Free ISACA CISA practice questions

Sample question 1. Which of the following does SP 800-53 IR-3 list as a way to test incident response capability?

1. An annual financial statement audit.
2. Walk-through or tabletop exercises.
3. A staff satisfaction survey about the service desk.
4. A weekly vulnerability scan of the internet-facing servers in the DMZ.

Sample question 2. An IS auditor tests the 15 largest wire transfers of the year for dual approval and finds all approved. The auditor then concludes that all 40,000 transfers were approved. What is wrong with this conclusion?

1. Fifteen items is below the minimum sample size of 25 for any conclusion.
2. Testing chosen items is not sampling, so the result cannot be projected.
3. Large transfers are routinely approved, so they are the least informative items to test.
4. Wire transfers cannot be tested by selection and need 100 percent examination.

Sample question 3. The IT leadership team plans a data center consolidation, builds the migration, runs the new environment and tracks its performance, all within direction set by the board. Which term describes these activities?

1. Management.
2. Assurance, because performance is being tracked against targets by the team.
3. Governance, because they concern the whole enterprise’s technology estate.
4. Compliance, since consolidation must follow the regulator’s outsourcing rules for data centers.