CISA Practice Exam – Questions and Answers
2026 | Verified Certified Information Systems
Auditor Study Guide
Play your way to mastery with fun games
Match Blocks Charms NEW
Terms in this set (323)
Identify the most critical element B. An information security policy comprises of
from the following for the successful processes, procedures, and rules in an organization.
implementation and ongoing regular The most important aspect of a successful
maintenance of an information implementation of an information security policy is
security policy. [BAC] the assimilation by all appropriate parties such as
employees, service providers, and business
A.Management support and approval partners. Punitive actions for any violations are
for the information security policy related to the education and awareness of the
B. Understanding of the information policy.
security policy by all appropriate
parties
C. Punitive actions for any violation of
information security rules
D. Stringent access control
monitoring of information security
rules
,Fair Lending has implemented a B. The immediate next step to evaluate the
disaster recovery plan. Andrew, CFO adequacy of a disaster recovery plan once it has
of Fair Lending, wants to ensure that been implemented is to conduct a desk-based
the implemented plan is adequate. evaluation which is also known as a paper test. The
Identify the immediate next step from paper test involves walking through the plan and
the following. discussion on what might happen in a particular
type of service disruption with the major
Initiate the Full Operational Test stakeholders. As per the best practice, the paper
Initiate the Desk-based Evaluation test precedes the preparedness test.
Initiate the Preparedness Test
Socialize with the Senior
Management and Obtain
Sponsorship
There are various methods of D, Dry-pipe sprinkling systems are the most
suppressing a data center fire. effective and environmentally friendly from the
Identify the MOST effective and available options. In this system, the water does not
environmentally friendly method from flow until the fire alarm activates a pump. Water-
the following. based systems (sprinkler systems) are
environmentally friendly but may not present the
Water-based systems (sprinkler most effective option. In this system, the water is
systems) always present in the piping, which can potentially
Argonite systems leak, causing damage to equipment.
Carbon dioxide systems
Dry-pipe sprinkling systems
,IT risk management process B. IT risk management process comprises of
comprises of following 5 steps listed following 5 steps: Step 1: Asset Identification Step 2:
in no particular sequence. (b) Asset Evaluation of Threats and Vulnerabilities to Assets
Identification (e) Evaluation of Threats Step 3: Evaluation of the Impact Step 4: Calculation
and Vulnerabilities to Assets (a) of Risk Step 5: Evaluation of and Response to Risk
Evaluation of the Impact (c)
Calculation of Risk (d) Evaluation of
and Response to Risk Identify the
correct sequence from the following
b, a, e, c, d
b, e, a, c, d
b, e, a, d, c
a, b, c, d, e
Palm Trading Company has D. The digital signature is used for verifying the
implemented digital signatures to identity of the sender and the integrity of the
protect email communication with content.
their customers. Identify the benefit
of using a digital signature from the
following.
Protects email content from
unauthorized reading
Protects email content from data
theft
Ensure timely delivery of email
content
Ensures integrity of the email content
, Merlin, head of information systems B An experienced project manager must be able to
audit at Cocoa Payroll Services, was identify the majority of key project risks at the
invited to a development project beginning of the project, and plan to deal with them
meeting. During the meeting, Merlin when they do materialize
noted that no project risks were
documented and raised this issue
with the head of IT. The IT project
manager opined that it was too early
to identify risks and that they intend
to hire a risk manager if risks do start
impacting the project. Identify the
likely response from Merlin from the
following.
Express the willingness to work with
the risk manager when one is
appointed
Emphasize the importance of
identifying and documenting risks,
and to develop contingency plans
Since the project manager is
accountable for the outcome of the
project, it is reasonable to accept his
position
Inform the project manager of intent
to conduct a review of the risks at the
completion of the requirements
definition phase of the project
2026 | Verified Certified Information Systems
Auditor Study Guide
Play your way to mastery with fun games
Match Blocks Charms NEW
Terms in this set (323)
Identify the most critical element B. An information security policy comprises of
from the following for the successful processes, procedures, and rules in an organization.
implementation and ongoing regular The most important aspect of a successful
maintenance of an information implementation of an information security policy is
security policy. [BAC] the assimilation by all appropriate parties such as
employees, service providers, and business
A.Management support and approval partners. Punitive actions for any violations are
for the information security policy related to the education and awareness of the
B. Understanding of the information policy.
security policy by all appropriate
parties
C. Punitive actions for any violation of
information security rules
D. Stringent access control
monitoring of information security
rules
,Fair Lending has implemented a B. The immediate next step to evaluate the
disaster recovery plan. Andrew, CFO adequacy of a disaster recovery plan once it has
of Fair Lending, wants to ensure that been implemented is to conduct a desk-based
the implemented plan is adequate. evaluation which is also known as a paper test. The
Identify the immediate next step from paper test involves walking through the plan and
the following. discussion on what might happen in a particular
type of service disruption with the major
Initiate the Full Operational Test stakeholders. As per the best practice, the paper
Initiate the Desk-based Evaluation test precedes the preparedness test.
Initiate the Preparedness Test
Socialize with the Senior
Management and Obtain
Sponsorship
There are various methods of D, Dry-pipe sprinkling systems are the most
suppressing a data center fire. effective and environmentally friendly from the
Identify the MOST effective and available options. In this system, the water does not
environmentally friendly method from flow until the fire alarm activates a pump. Water-
the following. based systems (sprinkler systems) are
environmentally friendly but may not present the
Water-based systems (sprinkler most effective option. In this system, the water is
systems) always present in the piping, which can potentially
Argonite systems leak, causing damage to equipment.
Carbon dioxide systems
Dry-pipe sprinkling systems
,IT risk management process B. IT risk management process comprises of
comprises of following 5 steps listed following 5 steps: Step 1: Asset Identification Step 2:
in no particular sequence. (b) Asset Evaluation of Threats and Vulnerabilities to Assets
Identification (e) Evaluation of Threats Step 3: Evaluation of the Impact Step 4: Calculation
and Vulnerabilities to Assets (a) of Risk Step 5: Evaluation of and Response to Risk
Evaluation of the Impact (c)
Calculation of Risk (d) Evaluation of
and Response to Risk Identify the
correct sequence from the following
b, a, e, c, d
b, e, a, c, d
b, e, a, d, c
a, b, c, d, e
Palm Trading Company has D. The digital signature is used for verifying the
implemented digital signatures to identity of the sender and the integrity of the
protect email communication with content.
their customers. Identify the benefit
of using a digital signature from the
following.
Protects email content from
unauthorized reading
Protects email content from data
theft
Ensure timely delivery of email
content
Ensures integrity of the email content
, Merlin, head of information systems B An experienced project manager must be able to
audit at Cocoa Payroll Services, was identify the majority of key project risks at the
invited to a development project beginning of the project, and plan to deal with them
meeting. During the meeting, Merlin when they do materialize
noted that no project risks were
documented and raised this issue
with the head of IT. The IT project
manager opined that it was too early
to identify risks and that they intend
to hire a risk manager if risks do start
impacting the project. Identify the
likely response from Merlin from the
following.
Express the willingness to work with
the risk manager when one is
appointed
Emphasize the importance of
identifying and documenting risks,
and to develop contingency plans
Since the project manager is
accountable for the outcome of the
project, it is reasonable to accept his
position
Inform the project manager of intent
to conduct a review of the risks at the
completion of the requirements
definition phase of the project
