CERTIFIED INFORMATION
SYSTEMS AUDITOR (CISA)
200 ORIGINAL PRACTICE QUESTIONS
2026-2027 | DOMAIN-ALIGNED STUDY EDITION
Practice. Analyze. Improve.
Five-domain review mapped to ISACA's published CISA job-practice outline.
PROFESSIONAL CERTIFICATION PRACTICE SERIES
,CISA CERTIFICATION PRACTICE SERIES PRACTICE EXAM
How to use this practice exam
This booklet contains 200 original multiple-choice study questions organized in the same five-domain proportions published by
ISACA. Select the single best answer based on the facts in each scenario. When two responses appear plausible, favor
risk-based reasoning, sufficient reliable evidence, clear accountability, and controls that address the stated business objective.
Study-use note: These are original practice items, not copied or verified secured exam questions. They do not guarantee a
score or passing outcome. Use current official ISACA materials as the final reference for exam requirements.
Question distribution
Domain Weight Questions
Domain 1 - Information Systems Auditing Process 18% 36
Domain 2 - Governance and Management of IT 18% 36
Domain 3 - Information Systems Acquisition, Development and Implementation 12% 24
Domain 4 - Information Systems Operations and Business Resilience 26% 52
Domain 5 - Protection of Information Assets 26% 52
Total 100% 200
Suggested timing: 200 questions in 240 minutes for a deliberate practice session, or split into domain blocks. Mark uncertain
items and review the separate rationale booklet after completing the exam.
Original study questions | 2026-2027 edition Page 2
,CISA CERTIFICATION PRACTICE SERIES PRACTICE EXAM
Answer sheet
Q Ans. Q Ans. Q Ans. Q Ans.
1 ____ 51 ____ 101 ____ 151 ____
2 ____ 52 ____ 102 ____ 152 ____
3 ____ 53 ____ 103 ____ 153 ____
4 ____ 54 ____ 104 ____ 154 ____
5 ____ 55 ____ 105 ____ 155 ____
6 ____ 56 ____ 106 ____ 156 ____
7 ____ 57 ____ 107 ____ 157 ____
8 ____ 58 ____ 108 ____ 158 ____
9 ____ 59 ____ 109 ____ 159 ____
10 ____ 60 ____ 110 ____ 160 ____
11 ____ 61 ____ 111 ____ 161 ____
12 ____ 62 ____ 112 ____ 162 ____
13 ____ 63 ____ 113 ____ 163 ____
14 ____ 64 ____ 114 ____ 164 ____
15 ____ 65 ____ 115 ____ 165 ____
16 ____ 66 ____ 116 ____ 166 ____
17 ____ 67 ____ 117 ____ 167 ____
18 ____ 68 ____ 118 ____ 168 ____
19 ____ 69 ____ 119 ____ 169 ____
20 ____ 70 ____ 120 ____ 170 ____
21 ____ 71 ____ 121 ____ 171 ____
22 ____ 72 ____ 122 ____ 172 ____
23 ____ 73 ____ 123 ____ 173 ____
24 ____ 74 ____ 124 ____ 174 ____
25 ____ 75 ____ 125 ____ 175 ____
26 ____ 76 ____ 126 ____ 176 ____
27 ____ 77 ____ 127 ____ 177 ____
28 ____ 78 ____ 128 ____ 178 ____
29 ____ 79 ____ 129 ____ 179 ____
30 ____ 80 ____ 130 ____ 180 ____
31 ____ 81 ____ 131 ____ 181 ____
32 ____ 82 ____ 132 ____ 182 ____
33 ____ 83 ____ 133 ____ 183 ____
34 ____ 84 ____ 134 ____ 184 ____
35 ____ 85 ____ 135 ____ 185 ____
36 ____ 86 ____ 136 ____ 186 ____
37 ____ 87 ____ 137 ____ 187 ____
38 ____ 88 ____ 138 ____ 188 ____
39 ____ 89 ____ 139 ____ 189 ____
40 ____ 90 ____ 140 ____ 190 ____
41 ____ 91 ____ 141 ____ 191 ____
42 ____ 92 ____ 142 ____ 192 ____
43 ____ 93 ____ 143 ____ 193 ____
44 ____ 94 ____ 144 ____ 194 ____
45 ____ 95 ____ 145 ____ 195 ____
46 ____ 96 ____ 146 ____ 196 ____
47 ____ 97 ____ 147 ____ 197 ____
48 ____ 98 ____ 148 ____ 198 ____
49 ____ 99 ____ 149 ____ 199 ____
50 ____ 100 ____ 150 ____ 200 ____
Original study questions | 2026-2027 edition Page 3
, CISA CERTIFICATION PRACTICE SERIES PRACTICE EXAM
Domain 1 - Information Systems Auditing Process
Weight in published outline: 18% | Practice items in this section: 36
Question 1. An audit manager is assigned to review a new access-control process that she designed last quarter.
