CISA Practice Exam Spring 2024
Study online at https://quizlet.com/_f3ltii
1. Which of the following would be C.Human safety procedures are in place.
MOST important for an IS auditor to
verify while conducting a business Explanation: The most important element in any busi-
continuity audit? ness continuity process is the protection of human
A.Data backups are performed on a life. This takes precedence over all other aspects of
timely basis. the plan.
B.A recovery site is contracted for
and available as needed.
C.Human safety procedures are in
place.
D.Insurance coverage is adequate
and premiums are current.
2. A comprehensive and effective email B.retention.
policy should address the issues of
email structure, policy enforcement, Explanation:Besides being a good practice, laws and
monitoring and: regulations may require an organization to keep in-
A.recovery. formation that has an impact on the financial state-
B.retention. ments. The prevalence of lawsuits in which email
C.rebuilding. communication is held in the same regard as the of-
D.reuse. ficial form of classic paper makes the retention policy
of corporate email a necessity. All email generated
on an organization's hardware is the property of the
organization, and an email policy should address the
retention of messages, considering both known and
unforeseen litigation. The policy should also address
the destruction of emails after a specified time to
protect the nature and confidentiality of the messages
themselves.
3. An IS auditor who was involved in de- D. communicate the possibility of conflict of interest to
signing an organization's business audit management prior to starting the assignment.
, CISA Practice Exam Spring 2024
Study online at https://quizlet.com/_f3ltii
continuity plan (BCP) has been as-
signed to audit the plan. The IS audi- Explanation:A possible conflict of interest, likely to
tor should: affect the IS auditor's independence, should be
A.decline the assignment. brought to the attention of management prior to
B.inform management of the possi- starting the assignment.
ble conflict of interest after complet-
ing the audit assignment.
C.inform the BCP team of the possi-
ble conflict of interest prior to begin-
ning the assignment.
D.communicate the possibility of
conflict of interest to audit manage-
ment prior to starting the assign-
ment.
4. Which of the following is the MOST A.Offsite storage of backup data
critical element to effectively execute
a disaster recovery plan? Explanation: Remote storage of backups is the most
A.Offsite storage of backup data critical disaster recovery plan (DRP) element of the
B.Up-to-date list of key disaster re- items listed because access to backup data is required
covery contacts to restore systems.
C.Availability of a replacement data
center
D.Clearly defined recovery time ob-
jective (RTO)
5. An IS auditor found that the en- B. report this issue as a finding in the audit report.
terprise architecture (EA) recently
adopted by an organization has an Explanation: It is critical for the EA to include the future
adequate current-state representa- state because the gap between the current state and
tion. However, the organization has the future state will determine IT strategic and tactical
started a separate project to develop plans. If the EA does not include a future-state repre-
, CISA Practice Exam Spring 2024
Study online at https://quizlet.com/_f3ltii
a future-state representation. The IS sentation, it is not complete, and this issue should be
auditor should: reported as a finding.
A.recommend that this separate pro-
ject be completed as soon as possi-
ble.
B.report this issue as a finding in the
audit report.
C.recommend the adoption of the
Zachmann framework.
D.re-scope the audit to include the
separate project as part of the cur-
rent audit.
6. What is the PRIMARY consideration A.Projects are aligned with the organization's strate-
for an IS auditor reviewing the prior- gy.
itization and coordination of IT pro-
jects and program management? Explanation: The primary goal of IT projects is to add
A.Projects are aligned with the orga- value to the business, so they must be aligned with
nization's strategy. the business strategy to achieve the intended results.
B.Identified project risk is monitored Therefore, the IS auditor should first focus on ensur-
and mitigated. ing this alignment.
C.Controls related to project plan-
ning and budgeting are appropri-
ate.
D.IT project metrics are reported ac-
curately.
7. When selecting audit procedures, an A.sufficient evidence will be collected.
IS auditor should use professional
judgment to ensure that: Explanation:Procedures are processes that an IS au-
A.sufficient evidence will be collect- ditor may follow in an audit engagement. In deter-
ed. mining the appropriateness of any specific proce-
, CISA Practice Exam Spring 2024
Study online at https://quizlet.com/_f3ltii
B.significant deficiencies will be cor- dure, an IS auditor should use professional judgment
rected within a reasonable period. that is appropriate to the specific circumstances. Pro-
C.all material weaknesses will be fessional judgment involves a subjective and often
identified. qualitative evaluation of conditions arising during an
D.audit costs will be kept at a mini- audit. Judgment addresses a grey area where binary
mum level. (yes/no) decisions are not appropriate, and the IS
auditor's past experience plays a key role in making
a judgment. The IS auditor should use judgment in
assessing the sufficiency of evidence to be collect-
ed. ISACA's guidelines provide information on how to
meet the standards when performing IS audit work.
8. Which of the following line media D.Dedicated lines
would provide the BEST security for
a telecommunication network? Explanation: These are set apart for a particular user
A.Broadband network digital trans- or organization. Because there is no sharing of lines
mission or intermediate entry points, the risk of intercep-
B.Baseband network tion or disruption of telecommunications messages
C.Dial-up is lower.
D.Dedicated lines
9. The PRIMARY purpose of an IT foren- B.the systematic collection and analysis of evidence
sic audit is: after a system irregularity.
A.to participate in investigations re-
lated to corporate fraud. Explanation: This best describes a forensic audit. The
B.the systematic collection and evidence collected can then be analyzed and used in
analysis of evidence after a system judicial proceedings
irregularity.
C.to assess the correctness of an or-
ganization's financial statements.
D.to preserve evidence of criminal
activity.
