ISACA Certified Information Systems Auditor (CISA) practice questions

Domain coverage 5 domains

• Information System Auditing Process (21%)
• Governance & Management of IT (17%)
• Information Systems Acquisition, Development & Implementation (12%)
• Information Systems Operations & Business Resilience (23%)
• Protection of Information Assets (27%)

Sample questions 40 of 400 shown

1. Q1

   Which of the following should be the role of internal audit in an organization’s move to the cloud?

   1. Identifying and mitigating risk to an acceptable level
   2. Identifying impacts to organizational budgets and resources
   3. Implementing security controls for data prior to migration
   4. Serving as a trusted partner and advisor

   The internal audit function should act as an independent advisor during a cloud migration. Identifying budget and resource impacts (B) is a key advisory responsibility that doesn't impair independence. Options A and C are operational activities (risk mitigation and implementing controls) that would compromise audit independence. Option D is too vague and doesn't specifically define the audit role in a cloud migration context.
2. Q2

   An IS auditor is providing input to an RFP to acquire a financial application system. Which of the following is MOST important for the auditor to recommend?

   1. The application should meet the organization's requirements.
   2. Vendor employee background checks should be conducted regularly.
   3. Audit trails should be included in the design.
   4. Potential suppliers should have experience in the relevant area.

   When providing input to an RFP (Request for Proposal), the IS auditor's primary focus should be ensuring the application meets the organization's business and technical requirements. This is fundamental to ensuring the system will support business objectives and comply with relevant standards. While audit trails (C) are important for control and compliance, they are a subset of overall requirements. Vendor background checks (B) and experience (D) are important evaluation criteria but are secondary to ensuring the application fulfills organizational needs.
3. Q3

   Which of the following provides the GREATEST assurance that a middleware application compiling data from multiple sales transaction databases for forecasting is operating effectively?

   1. Automated reconciliations
   2. Exception reporting
   3. Manual checks
   4. Continuous auditing

   Continuous auditing provides the greatest assurance for a middleware application compiling data from multiple databases because it involves automated testing and monitoring throughout the reporting period, providing real-time or near-real-time assurance. Automated reconciliations (A) and exception reporting (B) are components of continuous auditing but are not as comprehensive on their own. Manual checks (C) are the least reliable and efficient method for ensuring effectiveness of automated systems.
4. Q4

   Audit observations should be FIRST communicated with the auditee:

   1. during fieldwork.
   2. at the end of fieldwork.
   3. within the audit report.
   4. when drafting the report.

   Audit observations should be FIRST communicated to the auditee during fieldwork. This allows for immediate clarification, discussion, and agreement on findings while the auditor is still on-site and has direct access to evidence and personnel. Early communication also helps build rapport and ensures accuracy before formal reporting. Options B, C, and D represent later stages in the audit process (end of fieldwork, draft report, final report) which are too late for initial communication.
5. Q5

   A bank performed minor changes to the interest calculation computer program. Which of the following techniques would provide the STRONGEST evidence to determine whether the interest calculations are correct?

   1. Review of the quality assurance (QA) test results
   2. Manual verification of a sample of the results
   3. Source code review
   4. Parallel simulation using audit software

   Parallel simulation using audit software provides the strongest evidence because it involves the auditor writing programs to process the same data as the application and then comparing the results. This independently verifies the calculation logic and can cover 100% of transactions. It's more reliable than QA test results (A) which may not cover all scenarios or use production data, manual verification (B) which is sample-based and may miss errors, or source code review (C) which verifies the code but doesn't verify actual output with real data.
6. Q6

   An IS auditor has been asked to review an event log aggregation system to ensure risk management practices have been applied. Which of the following should be of MOST concern to the auditor?

   1. Completeness testing has not been performed on the log data.
   2. Log feeds are uploaded via batch process.
   3. The log data is not normalized.
   4. Data encryption standards have not been considered.

