Question bank
ISACA CISA
43 ISACA CISA questions with the correct answer and a written explanation, organised across 5 exam domains.
- 43 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Governance and Management of IT
8 questions in this domain
- Question 1Single Choice
Which one of the following activities best represents IT governance rather than routine operational management?
- AEvaluating investment outcomes against strategyCorrect answer
- BConfiguring firewall rules on servers
- CExecuting a planned database migration
- DResolving incidents at the service desk
Why this is the answer
IT governance involves evaluating, directing, and monitoring against strategy. Configuring, executing, and resolving are operational management tasks performed under governance.
- Question 2Multiple Select
Which activities are recognized as COBIT 2019 governance activities in the framework? Select all that apply.
- AEvaluateCorrect answer
- BDirectCorrect answer
- CMonitorCorrect answer
- DPlan
Why this is the answer
COBIT separates governance into evaluate, direct, and monitor. Plan, build, run, and monitor are management activities under the framework.
- Question 3Interactive
Refer to the code block shown. Which COBIT 2019 domain contains the displayed governance activities?
- AGovernanceCorrect answer
- BManagement
- COperations
- DAcquisition
Why this is the answer
The code lists evaluate, direct, and monitor, the three COBIT governance activities, so they belong to the governance domain.
- Question 4Single Choice
Which published standard is a principle-based framework designed specifically for direct use at board-level IT governance?
- AISO/IEC 38500Correct answer
- BCOBIT 2019
- CITIL 4
- DCMMI
Why this is the answer
ISO/IEC 38500 offers six principles for corporate governance of IT and addresses the governing body directly; COBIT is more prescriptive.
- Question 5Multiple Select
Which statements about centralized, decentralized, and federated IT structures are true? Select all that apply.
- ACentralized IT consolidates infrastructure for cost efficiencyCorrect answer
- BDecentralized IT can cause duplication and inconsistent standardsCorrect answer
- CFederated IT combines a central core with distributed teamsCorrect answer
- DCentralized IT automatically ensures effective governance
Why this is the answer
Each structure has trade-offs. Centralization helps efficiency, decentralization may duplicate effort, and federated models balance both; structure alone does not guarantee governance.
- Question 6Interactive
Refer to the code block. In the RACI matrix shown, which role has final accountability for vendor selection?
- ASteering CommitteeCorrect answer
- BIT Manager
- CLegal
- DCFO
Why this is the answer
In RACI, the A role is Accountable and holds final ownership. The IT Manager is Responsible, while Legal and CFO are Consulted/Informed.
- Question 7Single Choice
Which single artifact provides the strongest evidence that IT strategy is aligned with the business strategy?
- AIT strategic plan derived from the business planCorrect answer
- BDepartmental hardware inventory list
- CService desk incident log
- DList of installed software licenses
Why this is the answer
Alignment is shown when the IT strategic plan is derived from and continuously realigned to business strategy. Other artifacts are operational records.
- Question 8Multiple Select
Which document types are considered mandatory controls in the governance hierarchy? Select all that apply.
- APolicyCorrect answer
- BStandardCorrect answer
- CProcedureCorrect answer
- DGuideline
Why this is the answer
Policies, standards, and procedures are mandatory. Guidelines are recommended practices and are not required, though they may support implementation.
Information Systems Acquisition, Development and Implementation
5 questions in this domain
- Question 9Single Choice
In the context of information systems acquisition, which document supports a decision by justifying project initiation?
- ABusiness caseCorrect answer
- BFeasibility study
- CTest plan
- DVendor contract
Why this is the answer
A business case is a formal decision-support document that justifies an IS investment and serves as the baseline for later post-implementation reviews.
- Question 10Multiple Select
Which of the following are recognized feasibility categories assessed during the information systems acquisition process?
