CISA Practice Test

1. During the planning phase of an IS audit, an IS auditor discovers that a business process has never been formally risk-assessed. What should the auditor do FIRST?

• A. Perform a risk assessment of the process to determine audit scope and priority
• B. Exclude the process from the audit since no risk assessment exists
• C. Immediately report the missing risk assessment to the audit committee as a finding
• D. Ask management to sign off on the process as low risk before proceeding

2. An IS auditor is evaluating evidence gathered during fieldwork. Which characteristic of evidence is MOST important when the auditor must rely on it to support a significant audit finding?

• A. The evidence was easy and inexpensive to obtain
• B. The evidence confirms the auditor's initial expectations
• C. The evidence was provided directly by the process owner
• D. The evidence is sufficient, reliable, and relevant to the audit objective

3. An IS auditor finds that a control was operating effectively for 10 of 12 months tested, with two months showing exceptions due to a since-corrected configuration error. What is the MOST appropriate conclusion?

• A. The control can be rated fully effective because it is now corrected
• B. The control exceptions should be reported along with root cause, remediation, and residual risk during the exception period
• C. The finding should be dropped since the issue is already fixed
• D. The sample size is too small to draw any conclusion

4. Which sampling method is MOST appropriate when an IS auditor wants every item in the population to have an equal chance of selection, without bias from the auditor's judgment?

• A. Discovery sampling only
• B. Haphazard sampling
• C. Judgmental sampling
• D. Statistical (random) sampling

5. During an audit, management disagrees with a draft finding and provides additional documentation not previously available to the auditor. What is the BEST course of action?

• A. Escalate immediately to the audit committee without reviewing the documentation
• B. Ignore the new documentation since the audit fieldwork is complete
• C. Remove the finding automatically to maintain a good working relationship with management
• D. Evaluate the new evidence objectively and revise the finding if warranted before finalizing the report

6. An organization's internal audit charter grants the CISA-certified auditor authority to review all IT systems but is silent on access to third-party service providers used for payroll processing. What is the BEST way to address this gap?

• A. Assume authority extends automatically to any vendor touching company data
• B. Rely solely on the vendor's own internal audit reports without independent verification
• C. Update the audit charter or contractual right-to-audit clauses to explicitly cover third-party providers
• D. Decline to audit any process that involves a third party

7. An IS auditor is planning an engagement and must decide how much testing to perform. What primarily drives that decision?

• A. The preferences of the audited business unit
• B. The number of staff available in the audit function
• C. The size of the department's budget
• D. The assessed risk of the area under review, since audit effort is allocated where misstatement or control failure would matter most

8. An IS auditor gathers evidence through several methods on the same control. Which evidence is generally considered most reliable?

• A. Evidence the auditor obtains directly through independent observation or reperformance
• B. A written representation from the process owner
• C. A system-generated report supplied by the auditee without validation
• D. An internal procedure document describing how the control should operate

9. What distinguishes a test of control design from a test of operating effectiveness?

• A. Design testing asks whether a properly functioning control would address the risk, while effectiveness testing asks whether it actually operated as intended over the period
• B. Design testing is performed by the auditee and effectiveness testing by the auditor
• C. Design testing uses sampling and effectiveness testing uses inquiry
• D. The two are interchangeable descriptions of the same procedure

10. An auditor uses attribute sampling to test whether change approvals were obtained. What is being measured?

• A. The average time taken to approve a change
• B. The monetary value of unapproved changes
• C. The total number of changes in the population
• D. The rate of deviation from the control, expressed as a proportion of items lacking the attribute

11. An auditor discovers a control deficiency mid-engagement. What is the appropriate immediate action?

• A. Withhold the finding until the report is issued in all cases
• B. Correct the deficiency personally to demonstrate the remediation
• C. Document the condition, criteria, cause and effect, and communicate significant matters to management on a timely basis rather than only in the final report
• D. Expand the engagement scope to every adjacent system

12. An internal audit function reports administratively to the chief information officer and functionally to the audit committee. Why does the functional reporting line matter?