   The MOST concern should be that completeness testing has not been performed on the log data. Without completeness testing, there's no assurance that all relevant events are being captured by the log aggregation system, which severely undermines its effectiveness for risk management and incident detection. Options B, C, and D are important considerations but secondary to ensuring the system captures complete and accurate log data.
7. Q7

   Which of the following is MOST likely to increase if an organization increases its risk appetite?

   1. Audit findings
   2. Key controls
   3. Opportunities
   4. Security incidents

   If an organization increases its risk appetite, it becomes more willing to accept risk, which MOST likely increases security incidents (D). Risk appetite defines the amount and type of risk an organization is willing to accept to achieve its objectives. A higher risk appetite means weaker controls or more relaxed security measures, leading to more security incidents. Options A, B, and C may change but are not directly and immediately impacted by risk appetite changes.
8. Q8

   What should an IS auditor recommend to management as the MOST important action before selecting a Software as a Service (SaaS) vendor?

   1. Determine service level requirements.
   2. Perform a business impact analysis (BIA).
   3. Complete a risk assessment.
   4. Conduct a vendor audit.

   Before selecting a SaaS vendor, the MOST important action is to complete a risk assessment (C). This identifies potential risks associated with the vendor and the cloud service, enabling informed decision-making. Determining service level requirements (A) is important but should be done after understanding the risks. BIA (B) and vendor audit (D) are also important but come after initial risk assessment.
9. Q9

   During an audit of payment services of a branch based in a foreign country, a large global bank's audit team identifies an opportunity to use data analytics techniques to identify abnormal payments. Which of the following is the team's MOST important course of action?

   1. Request the data from the branch as the team audit charter covers the country where it is based.
   2. Conduct a walk through of the analytical strategy with stakeholders of the audited branch to obtain their buy-in.
   3. Consult the legal department to understand the procedure for requesting data from a different jurisdiction.
   4. Agree on a data extraction and sharing strategy with the IT team of the audited branch.

   When dealing with data across jurisdictions (foreign country), the MOST important action is to consult the legal department to understand data privacy laws, cross-border data transfer regulations, and proper procedures for requesting data from a different jurisdiction. This ensures compliance with legal and regulatory requirements. Options A, B, and D are important but secondary to ensuring legal compliance.
10. Q10

    Which of the following is the BEST way for an IS auditor to assess the design of an automated application control?

    1. Interview the application developer.
    2. Obtain management attestation and sign-off.
    3. Review system configuration parameters and output.
    4. Review the application implementation documents.

    The BEST way to assess the design of an automated application control is to review system configuration parameters and output (C). This allows the auditor to directly examine how the control is configured and verify its effectiveness through actual system output. Interviewing the developer (A) provides only theoretical understanding. Management attestation (B) is not sufficient evidence. Implementation documents (D) describe intended design but don't verify actual implementation.
11. Q11

    The PRIMARY reason to perform internal quality assurance (QA) for an internal audit function is to ensure:

    1. inherent risk in audits is minimized.
    2. audit resources are used most effectively.
    3. internal audit activity conforms with audit standards and methodology.
    4. the audit function is adequately governed and meets performance metrics.

    The PRIMARY reason for internal quality assurance (QA) for an internal audit function is to ensure the internal audit activity conforms with audit standards and methodology (C). This ensures consistency, quality, and compliance with professional standards (e.g., IIA Standards). While effective resource use (B) and performance metrics (D) are important, they are not the primary purpose of QA. Inherent risk (A) is not minimized by QA.
12. Q12

    An audit program indicates that a specific number of transactions are to be sampled for testing a particular control. However, it has been determined that the control design is deficient. What should the IS auditor do in response to this information?

    1. Recommend a change to the audit program to increase the sample size.
    2. Recommend a change to the audit program and testing methodology used.
    3. Document the observation and the testing methodology used.
    4. Notify audit management and continue to use the sample size.

