Free ISACA CISA Questions & Answers 2026 Part1 | Certified Information Systems Auditor

An IS auditor is tasked to review an organization ' s plan-do-check-act (PDCA) method for improving IT- related processes and wants to determine the accuracy of defined targets to be achieved. Which of the following steps in the PDCA process should the auditor PRIMARILY focus on in this situation?

Observation and testing can be used effectively in which of the following areas?

Which of the following is the MOST effective way for an organization to help ensure agreed-upon action plans from an IS audit will be implemented?

During an exit meeting, an IS auditor highlights that backup cyclesare being missed due to operator error and that these exceptionsare not being managed. Which of the following is the BEST way tohelp management understand the associated risk?

Which of the following is MOST important for an IS auditor to verify when reviewing a critical business application that requires high availability?

An IS auditor notes that several employees are spending an excessive amount of time using socialmedia sites for personal reasons. Which of the following should the auditor recommend beperformed FIRST?

Which of the following should be the FIRST step in managing the impact of a recently discovered zero-day attack?

Which of the following symmetric algorithms is a block cipher that the U.S. government adopted as AES to replace DES?

Which of the following is a PRIMARY benefit of using risk assessments to determine areas to be included in an audit plan?

Which of the following is the PRIMARY reason an IS auditor should recommend that management create an IT risk register?

An organization that has suffered a cyber-attack is performing a forensic analysis of the affected users' computers. Which of the following should be of GREATEST concern for the IS auditor reviewing this process?

An IS auditor is conducting a post-implementation review of an enterprise resource planning (ERP)system. End users indicated concerns with the accuracy of critical automatic calculations made bythe system. The auditor's FIRST course of action should be to:

Which of the following should be the FIRST step in managing the impact of a recently discovered zero-day attack?

An auditor should recommend the use of which of the following to determine the minimum level of service needed at an alternate site?

To confirm integrity for a hashed message, the receiver should use:

Which of the following BEST demonstrates to senior management and the board that an audit function is compliant with standards and the code of ethics?

Which of the following is the BEST way to determine whether a test of a disaster recovery plan (DRP)was successful?

Which of the following is the GREATEST risk if two users have concurrent access to the same database record?

An organization has recently acquired and implemented intelligent-agent software for granting loans to customers. During the post-implementation review, which of the following is the MOST important procedure for the IS auditor to perform?

A new regulation has been enacted that mandates specific information security practices for the protection of customer data. Which of the following is MOST useful for an IS auditor to review when auditing against the regulation?

An IS auditor has been asked to audit the proposed acquisition of new computer hardware. The auditor's PRIMARY concern is that:

Which of the following provides the MOST reliable audit evidence on the validity of transactions in afinancial application?

Which of the following should be of GREATEST concern to an IS auditor reviewing an organization's business continuity plan (BCP)?

Which of the following access rights presents the GREATEST risk when granted to a new member ofthe system development staff?

Which of the following layer of an enterprise data flow architecture represents subset of information from the core Data Warehouse selected and organized to meet the needs of a particular business unit or business line?

Data from a system of sensors located outside of a network is received by the open ports on a server. Which of the following is the BEST way to ensure the integrity of the data being collected from the sensor system?

Which of the following is the MOST effective way for an organization to help ensure agreed-upon action plans from an IS audit will be implemented?

Which of the following would MOST likely impair the independence of the IS auditor whenperforming a post-implementation review of an application system?

In the NIST version of the SDLC process, the system or program performs the work for which it was designed in which waterfall phase?

Which of the following would be MOST helpful to an IS auditor performing a risk assessment of an application programming interface (API) that feeds credit scores from a well-known commercial credit agency into an organizational system?

Which of the following is the PRIMARY purpose of obtaining a baseline image during an operating system audit?

In an annual audit cycle, the audit of an organization's IT department resulted in many findings. Which of the following would be the MOST important consideration when planning the next audit? The most important consideration when planning the next audit after many findings is to follow up on the status of all recommendations, as this will ensure that the audit findings are addressed in a timely and effective manner, and that the root causes of the issues are resolved12.Following up on the status of all recommendations will also help to assess the progress and performance of the IT department, and to identify any new or emerging risks or challenges34. References 1: What to consider when resolving internal audit findings32: A brief guide to follow up43: Guidance on auditing planning for Internal Audit24: Corrective Action Plan (CAP): How to Manage Audit Findings1

In a data center audit, an IS auditor finds that the humidity level is very low. The IS auditor would be MOST concerned because of an expected increase in:

Which of the following BEST facilitates the legal process in the event of an incident? The best way to facilitate the legal process in the event of an incident is to preserve the chain of custody of the evidence. The chain of custody is a record of who handled, accessed, or modified the evidence, when, where, how, and why. The chain of custody helps to ensure the integrity, authenticity, and admissibility of the evidence in a court of law. The chain of custody also helps to prevent tampering, alteration, or loss of evidence that could compromise the investigation or the prosecution.Reference: CISAReview Manual (Digital Version) CISA Questions, Answers and Explanations Database

Which of the following BEST mitigates the risk of SQL injection attacks against applications exposed to the internet?

During which step of the audit life cycle does an auditor identify which skills are needed for the audit, how many auditors are required, and what other resources are needed?

An IS auditor is reviewing the security of a web-based customer relationship management (CRM) system that is directly accessed by customers via the Internet, which of the following should be a concern for the auditor? A web-based CRM system that is directly accessed by customers via the Internet should be hosted in a secure and isolated environment to protect it from external threats and unauthorized access.A web-based CRM system should also be reliable, trusted, and backedup regularly1. Hosting the system on an external third-party service provider's servers (A) or a hybrid-cloud platform managed by a service provider (B) may not be a concern for the auditor if the service provider has adequate security measures and service level agreements in place.The auditor should verify the security controls and contractual terms of the service provider before trusting them with the CRM data23. Hosting the system within a demilitarized zone (DMZ) of a corporate network is a common practice to provide an extra layer of security to the CRM system from untrusted networks, such as the Internet.A DMZ is a perimeter network that isolates the CRM system from the internal network and filters the incoming traffic from the external network using a security gateway4567. Hosting the system within an internal segment of a corporate network (D) is a concern for the auditor because it exposes the CRM system and the internal network to potential attacks from the Internet. The CRM system should not be directly accessible from the Internet without a DMZ or a firewall to protect it.This could compromise the confidentiality, integrity, and availability of the CRM data and the internal network78.

An IS auditor found that a company executive is encouraging employee use of social networking sitesfor business purposes. Which of the following recommendations would BEST help to reduce the riskof data leakage?

In project management, which of the following is a task related to closing a project?

At the end of each business day, a business-critical application generates a report of financial transac-tions greater than a certain value, and an employee then checks these transactions for errors. What type of control is in place?