Download CISA Practice Exam... and more Exams Technology in PDF only on Docsity!
Question 1. Which of the following is MOST important when planning an IS audit? A) Reviewing prior audit reports B) Understanding business processes C) Interviewing IT staff D) Selecting audit tools Answer: B Explanation: Understanding business processes is fundamental to effective audit planning, as it ensures the auditor identifies critical areas, risks, and controls relevant to the organization. Question 2. Which type of control is intended to prevent security incidents from occurring? A) Detective B) Corrective C) Preventive D) Compensating Answer: C Explanation: Preventive controls are designed to stop security incidents before they occur, such as access controls and firewalls. Question 3. The PRIMARY purpose of risk-based audit planning is to: A) Ensure all areas are audited equally
B) Focus audit efforts on high-risk areas C) Comply with regulatory requirements D) Increase audit scope Answer: B Explanation: Risk-based audit planning ensures resources are allocated to areas with the highest risk, improving audit effectiveness. Question 4. Which of the following best describes an integrated audit? A) An audit of both financial and operational controls B) An audit of IT only C) An audit conducted by multiple firms D) An audit with no scope limitation Answer: A Explanation: Integrated audits assess both financial and operational controls, often including IT controls, for a holistic evaluation. Question 5. Which IS audit standard provides guidance on the code of ethics for IS auditors? A) ISO 27001 B) COBIT C) ISACA Code of Professional Ethics D) ISO 9001
Question 8. Which of the following is a key benefit of using data analytics in auditing? A) Reduces audit scope B) Identifies trends and anomalies in large datasets C) Eliminates the need for manual testing D) Guarantees audit accuracy Answer: B Explanation: Data analytics efficiently identifies trends, anomalies, and exceptions in large datasets, enhancing audit quality. Question 9. What is the PRIMARY purpose of an audit report? A) Satisfy audit team requirements B) Communicate audit findings and recommendations to stakeholders C) Document audit procedures D) Detail audit fees Answer: B Explanation: The main purpose of an audit report is to communicate findings and recommendations to relevant stakeholders. Question 10. Which is MOST essential for quality assurance in the audit process? A) Auditor certification
B) Peer review of audit work C) Use of automated tools D) Limiting audit scope Answer: B Explanation: Peer reviews help ensure the quality of audit work by providing independent assessment and feedback. Question 11. IT governance is primarily concerned with: A) Managing daily IT operations B) Aligning IT strategy with business objectives C) Reducing operational costs D) Upgrading technical infrastructure Answer: B Explanation: IT governance ensures that IT strategies are aligned with and support the overall business objectives. Question 12. COBIT is best described as a: A) Project management methodology B) Security standard C) IT governance and management framework D) Database management tool Answer: C
Question 15. Which model helps organizations assess and improve the maturity of their IT processes? A) SWOT Analysis B) Capability Maturity Model (CMM) C) Balanced Scorecard D) RACI Matrix Answer: B Explanation: The Capability Maturity Model (CMM) measures the maturity of processes and helps guide improvements. Question 16. Which law is MOST likely to impact the handling of personal data in the European Union? A) HIPAA B) GDPR C) SOX D) PCI DSS Answer: B Explanation: The General Data Protection Regulation (GDPR) governs the processing and protection of personal data in the EU. Question 17. The PRIMARY concern of data governance is: A) Data backup
B) Data integrity, availability, and confidentiality C) Hardware maintenance D) Software licensing Answer: B Explanation: Data governance focuses on maintaining the integrity, availability, and confidentiality of data throughout its lifecycle. Question 18. Which of the following is an example of a privacy principle? A) Least privilege B) Data minimization C) Defense in depth D) Failover clustering Answer: B Explanation: Data minimization is a privacy principle requiring organizations to collect only the data they need. Question 19. Which of the following is a key responsibility of IT resource management? A) Approving financial statements B) Allocating and managing IT assets, personnel, and budgets C) Conducting external audits D) Drafting legal contracts
Question 22. What is the PRIMARY focus of IT quality assurance? A) Documenting errors B) Ensuring IT processes and deliverables meet quality standards C) Increasing system complexity D) Reducing staff Answer: B Explanation: IT quality assurance ensures that processes and deliverables consistently meet defined quality standards. Question 23. Which project management methodology is based on iterative development with frequent reassessments? A) Waterfall B) Agile C) V-Model D) RAD Answer: B Explanation: Agile emphasizes iterative development, frequent reassessments, and adaptability. Question 24. A business case for a new IT system should MOST importantly include:
