Free ISACA CISA practice questions

10 free ISACA CISA practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 1,823 questions. Work through them, then open each answer to check your reasoning.

Get all 1,823 questions (US$39) · Download these 10 as a PDF

Question 1

Which of the following should be of GREATEST concern to an IS auditor reviewing an organization's business continuity plan (BCP)?

  1. The BCP has not been tested since it was first issued.
  2. The BCP is not version-controlled.
  3. The BCP's contact information needs to be updated.
  4. The BCP has not been approved by senior management.
Show answer and explanation

Correct answer: A. The BCP has not been tested since it was first issued.

An untested BCP is fundamentally unreliable and poses the greatest risk because it has never been validated to actually work during a real incident. Testing is critical to identifying gaps, clarifying procedures, and ensuring recovery objectives can be met. While version control, updated contact information, and management approval are all important, they are secondary to proving the plan actually functions when needed.

Why the other options are wrong

  • B. Version control is a good practice but does not affect whether the BCP will actually work during a crisis.
  • C. Outdated contact information should be corrected, but this is a maintenance issue, not a fundamental validity concern.
  • D. Senior management approval is necessary for authority but does not validate that the plan will function effectively.

Question 2

Which of the following would be MOST useful when analyzing computer performance?

  1. Tuning of system software to optimize resource usage
  2. Operations report of user dissatisfaction with response time
  3. Statistical metrics measuring capacity utilization
  4. Report of off-peak utilization and response time ✅Correct Answer: C, Statistical metrics measuring capacity utilization Statistical metrics on capacity utilization give objective, quantifiable data across varied conditions and time periods, supporting trend analysis, bottleneck identification, and data-driven decisions. Subjective complaints and narrow off-peak reports offer only partial insight with no statistical basis. System tuning is an action taken after analysis, not an analysis tool.
Show answer and explanation

Answer and explanation for question 2

Question 3

Which of the following is the GREATEST risk if two users have concurrent access to the same database record?

  1. Entity integrity
  2. Availability integrity
  3. Referential integrity
  4. Data integrity
Show answer and explanation

Correct answer: D. Data integrity

When two users have concurrent access to the same database record without proper locking mechanisms, the greatest risk is data integrity, the loss or corruption of actual data values. This can result in lost updates, dirty reads, or inconsistent data states. Entity integrity, referential integrity, and availability integrity are all important, but data integrity is the broadest and most fundamental concern when concurrent modifications occur without proper synchronization controls.

Why the other options are wrong

  • A. Entity integrity (unique identification) is less threatened by concurrent access than data value integrity.
  • B. Availability integrity is not a standard integrity classification in database theory.
  • C. Referential integrity (foreign key relationships) is less directly threatened than the core data values themselves.

Question 4

Which of the following is the MOST effective way for an organization to help ensure agreed-upon action plans from an IS audit will be implemented?

  1. Ensure ownership is assigned.
  2. Test corrective actions upon completion.
  3. Ensure sufficient audit resources are allocated.
  4. Communicate audit results organization-wide.
Show answer and explanation

Correct answer: A. Ensure ownership is assigned.

Assigning clear ownership is the most effective foundation for ensuring implementation because it establishes accountability and designates a responsible party with decisio-aking authority. Without clear ownership, action items can fall through the cracks regardless of other supporting activities. Testing, resource allocation, and communication are all valuable supporting measures, but they are ineffective without someone clearly responsible for seeing the actions through to completion.

Why the other options are wrong

  • B. Testing corrective actions is important verification but occurs after implementation and does not drive the initial commitment.
  • C. Adequate audit resources support the audit process itself but do not directly ensure management implements agreed-upon actions.
  • D. Organization-wide communication raises awareness but does not create the accountability needed for implementation.

Question 5

Which of the following issues associated with a data center's closed circuit television (CCTV) surveillance cameras should be of MOST concern to an IS auditor?

  1. CCTV recordings are not regularly reviewed.
  2. CCTV records are deleted after one year.
  3. CCTV footage is not recorded 24 x 7.
  4. CCTV cameras are not installed in break rooms.
Show answer and explanation

Correct answer: A. CCTV recordings are not regularly reviewed.

CCTV recordings that are not regularly reviewed provide false security, the system exists but serves no preventive or detective function. Regular review is essential for identifying suspicious activity, responding to incidents, and demonstrating that surveillance serves an actual security purpose. One-year retention is a reasonable policy, 24/7 recording is standard for critical areas, and break room exclusion is typically appropriate for privacy. However, unreviewed footage defeats the purpose of having the system.

Why the other options are wrong

  • B. A one-year retention policy is reasonable and sufficient for most audit and security purposes.
  • C. 24/7 recording is ideal but may be restricted to certain areas; not recording 24/7 in all areas does not eliminate the system's value.
  • D. Break rooms typically should not have CCTV for privacy reasons, so this is not a security concern.

