CISA CORE EXAM 2026 TEST QUESTIONS AND ANSWERS
GRADED A+
✔✔Which of the following is responsible for the approval of an information security
policy?
Select an answer:
A.
The IT department
B.
The security committee
C.
The security administrator
D.
The board of directors - ✔✔You are correct, the answer is D.
A. The IT department is responsible for the execution of the policy, having no authority
in framing the policy.
B. The security committee also functions within the broad security policy framed by the
board of directors.
C. The security administrator is responsible for implementing, monitoring and enforcing
the security rules that management has established and authorized.
D. Normally, the approval of an information systems security policy is the responsibility
of top management or the board of directors.
✔✔Which of the following should be included in an organization's information security
policy?
Select an answer:
A.
A list of key IT resources to be secured
B.
The basis for access control authorization
C.
Identity of sensitive security assets
D.
Relevant software security features - ✔✔You are correct, the answer is B.
,A. A list of key IT resources to be secured is more detailed than that which should be
included in a policy.
B. The security policy provides the broad framework of security as laid down and
approved by senior management. It includes a definition of those authorized to grant
access and the basis for granting the access.
C. The identity of sensitive security assets is more detailed than that which should be
included in a policy.
D. A list of the relevant software security features is more detailed than that which
should be included in a policy.
✔✔Which of the following is the initial step in creating a firewall policy?
Select an answer:
A.
A cost-benefit analysis of methods for securing the applications
B.
Identification of network applications to be externally accessed
C.
Identification of vulnerabilities associated with network applications to be externally
accessed
D.
Creation of an application traffic matrix showing protection methods - ✔✔You are
correct, the answer is B.
A. Identifying methods to protect against identified vulnerabilities and their comparative
cost-benefit analysis is the third step.
B. Identification of the applications required across the network should be identified first.
After identification, depending on the physical location of these applications in the
network and the network model, the person in charge will be able to understand the
need for, and possible methods of, controlling access to these applications.
C. Having identified the externally accessed applications, the second step is to identify
vulnerabilities (weaknesses) associated with the network applications.
D. The fourth step is to analyze the application traffic and create a matrix showing how
each type of traffic will be protected.
, ✔✔Which of the following is MOST critical for the successful implementation and
maintenance of a security policy?
Select an answer:
A.
Assimilation of the framework and intent of a written security policy by all appropriate
parties
B.
Management support and approval for the implementation and maintenance of a
security policy
C.
Enforcement of security rules by providing punitive actions for any violation of security
rules
D.
Stringent implementation, monitoring and enforcing of rules by the security officer
through access control software - ✔✔You answered B. The correct answer is A.
A. Assimilation of the framework and intent of a written security policy by all levels of
management and users of the system is critical to the successful implementation and
maintenance of the security policy. If a policy is not assimilated into daily actions, it will
not be effective.
B. Management support and commitment is, no doubt, important, but for successful
implementation and maintenance of a security policy, educating the users on the
importance of security is paramount.
C. Punitive actions are needed to enforce the policy but are not the key to successful
implementation.
D. The stringent implementation, monitoring and enforcing of rules by the security
officer through access control software, and provision for punitive actions for violation of
security rules is important, but it is dependent on the support and education of
management and users on the importance of security.
✔✔A comprehensive and effective email policy should address the issues of email
structure, policy enforcement, monitoring and:
Select an answer:
A.
recovery.
B.
retention.
GRADED A+
✔✔Which of the following is responsible for the approval of an information security
policy?
Select an answer:
A.
The IT department
B.
The security committee
C.
The security administrator
D.
The board of directors - ✔✔You are correct, the answer is D.
A. The IT department is responsible for the execution of the policy, having no authority
in framing the policy.
B. The security committee also functions within the broad security policy framed by the
board of directors.
C. The security administrator is responsible for implementing, monitoring and enforcing
the security rules that management has established and authorized.
D. Normally, the approval of an information systems security policy is the responsibility
of top management or the board of directors.
✔✔Which of the following should be included in an organization's information security
policy?
Select an answer:
A.
A list of key IT resources to be secured
B.
The basis for access control authorization
C.
Identity of sensitive security assets
D.
Relevant software security features - ✔✔You are correct, the answer is B.
,A. A list of key IT resources to be secured is more detailed than that which should be
included in a policy.
B. The security policy provides the broad framework of security as laid down and
approved by senior management. It includes a definition of those authorized to grant
access and the basis for granting the access.
C. The identity of sensitive security assets is more detailed than that which should be
included in a policy.
D. A list of the relevant software security features is more detailed than that which
should be included in a policy.
✔✔Which of the following is the initial step in creating a firewall policy?
Select an answer:
A.
A cost-benefit analysis of methods for securing the applications
B.
Identification of network applications to be externally accessed
C.
Identification of vulnerabilities associated with network applications to be externally
accessed
D.
Creation of an application traffic matrix showing protection methods - ✔✔You are
correct, the answer is B.
A. Identifying methods to protect against identified vulnerabilities and their comparative
cost-benefit analysis is the third step.
B. Identification of the applications required across the network should be identified first.
After identification, depending on the physical location of these applications in the
network and the network model, the person in charge will be able to understand the
need for, and possible methods of, controlling access to these applications.
C. Having identified the externally accessed applications, the second step is to identify
vulnerabilities (weaknesses) associated with the network applications.
D. The fourth step is to analyze the application traffic and create a matrix showing how
each type of traffic will be protected.
, ✔✔Which of the following is MOST critical for the successful implementation and
maintenance of a security policy?
Select an answer:
A.
Assimilation of the framework and intent of a written security policy by all appropriate
parties
B.
Management support and approval for the implementation and maintenance of a
security policy
C.
Enforcement of security rules by providing punitive actions for any violation of security
rules
D.
Stringent implementation, monitoring and enforcing of rules by the security officer
through access control software - ✔✔You answered B. The correct answer is A.
A. Assimilation of the framework and intent of a written security policy by all levels of
management and users of the system is critical to the successful implementation and
maintenance of the security policy. If a policy is not assimilated into daily actions, it will
not be effective.
B. Management support and commitment is, no doubt, important, but for successful
implementation and maintenance of a security policy, educating the users on the
importance of security is paramount.
C. Punitive actions are needed to enforce the policy but are not the key to successful
implementation.
D. The stringent implementation, monitoring and enforcing of rules by the security
officer through access control software, and provision for punitive actions for violation of
security rules is important, but it is dependent on the support and education of
management and users on the importance of security.
✔✔A comprehensive and effective email policy should address the issues of email
structure, policy enforcement, monitoring and:
Select an answer:
A.
recovery.
B.
retention.
