ISACA CISA Practice Exam

What the ISACA CISA exam covers

• Information System Auditing Process182 questions
• Governance and Management of IT157 questions
• Acquisition, Development and Implementation138 questions
• Operations and Business Resilience249 questions
• Protection of Information Assets249 questions

Free ISACA CISA practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 975.

1. Question 1Information System Auditing Process

   An IS audit department has a limited number of staff-days available for the coming year and must decide how to allocate them across dozens of systems and processes with widely varying levels of exposure. Some stakeholders suggest splitting the hours evenly across all systems so that every area receives some coverage. What should guide the audit director's decision instead?

   • AAudit hours should be distributed evenly across all systems so that no area is audited more than another
   • BAudit hours should be reduced overall so the team can produce shorter, less detailed reports
   • CAudit hours should be concentrated on the areas presenting the greatest risk to the organizationCorrect
   • DAudit hours should be allocated to relieve management of its responsibility for operating controls
   ✓ Correct answer: C

   Risk-based audit planning directs limited hours toward areas where the likelihood and impact of control failure are greatest, not spread evenly. The director should assess inherent and residual risk across systems and processes, then weight the annual plan so higher-risk areas get more hours and more frequent coverage; lower-risk areas still get periodic coverage. This maximizes value from a fixed budget and is what ISACA guidance and audit committees expect. Trap: an even split feels fair but wastes hours on low-risk areas while under-covering high-risk ones.

   Why the other options are wrong

   • AEven distribution ignores exposure differences and defeats the purpose of risk-based planning.
   • BRisk-based planning governs where effort is focused, not the volume or length of reporting.
   • DAudit planning never relieves management of its responsibility for operating controls.
2. Question 2Protection of Information AssetsSelect all that apply

   An IS auditor is reviewing the technical configuration of a customer-facing web application to assess controls over the confidentiality of data in transit. The auditor wants to confirm the configuration prevents any client from establishing an unencrypted, or weakly encrypted, connection to the server. Which TWO configuration settings should the auditor expect to find in place? (Choose TWO)

   • ACertificate validation disabled on client applications connecting to the service
   • BTLS 1.2 or higher enabled, with older protocols such as SSLv3 and TLS 1.0 explicitly disabledCorrect
   • CAutomatic redirection of HTTP requests to HTTPS, enforced through HTTP Strict Transport Security (HSTS)Correct
   • DThe application also reachable over plain HTTP on port 80 as a fallback option for older clients
   ✓ Correct answer: B, C

   Protecting data in transit requires both configuring strong encryption and eliminating any path for an unencrypted connection. Enabling TLS 1.2+ while disabling SSLv3 and TLS 1.0/1.1 removes protocol versions with known cryptographic weaknesses, ensuring every session negotiates a secure cipher suite. HSTS instructs browsers to always connect over HTTPS and automatically upgrade any HTTP request, closing off accidental plain-HTTP connections or downgrade attacks against the initial request. Disabling certificate validation would remove the check confirming server identity, and keeping an HTTP fallback directly contradicts the objective.

   Why the other options are wrong

   • ADisabling certificate validation enables a machine-in-the-middle attack on supposedly encrypted traffic.
   • DKeeping a plain HTTP fallback means clients using it transmit data with no encryption.
3. Question 3Governance and Management of IT

   An IS auditor reviewing the IT governance framework finds that the CIO produces a monthly dashboard of KPIs and KRIs for the executive committee. From a governance perspective, what is the MAIN purpose of this reporting?

   • ATo give management timely insight into IT performance and risk so they can make informed decisionsCorrect
   • BTo provide the sole source of assurance so no separate control testing is ever performed
   • CTo satisfy a regulator's request for raw system logs on a monthly schedule
   • DTo document the IT department's staffing levels for the human resources function
   ✓ Correct answer: A

   The governance purpose behind monthly KPI/KRI reporting is enabling informed oversight: the executive committee cannot fulfill its stewardship role without reliable, timely information on IT performance and risk exposure. KPIs show performance against objectives, while KRIs provide early warning of emerging risk trends, together creating a feedback loop letting the committee intervene and allocate resources. This reporting is not itself assurance; controls still need independent testing. It is also not a mechanism for regulatory raw-log submission or HR documentation.

   Why the other options are wrong

   • BKPI/KRI reporting informs oversight but is not assurance itself; controls must still be tested separately.
   • CSubmitting raw logs to a regulator is a distinct compliance task, not this dashboard's purpose.
   • DDocumenting staffing levels is an HR activity unrelated to this dashboard's governance purpose.
4. Question 4Operations and Business Resilience

   While reviewing the incident response plan following a suspected data breach, the IS auditor notes that the plan does not specify how items such as forensic disk images and extracted log files should be labeled, documented, and secured from the point of collection through storage. Which risk should the auditor MOST emphasize in the audit report?