    If the control design is deficient, the auditor should recommend a change to the audit program and testing methodology used (B). Testing a deficient control design is wasteful and doesn't provide meaningful assurance. The auditor should focus on documenting the design deficiency and testing the design itself, not on testing operating effectiveness. Increasing sample size (A) won't help if the control design is flawed. Simply documenting (C) without changing approach is insufficient.
13. Q13

    Which of the following is an example of inherent risk?

    1. Quality assurance (QA) processes may not effectively reduce errors.
    2. An approval process may not detect significant errors.
    3. The organization may not comply with regulations.
    4. Projects may still be delayed despite management controls.

    Inherent risk exists before considering internal controls. 'The organization may not comply with regulations' (C) is an example of inherent risk - it's the risk that exists in the environment regardless of controls. Options A and B describe control risks (risks that controls won't work effectively). Option D describes a risk that might occur despite controls (residual risk).
14. Q14

    Which of the following is the MOST significant risk when an application uses individual end-user accounts to access the underlying database?

    1. Users may be able to circumvent application controls.
    2. Application may not capture a complete audit trail.
    3. User accounts may remain active after a termination.
    4. Multiple connects to the database are used and slow the process.

    When an application uses individual end-user accounts to access the underlying database, the MOST significant risk is that the application may not capture a complete audit trail (B). Individual accounts mean each user connects directly to the database, making it difficult to track through the application layer what actions were performed. The application's audit trail may not capture the actual database activities. Options A, C, and D are concerns but not as significant as the loss of audit trail.
15. Q15

    An IS auditor is performing a project review and finds that scope reductions have been made without proper authorization. The IS auditor should be MOST concerned that:

    1. there could be significant delays in project completion.
    2. the project has not followed project management standards.
    3. project costs could increase above the original project budget.
    4. anticipated business functionality may not be delivered.

    The IS auditor should be MOST concerned that anticipated business functionality may not be delivered (D). Unauthorized scope reductions mean the project may not deliver the expected business benefits and functionality that justified the project investment. While delays (A), not following standards (B), and cost increases (C) are concerns, the primary concern is that the project may fail to deliver expected business value.
16. Q16

    In reviewing the IT strategic plan, the IS auditor should consider whether it identifies the:

    1. project management methodologies used.
    2. allocation of IT staff.
    3. major IT initiatives.
    4. links to operational tactical plans.

    When reviewing the IT strategic plan, the IS auditor should consider whether it identifies links to operational tactical plans (D). The IT strategic plan should align with and support the organization's overall strategic objectives and link to operational plans. While major IT initiatives (C) are important, they should be derived from strategic alignment. Project management methodologies (A) and IT staff allocation (B) are tactical/operational details, not strategic plan components.
17. Q17

    Which of the following would the IS auditor MOST likely review to determine whether modifications to the operating system parameters were authorized?

    1. Change control log
    2. Documentation of exit routines
    3. Security system parameters
    4. System initialization logs

    To determine whether modifications to operating system parameters were authorized, the IS auditor would MOST likely review the change control log (A). The change control log records all changes, including who requested them, who approved them, and when they were implemented. This provides evidence of authorization. Options B, C, and D don't provide information about change authorization.
18. Q18

    An organization is disposing of removable onsite media which contains sensitive information. Which of the following is the MOST effective method to prevent disclosure of sensitive data?

    1. Wiping and rewriting three times
    2. Software formatting
    3. Encrypting and destroying keys
    4. Machine shredding

    Machine shredding (D) is the MOST effective method to prevent disclosure of sensitive data on removable media because it physically destroys the media, making data recovery virtually impossible. Wiping and rewriting (A) and software formatting (B) can leave recoverable data. Encrypting and destroying keys (C) is effective if encryption is strong, but shredding provides the highest assurance.
19. Q19

    The BEST way to provide assurance that a project is adhering to the project plan is to:

    1. conduct compliance audits at major system milestones.
    2. require design reviews at appropriate points in the life cycle.
    3. have an IS auditor participate on the quality assurance (QA) team.
    4. have an IS auditor participate on the steering committee.

