ISACA CISA Practice Exam

What the ISACA CISA exam covers

• Information System Auditing Process175 questions
• Governance and Management of IT176 questions
• Acquisition, Development and Implementation159 questions
• Operations and Business Resilience194 questions
• Protection of Information Assets180 questions

Free ISACA CISA sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 884.

1. Question 1Information System Auditing Process

   What is the primary purpose of risk-based audit planning?

   • ATo distribute audit effort evenly across all systems irrespective of exposure
   • BTo reduce the amount of documentation the audit team must produce
   • CTo focus audit resources on the areas of highest risk to the organizationCorrect
   • DTo transfer responsibility for controls from management to the audit team
   ✓ Correct answer: C

   Risk-based audit planning is a methodology where the IS auditor identifies and evaluates the inherent and residual risks across the organization's systems, processes, and assets, then directs audit effort toward areas where the potential impact and likelihood of control failures are greatest. This approach ensures that limited audit resources produce the most value by concentrating on what matters most.

   Why the other options are wrong

   • ASpreading effort evenly ignores the entire purpose of a risk-based approach, which is to weight coverage toward exposure.
   • BRisk-based planning determines scope and priority, not the volume of documentation the auditor produces.
   • DAudit planning never shifts ownership of controls, which always remains with management.
2. Question 2Protection of Information Assets

   An auditor reviews a WAF/CDN added to a public site. Besides protection, which performance benefit should be verified?

   • AAn enduring guarantee that the site will have zero vulnerabilities forever
   • BReduced origin load and lower latency via edge caching of static contentCorrect
   • CAutomatic and complete compliance with all applicable privacy laws
   • DRemoval of the requirement to maintain regular data backups
   ✓ Correct answer: B

   A web application firewall combined with a content delivery network serves two distinct purposes that an auditor should verify independently. The WAF component provides security by filtering malicious requests such as SQL injection, cross-site scripting, and DDoS traffic before they reach the origin server. The CDN component improves performance by caching static content such as images, CSS files, JavaScript libraries, and HTML pages at geographically distributed edge nodes close to users. When users request cached content, it is served from the nearest edge location rather than the origin server, reducing round-trip latency for users and dramatically reducing the volume of requests that reach the origin infrastructure. This also reduces compute and bandwidth costs at the origin, making the CDN both a performance and cost optimization control.

   Why the other options are wrong

   • ANo control guarantees zero vulnerabilities; a WAF reduces but never eliminates all risk.
   • CA WAF/CDN does not by itself deliver automatic compliance with privacy laws.
   • DEdge caching improves delivery but does not remove the need for backups.
3. Question 3Protection of Information Assets

   A web application validates input only in the browser using JavaScript. From a security standpoint, what is the key flaw?

   • AClient-side validation can be bypassed; validation must also occur server-sideCorrect
   • BJavaScript validation encrypts the data in transit
   • CServer-side validation is unnecessary if the UI hides invalid fields
   • DClient-side validation is the strongest possible control
   ✓ Correct answer: A

   JavaScript input validation runs entirely in the user's browser, an environment the user controls. An attacker or automated tool can send HTTP requests straight to the server endpoint with tools like Burp Suite, Postman, or curl, bypassing the browser and its checks entirely. Malformed or malicious input - SQL injection payloads, cross-site scripting strings, oversized values - can then reach the server's processing logic unsanitized. Server-side validation is therefore mandatory because the server is the only environment the application controls and must independently validate all input regardless of client behavior.