   • AWithout documented evidence-handling steps, the organization will be unable to meet its recovery time objective for restoring affected systems
   • BThe absence of evidence-handling documentation will primarily increase the ongoing storage cost of retaining forensic images and log extracts over time
   • CUndocumented evidence handling will mainly delay the completion of the organization's unrelated annual internal audit schedule for other departments
   • DEvidence collected without a documented chain of custody may be challenged as altered or contaminated, undermining its use in investigation or legal actionCorrect
   ✓ Correct answer: D

   Chain-of-custody documentation records who collected each piece of evidence, when, how, and who accessed it afterward, and that record is what lets evidence withstand later scrutiny. Without it, a regulator or reviewer can plausibly claim the forensic images or logs were altered or mishandled, even if nothing actually happened. This directly threatens using the evidence in disciplinary action, regulatory reporting, or litigation, a far larger consequence than cost or scheduling impact. Recovery time objectives concern how fast systems are restored, a separate issue entirely.

   Why the other options are wrong

   • ARTOs concern how quickly systems are restored to service, not evidence integrity.
   • BStorage cost is minor next to evidence potentially being ruled unreliable.
   • CA scheduling delay to an unrelated audit is low-priority and misses the real risk.
5. Question 5Governance and Management of ITSelect all that apply

   Which TWO conditions are necessary for an organization to claim its IT processes are at a 'managed and measurable' (higher) maturity level? (Choose TWO)

   • AProcesses are monitored using quantitative metrics and the results drive improvementCorrect
   • BProcesses are documented and consistently followed across the organizationCorrect
   • CProcesses depend entirely on the heroics of a few key individuals
   • DProcesses are undocumented and performed differently each time
   ✓ Correct answer: A, B

   A 'managed and measurable' maturity level requires two things simultaneously: the process must be consistently documented and followed across the organization, and its performance must be monitored using quantitative metrics whose results actively drive improvement. Documentation and consistency alone describe only a 'defined' level, since a process can be followed the same way every time without anyone measuring how well it performs. Quantitative measurement elevates it further, letting management detect drift, benchmark against targets, and make evidence-based improvement decisions. Both are necessary, since a measured-but-inconsistent or consistent-but-unmeasured process would each fall short.

   Why the other options are wrong

   • CDependence on a few key individuals' heroics is characteristic of a low, person-dependent maturity level, not a managed one.
   • DUndocumented, inconsistently performed processes describe the lowest ad hoc maturity level, the opposite of what the question asks about.
6. Question 6Acquisition, Development and Implementation

   During the feasibility study phase of a new system acquisition, which analysis BEST helps management decide whether the project is worth pursuing?

   • AA cost-benefit analysis weighing projected costs against expected benefits over the system's lifeCorrect
   • BA detailed entity-relationship diagram documenting the design of the proposed database schema
   • CA unit test plan covering each individual code module in the system
   • DA detailed disaster recovery runbook prepared for the future production environment
   ✓ Correct answer: A

   During feasibility, management needs an objective basis for deciding whether a proposed system is worth pursuing, and cost-benefit analysis provides that by quantifying projected costs against expected benefits over the system's life. This directly supports the investment decision: if benefits do not justify costs, management has a clear basis to reject or rescope before committing significant resources. Cost-benefit analysis is one dimension of feasibility alongside technical and operational feasibility, but specifically answers whether the investment makes economic sense. The other options are all later-phase deliverables that presuppose approval already happened.

   Why the other options are wrong

   • BAn entity-relationship diagram is a design-phase deliverable, produced after approval to proceed.
   • CA unit test plan defines module testing well after the feasibility decision.
   • DA DR runbook is an operational document prepared after implementation, not feasibility.
7. Question 7Operations and Business Resilience

   An IS auditor is reviewing data retention practices for operational and backup data. Which factor should PRIMARILY drive how long backup data is retained?

   • AThe amount of unused storage capacity currently available
   • BLegal, regulatory, and business requirements for data retentionCorrect
   • CThe personal preference of the backup administrator
   • DThe speed of the backup network link
   ✓ Correct answer: B

   Backup retention periods must be set primarily by legal and regulatory requirements mandating how long data must be kept, combined with genuine business needs for recovery or audit trails, since these define the minimum and maximum valid retention. Setting retention by convenience risks two opposite failures: disposing of data before a legal obligation expires, or keeping it far longer than necessary, increasing breach exposure and, for personal data, a compliance violation. Capacity, network speed, and preference are implementation factors, not the retention basis.

