Free CISA practice questions

An IS auditor is reviewing the IT asset management process at a logistics firm and finds that the configuration management database (CMDB) records hardware ownership, location, and warranty status, while the software asset register records licence entitlements and deployment counts. Which statement BEST describes how these two records should relate within a mature IT asset management programme?

• AThe software asset register should be reconciled against the CMDB so that entitlements are compared with deployments and unsupported or unlicensed software is identified.check_circle Correct
• BThe CMDB should replace the software asset register because configuration items already include installed software components and their version data.
• CThe two records should remain independent to preserve segregation of duties between operations staff who maintain the CMDB and procurement staff who maintain the licence register.
• DThe CMDB should be updated only when a software audit by the vendor is announced, so that the operational record matches the entitlement position at that moment.

Why A is correct: Reconciling entitlements held in the software asset register against deployment data in the CMDB is the recognised control that surfaces under-licensing, over-licensing, and unsupported versions, satisfying both audit and compliance objectives.

Why B is wrong: This is tempting because the CMDB does record installed software as configuration items; however, a CMDB tracks operational state for service management, not licence entitlements or contractual rights, so it cannot satisfy software asset management obligations on its own.

Why C is wrong: Segregation of duties applies to who can authorise and record asset changes, not to whether two registers may be reconciled; keeping the records permanently disconnected defeats the purpose of asset management.

Why D is wrong: Updating the CMDB only in response to vendor audits is reactive and undermines day-to-day service management; the CMDB must reflect the current operational state continuously, regardless of audit timing.

An IS auditor at an insurance company discovers that the underwriting team has built a complex pricing model in a spreadsheet that feeds quarterly regulatory returns. The spreadsheet sits on a shared drive, has no version control, and is maintained by a senior actuary. Which characterisation BEST fits this artefact for audit purposes?

• AA sanctioned production application because it supports a regulated reporting process and is maintained by a qualified subject-matter expert within the business.
• BEnd-user computing that is also shadow IT, because it materially supports regulated output yet sits outside the IT governance and control framework.check_circle Correct
• CA configuration item under the CMDB because all assets that influence regulated reporting must be brought into the IT service management scope automatically.
• DA user acceptance testing artefact that has been retained for traceability and therefore poses minimal risk to the integrity of regulatory submissions.

Why A is wrong: This is tempting because the spreadsheet supports a regulated process; however, sanction by IT and inclusion in the production change-management regime are what define a production application, neither of which applies here.

Why B is correct: The spreadsheet is built and maintained by business users (end-user computing) and supports a regulated process without IT oversight or controls, which is the defining mix that makes it shadow IT for audit purposes.

Why C is wrong: Importance to regulated reporting does not automatically promote an artefact into the CMDB; configuration items require formal identification, ownership, and change control, which the spreadsheet currently lacks.

Why D is wrong: User acceptance testing artefacts are temporary records of approval, not live calculation engines feeding live returns; treating a production calculation as a test artefact understates the inherent risk to reporting integrity.

During an IT asset management review at a manufacturing group, an IS auditor finds that laptops are routinely retired without formal media sanitisation and are donated to a local charity. The IT director argues that full-disk encryption on every device removes the need for any further sanitisation step. Which observation BEST captures the audit concern?

• AEncryption removes residual data risk on retired devices, so the practice satisfies the asset disposal control objective provided the encryption keys are securely archived.
• BDonation is the audit concern because retired assets must be sold to recover residual value before any disposal arrangement that does not produce a financial return.
• CDisposal without recorded media sanitisation breaks the chain of custody for the asset and leaves no evidence that confidential data has been rendered unrecoverable.check_circle Correct
• DCharitable donation is permitted only when assets have been fully depreciated, so the auditor should focus on whether the disposal timing matches the depreciation schedule.

Why A is wrong: This is tempting because strong encryption renders data unreadable without the key; however, archived keys, weak key custody, or future cryptographic compromise all leave residual risk that recognised sanitisation guidance still requires to be addressed.

Why B is wrong: Recovery of residual value is a financial consideration, not an information-security control; the asset management standard does not require sale over donation, so the framing misses the primary risk.

Why C is correct: Recognised guidance treats sanitisation as a defined disposal control that must be performed and evidenced; without a sanitisation record, the auditor cannot conclude that confidential data on retired media has been rendered unrecoverable, regardless of encryption.

Why D is wrong: Depreciation status governs accounting treatment, not information-security risk on disposal; aligning donation to the depreciation schedule would not address the unsanitised media that the audit must flag.

Which statement BEST describes the relationship between ISO/IEC 27001 and ISO/IEC 27002 when an IS auditor is evaluating an organisation's information security framework?