The business unit says her familiarity will make the review faster. Which action is MOST appropriate?
A. Decline or mitigate the conflict and assign an appropriately independent auditor.
B. Keep the assignment but disclose the conflict only in the final report.
C. Let the business owner decide whether independence matters.
D. Proceed because familiarity with the control improves efficiency.
Question 2. During annual planning, the chief audit executive proposes assigning the original system implementer
to test whether the implementation controls are effective. Which response best addresses the control or risk
objective?
A. Keep the assignment but disclose the conflict only in the final report.
B. Decline or mitigate the conflict and assign an appropriately independent auditor.
C. Let the business owner decide whether independence matters.
D. Proceed because familiarity with the control improves efficiency.
Question 3. An IT auditor is denied access to a system log needed for an approved engagement. The system owner
says the audit team has no authority to inspect operational records. Which action is MOST appropriate?
A. Request informal permission from a junior administrator and avoid raising the issue.
B. Replace the log test with an interview without evaluating the evidence gap.
C. Refer to the approved audit charter and engagement authorization, then resolve access through governance channels.
D. Obtain the records by bypassing access restrictions.
Question 4. A new CIO asks what formal document establishes audit scope, authority, responsibility, and access
rights. Which response best addresses the control or risk objective?
A. Request informal permission from a junior administrator and avoid raising the issue.
B. Replace the log test with an interview without evaluating the evidence gap.
C. Obtain the records by bypassing access restrictions.
D. Refer to the approved audit charter and engagement authorization, then resolve access through governance channels.
Question 5. A retailer has limited audit capacity. Recent incidents point to payment processing and privileged
access, while a low-impact intranet has had no material changes. Which action is MOST appropriate?
A. Prioritize auditable areas according to business impact, likelihood, change, and residual risk.
B. Repeat last year’s plan without considering new exposure.
C. Allocate equal hours to every system regardless of risk.
D. Select the easiest audit because it can be completed before quarter-end.
Original study questions | 2026-2027 edition Page 4
SYSTEMS AUDITOR (CISA)
200 ORIGINAL PRACTICE QUESTIONS
2026-2027 | DOMAIN-ALIGNED STUDY EDITION
Practice. Analyze. Improve.
Five-domain review mapped to ISACA's published CISA job-practice outline.
PROFESSIONAL CERTIFICATION PRACTICE SERIES
,CISA CERTIFICATION PRACTICE SERIES PRACTICE EXAM
How to use this practice exam
This booklet contains 200 original multiple-choice study questions organized in the same five-domain proportions published by
ISACA. Select the single best answer based on the facts in each scenario. When two responses appear plausible, favor
risk-based reasoning, sufficient reliable evidence, clear accountability, and controls that address the stated business objective.
Study-use note: These are original practice items, not copied or verified secured exam questions. They do not guarantee a
score or passing outcome. Use current official ISACA materials as the final reference for exam requirements.
Question distribution
Domain Weight Questions
Domain 1 - Information Systems Auditing Process 18% 36
Domain 2 - Governance and Management of IT 18% 36
Domain 3 - Information Systems Acquisition, Development and Implementation 12% 24
Domain 4 - Information Systems Operations and Business Resilience 26% 52
Domain 5 - Protection of Information Assets 26% 52
Total 100% 200
Suggested timing: 200 questions in 240 minutes for a deliberate practice session, or split into domain blocks. Mark uncertain
items and review the separate rationale booklet after completing the exam.
Original study questions | 2026-2027 edition Page 2
,CISA CERTIFICATION PRACTICE SERIES PRACTICE EXAM
Answer sheet
Q Ans. Q Ans. Q Ans. Q Ans.
