Free Preparation Discussions
MENU
Isaca CISA Exam Questions
- Topic 1: Information System Auditing Process: This section of the exam measures the skills of an IT Auditor and covers the foundational principles and practices of conducting audits in information systems environments. It includes an understanding of audit standards, planning, execution, and reporting. The focus is on evaluating control effectiveness, identifying risks, and ensuring that audit engagements comply with regulatory and organisational requirements.
- Topic 2: Governance and Management of IT: This section of the exam measures the skills of a Risk and Compliance Analyst and covers the alignment between IT strategy and overall business objectives. It includes evaluating IT governance frameworks, performance monitoring, and risk management processes. The domain assesses how well IT structures, leadership, and policies support corporate governance and enterprise risk appetite.
- Topic 3: Information System Acquisition, Development, and Implementation: This section of the exam measures the skills of an IT Auditor and covers the oversight of system development lifecycles and project governance. It focuses on evaluating whether proper controls are integrated during acquisition and implementation phases. Topics include feasibility analysis, testing, deployment readiness, and ensuring that information systems meet business and regulatory requirements.
- Topic 4: Information Systems Operations and Business Resilience: This section of the exam measures the skills of a Risk and Compliance Analyst and covers the effectiveness of IT operations in supporting business continuity and resilience. It includes assessing operational processes, monitoring, service level agreements, and incident management. The domain also reviews business continuity planning and disaster recovery readiness to ensure minimal disruption during system failures.
- Topic 5: Protection of Information Assets: This section of the exam measures the skills of an IT Auditor and covers the design and implementation of controls that ensure data confidentiality, integrity, and availability. It involves evaluating physical and logical security, access control mechanisms, and information classification strategies. The focus is on how effectively an organisation protects sensitive information against internal and external threats.
Free Isaca CISA Exam Actual Questions
Note: Premium Questions for CISA were last updated On Mar. 10, 2026 (see below)
Which of the following can BEST reduce the impact of a long-term power failure?
When conducting an audit of an organization's use of AI in its customer service chatbots, an IS auditor should PRIMARILY focus on the:
Comprehensive and Detailed Step-by-Step
Theprimary concernwhen auditing an AI-powered chatbot is ensuring thesafeguarding of personal datato comply with privacy regulations such asGDPR, CCPA, and ISO 27701. AI chatbots process customer inquiries, often handling sensitive personal data.
Safeguarding of Personal Data (Correct Answer -- A)
Ensures compliance with data protection laws.
Reduces the risk of unauthorized access or data leakage.
Example:An AI chatbot collecting customer financial information must follow encryption and access control policies.
Compliance with Industry Standards (Incorrect -- B)
Important, but protecting customer data takes priority over general compliance.
Speed and Accuracy of Chatbot Responses (Incorrect -- C)
A performance metric, but not a primary audit focus.
AI's Ability to Handle Multiple Queries (Incorrect -- D)
Efficiency metric, but does not address security risks.
ISACA CISA Review Manual
ISO 27701 (Privacy Information Management System)
GDPR & CCPA Compliance Guidelines
An IS auditor has been asked to review the quality of data in a general ledger system. Which of the following would provide the auditor with the MOST meaningful results?
Which of the following provides the BE ST method for maintaining the security of corporate applications pushed to employee-owned mobile devices?
The best method for maintaining the security of corporate applications pushed to employee-owned mobile devices is implementing mobile device management (MDM). MDM is a software solution that allows an organization to remotely manage, configure, and secure the mobile devices that access its network and data. MDM can help protect corporate applications on employee-owned devices by:
Enforcing security policies and settings, such as encryption, password, firewall, antivirus, and VPN.
Controlling the installation, update, and removal of corporate applications and data.
Separating corporate and personal data and applications on the device using containers or profiles.
Monitoring and auditing the device's compliance status, activity, and location.
Performing remote actions, such as lock, wipe, backup, or restore, in case of loss, theft, or compromise.
MDM can provide a comprehensive and centralized approach to maintain the security of corporate applications on employee-owned devices, regardless of the device type, platform, or ownership. MDM can also help the organization comply with regulatory and industry standards for data protection and privacy.
Enabling remote data destruction capabilities is a useful feature for maintaining the security of corporate applications on employee-owned devices, but it is not the best method by itself. Remote data destruction allows the organization to erase the corporate data and applications from the device in case of loss, theft, or compromise. However, this feature does not prevent unauthorized access or misuse of the corporate data and applications before they are destroyed. Remote data destruction is usually part of an MDM solution.
Disabling unnecessary network connectivity options is a good practice for maintaining the security of corporate applications on employee-owned devices,but it is not the best method by itself. Network connectivity options, such as Wi-Fi, Bluetooth, NFC, or USB, can expose the device to potential attacks or data leakage. Disabling these options when they are not needed can reduce the attack surface and improve battery life. However, this practice does not address other security risks or requirements for the corporate applications on the device. Disabling network connectivity options can also be part of an MDM solution.
Requiring security awareness training for mobile users is an important measure for maintaining the security of corporate applications on employee-owned devices, but it is not the best method by itself. Security awareness training can educate the users about the potential threats and best practices for using their devices securely. It can also help foster a culture of security and responsibility among the users. However, security awareness training cannot guarantee that the users will follow the security policies and guidelines consistently and correctly. Security awareness training should be complemented by technical controls, such as MDM.
Protecting Corporate Data on Mobile Devices for All Companies1
Mobile Device Security: Corporate-Owned Personally-Enabled (COPE)23
A data breach has occurred due lo malware. Which of the following should be the FIRST course of action?
The first course of action when a data breach has occurred due to malware is to quarantine the impacted systems. This means isolating the infected systems from the rest of the network and preventing any further communication or data transfer with them. This can help contain the spread of the malware, limit the damage and exposure of sensitive data, and facilitate the investigation and remediation of the incident. Quarantining the impacted systems can also help preserve the evidence and logs that may be needed for forensic analysis or legal action.
[1] provides a guide on how to respond to a data breach caused by malware and recommends quarantining the impacted systems as the first step.
[2] explains what is malware and how it can cause data breaches, and suggests quarantining the infected devices as a best practice.
[3] describes the steps involved in quarantining a system infected by malware and the benefits of doing so.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Barabara
6 hours agoBrett
8 days agoLindsey
15 days agoCorazon
24 days agoChantell
1 month agoBlossom
1 month agoEllen
2 months agoWilson
2 months agoMaile
2 months agoAja
2 months agoGearldine
3 months agoKaycee
3 months agoKizzy
3 months agoJose
3 months agoAlbert
4 months agoShakira
4 months agoMelynda
4 months agoAretha
4 months agoFrancis
5 months agoAshley
5 months agoZana
5 months agoBasilia
5 months agoDiego
5 months agoSilva
6 months agoVelda
6 months agoJenifer
6 months agoNettie
8 months agoCarey
9 months agoMike
11 months agoNan
12 months agoHelene
1 year agoStephane
1 year agoNu
1 year agoDanilo
1 year agoCathrine
1 year agoDanilo
1 year agoTamala
1 year agoRoyce
1 year agoJade
1 year agoJennie
1 year agoEric
1 year agoTheron
1 year agoJaime
1 year agoLorenza
1 year agoStaci
1 year agoMoon
2 years agoFelicidad
2 years agoSheridan
2 years agoAmmie
2 years agoTijuana
2 years agoMireya
2 years agoDoug
2 years agoSamuel
2 years agoStefany
2 years agoSharee
2 years ago