Free CISA Practice Test Questions 2026

Which of the following will BEST protect the confidentiality of data stored on the hard drive of a laptop
computer?

A.

Biometric access control

B.

A boot password

C.

Physical locks and alarms

D.

Encryption of the data

Which of the following would BEST provide executive management with current information on IT related
costs and IT performance indicators?

A.

Risk register

B.

IT service management plan

C.

Continuous audit reports

D.

IT dashboard

Which of the following is MOST important with regard to an application development acceptance test?

A.

The quality assurance (QA) team is in charge of the testing process.

B.

User management approves the test design before the test is started.

C.

The programming team is involved in the testing process.

D.

All data files are tested for valid information before conversion.

An IS auditor is reviewing the process followed in identifying and prioritizing the critical business processes.
This process is part of the:

A.

operations component of the business continuity plan (BCP).

B.

enterprise risk management plan.

C.

balanced scorecard.

D.

business impact analysis (BIA).

When preparing to evaluate the effectiveness of an organizations IT strategy, an IS auditor should FIRST review;

A.

the IT governance framework.

B.

the IT processes and procedures.

C.

Information security procedures.

D.

the most recent audit results.

What is the BEST indicator of successful implementation of an organization s information security policy?

A.

Reduced number of noncompliance penalties incurred

B.

Reduced number of successful phishing incidents

C.

Reduced number of help desk calls

D.

Reduced number of false-positive security events

Which combination of access controls provides the BEST physical protection for a server room?

A.

User ID and PIN

B.

PIN and smart card

C.

Card with a magnetic stop and a shared PIN

D.

Card with a magnetic strip and a smart card

During the course of an audit, an IS auditor's organizational independence is impaired. The IS auditor should
FIRST

A.

inform senior management in writing and proceed with the audit

B.

inform audit management of the situation.

C.

proceed with the audit as planned after documenting the incident.

D.

obtain the auditee s approval before continuing the audit.

A legacy application is running on an operating system that is no longer supported by vendor, if the
organization continues to use the current application, which of the application should be the IS auditor’s
GREATEST concern?

A.

Inability to use the operating system due to potential licence issues

B.

Increased cost of maintaining the system

C.

Inability to update the legacy application database

D.

Potential exploitation of zero-day vulnerabilities in the system

Which of the following would provide the MOST important input during the planning phase for an audit on
the
implementation of a bring your own device (BYOD) program?

A.

Policies including BYOD acceptable use statements

B.

Results of a risk assessment

C.

An inventory of personal devices to be connected to the corporate network

D.

Findings from prior audits

While reviewing a hot site, the IS auditor discovers that one type of hardware platform is not installed. The IS
auditor should FIRST

A.

determine the business impact of the absence of the hardware.

B.

establish the lead time for delivery of a new machine

C.

recommend the purchase and installation of hardware at the hot site

D.

report the finding immediately to senior IS management

When an organization outsources a payroll system to a cloud service provider, the IS auditor’s PRIMARY
concern should be the:

A.

service level agreement (SLA) is not reviewed annually.

B.

service provider s platform is not compatible with legacy systems.

C.

lack of independent assurance from a third party.

D.

service provider s data center is on the ground floor.