    The BEST way to provide assurance that a project is adhering to the project plan is to conduct compliance audits at major system milestones (A). This provides independent verification at critical points in the project lifecycle. Design reviews (B) are important but may not cover all aspects of plan adherence. Having an auditor on the QA team (C) or steering committee (D) provides oversight but not independent assurance.
20. Q20

    An organization requires any travel and entertainment expenses over $10,000 to be approved by senior management. Which of the following is the MOST effective way to mitigate the risk that employees will split invoices to avoid the approval process?

    1. Develop computer-assisted audit techniques (CAATs) to check the full year's transactions.
    2. Adopt a zero-tolerance policy that requires termination of employees who submitted fraudulent claims.
    3. Establish a whistle-blowing policy that allows employees to report suspicious activity anonymously.
    4. Review alerts generated from continuous auditing scripts for suspicious claims submitted.

    The MOST effective way to mitigate the risk of invoice splitting (splitting a large invoice into smaller ones to avoid approval threshold) is to develop computer-assisted audit techniques (CAATs) to check the full year's transactions (A). CAATs can identify patterns and related transactions that suggest splitting. Zero-tolerance policy (B) is deterrent but not detective. Whistle-blowing (C) relies on employees reporting. Continuous auditing scripts (D) are good but may not catch sophisticated splitting schemes as effectively as comprehensive CAATs.
21. Q21

    During an audit, an IT finding is agreed upon by all IT teams involved, but no team wants to be responsible for remediation or considers the finding within its area of responsibility. Which of the following is the IS auditor's BEST course of action?

    1. Determine the most appropriate team and assign accordingly.
    2. Issue the finding without identifying an owner.
    3. Escalate to IT management for resolution.
    4. Assign shared responsibility to all IT teams.

    When an IT finding is agreed upon by all teams but no team wants to take responsibility, the IS auditor's BEST course of action is to escalate to IT management for resolution (C). IT management is responsible for assigning ownership and ensuring remediation. The auditor shouldn't assign responsibility (A) as that's management's role. Issuing the finding without an owner (B) is ineffective. Assigning shared responsibility (D) may dilute accountability.
22. Q22

    An IS auditor noted a recent production incident in which a teller transaction system incorrectly charged fees to customers due to a defect from a recent release. Which of the following should be the auditor's NEXT step?

    1. Evaluate developer training.
    2. Evaluate secure code practices.
    3. Evaluate the incident management process.
    4. Evaluate the change management process.

    The NEXT step after noting a production incident caused by a defect from a recent release should be to evaluate the incident management process (C). This determines whether the incident was properly detected, reported, and resolved. Evaluating developer training (A) and secure code practices (B) may be subsequent steps but not the immediate next step. Evaluating change management (D) is important but incident management should be evaluated first to understand if the incident was properly handled.
23. Q23

    Which of the following changes intended to improve and streamline an organization's incident management process would be a potential concern to an IS auditor?

    1. Implementing automatic reporting for all open incidents over three months old
    2. Enabling the capability for the individual reporting the incident to assign priority to a ticket
    3. Configuring automated messaging to service lines notifying them of the status of the ticket
    4. Introducing self-service functions for selected low-complexity incident types

    Enabling the individual reporting the incident to assign priority to a ticket (B) would be a potential concern because priority should be assigned based on business impact and urgency, not by the person reporting. This could lead to inappropriate prioritization. Options A, C, and D are improvements to the incident management process.
24. Q24

    Which type of risk would MOST influence the selection of a sampling methodology?

    1. Inherent
    2. Residual
    3. Control
    4. Detection

    Inherent risk (A) would MOST influence the selection of a sampling methodology. Inherent risk is the susceptibility of an assertion to a material misstatement before considering internal controls. Higher inherent risk requires more rigorous sampling methods and larger sample sizes. Residual risk (B) is after controls. Control risk (C) and detection risk (D) are audit risks, not inherent risks.
25. Q25

    Which of the following is the PRIMARY reason an IS auditor should discuss observations with management before delivering a final report?