• A. Because independence requires that audit conclusions and resourcing are not controlled by the management whose activities are audited
• B. Because administrative reporting is prohibited
• C. Because the audit committee performs the fieldwork
• D. Because the audit committee approves individual audit test steps

13. An auditor is asked to review a system they helped configure two years ago. What is the concern?

• A. There is no concern once two years have passed
• B. The concern applies only to external auditors
• C. The prior involvement makes the auditor the best-qualified reviewer
• D. Self-review impairs objectivity, so the assignment should be reallocated or the impairment disclosed and mitigated

14. An organization uses continuous auditing techniques. What capability does this add?

• A. Automated testing of transactions or configurations as they occur, shortening the interval between a control failure and its detection
• B. Elimination of the need for an annual audit plan
• C. A guarantee that no control failures occur
• D. Replacement of management's own monitoring responsibilities

15. An auditor is asked to provide an opinion where testing was limited because records were unavailable. What is the appropriate reporting treatment?

• A. Disclose the scope limitation and its effect on the conclusion rather than issuing an unqualified opinion
• B. Issue an unqualified opinion based on the testing that was possible
• C. Omit the affected area from the report without comment
• D. Delay the report indefinitely until records appear

16. An auditor uses computer-assisted audit techniques to test an entire population rather than a sample. What is the primary benefit?

• A. Management review of the results becomes unnecessary
• B. The need to understand the control is removed
• C. Sampling risk is eliminated for that test, since every item is examined rather than an inference drawn from a subset
• D. The reliability of the source data no longer matters

17. Management proposes a remediation action for an audit finding. What should the auditor evaluate before accepting it?

• A. Whether the action addresses the root cause rather than the symptom, and whether the owner and target date are specific enough to be followed up
• B. Whether the action is the least expensive option available
• C. Whether the action was proposed by senior rather than junior management
• D. Whether the action can be completed before the report is issued

18. While planning an IS audit of a payment-processing application, an IS auditor must decide which potential control weaknesses would be significant enough to warrant reporting to senior management if confirmed. Which audit concept PRIMARILY guides this determination?

• A. Materiality, because it defines the threshold at which a weakness or error becomes significant to stakeholders
• B. Inherent risk, because it reflects the susceptibility of the process to error before controls are considered
• C. Detection risk, because it reflects the chance that audit procedures fail to identify an existing error
• D. Sampling risk, because it measures the chance that the sample is not representative of the population

19. An IS auditor wants to estimate the total monetary value of errors in a population of automatically generated customer invoices. Which sampling approach is MOST appropriate for this objective?

• A. Attribute sampling, because it measures the rate of deviation from a prescribed control
• B. Variable sampling, because it estimates the monetary amount or quantitative value of a population characteristic
• C. Judgmental sampling, because the auditor can focus on the invoices most likely to contain errors
• D. Discovery sampling, because it is designed to find at least one example of a rare event

20. An audit manager reviews a completed IS audit file and finds procedures, evidence obtained, and conclusions recorded for each objective. What is the PRIMARY purpose served by this audit documentation?

• A. To satisfy the auditee that the audit was conducted with minimal disruption to operations
• B. To transfer ownership of identified control weaknesses from management to the audit function
• C. To eliminate the need for an exit meeting by making all findings self-explanatory
• D. To provide a defensible record that supports the audit conclusions and enables supervisory review of the work performed

21. During fieldwork, the operations manager verbally assures an IS auditor that failed overnight batch jobs are always remediated the same day. Before relying on this assertion to close the audit objective, what should the auditor do?

• A. Corroborate the assertion with independent evidence such as job logs and incident records
• B. Include the assertion in the report as a management representation requiring no further work
• C. Accept the assertion because it was provided by the manager accountable for the process
• D. Escalate the matter to the audit committee as an unsupported management claim

22. A prior-year audit reported that database administrators shared a single privileged login. During the follow-up review, management states that the issue has been fully remediated. What should the IS auditor do NEXT?

• A. Close the finding, because management has formally confirmed remediation
• B. Reopen the entire prior audit to revalidate all of its original findings
• C. Perform testing to verify that individual accounts are now in use and the shared login is disabled
• D. Downgrade the finding's risk rating to reflect management's attention to the issue

23. An audit director is building the annual IS audit plan and must choose which auditable areas to cover with limited resources. Which factor should MOST influence the prioritization?

• A. The preferences expressed by the managers of each business unit
• B. The length of time since each area was last audited
• C. The availability of auditors with prior experience in each area
• D. The relative risk each area poses to the organization's objectives

24. An IS auditor concludes that the IT general controls supporting a financial reporting application are poorly designed and unreliable. How should this conclusion affect the remainder of the audit approach?

• A. Discontinue the audit until management redesigns the control environment
• B. Reduce total testing, because weak controls make further procedures unlikely to change the conclusion
• C. Rely on analytical procedures alone, since detailed testing would duplicate the control weaknesses
• D. Increase substantive testing of the data and transactions, because control reliance is not justified

25. For a given audit area, the IS auditor assesses both inherent risk and control risk as high. To keep overall audit risk at an acceptable level, what must the auditor do?