A) Auditor preferences B) Cost-benefit analysis C) Brand logo D) Employee survey Answer: B Explanation: A business case must include a cost-benefit analysis to justify the investment and expected returns. Question 25. Which is a key control activity in system development lifecycle (SDLC)? A) Data encryption B) Segregation of duties C) Test case documentation and review D) Data replication Answer: C Explanation: Documenting and reviewing test cases is crucial to ensure the developed system meets requirements and functions as intended. Question 26. The PRIMARY goal of user acceptance testing (UAT) is to: A) Test hardware performance B) Ensure the system meets user requirements C) Validate network security
Explanation: Post-implementation reviews assess if objectives were met and capture lessons to improve future projects. Question 29. Which of the following is an example of a common technology component in IS operations? A) Marketing database B) Payroll system C) Operating system D) Financial statement Answer: C Explanation: Operating systems are fundamental technology components in IS operations. Question 30. IT asset management is concerned with: A) Physical security only B) Tracking and managing IT assets throughout their lifecycle C) Publishing advertisements D) Performing system backups Answer: B Explanation: IT asset management involves tracking and managing IT assets from acquisition to disposal.
Question 31. Which process automates the scheduling of batch jobs in production systems? A) Incident management B) Job scheduling C) Problem management D) Configuration management Answer: B Explanation: Job scheduling automates and manages the execution of batch jobs in production environments. Question 32. Shadow IT refers to: A) IT staff working overtime B) Unauthorized IT systems or solutions used outside official IT control C) Outdated IT systems D) IT systems in remote offices Answer: B Explanation: Shadow IT includes systems or applications used without the knowledge or approval of the IT department, posing risks. Question 33. End-user computing typically involves: A) Mainframe programming
Answer: B Explanation: Incident management aims to restore services quickly to minimize business impact. Question 36. Which of the following BEST describes patch management? A) Adding new hardware B) Applying fixes and updates to software to address vulnerabilities C) Training new employees D) Creating new databases Answer: B Explanation: Patch management involves applying updates to software to fix vulnerabilities and improve functionality. Question 37. Operational log management is important because it: A) Increases system speed B) Provides evidence for troubleshooting, auditing, and compliance C) Reduces hardware costs D) Eliminates the need for backups Answer: B Explanation: Operational logs record system events and are essential for troubleshooting, auditing, and demonstrating compliance.
Question 38. Which is the PRIMARY objective of IT service level management? A) Assigning IT roles B) Monitoring and managing service performance to meet agreed levels C) Increasing hardware inventory D) Developing new software Answer: B Explanation: IT service level management monitors and manages the quality of IT services to meet agreed-upon standards. Question 39. What is a key function of a database management system (DBMS)? A) Sending emails B) Managing data storage, retrieval, and security C) Creating network diagrams D) Designing web pages Answer: B Explanation: A DBMS is software that manages data storage, retrieval, and security in databases. Question 40. The MAIN purpose of a Business Impact Analysis (BIA) is to: A) Document IT policies B) Identify critical business functions and the impact of disruptions C) Train staff
Explanation: DRPs detail steps to restore IT services following a major incident or disaster. Question 43. Which standard is commonly used as a framework for information security management? A) ISO 9001 B) ISO 27001 C) PCI DSS D) COBIT Answer: B Explanation: ISO 27001 provides a framework for establishing, implementing, and maintaining information security management systems. Question 44. Which of the following is a privacy regulation? A) SOX B) PCI DSS C) HIPAA D) ITIL Answer: C Explanation: HIPAA is a U.S. regulation that protects the privacy and security of health information.
Question 45. Physical access controls are MOST effective when they: A) Are used alone B) Are combined with logical and environmental controls C) Are documented but not enforced D) Limit only employees Answer: B Explanation: Physical access controls are most effective when combined with logical and environmental controls for layered security. Question 46. Which of the following is an example of an identity management control? A) Firewall B) Single sign-on (SSO) C) Antivirus software D) File backup Answer: B Explanation: SSO is an identity management control that simplifies and secures user authentication across systems. Question 47. The PRIMARY purpose of data classification is to: A) Reduce storage requirements B) Ensure appropriate controls are applied based on data sensitivity