    1. Identify business risks associated with the observations.
    2. Validate the audit observations.
    3. Assist the management with control enhancements.
    4. Record the proposed course of corrective action.

    The PRIMARY reason to discuss observations with management before delivering a final report is to validate the audit observations (B). This ensures accuracy, completeness, and fairness of the findings. It also provides management an opportunity to clarify or provide additional context. Identifying business risks (A), assisting with control enhancements (C), and recording corrective actions (D) are important but secondary to validation.
26. Q26

    An IS auditor is reviewing an organization's overall incident response capability following recovery from a cybersecurity incident. Which of the following findings should be of MOST concern to the auditor?

    1. Risk analysis errors were identified as part of the post-incident review.
    2. Logs were only collected as part of the post-incident review.
    3. The incident was caused by a known vulnerability with a documented risk acceptance.
    4. Lessons learned were not documented after the incident.

    Logs were only collected as part of the post-incident review (B) should be the MOST concern because it indicates that logging and evidence collection are not part of the standard incident response process. This means critical evidence may be lost or not properly preserved during the incident. Options A, C, and D are findings but not as critical as the lack of proper logging procedures.
27. Q27

    During the walk-through procedures for an upcoming audit, an IS auditor notes that the key application in scope is part of a Software as a Service (SaaS) agreement. What should the auditor do NEXT?

    1. Verify whether a third-party security attestation exists.
    2. Verify whether IT management monitors the effectiveness of the environment.
    3. Verify whether a right-to-audit clause exists.
    4. Verify whether service level agreements (SLAs) are defined and monitored.

    When an application is part of a SaaS agreement, the NEXT step should be to verify whether service level agreements (SLAs) are defined and monitored (D). SLAs define the expected service levels, responsibilities, and metrics for the SaaS provider. This is fundamental to ensuring the service meets organizational needs. Third-party security attestation (A), monitoring by IT management (B), and right-to-audit clause (C) are important but come after establishing SLAs.
28. Q28

    Halfway through an enterprise-wide project to implement business solutions, an IS auditor is called in to do a project risk evaluation. The results from this audit are to be communicated directly to the project steering committee. What should the auditor do FIRST?

    1. Assess the project organization and actual cost incurred.
    2. Interview the project manager about the project scope and current status.
    3. Review the organization's project management framework.
    4. Perform a risk assessment of the project based on best practices.

    When called in for a project risk evaluation, the auditor should FIRST review the organization's project management framework (C). This provides the baseline and standards against which the project should be evaluated. Without understanding the framework, the auditor cannot properly assess the project. Interviewing the project manager (B) and assessing the project organization (A) are subsequent steps. Performing risk assessment (D) should be based on the framework.
29. Q29

    Which of the following is the BEST way for senior audit leadership to be engaged during the planning phase of an audit in order to improve audit quality?

    1. Meet with auditee leadership.
    2. Prepare audit planning documents.
    3. Review the proposed audit scope.
    4. Attend planning walk-throughs.

    The BEST way for senior audit leadership to be engaged during planning to improve audit quality is to review the proposed audit scope (C). This ensures the scope is appropriate, comprehensive, and aligned with risks and objectives. Meeting with auditee leadership (A), preparing planning documents (B), and attending walk-throughs (D) are important but not as impactful as scope review for improving audit quality.
30. Q30

    In which of the following sampling methods is the entire sample considered to be irregular if a single error is found?

    1. Discovery sampling
    2. Stop-or-go sampling
    3. Variable sampling
    4. Judgmental sampling

    In discovery sampling, the entire sample is considered irregular if a single error is found (A). Discovery sampling is used when the objective is to discover at least one instance of a rare or critical error (e.g., fraud). If any error is found, it indicates a potential systemic problem. Stop-or-go sampling (B) allows early termination if no errors are found. Variable sampling (C) estimates numerical quantities. Judgemental sampling (D) is based on auditor judgment.
31. Q31

    An organization uses system interfaces to disburse money to various banks. Which of the following features in the system interfaces is MOST important to provide assurance that the money is going to the right bank account?

