Free CISA Practice Test Questions 2026

A configuration management audit identified that predefined automated procedures are used when deploying
and configuring application infrastructure in a cloud-based environment. Which of the following is MOST
important for the IS auditor to review?

A.

Contracts of vendors responsible for maintaining provisioning tools

B.

Processes for making changes to cloud environment specifications

C.

Storage location of configuration management documentation

D.

Number of administrators with access to cloud management consoles

Which of the following is the GREATEST risk of using a reciprocal site for disaster recovery?

A.

Mismatched organizational security policies

B.

Equipment compatibility issues at the site

C.

Inability to test the recovery plans onsite

D.

Inability to utilize the site when required

What should an IS auditor review FIRST when assessing the results of a recent penetration test to identify potential vulnerabilities?

A.

Number of critical issues found

B.

Skill level of the network support staff

C.

Incident response process

D.

Parameters of the test

The BEST access strategy while configuring a firewall would be to:

A.

permit access to all and log the activity.

B.

deny access to all except authorized programs.

C.

deny access to all but permit selected.

D.

permit access to all but deny selected.

An organization uses electronic funds transfer (EFT) to pay its vendors. Which of the following should be an
IS auditor s MAIN focus while reviewing controls in the accounts payable Application?

A.

Amount of disbursements

B.

Volume of transactions

C.

Changes to the vendor master file

D.

Frequency of transactions

The CIO of an organization is concerned that the information security policies may not be comprehensive.
Which of the following should an IS auditor recommend be performed FIRST?

A.

Determine if there is j process to handle exceptions to the policies

B.

Establish a governance board to track compliance with the policies

C.

Obtain a copy of their competitor's policies

D.

Compare the policies against an industry framework.

Which of the following is the MOST important difference between end-user computing (EUC) applications and traditional applications?

A.

Traditional application documentation is typically less comprehensive than EUC application
documentation.

B.

Traditional applications require roll-back procedures whereas EUC applications do not.

C.

Traditional applications require periodic patching whereas EUC applications do not.

D.

Traditional application input controls are typically more robust than EUC application input controls.

Which of the following is the MOST important step in the development of an effective IT governance action plan?

A.

Setting up an IT governance framework for the process

B.

Conducting a business impact analysis (BIA)

C.

Measuring IT governance key performance indicators (KPIs)

D.

Preparing a statement of sensitivity

An IS auditor suspects an organization's computer may have been used to commit a crime. Which of the
following is the auditor s BEST course of
action?

A.

Examine the computer to search for evidence supporting the suspicions.

B.

Notify local law enforcement of the potential crime before further investigation.

C.

Advise management of the crime after the investigation.

D.

Contact the incident response team to conduct an investigation.

An organization outsourced its IS functions. To meet its responsibility for disaster recovery, the organization
should:

A.

delegate evaluation of disaster recovery to internal audit.

B.

delegate evaluation of disaster recovery to a third party.

C.

discontinue the maintenance of the disaster recovery plan (DRP).

D.

coordinate disaster recovery administration with the outsourcing vendor.

The MAJOR reason for replacing checks with electronic funds transfer (EFT) systems in the accounts payable
area is to:

A.

decrease the risk of unauthorized changes to payment transactions.

B.

increase the efficiency of the payment process.

C.

decrease the number of paper-based payment forms.

D.

increase organizational credibility.

Which of the following documents would be MOST useful in detecting a weakness in segregation of duties?

A.

Data flowdiagram

B.

Entity-relationship diagram

C.

Process flowchart

D.

Systems flowchart