• AISO/IEC 27001 specifies the certifiable requirements for an information security management system, while ISO/IEC 27002 provides implementation guidance for the controls referenced in Annex A.check_circle Correct
• BISO/IEC 27001 lists detailed technical configuration baselines, while ISO/IEC 27002 lists the certifiable management system clauses that an external registrar can audit against.
• CISO/IEC 27001 and ISO/IEC 27002 are alternative frameworks that an organisation may choose between depending on whether it wants a risk-based or a control-based approach to security.
• DISO/IEC 27001 provides the catalogue of cryptographic algorithms, while ISO/IEC 27002 provides the risk treatment methodology that the certified organisation must adopt.

Why A is correct: This is correct because 27001 contains the audit-certifiable management system requirements and references Annex A controls, and 27002 is the companion guidance describing how each control may be implemented in practice.

Why B is wrong: This is tempting because both standards are well known, but the roles are reversed; configuration baselines are not in either standard and the certifiable clauses sit in 27001, not 27002.

Why C is wrong: This is tempting because candidates know multiple frameworks exist, but the two standards are complementary parts of the same family rather than alternatives chosen between.

Why D is wrong: This is tempting because cryptography and risk treatment are familiar terms, but neither standard is an algorithm catalogue and risk treatment is governed by 27001 clauses, not 27002.

An IS auditor is reviewing the data centre perimeter at a regional processing site. Which control is BEST categorised as a physical preventive control?

• AClosed-circuit television cameras with motion-triggered recording at every external door and the loading bay.
• BMantrap turnstiles linked to the badge system that allow only one authenticated person to pass at a time.check_circle Correct
• CQuarterly review of physical access logs against the authorised access list maintained by the facilities manager.
• DDocumented physical security policy that requires escort of visitors and revocation of badges on termination of staff.

Why A is wrong: This is tempting because cameras are physical security, but recorded surveillance primarily detects and provides evidence after the fact rather than stopping entry, so it is detective.

Why B is correct: This is correct because a mantrap physically blocks unauthorised or piggybacking entry before access occurs, fitting the definition of a physical preventive control.

Why C is wrong: This is tempting because access reviews are essential, but reviewing past entries identifies anomalies after the fact, which is detective rather than preventive.

Why D is wrong: This is tempting because policy underpins controls, but a policy on its own is an administrative directive rather than a physical preventive control acting at the perimeter.

Which statement BEST describes the purpose of Crime Prevention Through Environmental Design (CPTED) when an IS auditor is evaluating physical security at a new corporate campus?

• AIt mandates a minimum number of armed guards per square metre of usable floor space across critical facilities.
• BIt is a cryptographic standard that governs the protection of physical access badge credentials at the card reader.
• CIt uses environmental design features such as natural surveillance, territorial reinforcement and access control to discourage criminal behaviour.check_circle Correct
• DIt is a regulatory regime that requires every data centre to be located underground and to have hardened blast-resistant walls.

Why A is wrong: This is tempting because guards are visible physical controls, but CPTED is a design philosophy, not a staffing rule, and prescribes no guard ratios.

Why B is wrong: This is tempting because badge systems are part of physical security, but CPTED is unrelated to cryptography and addresses the built environment rather than credential protection.

Why C is correct: This is correct because CPTED is a recognised design discipline that reduces opportunities for crime by shaping sightlines, boundaries and movement paths through the environment itself.

Why D is wrong: This is tempting because data centre hardening is a real concern, but CPTED is not a regulatory regime and does not prescribe underground siting or blast hardening.

An IS auditor is preparing the annual audit plan for a mid-sized retail bank. Senior management has asked that prior-year findings drive the selection of auditable units, while the audit committee has asked for coverage that reflects the bank's current risk profile. Which approach should the IS auditor adopt as the PRIMARY basis for selecting auditable units?

• AAssess inherent risk, control risk and detection risk for each auditable unit and allocate effort to the highest residual risk areas.check_circle Correct
• BSchedule each auditable unit on a fixed three-year rotation so every system is covered at least once in the cycle.
• CRe-audit every area where the previous year's report contained a high-rated finding before considering any new auditable units.
• DPrioritise the auditable units that the available audit staff have the strongest technical familiarity with for the coming year.

Why A is correct: This is the risk-based audit planning model required by ISACA standards; effort is concentrated where residual risk is highest, which is the defensible basis for an annual plan.

Why B is wrong: Fixed-rotation cycles are tempting because they look fair and predictable, but ISACA standards require selection driven by current inherent and control risk, not calendar rotation that ignores threat changes.

Why C is wrong: Following up prior findings is necessary but partial; it anchors the plan on history rather than the current risk profile and leaves emerging high-risk areas uncovered.

Why D is wrong: Staffing convenience is tempting in a resource-constrained team, but ISACA requires the plan to be driven by risk; auditor availability informs delivery, not selection.