- ATechnical feasibilityCorrect answer
- BEconomic feasibilityCorrect answer
- COperational feasibilityCorrect answer
- DLegal/regulatory feasibilityCorrect answer
Why this is the answer
Classic feasibility categories include technical, economic, operational, schedule, and legal/regulatory feasibility; they are used to screen alternatives.
- Question 11Interactive
The code block calculates an appraisal value by discounting future cash flows. Which financial technique does it implement?
- ANet present value (NPV)Correct answer
- BPayback period
- CReturn on investment (ROI)
- DBreak-even analysis
Why this is the answer
NPV discounts expected future cash flows to present value, providing a more accurate economic view than payback or ROI.
- Question 12Single Choice
Which alternative must be included in an alternatives analysis to serve as the baseline for an IT investment?
- ADo nothingCorrect answer
- BBest of breed
- COutsourcing
- DCloud first
Why this is the answer
The do nothing baseline is a legitimate comparator and is required to determine the incremental net impact of the proposed investment.
- Question 13Multiple Select
Which of the following are financial appraisal techniques commonly used to evaluate information technology investments?
- ANet present value (NPV)Correct answer
- BPayback periodCorrect answer
- CReturn on investment (ROI)Correct answer
- DBenchmarking
Why this is the answer
Payback, ROI, and NPV are common appraisal methods; benchmarking is a comparison technique, not a financial appraisal method.
Information Systems Auditing Process
8 questions in this domain
- Question 14Single Choice
Within ISACA's ITAF, which term applies to the 1000-series publications?
- AMandatory standardsCorrect answer
- BAdvisory guidelines
- CIllustrative tools
- DImplementation templates
Why this is the answer
ITAF 1000-series documents are mandatory audit standards. Guidelines are 2000-series, while tools and techniques are 3000-series.
- Question 15Multiple Select
Which of the following obligations are included in ISACA's Code of Professional Ethics? (Select all that apply.)
- AMaintaining integrity and objectivityCorrect answer
- BExercising due professional careCorrect answer
- CGuaranteeing absolute certainty of audit conclusions
- DDisclosing all confidential information to the public on request
Why this is the answer
The Code requires integrity, objectivity, and due professional care. It does not guarantee absolute certainty or permit public disclosure of confidential information.
- Question 16Interactive
Review the query in the code block. What is this CAAT primarily used to identify?
- ADuplicate invoicesCorrect answer
- BGhost employees
- CUnauthorized configuration changes
- DInvalid approval codes
Why this is the answer
The query groups invoices by invoice number and returns those with more than one occurrence, which indicates duplicate invoices.
- Question 17Single Choice
If an IS auditor deviates from an ISACA guideline, what action is expected?
- ADocument the rationale and demonstrate the standard is metCorrect answer
- BNo documentation is needed because guidelines are optional
- CImmediately notify an external regulator
- DObtain approval from the auditee's board
Why this is the answer
Guidelines are advisory. A deviation is acceptable if the auditor documents the reason and proves the applicable standard is met.
- Question 18Multiple Select
Which of the following are structure layers of ISACA's ITAF? (Select all that apply.)
- AStandardsCorrect answer
- BGuidelinesCorrect answer
- CCOBIT control objectives
- DISO 27001 requirements
Why this is the answer
ITAF is structured into standards, guidelines, and tools and techniques. COBIT and ISO 27001 are separate frameworks.
- Question 19Interactive
Review the SQL logic in the code block. What does the resulting list represent?
- AA prioritized audit universe based on residual riskCorrect answer
- BA list of audit committee decisions
- CA record of all audit findings
- DA catalog of management action plans
Why this is the answer
The query orders auditable entities using inherent risk and control effectiveness scores, producing a residual risk priority list.
- Question 20Single Choice
Which statement best defines the audit universe?
- AThe complete inventory of possible auditable entitiesCorrect answer
- BThe approved list of audits for the fiscal year
- CThe collection of audit findings from past audits
- DThe risk register maintained by management
Why this is the answer
The audit universe includes every potential auditable entity. The audit plan is the risk-prioritized subset of that universe.