• A. Accept a higher overall audit risk, since inherent and control risk are outside the auditor's influence
• B. Reassess inherent risk downward to offset the elevated control risk
• C. Lower detection risk by performing more extensive and more reliable audit procedures
• D. Transfer the engagement to an external audit firm with greater resources

26. An IS auditor lacks the specialized knowledge needed to evaluate a complex actuarial model and engages an external expert to assess it. Which statement BEST describes the auditor's remaining responsibility?

• A. The auditor remains responsible for the audit conclusions and must assess the expert's competence, objectivity, and the reasonableness of the work
• B. Responsibility for that portion of the audit transfers to the expert once the engagement letter is signed
• C. The auditor must disclaim any opinion on areas where expert work was used
• D. The auditor may rely on the expert only if the expert is employed by the same firm

27. An IS auditor wants ongoing assurance that a live claims-processing system handles transactions correctly, and arranges for fictitious transactions belonging to a dummy business unit to flow through production processing alongside real data. Which technique is being used?

• A. Integrated test facility, which processes fictitious entities' transactions within the production system
• B. Test data method, which runs prepared transactions through a copy of the application
• C. Snapshot technique, which captures transaction images at defined processing points
• D. Parallel simulation, which reprocesses real data through auditor-controlled software

28. An IS auditor needs to identify potential duplicate vendor payments across an entire year of accounts payable transactions held in a large database. Which approach is MOST efficient and effective?

• A. Review the application's user manual to confirm a duplicate-check feature exists
• B. Use generalized audit software to analyze the full population for matching invoice numbers, amounts, and vendors
• C. Interview accounts payable staff about their procedures for preventing duplicates
• D. Select a random sample of payments and manually trace each to supporting invoices

29. At the conclusion of fieldwork, the IS audit team schedules a closing meeting with auditee management before the report is issued. What is the PRIMARY purpose of this meeting?

• A. To obtain management's signature accepting responsibility for all identified risks
• B. To confirm the factual accuracy of findings and give management an opportunity to respond
• C. To negotiate which findings will be removed from the final report
• D. To assign remediation deadlines that the audit function will enforce

30. A draft audit finding states that quarterly user access reviews were not performed for a core banking application, but the finding does not describe what could happen as a result. Which element of a well-structured finding is missing?

• A. The criteria, which state what should have occurred
• B. The condition, which states what was actually observed
• C. The cause, which explains why the deviation happened
• D. The effect, which explains the risk or consequence of the deviation

31. Based on a sample of change tickets, an IS auditor concluded that a change-approval control was operating effectively. Later, full-population analysis showed the control actually failed frequently. Assuming the sampled items were evaluated correctly, which risk materialized?

• A. Inherent risk, because the process was naturally prone to failure
• B. Non-sampling risk, because the auditor misapplied the audit procedure
• C. Fraud risk, because the exceptions were deliberately concealed from the auditor
• D. Sampling risk, because the sample drawn was not representative of the population

32. To demonstrate that a reconciliation control operates daily, management gives the IS auditor a report generated from the application by the same team that performs the control. Applying professional skepticism, what should the auditor do before using this report as evidence?

• A. Accept the report because system-generated output is inherently reliable
• B. Evaluate the integrity of the report by verifying its source, parameters, and completeness
• C. Ask the team to certify the report's accuracy in writing before relying on it
• D. Reject the report outright because it originates from the auditee

33. A newly appointed audit committee member asks whether the upcoming IS audit will guarantee that no material control failures exist in the environment being reviewed. Which response BEST reflects professional audit standards?

• A. An audit provides reasonable assurance, not absolute assurance, due to factors such as sampling and the nature of evidence
• B. An audit guarantees detection of all material failures if the budget is sufficient
• C. An audit provides no assurance; it only documents processes as they exist
• D. An audit's assurance level depends entirely on whether management cooperates

34. Management asks the IS audit function to help strengthen access controls for a new system that the function expects to audit next year. Which arrangement BEST preserves audit independence?

• A. Auditors advise on control objectives and good practice, while management designs, implements, and owns the controls
• B. Auditors implement the access rules themselves to guarantee they meet audit expectations
• C. Auditors take temporary operational responsibility for the system until the first audit is finished
• D. Auditors decline any contact with the project until it is complete

35. An IT steering committee is reviewing whether a proposed enterprise system project aligns with the organization's strategic objectives. This activity is a core function of which governance concept?