Study online at https://quizlet.com/_f3ltii
1. Which of the following would be C.Human safety procedures are in place.
MOST important for an IS auditor to
verify while conducting a business Explanation: The most important element in any busi-
continuity audit? ness continuity process is the protection of human
A.Data backups are performed on a life. This takes precedence over all other aspects of
timely basis. the plan.
B.A recovery site is contracted for
and available as needed.
C.Human safety procedures are in
place.
D.Insurance coverage is adequate
and premiums are current.
2. A comprehensive and effective email B.retention.
policy should address the issues of
email structure, policy enforcement, Explanation:Besides being a good practice, laws and
monitoring and: regulations may require an organization to keep in-
A.recovery. formation that has an impact on the financial state-
B.retention. ments. The prevalence of lawsuits in which email
C.rebuilding. communication is held in the same regard as the of-
D.reuse. ficial form of classic paper makes the retention policy
of corporate email a necessity. All email generated
on an organization's hardware is the property of the
organization, and an email policy should address the
retention of messages, considering both known and
unforeseen litigation. The policy should also address
the destruction of emails after a specified time to
protect the nature and confidentiality of the messages
themselves.
3. An IS auditor who was involved in de- D. communicate the possibility of conflict of interest to
signing an organization's business audit management prior to starting the assignment.
, CISA Practice Exam Spring 2024
Study online at https://quizlet.com/_f3ltii
continuity plan (BCP) has been as-
signed to audit the plan. The IS audi- Explanation:A possible conflict of interest, likely to
tor should: affect the IS auditor's independence, should be
A.decline the assignment. brought to the attention of management prior to
B.inform management of the possi- starting the assignment.
ble conflict of interest after complet-
ing the audit assignment.
C.inform the BCP team of the possi-
ble conflict of interest prior to begin-
ning the assignment.
D.communicate the possibility of
conflict of interest to audit manage-
ment prior to starting the assign-
ment.
4. Which of the following is the MOST A.Offsite storage of backup data
critical element to effectively execute
a disaster recovery plan? Explanation: Remote storage of backups is the most
A.Offsite storage of backup data critical disaster recovery plan (DRP) element of the
B.Up-to-date list of key disaster re- items listed because access to backup data is required
covery contacts to restore systems.
C.Availability of a replacement data
center
D.Clearly defined recovery time ob-
jective (RTO)
5. An IS auditor found that the en- B. report this issue as a finding in the audit report.
terprise architecture (EA) recently
adopted by an organization has an Explanation: It is critical for the EA to include the future
adequate current-state representa- state because the gap between the current state and
tion. However, the organization has the future state will determine IT strategic and tactical
started a separate project to develop plans. If the EA does not include a future-state repre-
, CISA Practice Exam Spring 2024
Study online at https://quizlet.com/_f3ltii
a future-state representation. The IS sentation, it is not complete, and this issue should be
auditor should: reported as a finding.
A.recommend that this separate pro-
ject be completed as soon as possi-
ble.
B.report this issue as a finding in the
audit report.
C.recommend the adoption of the
Zachmann framework.
D.re-scope the audit to include the
separate project as part of the cur-
rent audit.
6. What is the PRIMARY consideration A.Projects are aligned with the organization's strate-
for an IS auditor reviewing the prior- gy.
itization and coordination of IT pro-
jects and program management? Explanation: The primary goal of IT projects is to add
A.Projects are aligned with the orga- value to the business, so they must be aligned with
nization's strategy. the business strategy to achieve the intended results.
B.Identified project risk is monitored Therefore, the IS auditor should first focus on ensur-
and mitigated. ing this alignment.
C.Controls related to project plan-
ning and budgeting are appropri-
ate.
D.IT project metrics are reported ac-
curately.
7. When selecting audit procedures, an A.sufficient evidence will be collected.
IS auditor should use professional
judgment to ensure that: Explanation:Procedures are processes that an IS au-
A.sufficient evidence will be collect- ditor may follow in an audit engagement. In deter-
ed. mining the appropriateness of any specific proce-
, CISA Practice Exam Spring 2024
Study online at https://quizlet.com/_f3ltii
B.significant deficiencies will be cor- dure, an IS auditor should use professional judgment
rected within a reasonable period. that is appropriate to the specific circumstances. Pro-
C.all material weaknesses will be fessional judgment involves a subjective and often
identified. qualitative evaluation of conditions arising during an
D.audit costs will be kept at a mini- audit. Judgment addresses a grey area where binary
mum level. (yes/no) decisions are not appropriate, and the IS
auditor's past experience plays a key role in making
a judgment. The IS auditor should use judgment in
assessing the sufficiency of evidence to be collect-
ed. ISACA's guidelines provide information on how to
meet the standards when performing IS audit work.
8. Which of the following line media D.Dedicated lines
would provide the BEST security for
a telecommunication network? Explanation: These are set apart for a particular user
A.Broadband network digital trans- or organization. Because there is no sharing of lines
mission or intermediate entry points, the risk of intercep-
B.Baseband network tion or disruption of telecommunications messages
C.Dial-up is lower.
D.Dedicated lines
9. The PRIMARY purpose of an IT foren- B.the systematic collection and analysis of evidence
sic audit is: after a system irregularity.
A.to participate in investigations re-
lated to corporate fraud. Explanation: This best describes a forensic audit. The
B.the systematic collection and evidence collected can then be analyzed and used in
analysis of evidence after a system judicial proceedings
irregularity.
C.to assess the correctness of an or-
ganization's financial statements.
D.to preserve evidence of criminal
activity.
