Questions & answers (free, no sign-in needed)
- View
10 beginner questions across the five CISA domains: auditor objectivity and reporting duties, COBIT and data ownership, segregation of duties and Agile delivery, recovery time objectives and business impact analysis, device encryption and multi-factor authentication.
Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.
An IS auditor is assigned to audit a payroll system that she helped design and implement last year. What is the main concern?
- A. The audit will take longer because she knows the system too well
- B. Her objectivity may be impaired, so someone else should audit it ✔ correct
- C. She must first be promoted to audit manager before auditing it
- D. The audit must be postponed until the system is replaced
Answer: B. ISACA's Code of Professional Ethics requires members to perform duties with objectivity. Reviewing your own design work is a self-review situation that can bias the result, so the audit should go to someone who was not involved.
Source: www.isaca.org/credentialing/code-of-professional-ethics · Domain: Information Systems Auditing Process
Under ISACA's Code of Professional Ethics, an auditor may leave a significant finding out of the audit report if the system owner asks for it to be removed.
- A. True
- B. False ✔ correct
Answer: B. False. The Code requires informing appropriate parties of the results of work performed, including disclosure of all significant facts that, if not disclosed, may distort the reporting of the results.
Source: www.isaca.org/credentialing/code-of-professional-ethics · Domain: Information Systems Auditing Process
Which ISACA framework is designed for the governance and management of enterprise information and technology?
- A. ITIL
- B. PRINCE2
- C. COBIT ✔ correct
- D. TOGAF
Answer: C. COBIT is ISACA's framework for the governance and management of enterprise I&T. ITIL focuses on service management, PRINCE2 on project management and TOGAF on enterprise architecture, and none of them is published by ISACA.
Source: www.isaca.org/resources/cobit · Domain: Governance & Management of IT
A business unit's customer dataset needs a classification level and rules for who may access it. Who should make these decisions?
- A. The information (data) owner in the business ✔ correct
- B. The database administrator who stores the data
- C. The IS auditor who reviews the access controls
- D. Any user who works with the data every day
Answer: A. The information owner has authority for the information and is responsible for establishing its controls, including classification and access approval. The DBA acts as custodian, and the auditor must stay independent of these decisions.
Source: csrc.nist.gov/glossary/term/information_owner · Domain: Governance & Management of IT
During an audit, an IS auditor finds that developers can write code and also move their own changes into production without anyone else's approval. Which control weakness is this?
- A. Missing capacity management
- B. Weak password complexity
- C. Missing data backups
- D. Lack of segregation of duties ✔ correct
Answer: D. Segregation (separation) of duties means no single person holds enough privileges to misuse a system alone. A developer who can both change code and release it to production could introduce unauthorized or faulty changes unnoticed.
Source: csrc.nist.gov/glossary/term/separation_of_duty · Domain: Information Systems Acquisition, Development & Implementation
A company moves a software project from a waterfall method to Agile. Which two practices should the IS auditor expect to see? (Select TWO)
- A. Working software delivered frequently in short iterations ✔ correct
- B. Business people and developers working together daily ✔ correct
- C. All requirements frozen before any design work begins
- D. A single delivery of the whole system at the end of the project
- E. Comprehensive documentation valued over working software
Answer: A, B. The Agile principles call for delivering working software frequently, from a couple of weeks to a couple of months, and for business people and developers to work together daily. Frozen requirements and one big final delivery are waterfall traits.
Source: agilemanifesto.org/principles.html · Domain: Information Systems Acquisition, Development & Implementation
Management states that the order-processing system must be running again within 4 hours of a disruption, or the business impact becomes unacceptable. What does this 4-hour target represent?
- A. Recovery point objective (RPO)
- B. Recovery time objective (RTO) ✔ correct
- C. Service level indicator (SLI)
- D. Mean time to detect (MTTD)
Answer: B. The RTO is the length of time a system can be in recovery before the mission or business processes are negatively impacted. The RPO instead defines the point in time to which data must be recovered.
Source: csrc.nist.gov/glossary/term/recovery_time_objective · Domain: Information Systems Operations & Business Resilience
Which activity analyzes business functions and the effect a disruption would have on them, so that recovery priorities can be set?
- A. Vulnerability scanning
- B. Penetration testing
- C. Business impact analysis (BIA) ✔ correct
- D. User acceptance testing
Answer: C. A business impact analysis examines operational functions and the effect a disruption might have on them. Its results set recovery priorities and objectives such as RTO and RPO for the continuity and recovery plans.
Source: csrc.nist.gov/glossary/term/business_impact_analysis · Domain: Information Systems Operations & Business Resilience
A company's sales staff carry laptops with customer data, and laptops are sometimes lost. Which control best protects the confidentiality of the data on a lost laptop?
- A. Full-disk encryption on each laptop ✔ correct
- B. A screen saver that starts after 30 minutes
- C. A strict clean-desk policy in the office
- D. A larger hard drive for local backups
Answer: A. Storage encryption such as full-disk encryption keeps data unreadable to anyone who obtains the device without the key, as described in NIST SP 800-111. The other options do not protect data once the device is in someone else's hands.
Source: csrc.nist.gov/pubs/sp/800/111/final · Domain: Protection of Information Assets
Signing in with a password followed by a secret PIN counts as multi-factor authentication.
- A. True
- B. False ✔ correct
Answer: B. False. Multi-factor authentication uses two or more different factors: something you know, something you have or something you are. A password and a PIN are both something you know, so this is single-factor.
Source: csrc.nist.gov/glossary/term/multi_factor_authentication · Domain: Protection of Information Assets
Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public ISACA exam objectives (CISA Exam Content Outline effective 2024-08-01), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by ISACA; exam names are trademarks of their owners. Official exam page: www.isaca.org/credentialing/cisa/cisa-exam-content-outline.