• A. Configuration management
• B. Change management
• C. IT governance and strategic alignment
• D. IT service level management

36. A company's IT risk register lists a risk as 'high likelihood, high impact' but no owner or treatment plan is assigned. From a governance perspective, what is the MOST significant concern?

• A. The risk register format does not use a heat map
• B. Without an assigned owner and treatment plan, accountability for managing the risk to an acceptable level is unclear
• C. The risk should be removed from the register since it lacks an owner
• D. High likelihood and high impact risks cannot coexist in a valid register

37. Which of the following BEST describes the purpose of segregation of duties (SoD) within an IT organization's governance structure?

• A. To eliminate the need for management review of transactions
• B. To reduce the number of employees required to run IT operations
• C. To ensure no single individual can both perform and conceal an error or irregularity through incompatible functions
• D. To guarantee compliance with all software licensing agreements

38. An organization outsources its data center operations. Under an effective IT governance framework, which statement about accountability is MOST accurate?

• A. Accountability for the outsourced function transfers entirely to the service provider
• B. The organization retains ultimate accountability for outcomes even though operational responsibility is delegated to the provider
• C. No governance oversight is needed once a contract is signed
• D. Accountability is shared equally and cannot be defined further

39. A CIO wants to measure whether IT investments are delivering expected business value. Which approach BEST supports this governance objective?

• A. Tracking IT spend against budget only
• B. Establishing a benefits realization framework with defined metrics tied to business objectives
• C. Counting the number of IT projects completed each year
• D. Relying on vendor satisfaction surveys

40. An organization wants to evaluate IT performance from multiple perspectives, including financial return, internal process efficiency, customer satisfaction, and organizational learning, rather than relying on financial metrics alone. Which management tool is BEST suited to this objective?

• A. A balanced scorecard incorporating multiple performance perspectives
• B. A single return-on-investment calculation for the IT department
• C. A capability maturity model assessment of IT processes
• D. An annual IT budget variance report

41. A software delivery organization distinguishes between activities that build quality into its development process and activities that inspect deliverables for defects before release. Which pairing correctly labels these two sets of activities?

• A. Quality control for process design; quality assurance for defect inspection
• B. Both are quality assurance; quality control applies only to manufacturing
• C. Quality assurance for process-focused prevention; quality control for product-focused detection
• D. Both are quality control; quality assurance is a governance-board activity only

42. An organization is acquiring a smaller competitor and plans to integrate its systems within a year. From an IT governance perspective, what should due diligence PRIMARILY assess before the deal closes?

• A. Whether the target's staff prefer the acquirer's collaboration tools
• B. The target's IT risks, including security posture, licensing obligations, and integration compatibility
• C. Whether the acquirer's data center has spare rack space for the target's servers
• D. Whether the target's brand colors can be applied to the acquirer's intranet

43. A financial services firm requires employees in sensitive treasury-system roles to take an uninterrupted two-week vacation each year, during which their duties are performed by others. What is the PRIMARY control rationale for this requirement?

• A. It reduces payroll costs by spreading work across more employees
• B. It allows managers to evaluate whether the role can be eliminated
• C. It ensures compliance with occupational health regulations on rest periods
• D. It increases the chance that concealed irregularities or fraud will surface while another person performs the duties

44. An organization is negotiating a service level agreement with a cloud provider for a business-critical application. Which SLA characteristic MOST enables effective ongoing governance of the provider's performance?

• A. A statement that the provider will use its best efforts to maintain availability
• B. A commitment to industry-leading service expressed in the marketing schedule
• C. Objectively measurable service targets with regular performance reporting and defined remedies for misses
• D. A clause allowing the customer to terminate for convenience at any time

45. An IT governance framework assigns decision rights for technology investment. Who should hold ultimate accountability?

• A. The IT department, which understands the technology
• B. The external service provider delivering the systems
• C. The internal audit function
• D. The board and executive management, since IT investment allocates enterprise resources against enterprise objectives

46. An enterprise architecture is maintained and kept current. What audit-relevant benefit does it provide?

• A. A documented view of systems, data flows and dependencies that supports impact analysis, scoping and identification of single points of failure
• B. A guarantee that all systems are patched
• C. Automatic compliance with data protection regulation
• D. Elimination of the need for a business impact analysis

47. An organization outsources application hosting to a third party. Where does accountability for the controls reside?

• A. With the regulator that approved the arrangement
• B. Accountability is shared equally regardless of the contract
• C. With the organization, which can delegate the activity but not the accountability, and must obtain assurance over the provider's controls
• D. With the provider, which assumes full accountability under the contract

48. An auditor reviews a third-party assurance report covering a service provider. What must be checked beyond the opinion?

