CISA Practice Questions (2026) — Free Sample Questions with Answers

Answer: A

Reconcile extract record counts and totals to the ledger: Correct. Before relying on analytics, the auditor must confirm that the data is complete and accurate, especially when the auditee produced the extract (1B4). This comes FIRST because results from incomplete or altered data are unreliable.

Run the script and review the exceptions generated: A later step. Exceptions from unvalidated data may be incomplete or misleading.

Document the script logic in the audit workpapers: Needed, but it does not address whether the input data can be relied on.

Ask management to explain the exceptions that are identified: A later step, after the data is validated and the analytics are run.

Validate the completeness and integrity of auditee-provided data before running any audit analytics on it.

Answer: B

Exclude the control network from the audit plan: An accepted risk can still be high; accepting it does not remove the area from audit consideration.

Assess the acceptance against the risk appetite: Correct. Management owns risk decisions, and the auditor evaluates them: whether the acceptance was approved at the right level, is within the risk appetite and is reviewed periodically (1A3). This is BEST because it respects management's role while still giving assurance over the risk.

Report the accepted risk as a high-priority finding: A properly approved risk acceptance is a legitimate management decision, not automatically a finding.

Recommend upgrading the operating systems immediately: Premature. The auditor should first evaluate the acceptance; an upgrade may not be feasible for control systems, and the decision belongs to management.

Risk acceptance belongs to management; the IS auditor evaluates whether the acceptance is authorized and within risk appetite.

Answer: A

Have data owners assign the classification levels: Correct. Data owners understand the business value and sensitivity of their data and are accountable for classifying it; custodians such as DBAs then apply the matching controls (data classification, 2A7; task 31). This corrects the root cause.

Have the security team review the assigned levels annually: Detective and periodic; the levels are still set by the wrong party.

Have database administrators document their criteria: Better documentation does not fix the fact that custodians, not owners, are classifying.

Have report users label the data they extract: Moves classification to yet another party without business accountability and produces inconsistent labels.

Data owners classify data; custodians implement the controls the classification requires.

Answer: D

Assign each risk to the chief information security officer: Keeps ownership inside IT/security, which still separates the risk from the business accountable for it.

Have the IS audit function monitor each listed risk: Auditors assess and report; taking on risk monitoring is a management role and impairs independence.

Increase how often the risk register is updated: More frequent updates do not correct who owns the risks.

Assign each risk to the relevant business process owner: Correct. Risk ownership should sit with the manager who is accountable for the business process and can decide on and fund the response (ERM, 2A5; task 14). IT supports the controls, but the business owns the risk, which makes this the BEST recommendation.

Business process owners own the risks to their processes; IT owns and operates controls on their behalf.

Answer: D

The policy specifies configuration settings for each platform: Wrong level of detail: settings belong in standards and procedures, not in a high-level policy.

The policy matches the policies of peer organizations: Secondary: a policy must reflect this organization's risks and objectives, not mirror others.

The policy was drafted by the information security team: Authorship does not matter; approval and communication give a policy its force.

Senior management has approved and communicated the policy: Correct. A policy carries authority only when senior management approves it, and it is effective only when the people it governs know it (IT policies, 2A3; task 11). This is MOST important because every standard and procedure derives from it.

Policies are high-level statements that must be approved by senior management and communicated; detail belongs in standards and procedures.

Answer: B

Minutes of the daily stand-up meetings: Stand-ups coordinate the team's work. They do not show that the business accepted what was delivered.

Product owner acceptance against defined criteria: Correct. In agile, the product owner represents the business and accepts each user story against its acceptance criteria. This is the key control that delivered functionality meets business needs (system development methodologies, 3A3; task 21).

Burndown charts for each sprint: Burndown charts track how fast work is completed, not whether it meets business needs.

A complete requirements specification before each sprint: Overreaching. This forces a waterfall approach onto agile. The control objective can be met through acceptance criteria without it.

In agile, look for business acceptance of each increment against defined criteria, not for up-front documentation.

Answer: B

Replication will use a large share of network bandwidth: Bandwidth use is an operational cost, not a recovery failure.

Corrupted or encrypted data will also be replicated: Correct. Replication copies every change, including corruption, accidental deletion or ransomware encryption, so no clean earlier copy would exist (data backup and storage, 4B3). Point-in-time, offline or immutable backups are needed.

Staff at the secondary site will need replication training: Training is a minor issue compared with having no clean copy of the data.

Replication software will need separate licenses: Licensing is a cost issue and does not affect recoverability.

Replication protects availability, not against logical corruption; keep point-in-time copies that are isolated from production.

Answer: B

The circuits from both carriers provide equal bandwidth: Equal bandwidth is a capacity preference; it does not ensure that one failure leaves the other link working.