   Why the other options are wrong

   • BJavaScript validation encrypts the data in transit confuses two concepts; validation performs format and range checks, while encryption in transit is provided by TLS at the transport layer and is unrelated to validation logic.
   • CServer-side validation is unnecessary if the UI hides invalid fields is false because UI design only affects what legitimate users see and offers no protection against raw HTTP requests that bypass the UI entirely.
   • DClient-side validation is the strongest possible control is the opposite of the truth; it is the weakest input control precisely because anyone able to send direct HTTP requests can trivially bypass it.
4. Question 4Protection of Information AssetsSelect all that apply

   Sensitive files are emailed externally as plaintext attachments and the gateway performs no content inspection. Which TWO controls would BEST reduce this risk? (Choose TWO)

   • AData loss prevention (DLP) with egress content inspection and policy enforcementCorrect
   • BAllowing all outbound email unmonitored
   • CEncryption of sensitive attachments in transitCorrect
   • DRemoving all email logging
   ✓ Correct answer: A, C

   These two controls work together to address the risk of sensitive data leaving the organization via email in readable form. DLP with egress content inspection examines outbound email content and attachments against predefined policies, detecting and blocking or quarantining messages that contain sensitive data such as personally identifiable information, financial records, or intellectual property. Encryption of sensitive attachments ensures that even if a file is legitimately sent externally, its contents are protected from interception or unauthorized access during transit. Together, these controls prevent inadvertent leakage through policy enforcement and protect authorized transmissions through cryptographic protection.

   Why the other options are wrong

   • BAllowing all outbound email unmonitored is incorrect because removing oversight of outgoing communications eliminates the organization's ability to detect and prevent unauthorized data exfiltration via email.
   • DRemoving all email logging is incorrect because eliminating email logs destroys the audit trail needed to investigate data leakage incidents, identify responsible parties, and demonstrate compliance with data protection requirements.
5. Question 5Information System Auditing Process

   An IS auditor plans to perform a substantive test of details directly on transaction balances. What is the PRIMARY objective of a substantive test as opposed to a test of controls?

   • ATo detect material misstatements or errors in the data or transactions themselvesCorrect
   • BTo confirm that a control is designed appropriately
   • CTo determine whether a control operated throughout the period
   • DTo assess the competence of the control owner
   ✓ Correct answer: A

   Tests of controls evaluate whether controls are designed and operating effectively, whereas substantive tests examine the data itself to detect material errors or misstatements. When control risk is assessed as high, the auditor increases substantive testing because reliance on controls is reduced. Substantive procedures provide direct evidence about the accuracy of recorded amounts.

   Why the other options are wrong

   • BConfirming control design is part of a test of control design effectiveness, not a substantive test of the data.
   • CDetermining whether a control operated throughout the period is a test of operating effectiveness, a type of control test, not a substantive test.
   • DAssessing the competence of a control owner is an inquiry or design consideration, not the objective of substantive testing.
6. Question 6Governance and Management of IT

   What is the PRIMARY benefit of an IT investment business case at the project approval gate?

   • AIt justifies the expected value and aligns the proposed investment with business objectives before fundingCorrect
   • BIt records the detailed technical design the project team will build
   • CIt defines the day-to-day task schedule the project manager will follow
   • DIt certifies that the chosen vendor has passed a security assessment
   ✓ Correct answer: A

   The business case documents expected costs, benefits, risks, and strategic alignment so decision-makers can decide whether to fund the investment. It is a governance instrument that should be revisited at stage gates throughout the project life cycle. It does not guarantee outcomes or remove the need for monitoring.

   Why the other options are wrong

   • BA detailed technical design is produced later in delivery; the business case justifies value and alignment at the approval gate rather than specifying the build.
   • CA day-to-day task schedule is part of project planning after approval; the business case supports the funding decision, not the execution timetable.
   • DCertifying a vendor's security posture is a due-diligence output; the business case establishes expected value and strategic fit, not vendor security assurance.
7. Question 7Operations and Business Resilience

   Which IT service management process is responsible for identifying the underlying cause of recurring incidents so that they can be permanently resolved?

   • AProblem managementCorrect
   • BIncident management
   • CRelease management
   • DService-level management
   ✓ Correct answer: A

   Incident management focuses on restoring service as quickly as possible, while problem management investigates the underlying causes of one or more incidents and seeks a permanent fix or workaround. Distinguishing the two is a common exam point: incidents are about speed of restoration, problems are about eliminating recurrence through root-cause analysis.