- Question 21Multiple Select
Which of the following are components of the IT audit risk model? (Select all that apply.)
- AInherent riskCorrect answer
- BControl riskCorrect answer
- CDetection riskCorrect answer
- DResidual risk
Why this is the answer
IT audit risk is composed of inherent, control, and detection risk. Residual risk is not a component of this formula.
Information Systems Operations and Business Resilience
11 questions in this domain
- Question 22Single Choice
What is the primary purpose of IT service management?
- AFraud detection
- BDesign, deliver, manage, and improve IT useCorrect answer
- CMarketing IT products
- DNetwork hardware installation
Why this is the answer
ITSM is a structured framework for designing, delivering, managing, and improving the use of IT in alignment with business objectives.
- Question 23Multiple Select
Which two actions are primary goals of incident management? (Select two.)
- ARestore normal service operation quicklyCorrect answer
- BMinimize impact on business operationsCorrect answer
- CIdentify underlying root causes
- DEliminate all configuration errors
Why this is the answer
Incident management focuses on rapid restoration and impact minimization; root cause analysis belongs to problem management.
- Question 24Interactive
Review the incident record extract in the code block. Based on the repeated failure pattern, which process should be initiated?
- AProblem managementCorrect answer
- BIncident management
- CRelease management
- DAsset management
Why this is the answer
Repeated incidents with the same symptom trigger problem management to find and eliminate the root cause.
- Question 25Single Choice
What does recovery point objective (RPO) measure?
- AMaximum tolerable data lossCorrect answer
- BMaximum acceptable downtime
- CTime to restore service
- DNumber of backup copies
Why this is the answer
RPO defines the maximum tolerable data loss measured in time; downtime is defined by RTO.
- Question 26Multiple Select
Which of the following are recognized backup types? (Select three.)
- AFullCorrect answer
- BIncrementalCorrect answer
- CDifferentialCorrect answer
- DMirrored disk
Why this is the answer
Full, incremental, and differential are standard backup types; mirrored disk supports availability, not historical backup.
- Question 27Interactive
Refer to the reporting snippet in the code block. Why should the auditor question the availability metric?
- AOutage during core business hours is hiddenCorrect answer
- BUptime is too high
- CAvailability was not measured
- DCustomers were not affected
Why this is the answer
Averaged 24/7 availability can mask outages during critical business hours, which is a key SLA audit concern.
- Question 28Single Choice
What control applies to emergency changes?
- APost-implementation reviewCorrect answer
- BFull user acceptance testing
- C30-day advance notice
- DElimination of documentation
Why this is the answer
Emergency changes need urgent approval but must still be documented and undergo post-implementation review.
- Question 29Multiple Select
Which controls are typical in incident management? (Select three.)
- ADocumented proceduresCorrect answer
- BDefined response timesCorrect answer
- CAutomatic escalationCorrect answer
- DUnrestricted administrator access
Why this is the answer
Incident management includes documented procedures, response times, and automatic escalation; unrestricted access violates least privilege.
- Question 30Interactive
The code block describes a change classification. What authorization path should this change follow?
- AUse pre-approved standard change pathCorrect answer
- BFull CAB assessment required
- CEmergency approval
- DOnly developer self-approval
Why this is the answer
Standard changes are pre-approved, low-risk, and template-driven, so they do not require a full CAB review.
- Question 31Single Choice
Which process identifies and eliminates the root cause of recurring incidents?
- AIncident management
- BProblem managementCorrect answer
- CService level management
- DRelease management
Why this is the answer
Problem management analyzes incident trends and permanently fixes underlying root causes.
- Question 32Multiple Select
Which statements correctly describe a configuration management database (CMDB)? (Select three.)
