Strategic Plan, the Information Systems Auditor found that some of the action plans focused on launching new systems and technologies were inconsistent with the company's strategy.

Which of the following would be the best advice for an information systems auditor?

31.  Which of the following is the main benefit of using an integrated audit approach?

32.  Which of the following can minimize the risk of business process disruption when replacing a key-key software application?

33.  Management requires a post-implementation review of the newly installed procurement package to determine the system meets business requirements.

Which of the following is most likely to be evaluated?

34.  An organization wants to classify database tables based on their data classification scheme.

The information system auditor believes that the classification of the table should be based on:

35.  Which of the following can provide the fastest secure backup for companies that process large amounts of data?

36.  Which of the following best describes the effectiveness of a portfolio management plan?

37.  Which of the following information system auditors' recommendations best ensures that the control weaknesses found during the audit process are properly mitigated?

38.  Which of the following should be considered when an information system auditor considers the risks associated with sensitive reporting by offline printing?

39.  When disaster occurs and the data center is no longer available, which of the following tasks should be performed first?

40.  If you ask management to issue a report on IT internal control measures to stakeholders, which of the following is the benefit of doing so?

41.  In order to ensure that the firewall can effectively protect the network from external attacks, which of the following basic practices should be followed?

42.  What are the main reasons for including source code escrow terms in the application vendor agreement?