Free CISA Practice Test Questions 2026

An IS auditor finds that corporate mobile devices used by employees have varying levels of password settings.
Which of the following would be the BEST recommendation?

A.

Update the acceptable use policy for mobile devices.

B.

Encrypt data between corporate gateway and devices.

C.

Notify employees to set passwords to a specified length

D.

Apply security policy to the mobile devices.

An organization using instant messaging to communicate with customers prevent legitimate customers from
being impersonated by:

A.

Authentication users before conversation are initiated.

B.

Using firewall to limit network traffic to authorized ports.

C.

Logging conversation.

D.

Using call monitoring.

Which of the following is MOST likely to be spoofed in an email transmission?

A.

The path the message traveled through the Internet

B.

The identity of the sending host

C.

The identity of the receiving host

D.

The identity of the sender

To restore service at a large processing facility after a disaster, which of the following tasks should be
performed FIRST?

A.

Contact equipment vendors.

B.

Activate the reciprocal agreement.

C.

Launch the emergency action team.

D.

Inform insurance company agents.

While performing a risk-based audit, which of the following would BEST enable an IS auditor to identify and
category risk?

A.

Understanding the business environment

B.

Understanding the control framework

C.

Adopting qualitative risk analysis

D.

Developing a comprehensive risk model

During the implementation of an upgraded enterprise resource planning (ERP) system, which of the following
is the MOST important consideration foe a go-live decision?

A.

Post-implementation review objectives

B.

Test cases

C.

Rollback strategy

D.

Business case

What is the PRIMARY advantage of prototyping as part of systems development?

A.

Maximizes user satisfaction

B.

Reduces the need for compliance testing

C.

Eliminates the need for internal controls

D.

Increases accuracy in reporting

A start-up company acquiring for its order-taking system is unable to predict the volume of transactions.
Which of the following is MOST important for the company to consider?

A.

Configuration

B.

Optimization

C.

Compatibility

D.

Scalability

During the evaluation of a firm's newly established whistleblower system, an auditor notes several findings.
Which of the following should be the
auditor's GREATEST concern?

A.

The whistleblower system is only available during business hours.

B.

New employees have not been informed of the whistleblower policy.

C.

The whistleblower system does not track the time and date of submission.

D.

The whistleblower's privacy is not protected.

Which of the following is the safest means of transmitting confidential information over the Internet?

A.

Establish a virtual private network (VPN) between the source and the destination.

B.

Use asymmetric encryption and encrypt the data with a private key.

C.

Send the data to a trusted third party to resend to the destination.

D.

Break the data into many packets and send it over different routes.

An IS auditor is assigned to review the IS department’s quality procedures. Upon contacting the IS manager,
the auditor finds that there is an informal unwritten set of standards. Which of the following should be the
auditor’s NEXT action?

A.

Finalize the audit and report the finding.

B.

Make recommendations to IS management as to appropriate quality standards.

C.

Postpone the audit until IS management implements written standards.

D.

Document and test compliance with the informal standards.

Which of the following is the BEST approach to verify that internal help desk procedures are executed in
compliance with policies?

A.

Test a sample of closed tickets.

B.

Benchmark help desk procedures.

C.

Evaluate help desk call metrics.

D.

Interview end users