Question 6

An IS auditor has been asked to audit the proposed acquisition of new computer hardware. The auditor's PRIMARY concern is that:

  1. a clear business case has been established.
  2. the new hardware meets established security standards.
  3. a full, visible audit trail will be included.
  4. the implementation plan meets user requirements.
Show answer and explanation

Correct answer: A. a clear business case has been established.

The primary concern for an IS auditor reviewing hardware acquisition is ensuring a clear business case exists. This establishes that the acquisition aligns with organizational strategy, has been justified by demonstrable need, and represents a prudent investment decision. Without a sound business case, security standards, audit trails, and user requirements become secondary concerns. The business case is the foundational justification that should precede all other implementation decisions.

Why the other options are wrong

  • B. Security standards compliance is important but is typically addressed during the procurement specification phase, not the primary audit concern.
  • C. Audit trails are implementation details that support accountability but do not determine whether the acquisition itself is justified.
  • D. Meeting user requirements is important but assumes the acquisition decision itself is justified, which the business case must establish first.

Question 7

To confirm integrity for a hashed message, the receiver should use:

  1. the same hashing algorithm as the sender's to create a binary image of the file.
  2. a different hashing algorithm from the sender's to create a numerical representation of the file.
  3. a different hashing algorithm from the sender's to create a binary image of the file.
  4. the same hashing algorithm as the sender's to create a numerical representation of the file.
Show answer and explanation

Correct answer: D. the same hashing algorithm as the sender's to create a numerical representation of the file.

To confirm message integrity, the receiver must use the same hashing algorithm as the sender to produce a numerical representation (hash value) of the received message. This hash is then compared to the sender's transmitted hash; if they match, integrity is confirmed. Using the same algorithm is essential for reproducibility, and hashing produces a numerical digest, not a binary image. Any variation in algorithm or output format would prevent proper verification.

Why the other options are wrong

  • A. While the same algorithm is correct, hashing produces a numerical representation (digest), not a binary image of the entire file.
  • B. A different hashing algorithm would produce an incompatible result and prevent verification of the original sender's hash.
  • C. Both the different algorithm and binary image characterizations are incorrect; the receiver must use the same algorithm and compare numerical hashes.

Question 8

An organization is implementing a new system that supports a month-end business process.

Which of the following implementation strategies would be MOST efficient to decrease business downtime?

  1. Cutover
  2. Phased
  3. Pilot
  4. Parallel ✅Correct Answer: D, Parallel Parallel implementation keeps the old and new systems running concurrently through the critical month-end period, so the business never loses processing capability while the new system is validated. If the new system produces errors, work continues on the proven system with no interruption, which is exactly what minimizing downtime requires. It costs more in effort and resources than other strategies, but no other approach keeps a fully working fallback available throughout the month-end cycle. Cutover, phased, and pilot approaches all expose the month-end process to gaps or defects with no immediate fallback.
Show answer and explanation

Answer and explanation for question 8

Question 9

Which of the following should be the FIRST step in managing the impact of a recently discovered zero-day attack?

  1. Estimating potential damage
  2. Identifying vulnerable assets
  3. Evaluating the likelihood of attack
  4. Assessing the impact of vulnerabilities
Show answer and explanation

Correct answer: B. Identifying vulnerable assets

When a zero-day attack is discovered, the immediate first step must be to identify which assets in the organization are vulnerable to this new threat. This inventory of vulnerable systems is foundational, without knowing what is at risk, you cannot effectively prioritize response actions, estimate damage, or evaluate likelihood. Once vulnerable assets are identified, then you can assess impact, estimate damage, and implement remediation strategies.

Why the other options are wrong

  • A. Estimating damage is premature before understanding which assets are actually vulnerable to the zero-day.
  • C. Evaluating likelihood of attack is less urgent than first identifying what is exposed to the threat.
  • D. Assessing impact of vulnerabilities should follow identification of which assets are vulnerable.

Question 10

Which of the following is the BEST way to ensure that an application is performing according to its specifications?

  1. Pilot testing
  2. System testing
  3. Integration testing
  4. Unit testing
Show answer and explanation

Correct answer: B. System testing

System testing is the comprehensive phase where an integrated application is tested against the original specifications and requirements to verify it performs as intended. It validates the complete, end-to-end functionality of the application. Pilot testing validates in a live environment but not comprehensively against specs; integration testing focuses on component interactions; unit testing addresses individual code modules. Only system testing directly validates that the entire application meets its specified requirements.

Why the other options are wrong

  • A. Pilot testing evaluates performance in a limited production environment but does not systematically verify all specifications.
  • C. Integration testing verifies that components work together but does not comprehensively validate full application specifications.
  • D. Unit testing validates individual code units but not the overall application behavior against complete specifications.

That was 10 of 1,823.

The full ISACA CISA pack has all 1,823 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack