ISACA Certified Information Systems Auditor (CISA) - Blueprint Practice Exam 1

1. A backup dashboard reports success every night, but no restored database has been tested. What should the auditor emphasize?
2. A business owner accepts a documented IT risk that exceeds their delegated authority. What should an auditor expect?
3. A business states that a payment service must recover within 90 minutes with at most five minutes of lost data. Which evidence is strongest?
4. A business unit reports that a prior high-risk finding is closed. What should establish closure?
5. A cloud deployment passed an external provider audit, but the customer's storage permissions allow broad public reads. What should be concluded?
6. A company encrypts sensitive files but stores the decryption keys in the same unrestricted shared folder. What should be reported?
7. A company has disaster recovery plans for servers but no documented process for staff to continue essential customer operations. What is the principal gap?
8. A company implements DLP that alerts on sensitive exports but no team reviews the alerts. What is the main control deficiency?
9. A company monitors privileged activity, but the monitored administrators can alter all the logs without independent detection. What weakness is most direct?
10. A company outsources IT operations but retains ownership of business information. What should its governance framework make clear?
11. A critical batch job can finish successfully even when one upstream input file is missing. Which control best detects incomplete processing?
12. A data conversion reconciles only the total number of records before and after migration. What additional evidence is most useful?
13. A department stores regulated data in an unapproved SaaS tool. What is the most appropriate audit focus?
14. A major IT investment has strong technical support but no clear business outcome measures. What governance weakness should be highlighted?
15. A penetration test identifies a significant vulnerability. Management says a firewall makes remediation unnecessary. What should the auditor assess?
16. A phishing simulation records only how many staff opened the message. Which additional measure best evaluates response behavior?
17. A policy assigns data classification to no named accountable role. Why is this a governance concern?
18. A programmer can develop, approve, and deploy their own production changes without independent review. Which risk is most direct?
19. A project meets its technical requirements but lacks evidence of business-user acceptance before release. What is the key control gap?
20. A quarterly access review is signed by a manager who cannot see what the listed privileged roles permit. What is the key concern?
21. A restored application starts, but its external identity provider and payment connection are unavailable. What was missing from recovery planning?
22. A security incident requires collection of evidence from a laptop. Which practice best supports later evidence integrity?
23. A service provider meets average response-time targets but has repeated outages during the customer's critical settlement window. What should be examined?
24. A supplier's assurance report excludes the service used by the organization. How should the auditor treat it?
25. A user's account remains active after employment ends because HR and IT exchange termination notices manually. Which improvement most directly addresses the exposure?
26. An agile team says that short iterations remove the need to define security requirements. How should an auditor respond?
27. An API validates that a caller is logged in but does not check whether that caller owns the requested customer's record. Which control is missing?
28. An audit report identifies a critical access-control weakness. Management disagrees with the severity. What should the auditor do?
29. An audit sample contains several unapproved production changes. What is the best next audit response?
30. An auditor discovers that the source extract for an exception analysis omits a business unit. What should happen before relying on its findings?
31. An auditor has one month to review five applications. One recently began processing sensitive data through an untested interface. What should primarily drive audit scheduling?
32. An auditor is assigned to assess a control they designed and operated until last week. What should be addressed before the engagement proceeds?
33. An auditor reviews a spreadsheet used to calculate material customer charges. What is the appropriate approach?
34. An incident is resolved by restarting a service, but the same failure recurs every week. What process should address the underlying cause?
35. An interface transfers invoice data between two systems. The sender and receiver show different total amounts for the same period. What should be investigated first?
36. An operations team applies emergency changes during an outage. Which control is still expected?
37. An organization disposes of leased disks that stored confidential information. What evidence is most relevant to the auditor?
38. An organization measures IT success only by the number of completed projects. Which addition best improves governance reporting?
39. Management states that every privileged account was reviewed quarterly. Which evidence best supports testing that assertion?
40. Six months after implementation, a project sponsor asks whether the system delivered its approved benefits. Which review addresses this?

Comments — 0