   Why the other options are wrong

   • BIncident management restores service quickly but does not focus on permanently eliminating the underlying cause.
   • CRelease management governs the deployment of changes into production, not root-cause investigation.
   • DService-level management negotiates and monitors SLAs; it does not perform root-cause analysis of incidents.
8. Question 8Protection of Information AssetsSelect all that apply

   An organization is hardening its email security to reduce spoofing and phishing. Which TWO mechanisms help recipients verify that an email genuinely originated from the claimed sending domain? (Choose TWO)

   • ASPF (Sender Policy Framework) records published in DNSCorrect
   • BDKIM (DomainKeys Identified Mail) cryptographic signaturesCorrect
   • CIncreasing the mailbox storage quota for all users
   • DEnabling an out-of-office auto-responder on shared mailboxes
   ✓ Correct answer: A, B

   SPF publishes in DNS which mail servers are authorized to send for a domain, so receivers can reject mail from unauthorized sources. DKIM adds a cryptographic signature tied to the domain's published key, letting receivers confirm the message was signed by the domain and was not altered in transit. Together, often enforced via DMARC, they significantly reduce domain spoofing and phishing.

   Why the other options are wrong

   • CMailbox storage quotas affect capacity, not the authenticity verification of incoming mail.
   • DAuto-responders are a convenience feature and have no role in verifying sender authenticity.
9. Question 9Governance and Management of IT

   Management decides to accept a moderate IT risk rather than implement an expensive control. From an audit perspective, the acceptance is APPROPRIATE only if:

   • AIt is formally documented and approved by a person with authority within the risk appetiteCorrect
   • BThe IT department verbally agrees the control is too costly
   • CThe risk is removed from the risk register so it no longer requires monitoring
   • DThe vendor offering the control confirms the price is non-negotiable
   ✓ Correct answer: A

   Acceptance is a legitimate risk treatment, but it must be a conscious, documented decision made by someone with the authority to accept on the organization's behalf, and the residual exposure must fall within the defined risk appetite or tolerance. An auditor looks for that evidence of authorized, bounded acceptance.

   Why the other options are wrong

   • BAn informal verbal agreement from IT is not authorized risk acceptance.
   • CAccepted risks remain on the register and must continue to be monitored.
   • DVendor pricing is irrelevant to whether the organization properly accepted the risk.
10. Question 10Operations and Business Resilience

    An organization uses a grandfather-father-son backup rotation. An IS auditor is assessing what this scheme primarily provides. Which statement is MOST accurate?

    • AA retention hierarchy of daily, weekly, and monthly backups enabling multiple restore pointsCorrect
    • BA mirrored disk arrangement that keeps two identical live copies of data at all times
    • CA single full backup taken each night and overwritten by the next night's backup job
    • DAn incremental scheme that captures only changed blocks and never a full baseline copy
    ✓ Correct answer: A

    In this scheme, sons are daily backups, fathers are weekly, and grandfathers are monthly. Reusing media on a defined rotation balances media cost against retention, giving the ability to restore from several points in time, which is the auditor's key consideration when reviewing retention adequacy.

    Why the other options are wrong

    • BDisk mirroring provides fault tolerance, not the tiered daily-weekly-monthly retention that the grandfather-father-son scheme defines.
    • CA single overwritten nightly full backup gives only one restore point, contrary to the multiple restore points the rotation provides.
    • DA pure incremental scheme with no full baseline is a different strategy and does not describe the generational retention hierarchy.

Related Security resources

• ISACA CISA study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• (ISC)² CISSP practice examRelated
• (ISC)² Certified in Cybersecurity (CC) practice examRelated
• CompTIA Security+ SY0-701 practice examRelated

ISACA CISA practice exam FAQ