• A. Whether the report's scope, period and control objectives cover the services relied upon, and how complementary user entity controls are addressed
• B. Only whether the opinion is unqualified
• C. Only the identity of the reporting auditor
• D. Only the report's issue date

49. Management accepts a risk that exceeds the organization's stated appetite. What should the auditor do?

• A. Remove the finding, since management has accepted the risk
• B. Report the matter externally to the regulator immediately
• C. Override the decision and require remediation
• D. Confirm the acceptance was made at an appropriate authority level and documented, and escalate to the audit committee if the residual risk remains unacceptable

50. An organization defines key performance indicators and key risk indicators for IT. What is the distinction?

• A. The two are the same metrics reported to different audiences
• B. Performance indicators measure achievement of objectives, while risk indicators are forward-looking signals that exposure is rising
• C. Risk indicators measure past performance and performance indicators predict the future
• D. Risk indicators apply only to financial risk

51. An organization's control self-assessment programme is in place. How does it relate to internal audit's work?

• A. It engages process owners in evaluating their own controls, and internal audit may rely on it only after validating its quality and objectivity
• B. It is performed by internal audit on behalf of process owners
• C. It has no relationship to the audit plan
• D. It replaces the need for internal audit testing entirely

52. An auditor finds that a critical vendor has no documented exit plan. Why is this a governance concern?

• A. Because concentration in a provider without a transition path leaves the organization unable to exit on acceptable terms if service or the relationship deteriorates
• B. Because it prevents the vendor from being paid
• C. Because it invalidates the vendor's assurance report
• D. Because exit plans are required by all data protection regulation

53. An organization measures IT value delivery. What does an auditor look for beyond project delivery metrics?

• A. Whether the project team was the largest available
• B. Whether the project used the most current technology available
• C. Whether the project finished under budget regardless of scope
• D. Whether expected benefits were defined, tracked and realized after implementation, since on-time delivery of an unused system creates no value

54. An IS auditor evaluating an organization's control environment wants to identify the single strongest influence on whether employees take internal controls seriously. Which factor should the auditor examine?

• A. The frequency of disciplinary actions recorded by human resources
• B. The number of control-related policies published on the intranet
• C. The demonstrated commitment of senior leadership to ethical conduct and control compliance
• D. The sophistication of the automated monitoring tools in use

55. An IT steering committee is documented as responsible for approving major technology investments, but in practice the CIO regularly approves large projects unilaterally without committee review. From a governance perspective, what is the MOST significant concern?

• A. The steering committee meets too infrequently to be useful
• B. The CIO lacks sufficient technical expertise to approve projects alone
• C. Decision rights defined in governance documentation are not being followed in practice
• D. Technology investment decisions are being made too quickly for the organization's needs

56. An organization wants to translate its IT strategy into measurable objectives spanning financial results, customer satisfaction, internal process quality, and staff learning and growth. Which management tool is designed for this purpose?

• A. A capability maturity assessment of IT processes
• B. A total cost of ownership analysis for the IT portfolio
• C. A heat map of the IT risk register
• D. An IT balanced scorecard linking strategy to metrics across multiple perspectives

57. A board formally states the overall level and types of risk the organization is willing to accept in pursuit of its strategy, while operating management defines acceptable variation around specific performance targets. Which terms describe these two concepts, respectively?

• A. Risk capacity and risk appetite
• B. Risk tolerance and residual risk
• C. Risk appetite and risk tolerance
• D. Residual risk and inherent risk

58. An IS auditor reviews a corporate document that mandates minimum password length and complexity settings that every system must enforce. In a well-structured documentation hierarchy, what type of document is this?

• A. A policy, because it states management's high-level intent for security
• B. A guideline, because it suggests recommended practices for administrators
• C. A standard, because it specifies mandatory settings that implement policy intent
• D. A procedure, because it lists steps for configuring authentication

59. Several proposed IT initiatives compete for a limited investment budget, and executives disagree about which to fund. Which governance mechanism BEST supports a defensible selection decision?