During scoping of an annual audit, the chief information officer offers the IS auditor a paid weekend role helping to redesign the access-provisioning workflow that the auditor is scheduled to review three months later. According to the ISACA Code of Professional Ethics, what should the IS auditor do FIRST?

• AAccept the engagement, document the dual role in the working papers and proceed with the planned audit under heightened supervision.
• BDecline the design work and disclose the offer to the audit committee or other appropriate governance body before continuing planning.check_circle Correct
• CAccept the design work but request that a peer auditor sign the eventual report so that independence in appearance is preserved.
• DDefer a decision until after the planned audit is complete, then accept the design role once the report has been issued.

Why A is wrong: Documentation alone does not cure the conflict; the auditor would be opining on a control they helped design, which impairs independence in appearance and in fact.

Why B is correct: The ISACA Code requires the auditor to maintain independence and objectivity; declining design work over a process they will audit, and disclosing the offer, is the correct first response.

Why C is wrong: Swapping the signer is tempting because it appears to insulate the report, but the firm or function still has a self-review threat and the engagement remains compromised.

Why D is wrong: Deferring looks neutral, yet accepting future paid work from an auditee during planning still creates a familiarity and self-interest threat that should be disclosed now.

An IS auditor is scoping a review of a new cloud-based human resources system. The vendor cannot reconfigure the application to enforce maker-checker on bulk salary uploads in time for go-live, so the project sponsor proposes a quarterly reconciliation of upload files against approved change tickets. How should the IS auditor categorise the proposed reconciliation when documenting the control environment?

• AAs a preventive control that stops unauthorised salary changes from reaching the production payroll ledger.
• BAs a corrective control that automatically reverses any unauthorised salary uploads found in the production ledger.
• CAs a compensating control that substitutes for the missing maker-checker preventive control on bulk uploads.check_circle Correct
• DAs a directive control that instructs payroll staff how the bulk-upload approval workflow is supposed to operate.

Why A is wrong: Preventive controls act before the event; a reconciliation performed quarterly reviews entries after they have posted, so calling it preventive misclassifies its timing.

Why B is wrong: Corrective controls restore a correct state after detection; a reconciliation surfaces variances but does not, by itself, reverse the transactions it identifies.

Why C is correct: Compensating controls are introduced when a primary control cannot be implemented; the reconciliation provides a substitute assurance over the same risk and should be documented as such.

Why D is wrong: Directive controls are policies and procedures that set expectation; a reconciliation activity is an operating control, not a statement of how staff should behave.

Which statement BEST distinguishes IT governance from IT management within an enterprise?

• AIT governance is the daily oversight of IT operations by the chief information officer, while IT management is the strategic stewardship exercised by the audit committee.
• BIT governance is performed only by external auditors providing assurance over IT, while IT management is performed by internal audit through control self-assessment.
• CIT governance is identical to IT management once a control framework such as COBIT 2019 has been adopted across the enterprise.
• DIT governance directs and evaluates the enterprise so that IT supports strategic objectives, while IT management plans, builds and runs IT services to deliver agreed outcomes.check_circle Correct

Why A is wrong: This inverts the recognised roles. The board and its committees govern, and the chief information officer manages; conflating the two undermines the separation of decision rights established by COBIT 2019.

Why B is wrong: Assurance providers do not govern or manage IT; they evaluate it. Treating audit as the governance function removes accountability from those charged with governance and is a common candidate trap.

Why C is wrong: Adopting a framework does not collapse the distinction. COBIT 2019 explicitly separates the governance objectives from the management objectives precisely to preserve segregation of decision rights.

Why D is correct: This reflects the ISO/IEC 38500 and COBIT 2019 distinction: governance sets direction, evaluates performance, and monitors compliance through the board, whereas management executes the plans within governance constraints.

An IS auditor is reviewing whether the enterprise IT strategy is properly aligned with the corporate strategy. Which artefact provides the MOST direct evidence of strategic alignment?

• AA balanced scorecard or strategy map that traces IT objectives, initiatives and measures back to the enterprise goals they support.check_circle Correct
• BThe minutes of the most recent change advisory board, showing that recent releases were approved before deployment to production.
• CThe service catalogue maintained by the service desk, listing every IT service available to business units and its associated service level.
• DAn aggregated register of open IT audit findings classified by control objective and remediation owner across the past three audit cycles.

Why A is correct: An IT balanced scorecard or COBIT goals cascade is the artefact specifically designed to evidence that each IT objective and measure is derived from an enterprise goal, providing direct alignment evidence.

Why B is wrong: Change advisory board minutes evidence operational change control, not the linkage between IT investment priorities and the enterprise's strategic objectives, so they cannot confirm strategic alignment.