The circuits share no physical route into the building: Correct. Two carriers give no resilience if both circuits run through the same conduit or entry point, where one cut disables both (diverse routing, system resilience, 4B2). Physical route diversity is MOST important.

The contracts include penalties for service outages: Penalties compensate for outages but do not prevent them.

The carriers provide monthly circuit utilization reports: Utilization reports support capacity management, not resilience.

Redundant links are resilient only if they are physically diverse, with no shared route, conduit or entry point.

Answer: D

Add more service desk staff to restore service faster: Faster restoration treats symptoms; the failure will keep recurring.

Shorten the target time for incident resolution: Tighter targets do not remove the cause of the recurring incident.

Escalate each future incident to senior management: Escalation adds visibility but does not address the root cause.

Open a problem record to find the root cause: Correct. Incident management restores service; problem management finds and removes the underlying cause of repeated incidents (problem and incident management, 4A7). A problem record addresses the recurrence.

Recurring incidents call for problem management: identify the root cause and a permanent fix rather than repeated restoration.

Answer: C

Reviewing the change advisory board's meeting minutes: Minutes cover only changes submitted to the board. Unauthorized changes bypass it.

Tracing a sample of approved change requests to production programs: The wrong direction. Starting from approved requests tests only changes already known, so a change made without a request is never sampled.

Tracing a sample of production program changes to approved change requests: Correct. Starting from a system-generated record of what actually changed in production and tracing it back to approvals catches changes that never had a request. This is the direction that tests for unauthorized changes (change management, 4A8; task 33).

Interviewing the change manager about the approval process: Inquiry describes the design of the process. It gives no evidence about the changes that actually happened.

To find unauthorized changes, start from the population of actual production changes and trace back to approvals.

Answer: C

The sensor uses signatures rather than anomaly detection: Signature detection is designed to catch known attack strings like the ones logged.

The sensor detects attacks but cannot block them: True of any IDS, but an IDS that cannot block should still alert; it does not explain the missing alerts.

The sensor cannot inspect the encrypted traffic content: Correct. Because TLS is terminated on the web server, the sensor sees only encrypted payloads and cannot match attack signatures, even for well-known attacks (IDS limitations, 5B4). This explains why the attacks appear in the server logs but not in the IDS, so it is MOST likely.

The sensor does not forward its alerts to the web server: IDS alerts go to the monitoring console or SIEM, not the web server; this would not stop alerts being raised.

A network IDS cannot inspect encrypted payloads; monitor decrypted traffic (after termination) or use host-based detection.

Answer: A

Calling the supplier at a known number to confirm changes: Correct. Verifying the change through an independent channel (a known phone number, not one in the e-mail) stops the fraud even when the e-mail is convincing or sent from a compromised supplier mailbox (business e-mail compromise, 5B2). It is preventive and does not depend on spotting the deception, so it is BEST.

Training accounts payable staff to recognize spoofed sender addresses: Helpful, but a compromised genuine supplier mailbox shows a legitimate address, so training alone cannot reliably prevent the fraud.

Reviewing the monthly report of changes to supplier bank details: A monthly review is detective; the payment may already have been sent to the fraudster.

Scanning inbound e-mail attachments for malicious code: Payment-redirection requests usually contain no malware; this control addresses a different threat.

Changes to payment instructions requested by e-mail should be verified out of band using contact details already on file.

Answer: B

Encryption of each payment instruction with the bank's public key: This gives confidentiality: anyone can encrypt with the bank's public key, so it proves nothing about the sender.

A digital signature created with the client's private key: Correct. Only the client holds its private key, so a valid signature verified with the client's certified public key proves origin and integrity and supports non-repudiation (digital signatures, 5A7).

An encrypted session between the client and the bank: Transport encryption protects data in transit but leaves no lasting proof of who sent each instruction.

A message authentication code using a shared secret key: A MAC proves integrity, but because both parties hold the key, either could have created it, so it does not give non-repudiation.

Non-repudiation needs a digital signature made with a private key that only the sender holds; shared-key methods cannot provide it.

Answer: C

Reviewing the vendor connection logs every month: Log review is detective and leaves the connection open at all times.

Requiring the vendor to sign a confidentiality agreement: A contractual control addresses disclosure by the vendor, not the open technical path an attacker could use.

Enabling the connection only for approved sessions: Correct. Opening vendor access only for an approved support request, for a limited time, and closing it afterward removes the standing path into production (least privilege for network access, 5A4). It is preventive and addresses the exposure directly, so it is BEST.

Changing the vendor connection password every quarter: Password rotation does not remove the permanent exposure of the connection.

Third-party remote access should be enabled on demand for approved sessions, not left permanently open.