HikeLetter | PMP Training & Certification Online Course | Project Management Learning

Overview

Course Description

Certification: Certified Information Systems Auditor (CISA)
Provider: ISACA
Exam code: CISA (ISACA identifies the exam by certification name; no separate numeric exam code listed)
Exam duration: 4 hours
Question count: 150 multiple-choice questions
Passing score: 450 on a 200–800 scaled score
Exam fee (USD): ISACA member: US$575; nonmember: US$760 (confirm current regional taxes and
checkout price)

Course Questions

10 Questions

An IS auditor is planning an audit of a business-critical application. What should be the auditor's FIRST priority?

A. Select testing tools B. Understand business objectives, risks, scope, and audit criteria C. Begin sampling production records D. Draft findings before fieldwork

An application processes high-value transactions but has not been audited recently. How should the auditor prioritize it?

A. Audit every system equally B. Assess inherent risk, control environment, and business impact to determine priority C. Prioritize systems based only on age D. Wait for management to request an audit

An auditor is assigned to assess a control they designed and implemented last month. What is the best action?

A. Proceed without disclosure B. Disclose the conflict and seek an independent auditor or suitable safeguards C. Change the audit criteria D. Ask the control owner to write the findings

A control owner says that access reviews are performed but provides no evidence. What should the auditor do?

A. Accept the verbal statement as sufficient B. Obtain and evaluate appropriate evidence that the reviews occurred and were effective C. Close the audit immediately D. Assume the control is effective

The auditor finds several exceptions in a sample of access approvals. What should happen next?

A. Ignore the exceptions because the sample is small B. Evaluate the exceptions, determine cause and potential extent, and consider additional testing C. Automatically conclude every transaction is fraudulent D. Delete the sample results

A company invests in IT projects without clear business ownership or benefit tracking. What should the auditor recommend?

A. More projects without governance B. Defined accountability, business-case approval, and benefits realization monitoring C. Remove project reporting D. Let vendors set business priorities

A terminated employee's account remains active. Which control weakness does this most directly indicate?

A. Inadequate user access deprovisioning B. Excessive backup frequency C. Poor network cabling D. Missing project charter

A developer directly changes production code without approval or testing. What is the primary concern?

A. Improved auditability B. Unauthorized or untested changes may disrupt services or introduce vulnerabilities C. Stronger separation of duties D. Lower risk by default

A critical application has backups but no documented recovery procedure. What should the auditor emphasize?

A. Backups alone guarantee recovery B. Document and test recovery procedures against approved RTO and RPO objectives C. Delete old backups D. Stop testing to avoid disruption

A database containing sensitive personal information is accessible to many employees without a business need. What is the best recommendation?

A. Apply least privilege and periodically review access B. Give all employees administrator access C. Remove audit logs D. Share one account across teams

₹4999.00 ₹1999.00

Enroll Now

Certified Information Systems Auditor : CISA