Free CISA Practice Test Questions 2026

An organization has implemented an automated match between purchase orders, goods receipts, and invoices.
Which of the following risks will this control BEST mitigate?

A.

Customer discounts not being applied

B.

Invalid payments being processed by the system

C.

Delay of purchase orders

D.

A legitimate transaction being paid multiple times

An organization using instant messaging to communicate with customers can prevent legitimate customers
from being impersonated by:

A.

using call monitoring

B.

logging conversations.

C.

authenticating users before conversations are initiated

D.

using firewalls to limit network traffic to authorized ports.

An organization wants to classify database tables according to its data classification scheme. From an IS
Auditor’s perspective, the tables should be classified based on the:

A.

number of end users with access to the table

B.

frequency of updates to the table

C.

descriptions of column names in the table

D.

specific functional contents of each single table

An IS auditor is assessing a recent migration of mission critical applications to a virtual platform. Which of the
following observations poses the GREATEST risk to the organization?

A.

The migration was not approved by the board of directors.

B.

Training for staff with new virtualization responsibilities has not been conducted.

C.

Role descriptions do not accurately reflect new virtualization responsibilities.

D.

A post-implementation review of the hypervisor has not yet been conducted.

A risk analysis is MOST useful when applied during which phase of the system development process?

A.

Pre-implementation

B.

Feasibility

C.

Design

D.

Testing

Which of the following is the GREATEST risk of cloud computing?

A.

Lack of scalability

B.

Reduced performance

C.

Disclosure of data

D.

Inflexibility

A retirement system verifies that the field for employee status has either a value of A (for active) or R (for
retired). This is an example of which type of check?

A.

Limit

B.

Completeness

C.

Existence

D.

Validity

Which of the following BEST helps to ensure data integrity across system interfaces?

A.

Environment segregation

B.

System backups

C.

Reconciliations

D.

Access controls

A transaction processing system interfaces with the general ledger. Data analytics has identified that some
transactions are being recorded twice
in the general ledger. While management states a system fix has been implemented, what should the IS auditor
recommend to validate the
interface is working in the future?

A.

Perform periodic reconciliations.

B.

Ensure system owner sign-off for the system fix.

C.

Conduct functional testing.

D.

Improve user acceptance testing (UAT).

Which of the following cloud deployment models would BEST meet the needs of a startup software
development organization with limited initial capital?

A.

Community

B.

Public

C.

Hybrid

D.

Private

Which of the following would provide the BEST assurance that an organization s backup media is adequate in
the case of a disaster?

A.

Scheduled maintenance of the backup device

B.

Scheduled read/write tests of the backup media

C.

Regular review of backup logs to ensure that all data from the production environment is included

D.

Regular recovery of production systems in a test environment

Which of the following would BEST facilitate the successful implementation of an [T-related framework?

A.

Involving appropriate business representation within the framework

B.

Documenting IT-related policies and procedures

C.

Aligning the framework to industry best practices

D.

Establishing committees to support and oversee framework activities