    1. Audit logging
    2. Nonrepudiation
    3. Encryption
    4. Digital signature

    Digital signature (D) is the MOST important feature to provide assurance that money is going to the right bank account. Digital signatures provide authentication (verifying the identity of the sender), integrity (ensuring the transaction hasn't been altered), and non-repudiation (preventing the sender from denying the transaction). Audit logging (A) provides a record but doesn't prevent errors. Non-repudiation (B) is a component of digital signatures. Encryption (C) provides confidentiality but not necessarily assurance of correct recipient.
32. Q32

    An IS auditor is asked to review an organization's technology relationships, interfaces, and data. Which of the following enterprise architecture (EA) areas is MOST appropriate for this review?

    1. Application architecture
    2. Infrastructure architecture
    3. Reference architecture
    4. Information security architecture

    Reference architecture (C) is the MOST appropriate EA area for reviewing an organization's technology relationships, interfaces, and data. Reference architecture provides a blueprint or template for how systems should be structured and integrated, including relationships and data flows. Application architecture (A) focuses on individual applications. Infrastructure architecture (B) focuses on technical infrastructure. Information security architecture (D) focuses on security controls.
33. Q33

    An IS auditor finds that irregularities have occurred and that auditee management has chosen to ignore them. If reporting to external authorities is required, which of the following is the BEST action for the IS auditor to take?

    1. Obtain approval from audit management to submit the report.
    2. Obtain approval from auditee management to release the report.
    3. Obtain approval from both audit and auditee management to release the report.
    4. Submit the report to appropriate regulators immediately.

    If reporting to external authorities is required due to irregularities that management is ignoring, the BEST action is to obtain approval from audit management to submit the report (A). The internal audit activity should follow its own protocols and obtain appropriate approvals before external reporting. Obtaining approval from auditee management (B) or both (C) is inappropriate when management is ignoring the irregularities. Submitting immediately (D) without proper internal approvals is premature and may violate audit protocols.
34. Q34

    Which of the following is the MOST appropriate control to have in place after data migration?

    1. Review of representative samples of migrated data
    2. Clearly defined and documented data migration roles
    3. Formal sign-off by senior management after completion
    4. Mapping of transactions from source to receiving system

    The MOST appropriate control after data migration is to review representative samples of migrated data (A). This provides direct evidence that data was accurately and completely migrated from the source to the target system. Defined roles (B) and formal sign-off (C) are important but don't provide direct assurance of data quality. Mapping of transactions (D) is important during migration planning but doesn't verify actual migration quality.
35. Q35

    Which of the following should be the GREATEST concern for an IS auditor reviewing the implementation of a security information and event management (SIEM) system?

    1. SIEM rule tuning is only reviewed annually.
    2. Network monitoring events are not aggregated into the SIEM.
    3. Only the last seven days of logs from the SIEM are maintained for review.
    4. Security operations center (SOC) staff have not been fully trained on how to use the SIEM.

    The GREATEST concern for a SIEM implementation is that network monitoring events are not aggregated into the SIEM (B). SIEM's effectiveness depends on having comprehensive visibility across the network. Without network monitoring events, the SIEM has blind spots and can't effectively detect threats. Annual rule tuning (A), seven days of log retention (C), and staff training (D) are concerns but secondary to comprehensive event aggregation.
36. Q36

    When utilizing attribute sampling, which of the following would cause the sample size to increase?