• A. Letting the infrastructure team select initiatives based on technical elegance
• B. Portfolio management that evaluates initiatives on value, risk, and strategic alignment using consistent criteria
• C. Allocating the budget proportionally to each department's headcount
• D. Funding initiatives in the order their business cases were submitted

60. A marketing analyst requests read access to a customer data set maintained on a shared platform. Under a sound data governance model, who should APPROVE this access request?

• A. The database administrator, because they can technically grant the access
• B. The requesting analyst's direct manager, because they know the analyst's duties
• C. The data owner, because they are accountable for how the data is used and by whom
• D. The IT help desk, because access requests flow through its ticketing system

61. An organization has run a mandatory annual security-awareness course for three years. Which measure would give management the BEST evidence that the program is actually changing employee behavior?

• A. Course completion rates across all departments
• B. The number of hours of training content produced each year
• C. Employee satisfaction scores for the training modules
• D. A declining click rate on simulated phishing campaigns over successive tests

62. An IT organization assesses its processes against a recognized capability maturity model and receives ratings for each process area. What is the PRIMARY benefit of this exercise?

• A. It removes the need for internal audit to test those processes
• B. It identifies capability gaps and provides a roadmap for prioritized process improvement
• C. It certifies the organization as compliant with applicable regulations
• D. It guarantees that higher-rated processes contain no control failures

63. A board of directors receives cybersecurity information solely through a brief annual verbal update from the security officer, with no supporting metrics or independent validation. From a governance standpoint, what is the MOST significant concern?

• A. The update consumes valuable time on the board agenda
• B. Verbal delivery prevents the update from being translated for overseas directors
• C. The security officer may feel micromanaged by board attention
• D. The board cannot exercise informed oversight without regular, metric-based, and independently validated reporting

64. An IS auditor is reviewing a new system development project and notes that user acceptance testing (UAT) was skipped due to schedule pressure. What is the MOST significant risk of this omission?

• A. The project may be delivered slightly under budget
• B. System documentation will automatically be more accurate
• C. Business requirements may not be validated, increasing the risk the system fails to meet user needs in production
• D. The development team will need to write less code

65. During a post-implementation review, an IS auditor finds that the project's original business case benefits were never re-measured after go-live. What should the auditor recommend?

• A. No action is needed since the system is functioning technically
• B. Cancel the project retroactively
• C. Perform a benefits realization assessment comparing actual outcomes to the original business case
• D. Rewrite the business case to match whatever was delivered

66. Which system development life cycle (SDLC) phase is MOST critical for identifying and documenting security requirements to avoid costly rework later?

• A. Requirements definition
• B. Post-implementation support
• C. Decommissioning
• D. Final user training

67. An organization is migrating from a legacy system to a new ERP. Which data conversion control provides the STRONGEST assurance that all records were migrated completely and accurately?

• A. A verbal confirmation from the project manager that migration is complete
• B. Independent reconciliation of record counts and control totals between the old and new systems
• C. Reviewing the migration tool's marketing documentation
• D. Confirming the new system's user interface looks similar to the old one

68. A project team wants to select a system development methodology that allows for iterative delivery and frequent stakeholder feedback on a project with evolving requirements. Which approach is MOST appropriate?

• A. Traditional waterfall model with a single delivery at project end
• B. Agile methodology with iterative sprints and regular stakeholder review
• C. A big-bang cutover with no phased releases
• D. A methodology with no defined requirements process

69. During system development, a project manager wants to estimate the relative size and effort of a proposed application based on the number and complexity of its inputs, outputs, inquiries, and internal data structures, independent of the programming language to be used. Which estimation technique is being applied?

• A. Program evaluation and review technique
• B. Earned value management
• C. Critical path method
• D. Function point analysis

70. A project delivers a system that meets its specification but not the business need. What control weakness does this most likely indicate?

• A. Inadequate requirements definition and stakeholder involvement at the outset
• B. Insufficient unit testing during construction
• C. Weak production change management
• D. Inadequate backup procedures

71. What is the purpose of user acceptance testing in a system implementation?

• A. To verify that individual code modules function correctly
• B. To measure system performance under peak load
• C. To confirm the vendor has been paid
• D. To confirm the system meets business requirements from the user's perspective before it is accepted into production

72. An organization plans a parallel changeover from an old system to a new one. What is the principal advantage over a direct cutover?

• A. It eliminates the need for data conversion
• B. It is the least costly changeover approach
• C. It requires no user training on the new system
• D. Both systems run concurrently so results can be compared and the old system remains available as a fallback, reducing implementation risk

73. An auditor reviews a data conversion from a legacy system. What control most directly addresses conversion completeness?