1 ____ 51 ____ 101 ____ 151 ____
2 ____ 52 ____ 102 ____ 152 ____
3 ____ 53 ____ 103 ____ 153 ____
4 ____ 54 ____ 104 ____ 154 ____
5 ____ 55 ____ 105 ____ 155 ____
6 ____ 56 ____ 106 ____ 156 ____
7 ____ 57 ____ 107 ____ 157 ____
8 ____ 58 ____ 108 ____ 158 ____
9 ____ 59 ____ 109 ____ 159 ____
10 ____ 60 ____ 110 ____ 160 ____
11 ____ 61 ____ 111 ____ 161 ____
12 ____ 62 ____ 112 ____ 162 ____
13 ____ 63 ____ 113 ____ 163 ____
14 ____ 64 ____ 114 ____ 164 ____
15 ____ 65 ____ 115 ____ 165 ____
16 ____ 66 ____ 116 ____ 166 ____
17 ____ 67 ____ 117 ____ 167 ____
18 ____ 68 ____ 118 ____ 168 ____
19 ____ 69 ____ 119 ____ 169 ____
20 ____ 70 ____ 120 ____ 170 ____
21 ____ 71 ____ 121 ____ 171 ____
22 ____ 72 ____ 122 ____ 172 ____
23 ____ 73 ____ 123 ____ 173 ____
24 ____ 74 ____ 124 ____ 174 ____
25 ____ 75 ____ 125 ____ 175 ____
26 ____ 76 ____ 126 ____ 176 ____
27 ____ 77 ____ 127 ____ 177 ____
28 ____ 78 ____ 128 ____ 178 ____
29 ____ 79 ____ 129 ____ 179 ____
30 ____ 80 ____ 130 ____ 180 ____
31 ____ 81 ____ 131 ____ 181 ____
32 ____ 82 ____ 132 ____ 182 ____
33 ____ 83 ____ 133 ____ 183 ____
34 ____ 84 ____ 134 ____ 184 ____
35 ____ 85 ____ 135 ____ 185 ____
36 ____ 86 ____ 136 ____ 186 ____
37 ____ 87 ____ 137 ____ 187 ____
38 ____ 88 ____ 138 ____ 188 ____
39 ____ 89 ____ 139 ____ 189 ____
40 ____ 90 ____ 140 ____ 190 ____
41 ____ 91 ____ 141 ____ 191 ____
42 ____ 92 ____ 142 ____ 192 ____
43 ____ 93 ____ 143 ____ 193 ____
44 ____ 94 ____ 144 ____ 194 ____
45 ____ 95 ____ 145 ____ 195 ____
46 ____ 96 ____ 146 ____ 196 ____
47 ____ 97 ____ 147 ____ 197 ____
48 ____ 98 ____ 148 ____ 198 ____
49 ____ 99 ____ 149 ____ 199 ____
50 ____ 100 ____ 150 ____ 200 ____
Original study questions | 2026-2027 edition Page 3
, CISA CERTIFICATION PRACTICE SERIES PRACTICE EXAM
Domain 1 - Information Systems Auditing Process
Weight in published outline: 18% | Practice items in this section: 36
Question 1. An audit manager is assigned to review a new access-control process that she designed last quarter.
The business unit says her familiarity will make the review faster. Which action is MOST appropriate?
A. Decline or mitigate the conflict and assign an appropriately independent auditor.
B. Keep the assignment but disclose the conflict only in the final report.
C. Let the business owner decide whether independence matters.
D. Proceed because familiarity with the control improves efficiency.
Question 2. During annual planning, the chief audit executive proposes assigning the original system implementer
to test whether the implementation controls are effective. Which response best addresses the control or risk
objective?
A. Keep the assignment but disclose the conflict only in the final report.
B. Decline or mitigate the conflict and assign an appropriately independent auditor.
C. Let the business owner decide whether independence matters.
D. Proceed because familiarity with the control improves efficiency.
Question 3. An IT auditor is denied access to a system log needed for an approved engagement. The system owner
says the audit team has no authority to inspect operational records. Which action is MOST appropriate?
A. Request informal permission from a junior administrator and avoid raising the issue.
B. Replace the log test with an interview without evaluating the evidence gap.
C. Refer to the approved audit charter and engagement authorization, then resolve access through governance channels.
D. Obtain the records by bypassing access restrictions.
Question 4. A new CIO asks what formal document establishes audit scope, authority, responsibility, and access
rights. Which response best addresses the control or risk objective?
A. Request informal permission from a junior administrator and avoid raising the issue.
B. Replace the log test with an interview without evaluating the evidence gap.
C. Obtain the records by bypassing access restrictions.
D. Refer to the approved audit charter and engagement authorization, then resolve access through governance channels.
Question 5. A retailer has limited audit capacity. Recent incidents point to payment processing and privileged
access, while a low-impact intranet has had no material changes. Which action is MOST appropriate?
A. Prioritize auditable areas according to business impact, likelihood, change, and residual risk.
B. Repeat last year’s plan without considering new exposure.
C. Allocate equal hours to every system regardless of risk.
D. Select the easiest audit because it can be completed before quarter-end.
Original study questions | 2026-2027 edition Page 4