   Why the other options are wrong

   • AAvailable storage capacity is an implementation constraint, not a valid basis for legal retention periods.
   • CAn administrator's personal preference has no standing as a retention basis, which must be legally grounded.
   • DBackup network speed affects how quickly backups complete, not how long the data must be retained.
8. Question 8Governance and Management of IT

   An IS auditor is assessing the hierarchy of an organization's IT directive documents. Which sequence correctly orders them from highest authority and most general to most detailed and specific?

   • APolicy, then standard, then procedure, with guidelines as advisory supportCorrect
   • BProcedure, then policy, then standard, with guidelines as mandatory
   • CStandard, then guideline, then policy, then procedure
   • DGuideline, then procedure, then policy, then standard
   ✓ Correct answer: A

   The directive hierarchy is built on traceability: each lower document derives its authority from the one above it. Policy sits at the top, expressing management's high-level intent. Standards translate that intent into mandatory, specific requirements. Procedures give step-by-step detail for carrying out those requirements. Guidelines sit outside the mandatory chain as advisory, recommended practice. This order, policy then standard then procedure with guidelines as optional support, confirms authority flows correctly from the top down.

   Why the other options are wrong

   • BThis inverts the hierarchy, placing procedure above policy, and wrongly treats guidelines as mandatory.
   • CStandards derive authority from policy and cannot sit above it, breaking the intended traceability.
   • DGuidelines are the lowest, most advisory layer, not the starting point; this order is backwards.
9. Question 9Operations and Business Resilience

   An IS auditor reviewing the help desk finds that incidents are resolved but never categorized or trended. What capability is MOST impaired by this practice?

   • AThe ability to identify recurring issues and feed them into problem managementCorrect
   • BThe ability to confirm that each incident ticket was assigned a unique reference number
   • CThe ability to record the exact time each incident was first reported to the desk
   • DThe ability to close incident tickets once the affected user confirms service is restored
   ✓ Correct answer: A

   Problem management depends on recognizing that multiple incidents share a common cause, which is only possible if incidents are consistently categorized so patterns become visible. Without categorization or trending, each incident is closed as an isolated event, so recurring issues never surface and the link that should trigger a permanent fix never forms. This is the capability most impaired because it breaks the specific mechanism - categorization feeding trend analysis feeding problem identification - that connects incident to problem management.

   Why the other options are wrong

   • BAssigning a unique ticket number is basic logging that happens regardless of later categorization.
   • CRecording the report time is routine logging, independent of categorization or trend analysis.
   • DClosing tickets on user confirmation is standard closure practice, unaffected by whether the incident was ever categorized.
10. Question 10Protection of Information Assets

    An IS auditor evaluates security testing performed before a major application release. The team ran only an automated vulnerability scan against the login page. Why might the auditor consider the assurance insufficient?

    • AA single automated scan of one page provides limited coverage and may miss business-logic, authorization, or unscanned-component flawsCorrect
    • BA single automated scan of the login page will typically overwhelm the release team with a large number of false-positive findings to triage
    • CA single automated scan of the login page cannot be trusted because scanners are generally not designed to evaluate authentication-related weaknesses
    • DA single automated scan of the login page becomes acceptable once it has been repeated across a few subsequent maintenance windows
    ✓ Correct answer: A

    Adequate pre-release assurance depends on breadth and variety of technique, since different methods and app areas expose different vulnerability classes. An automated scanner finds known, signature-based flaws but is not designed to catch business-logic errors, broken authorization, or weaknesses in components it never exercises. Scanning only the login page leaves the rest of the app, and entire flaw categories within that page, unassessed - a clean report reflecting narrow scope, not true risk. Testing should include broader coverage and mixed techniques, particularly for authentication and access control.

    Why the other options are wrong

    • BA high volume of false positives is a triage problem, not the coverage gap itself.
    • CScanners miss deep authentication logic, but the real gap here is scope, not inability.
    • DRepeating the same single-page scan does not test the rest of the app.

Who this ISACA CISA practice exam is for

This practice set is for anyone preparing for the ISACA CISA exam - from first-time candidates building a foundation to experienced professionals doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this ISACA CISA practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real ISACA CISA exam.

Related Security resources

• ISACA CISA study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• ISACA CISM practice examRelated
• ISACA CRISC (Certified in Risk and Information Systems Control) practice examRelated
• (ISC)² CCSP practice examRelated

ISACA CISA practice exam FAQ