• A. Retaining a backup of the legacy database
• B. Restricting access to the conversion tool
• C. Reconciliation of record counts and control totals between source and target, with documented investigation of differences
• D. Encryption of the data in transit during conversion

74. A developer requires access to the production environment to resolve an urgent defect. What compensating control is appropriate?

• A. Time-limited, approved and logged emergency access with independent review of the actions taken afterward
• B. Permanent production access for the development team
• C. Granting access without logging to avoid slowing the fix
• D. Allowing the developer to disable audit logging during the change

75. A change management process requires approval before deployment. What does an auditor test to conclude the control operated?

• A. A sample of production changes traced back to documented approval, plus a search for changes that reached production without a corresponding record
• B. Only the change management policy document
• C. Only the list of approved change requests
• D. Only the number of changes deployed in the period

76. An organization uses agile development. How does this affect the auditor's approach to controls?

• A. The control objectives remain the same while the evidence changes form, appearing in backlogs, automated pipeline gates and iteration records rather than phase-gate documents
• B. The auditor should require the organization to adopt a waterfall method
• C. Only the final release requires any control evidence
• D. Control objectives no longer apply in an agile environment

77. An IS auditor reviewing change management for a production ERP system notes that emergency changes are deployed without prior testing but are documented after the fact. What is the BEST recommendation?

• A. Allow emergency changes to bypass all documentation requirements permanently
• B. Eliminate the emergency change process entirely
• C. Require the same multi-week testing cycle for emergency changes as standard changes
• D. Require post-implementation review and retrospective approval with documented justification for each emergency change

78. An organization's business continuity plan (BCP) specifies a recovery time objective (RTO) of 4 hours for its order-processing system. What does this RTO represent?

• A. The frequency at which backups must be taken
• B. The total time allotted for annual disaster recovery testing
• C. The maximum acceptable amount of data loss measured in time
• D. The maximum acceptable time the system can be unavailable before causing unacceptable business impact

79. During a review of an organization's incident management process, an IS auditor finds that security incidents are resolved but root cause analysis is rarely performed. What is the MOST significant long-term risk?

• A. Recurring incidents from the same underlying cause, since the true source of the problem is never addressed
• B. Faster incident closure times going forward
• C. Increased helpdesk ticket volume in the short term only
• D. Improved compliance with service level agreements

80. An organization performs full backups weekly and incremental backups daily. If a server fails on a Thursday (3 days after the last full backup), what is required to fully restore data to the most recent point?

• A. Only the original full backup from initial system setup
• B. Only the most recent incremental backup
• C. No backups are needed if the system has RAID storage
• D. The last full backup plus each incremental backup taken since, applied in sequence

81. Which of the following is the PRIMARY reason organizations conduct periodic disaster recovery (DR) testing rather than relying solely on a documented DR plan?

• A. To satisfy an annual budget requirement
• B. To validate that the plan actually works in practice and to identify gaps before a real disaster occurs
• C. To reduce the need for a documented plan going forward
• D. To replace the need for offsite data backups

82. An IS auditor reviewing capacity management notes that a critical database server has consistently run at 95% CPU utilization for the past quarter with no capacity plan in place. What is the MOST significant risk?

• A. Users will need additional training on the application
• B. The server may be under warranty expiration soon
• C. Performance degradation or an outage as demand grows, potentially disrupting critical business operations
• D. The vendor may increase software licensing costs

83. A business impact analysis has been completed. What does it establish that a risk assessment does not?

• A. The criticality of each process and the maximum tolerable outage, which drive recovery objectives
• B. The likelihood of each threat occurring
• C. The technical configuration of recovery infrastructure
• D. The cost of cyber insurance premiums

84. A system has a recovery point objective of four hours and a recovery time objective of eight hours. What do these mean?

• A. Up to four hours of data may be lost, and the system must be restored to service within eight hours of the disruption
• B. The system must be restored within four hours and may lose eight hours of data
• C. Backups run every eight hours and are retained for four hours
• D. The system may be unavailable for four hours per month

85. An organization maintains a hot site for disaster recovery. What characterizes it relative to a cold site?

• A. It is an empty facility with power and connectivity only
• B. It requires no testing because it mirrors production
• C. It costs less than a cold site because it is shared
• D. It is fully equipped and current, enabling resumption within a short period, at substantially higher cost than an empty facility requiring build-out

86. A disaster recovery plan is tested using a walkthrough rather than a full interruption test. What is the limitation?

• A. It validates understanding and documentation but does not demonstrate that the technical recovery actually works under real conditions
• B. It is more disruptive than a full interruption test
• C. It cannot involve business stakeholders
• D. It provides equivalent assurance to a full test at lower cost

87. An auditor reviews backup practices and finds backups run nightly and complete successfully. What further evidence is essential?