Why C is wrong: The service catalogue describes what services are delivered today, not why they exist in relation to enterprise strategy; it is an operating artefact rather than a strategic alignment artefact.

Why D is wrong: An audit findings register evidences control weaknesses and remediation progress; it speaks to control posture, not to whether IT objectives are derived from and traceable to the corporate strategy.

An IS auditor is evaluating the organisational structure of the IT function in a payments processor. Which reporting line BEST preserves the independence and authority of the information security function?

• AThe chief information security officer reports administratively to the head of network operations and functionally to the chief information officer.
• BThe chief information security officer reports administratively to the chief executive officer and functionally to a board-level risk or audit committee.check_circle Correct
• CThe chief information security officer reports to the chief financial officer to ensure that security spending is controlled within the IT operating budget.
• DThe chief information security officer reports directly to the chief information officer, who chairs the change advisory board and the project portfolio board.

Why A is wrong: Reporting into operations creates a conflict because security would be subordinate to the team whose work it is meant to assess; this is a common but flawed structure used as a distractor.

Why B is correct: Reporting to the chief executive officer with a functional line to a board committee preserves authority over the enterprise and independence from the IT operations being protected, in line with leading governance practice.

Why C is wrong: Financial reporting lines subordinate the security agenda to cost control. While appealing for budget discipline, it weakens the security mandate and is not the structure recommended by governance frameworks.

Why D is wrong: Reporting to the chief information officer subordinates security to the function that builds and runs systems, undermining objectivity over those same systems and weakening escalation paths.

Which statement BEST describes the primary purpose of a business case at the outset of a systems acquisition project?

• ATo document the detailed functional and non-functional requirements that the chosen vendor must satisfy before contract award.
• BTo justify the proposed investment by linking expected benefits, costs and risks to a defined business problem and strategy.check_circle Correct
• CTo record the agreed acceptance criteria that the steering committee will use to sign off the system at go-live.
• DTo list the project deliverables, milestones and resource assignments that the project manager will track in the schedule.

Why A is wrong: Detailed functional and non-functional requirements belong in the requirements specification produced after the business case is approved, so this confuses two separate deliverables.

Why B is correct: A business case exists to demonstrate that an investment is justified by linking forecast benefits, whole-of-life costs, risks and strategic fit, which is the basis on which governance bodies authorise funding.

Why C is wrong: Acceptance criteria are part of the user acceptance testing approach near the end of the project, not the early justification artefact reviewed by the investment board.

Why D is wrong: Deliverables, milestones and resource assignments are scheduling outputs that follow approval of the business case rather than the justification it provides.

Which statement MOST accurately distinguishes project governance from project management for a systems acquisition initiative?

• AProject governance assigns daily task ownership while project management ratifies the investment decision at each phase gate.
• BProject governance is exercised by the project sponsor alone while project management is exercised by the project management office function.
• CProject governance sets the decision framework and accountability for outcomes while project management plans, executes and controls the work within it.check_circle Correct
• DProject governance defines the technical architecture while project management negotiates the supplier contracts that deliver that architecture.

Why A is wrong: This inverts the two roles, since daily task ownership sits with the project manager and phase-gate ratification sits with the governance body.

Why B is wrong: Governance is a multi-stakeholder oversight structure rather than a single sponsor, and project management is exercised by the project manager, not by the office that supports them.

Why C is correct: Governance establishes the decision rights, oversight and accountability structures within which a delegated project manager plans, executes and controls the project work, which is the distinction set out in ISACA guidance and PMBOK.

Why D is wrong: Technical architecture decisions and supplier negotiations are project execution activities, not the oversight and decision-rights framing that defines governance.

Which type of feasibility analysis is PRIMARILY concerned with whether a proposed system will achieve a positive return when compared with the do-nothing baseline?

• AOperational feasibility, which evaluates whether the organisation's people and processes can absorb the new way of working.
• BTechnical feasibility, which evaluates whether the proposed architecture and skills are available within the chosen platform.
• CSchedule feasibility, which evaluates whether the proposed delivery dates align with the available resource calendar.
• DEconomic feasibility, which compares whole-of-life costs against quantified benefits and any opportunity cost of inaction.check_circle Correct

Why A is wrong: Operational feasibility looks at workforce readiness and process fit rather than the monetary return relative to the baseline scenario.

Why B is wrong: Technical feasibility assesses whether the build can be delivered on the chosen technology stack and is silent on whether the investment pays back.

Why C is wrong: Schedule feasibility is concerned with whether the timeline is achievable given resource availability rather than with the financial return of the investment.

Why D is correct: Economic feasibility is the analysis that compares the present value of whole-of-life costs against quantified benefits relative to a do-nothing baseline, producing the net benefit figure used in the investment decision.