ISACA CISA - Certified Information Systems Auditor - IS Audit IT Governance Systems Acquisition Operations Asset Protection

By Sam Patel · Updated May 25, 2026

Questions25
Passing Score75%
Format100% Multiple Choice
Sessions Logged2,135
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
4.7 (40)

Topics covered

This quiz

Uncategorized25 (100%)

Uncategorized25 questions

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

During a systems acquisition audit, an IS auditor reviews a vendor selection process for a new HR information system. The organization selected the most expensive vendor without formal evaluation criteria. What governance concern does this raise?

Answer choices

  • A. The most expensive solution is usually the best — no audit concern is raised

  • B. The selection process lacked formal evaluation criteria, scoring methodology, and documented decision rationale — this raises concerns about objectivity, potential bias/conflict of interest, and whether the selected solution best meets organizational needs

  • C. IT should always select the least expensive solution that meets minimum requirements

  • D. Vendor selection should always be performed by the business, not IT

Question 2

An IS auditor is assessing the reliability of computer-generated reports used for financial reporting. What procedure provides the MOST assurance that the reports accurately reflect the underlying data?

Answer choices

  • A. Verify that the report printing process executes without error messages

  • B. Test the report logic by tracing a sample of transactions from source data through the processing logic to the final report output, verifying each step — this is called "end-to-end" testing

  • C. Confirm that management reviews and signs off on the reports before submission

  • D. Verify that the reporting system has been certified by the software vendor

Question 3

An IS auditor is performing a compliance audit against GDPR requirements. The organization processes EU citizen personal data. Which finding is MOST SIGNIFICANT?

Answer choices

  • A. The privacy policy on the website is written at a graduate reading level rather than plain language

  • B. The organization has no documented legal basis for processing personal data, no records of processing activities (ROPA), and has never responded to a data subject access request (DSAR)

  • C. Cookie consent banners don't include the company's DPO contact information

  • D. The privacy policy was last updated 14 months ago instead of annually

Question 4

During a pre-implementation audit of a new ERP system, an IS auditor identifies that the vendor will have remote maintenance access using a single shared administrator account. What segregation of duties concern does this create?

Answer choices

  • A. The shared account has too many characters in the username

  • B. Shared accounts prevent individual accountability — activities performed under shared credentials cannot be attributed to specific vendor personnel, eliminating auditability and accountability for privileged actions

  • C. The ERP vendor should not have administrator access at all

  • D. Remote access should require VPN but the type of VPN is not specified

Question 5

During an access control audit, an IS auditor reviews user access to the financial system and finds 45 accounts belong to employees who left the organization between 6 and 18 months ago. What is the MOST significant risk?

Answer choices

  • A. The system storage is wasted by inactive accounts

  • B. Orphaned accounts represent a significant access control risk — they may still have valid credentials and could be used for unauthorized access or exploited by former employees or external attackers who obtain the credentials

  • C. Regulatory non-compliance with username format standards

  • D. The IT department will have difficulty managing the excess accounts