• A. Evidence that restoration from those backups has been tested successfully, since a backup that cannot be restored provides no recovery capability
• B. The brand of backup software in use
• C. The physical size of the backup media
• D. The number of backup jobs configured

88. An organization applies capacity management to its infrastructure. What is the audit-relevant objective?

• A. Reducing the number of servers regardless of demand
• B. Ensuring resources meet current and projected demand so availability commitments are met without unnecessary expenditure
• C. Eliminating the need for performance monitoring
• D. Ensuring all systems run at maximum utilization

89. An incident and a problem are distinguished in service management. What is the difference?

• A. An incident is an unplanned interruption requiring restoration of service, while a problem is the underlying cause requiring elimination
• B. An incident is more severe than a problem by definition
• C. A problem is a customer complaint and an incident is a system fault
• D. The two terms are interchangeable

90. Which access control model grants permissions based on a user's assigned job function rather than granting permissions to each individual user directly?

• A. Role-based access control (RBAC)
• B. Mandatory access control (MAC)
• C. Discretionary access control (DAC)
• D. Rule-based routing

91. An IS auditor discovers that terminated employees' network accounts remain active for an average of 30 days after departure. What is the MOST significant risk this presents?

• A. Increased software licensing costs only
• B. Slower network performance due to unused accounts
• C. Unauthorized access to systems and data by former employees or others using their still-active credentials
• D. Increased helpdesk password reset requests

92. An auditor evaluates logical access controls. What does the principle of least privilege require?

• A. Each account holds only the access necessary for its function, and no more, for as long as it is needed
• B. Administrators require no access restrictions
• C. All users share a common access profile for consistency
• D. Access is granted broadly and revoked when misuse is detected

93. An auditor reviews user access recertification. What is the control's purpose?

• A. Periodic confirmation by an accountable owner that each user's access remains appropriate, catching accumulation from role changes and departures
• B. Confirming that the access management system is licensed
• C. Testing whether users can access systems from remote locations
• D. Verifying that users remember their passwords

94. Data is classified into sensitivity levels. What does classification primarily enable?

• A. Automatic encryption of all organizational data
• B. Proportionate application of controls, so protection effort matches the consequence of disclosure or loss
• C. Elimination of the need for access controls
• D. Compliance with all applicable regulations by itself

95. An organization encrypts data at rest in a database. What risk does this address, and what does it not?

• A. It protects against exposure of the underlying storage media or files, but not against an attacker or user operating through an authorized application session
• B. It removes the need for access controls on the database
• C. It protects data in transit across the network
• D. It protects against all forms of unauthorized data access

96. An auditor reviews the physical security of a data centre. Which control best addresses tailgating?

• A. A mantrap or interlocking door arrangement permitting one authenticated person through at a time
• B. A visitor sign-in log at reception
• C. Closed circuit television covering the entrance
• D. A door alarm sounding when held open

97. Media containing sensitive data is decommissioned. What disposal control is appropriate?

• A. Deleting the files and reformatting the drive
• B. Sanitization or destruction appropriate to the media type and data sensitivity, with documented evidence of completion
• C. Storing the media indefinitely in a locked room
• D. Returning the media to the original vendor without further action

98. An auditor examines security event logging. Beyond generating logs, what is essential?

• A. That logs are generated at the highest verbosity for all systems
• B. That logs are protected from alteration, retained for an adequate period and actually reviewed or monitored for indicators requiring action
• C. That logs are stored on the same system that generates them
• D. That log files are deleted regularly to control storage cost

99. An organization deploys multi-factor authentication. What makes an authentication scheme genuinely multi-factor?

• A. The factors come from different categories such as something known, something possessed and something inherent
• B. The password must exceed a minimum length
• C. Authentication is required at more than one system
• D. Two separate passwords are required

100. An auditor assesses a data loss prevention deployment. What limits its effectiveness?

• A. Its inability to inspect any network traffic
• B. Its incompatibility with encryption of any kind
• C. Its dependence on accurate data identification and on covering the channels actually used, since unclassified data or an uncovered channel passes unexamined
• D. The requirement that it be deployed only on servers