CISA Study guide and practice
questions and answers 2026
During an IS audit, which is the BEST method for an IS auditor to evaluate the implementation of
segregation of duties within an IT department?
A. Discuss it with the IT managers.
B. Review the job descriptions of the IT functions.
C. Research past IS audit reports.
D. Evaluate the organizational structure.
Question #: 919 CISA Job Practice Task Statement: 1.3 - correct answersthe answer is A.
A. Discussing the implementation of segregation of duties with the IT managers is the best way to
determine how responsibilities are assigned within the department.
B. Job descriptions may not be the best source of information because they could be outdated or what is
documented in the job descriptions may be different from what is actually performed.
C. Past IS audit reports are not the best source of information because they may not accurately describe
how IT responsibilities are assigned.
D. Evaluating the organizational structure may give a limited view on the allocation of IT responsibilities.
The responsibilities also may have changed over time.
Which of the following controls would provide the GREATEST assurance of database integrity?
A. Audit log procedures
B. Table link/reference checks
C. Query/table access time checks
D. Rollback and rollforward database features - correct answersThe correct answer is B.
A. Audit log procedures enable recording of all events that have been identified and help in tracing the
events. However, they only point to the event and do not ensure completeness or accuracy of the
database contents.
B. Performing table link/reference checks serves to detect table linking errors (such as completeness and
accuracy of the contents of the database), and thus provides the greatest assurance of database
integrity.
, C. Querying/monitoring table access time checks helps designers improve database performance but
not integrity.
D. Rollback and rollforward database features ensure recovery from an abnormal disruption. They
assure the integrity of the transaction that was being processed at the time of disruption, but do not
provide assurance on the integrity of the contents of the database
Which of the following would be the BEST overall control for an Internet business looking for
confidentiality, reliability and integrity of data?
A. Secure Sockets Layer (SSL)
B. Intrusion detection system (IDS)
C. Public key infrastructure (PKI)
D. Virtual private network (VPN)
Question #: 688 CISA Job Practice Task Statement: 5.3 - correct answersThe correct answer is A.
A. Secure Sockets Layer (SSL) is used for many e-commerce applications to set up a secure channel for
communications providing confidentiality through a combination of public and symmetric key
encryption and integrity through hash message authentication code (HMAC).
B. An intrusion detection system (IDS) will log network activity but is not used for protecting traffic over
the Internet.
C. Public key infrastructure (PKI) is used in conjunction with SSL or for securing communications such as
e-commerce and email.
D. A virtual private network (VPN) is a generic term for a communications tunnel that can provide
confidentiality, integrity and authentication (reliability). A VPN can operate at different levels of the
Open Systems Interconnection (OSI) stack and may not always be used in conjunction with encryption.
SSL can be called a type of VPN.
Which of the following has the MOST significant impact on the success of an application systems
implementation?
A.
The prototyping application development methodology
B.
Compliance with applicable external requirements
C.
The overall organizational environment
D.
questions and answers 2026
During an IS audit, which is the BEST method for an IS auditor to evaluate the implementation of
segregation of duties within an IT department?
A. Discuss it with the IT managers.
B. Review the job descriptions of the IT functions.
C. Research past IS audit reports.
D. Evaluate the organizational structure.
Question #: 919 CISA Job Practice Task Statement: 1.3 - correct answersthe answer is A.
A. Discussing the implementation of segregation of duties with the IT managers is the best way to
determine how responsibilities are assigned within the department.
B. Job descriptions may not be the best source of information because they could be outdated or what is
documented in the job descriptions may be different from what is actually performed.
C. Past IS audit reports are not the best source of information because they may not accurately describe
how IT responsibilities are assigned.
D. Evaluating the organizational structure may give a limited view on the allocation of IT responsibilities.
The responsibilities also may have changed over time.
Which of the following controls would provide the GREATEST assurance of database integrity?
A. Audit log procedures
B. Table link/reference checks
C. Query/table access time checks
D. Rollback and rollforward database features - correct answersThe correct answer is B.
A. Audit log procedures enable recording of all events that have been identified and help in tracing the
events. However, they only point to the event and do not ensure completeness or accuracy of the
database contents.
B. Performing table link/reference checks serves to detect table linking errors (such as completeness and
accuracy of the contents of the database), and thus provides the greatest assurance of database
integrity.
, C. Querying/monitoring table access time checks helps designers improve database performance but
not integrity.
D. Rollback and rollforward database features ensure recovery from an abnormal disruption. They
assure the integrity of the transaction that was being processed at the time of disruption, but do not
provide assurance on the integrity of the contents of the database
Which of the following would be the BEST overall control for an Internet business looking for
confidentiality, reliability and integrity of data?
A. Secure Sockets Layer (SSL)
B. Intrusion detection system (IDS)
C. Public key infrastructure (PKI)
D. Virtual private network (VPN)
Question #: 688 CISA Job Practice Task Statement: 5.3 - correct answersThe correct answer is A.
A. Secure Sockets Layer (SSL) is used for many e-commerce applications to set up a secure channel for
communications providing confidentiality through a combination of public and symmetric key
encryption and integrity through hash message authentication code (HMAC).
B. An intrusion detection system (IDS) will log network activity but is not used for protecting traffic over
the Internet.
C. Public key infrastructure (PKI) is used in conjunction with SSL or for securing communications such as
e-commerce and email.
D. A virtual private network (VPN) is a generic term for a communications tunnel that can provide
confidentiality, integrity and authentication (reliability). A VPN can operate at different levels of the
Open Systems Interconnection (OSI) stack and may not always be used in conjunction with encryption.
SSL can be called a type of VPN.
Which of the following has the MOST significant impact on the success of an application systems
implementation?
A.
The prototyping application development methodology
B.
Compliance with applicable external requirements
C.
The overall organizational environment
D.