- AContains configuration items and relationshipsCorrect answer
- BSupports impact analysis for changesCorrect answer
- CRecords technical dependenciesCorrect answer
- DReplaces the financial asset register
Why this is the answer
CMDB records CIs and relationships for impact analysis; it does not replace asset inventory.
Protection of Information Assets
11 questions in this domain
- Question 33Single Choice
What is an information security strategy in an enterprise context?
- AHigh-level roadmap aligning security with business objectivesCorrect answer
- BDetailed configuration guide for firewalls
- CStandalone technical project managed by IT
- DAnnual compliance checklist
Why this is the answer
An information security strategy is a business-driven roadmap that aligns security investments with enterprise objectives and risk appetite.
- Question 34Multiple Select
Which two responsibilities belong to the board regarding information security strategy?
- AApprove the security strategyCorrect answer
- BSet the enterprise risk appetiteCorrect answer
- CConfigure network firewalls
- DPerform daily vulnerability scans
Why this is the answer
The board approves the strategy and sets risk appetite; firewall configuration and scanning are operational tasks.
- Question 35Interactive
An auditor runs this query to identify accounts with no recent review. Which IAM control is being tested?
- AAccess recertificationCorrect answer
- BUser provisioning
- CAuthentication
- DSingle sign-on
Why this is the answer
The query detects stale access reviews, so it tests access recertification, a detective IAM control.
- Question 36Single Choice
Which governance document provides mandatory high-level direction and is approved by management?
- APolicyCorrect answer
- BProcedure
- CGuideline
- DStandard
Why this is the answer
A policy is mandatory, high-level direction approved by management; standards and procedures state how, and guidelines are optional.
- Question 37Multiple Select
Which two items are standard authentication factors?
- ASomething you knowCorrect answer
- BSomething you haveCorrect answer
- CSomething you want
- DSomething you forgot
Why this is the answer
Authentication factors are knowledge, possession, and inherence; something you know and have are valid factors.
- Question 38Interactive
The user authenticates once and uses a token for multiple applications. Which two statements describe this architecture?
- AIt is single sign-onCorrect answer
- BIt uses a central identity providerCorrect answer
- CIt requires separate passwords for each app
- DIt eliminates all access control risk
Why this is the answer
SSO uses a central identity provider and one token for many apps; it improves convenience but does not eliminate risk.
- Question 39Single Choice
Which cryptographic method is most efficient for bulk data encryption?
- ASymmetric cryptographyCorrect answer
- BAsymmetric cryptography
- CDigital signature
- DHash function
Why this is the answer
Symmetric cryptography uses a single shared key and is fast, making it appropriate for bulk data encryption.
- Question 40Multiple Select
Which three outcomes are provided by a digital signature?
- AAuthenticityCorrect answer
- BIntegrityCorrect answer
- CNon-repudiationCorrect answer
- DConfidentiality
Why this is the answer
Digital signatures verify origin, detect alteration, and prevent denial, but they do not encrypt the message.
- Question 41Interactive
An auditor issues this command to verify a certificate's revocation status in near real time. Which technology is used?
- AOCSPCorrect answer
- BCRL
- CHSM
- DCA
Why this is the answer
OCSP provides real-time certificate revocation checks, while a CRL is a periodic publication.
- Question 42Single Choice
Which network security control passively monitors traffic and generates alerts but does not block it?
- AIntrusion detection systemCorrect answer
- BIntrusion prevention system
- CFirewall
- DVPN concentrator
Why this is the answer
An IDS is passive and detective; an IPS is inline and can block malicious traffic.
- Question 43Multiple Select
Which three components are part of endpoint security?
- AEndpoint detection and responseCorrect answer
- BHost-based firewallCorrect answer
- CAntimalwareCorrect answer
- DNetwork switch
Why this is the answer
Endpoint security includes EDR, host firewalls, and antimalware; a network switch is infrastructure, not endpoint.
Frequently asked questions
Everything about the ISACA CISA question bank and how to use it.