CISA Certification Practice Test

1. What is the primary purpose of an IT audit?

To ensure IT systems are efficient and cost-effective

To evaluate IT governance, risk management, and control effectiveness

To replace IT management functions

To identify all software vulnerabilities in an organization

2. Which framework provides guidance for IT governance and management?

ITIL and COBIT

ISO 27001 only

NIST Cybersecurity Framework only

SOC 2 Type II

3. In the context of CISA, what does 'risk' primarily refer to?

The cost of implementing security controls

The probability and impact of a threat exploiting a vulnerability

The time required to recover from a disaster

The number of IT staff required

4. Which of the following is a key responsibility of an IS auditor?

Implementing all security controls

Assessing the effectiveness of internal controls and compliance

Managing IT operations daily

Replacing IT infrastructure

5. What is the purpose of segregation of duties in IT environments?

To reduce staffing costs

To prevent one person from controlling all phases of a critical transaction

To improve system performance

To eliminate the need for access controls

6. Which type of audit examines IT systems during normal operations?

Penetration testing

Operational audit

Forensic audit

Post-implementation review

7. What does COBIT primarily address?

Network security protocols

IT governance and management frameworks

Database encryption standards

Cloud storage solutions

8. True or False: An IS auditor should always implement the controls they recommend.

True

False

9. Which of the following is a detective control?

User access provisioning

System log monitoring and review

Firewall configuration

Password policy enforcement

10. What is the primary goal of business continuity planning?

To eliminate all IT risks

To ensure critical business functions can resume after a disruption

To reduce IT budgets

To replace all legacy systems

11. In risk management, what does 'residual risk' refer to?

Risk that existed before controls were implemented

Risk remaining after control implementation

Risk that cannot be quantified

Risk accepted by executive management

12. True or False: Data classification is a foundational element of information security governance.

True

False

13. Which standard provides requirements for information security management systems?

ISO 27001

ITIL v4

COSO Internal Control Framework

NIST SP 800-53

14. What is the primary focus of application controls?

Protecting the physical data center

Ensuring data accuracy, completeness, and validity within applications

Managing IT personnel access

Reducing software licensing costs

15. True or False: An IS auditor can provide assurance on the effectiveness of IT controls without understanding business objectives.

True

False

CISA Certification Practice Test

1. What is the primary purpose of an IT audit?

2.

What first name or nickname would you like us to use?

2. Which framework provides guidance for IT governance and management?

3. In the context of CISA, what does 'risk' primarily refer to?

4. Which of the following is a key responsibility of an IS auditor?

5. What is the purpose of segregation of duties in IT environments?

6. Which type of audit examines IT systems during normal operations?

7. What does COBIT primarily address?

8. True or False: An IS auditor should always implement the controls they recommend.

9. Which of the following is a detective control?

10. What is the primary goal of business continuity planning?

11. In risk management, what does 'residual risk' refer to?

12. True or False: Data classification is a foundational element of information security governance.

13. Which standard provides requirements for information security management systems?

14. What is the primary focus of application controls?

15. True or False: An IS auditor can provide assurance on the effectiveness of IT controls without understanding business objectives.