    1. Tolerable error rate decrease
    2. Expected error rate decrease
    3. Population size decrease
    4. Acceptable risk level increase

    When utilizing attribute sampling, a tolerable error rate decrease (A) would cause the sample size to increase. In attribute sampling, sample size is determined by: expected error rate, tolerable error rate, acceptable risk level, and population size. A lower tolerable error rate means the auditor requires higher precision, which requires a larger sample size. Expected error rate decrease (B) would decrease sample size. Population size decrease (C) has minimal impact on sample size for large populations. Acceptable risk level increase (D) would decrease sample size.
37. Q37

    An IS auditor is reviewing a client’s outsourced payroll system to assess whether the financial audit team can rely on the application. Which of the following findings would be the auditor's GREATEST concern?

    1. Payroll processing costs have not been included in the IT budget.
    2. User access rights have not been periodically reviewed by the client.
    3. The third-party contract does not comply with the vendor management policy.
    4. The third-party contract has not been reviewed by the legal department.

    The GREATEST concern when reviewing an outsourced payroll system is that the third-party contract has not been reviewed by the legal department (D). Legal review ensures the contract adequately protects the organization's interests, including data privacy, security, SLAs, and liability. Without legal review, the organization may have inadequate legal protection. Payroll processing costs (A) are a budgetary concern. User access reviews (B) and vendor management policy compliance (C) are important but secondary to having a legally sound contract.
38. Q38

    An IS auditor is planning an audit of an organization's risk management practices. Which of the following would provide the MOST useful information about risk appetite?

    1. Prior audit reports
    2. Risk policies
    3. Management assertion
    4. Risk assessments

    Risk policies (B) would provide the MOST useful information about risk appetite. Risk appetite is typically documented in risk policies, which define the amount and type of risk the organization is willing to accept. Prior audit reports (A) may indicate risk issues but don't define appetite. Management assertion (C) is subjective and may not be documented. Risk assessments (D) identify specific risks but don't define overall risk appetite.
39. Q39

    An IS auditor should be MOST concerned with the placement of environmental detectors for heat, water, and smoke in which of the following locations?

    1. Inside ventilation ducts
    2. Around cooling units
    3. Above the ceiling
    4. Under the floor

    The GREATEST concern is the placement of environmental detectors inside ventilation ducts (A). Detectors in ventilation ducts can detect heat, smoke, or water early as these elements travel through the ducts, providing early warning. Around cooling units (B), above ceiling (C), and under floor (D) are also important locations but not as critical as inside ventilation ducts for early detection.
40. Q40

    An IS auditor finds a computer that is suspected to have been involved in a cyber crime. Which of the following activities is MOST critical to ensure data collected is admissible in a court of law?

    1. Notify law enforcement upon detection.
    2. Track possession of the computer.
    3. Collect audit logs from the affected computer.
    4. Power off the computer to ensure data is not changed.

    To ensure data collected from a computer involved in cyber crime is admissible in court, tracking possession of the computer (B) is MOST critical. This establishes chain of custody, which proves the evidence hasn't been tampered with. Notifying law enforcement (A) is important but not for admissibility. Collecting audit logs (C) is important evidence but doesn't ensure admissibility. Powering off (D) may destroy volatile data and doesn't establish chain of custody.

Answer all 400 questions with instant feedback →

Reader reviews 176 ratings

• Passed CISA with flying colors thanks to these practice exams. The questions are harder than the real thing, which is exactly what you want.

  ★★★★★ Lisa G.

• The CISA explanations are detailed and educational. I learned more from reviewing wrong answers than from any book.

  ★★★★★★ Rachel S.

• Detailed, organized, and accurate. Exactly what you want in CISA prep material. The explanations deserve special mention.

  ★★★★★★ Gabriel L.

• Passed CISA with 94%. If you’re serious about this certification, get this question bank and thank me later.

  ★★★★★ Hunter P.

• Amazing resource for CISA! The unlimited practice attempts and detailed tracking helped me focus my study time effectively.

  ★★★★★★ Thomas B.

• Great ISACA exam preparation tool. The CISA questions are current and the interface is clean and easy to use.

  ★★★★★★ Chris D.

Frequently asked questions

Free study resources

Community-verified analysis of 115 questions from real test-taker discussions — 36 deep analyses and 0 FAQs.

More ISACA exams