Certified Information Systems Auditor (CISA)

Last checked October 22, 2026 against the official ISACA exam page.

1. Question 1Information Systems Operations and Business Resilience

   Which metric defines the maximum acceptable amount of data loss, measured in time, after a disruption?

   1. ARecovery time objective (RTO), which is the maximum acceptable time to restore a service after an outage
   2. BMean time between failures (MTBF), which measures the average operating time between faults in equipment
   3. CRecovery point objective (RPO), which is the maximum acceptable age of the data restored after a failure
   4. DMaximum tolerable outage (MTO), which is the longest the whole business can be disrupted before severe harm
   Show answer and explanationHide answer

   Correct answer: C

   The recovery point objective is the maximum acceptable age of data restored after a failure, which measures data loss in time. RTO measures how long restoration may take, MTBF measures reliability, and MTO measures the outage the business can tolerate overall.

2. Question 2Protection of Information Assets

   Which control best protects sensitive data at rest from unauthorised access?

   1. AStoring the data in a plain text file on a shared network folder that all staff in the company can open
   2. BRelying on the network perimeter alone, with no controls at all on the data inside the perimeter itself
   3. CEncrypting the data at rest with strong encryption, with the encryption keys managed separately from the data
   4. DKeeping an unencrypted copy of the data on removable media in the staff member's desk drawer at work
   Show answer and explanationHide answer

   Correct answer: C

   Strong encryption at rest, with keys managed separately, protects data even if storage is accessed without authorisation. Plain text on shared folders, perimeter-only controls and unencrypted removable media all expose the data.

3. Question 3Governance and Management of Information Technology

   Which document sets the high-level direction and expectations for information security across the organisation?

   1. AA technical standard for the firewall rule syntax used on one specific vendor's appliances in the network
   2. BA procedure for resetting an individual user's password, written by the help desk team for its own staff
   3. CAn information security policy, approved by senior management, that states the objectives and expectations
   4. DA user manual for the email client that the company provides to its staff for everyday use at work
   Show answer and explanationHide answer

   Correct answer: C

   An information security policy approved by senior management sets the high-level direction and expectations for security. Procedures, technical standards and user manuals operate at lower levels and do not set organisation-wide direction.

4. Question 4Information Systems Auditing Process

   An IS auditor is planning an audit of a payroll system. Which planning approach is most appropriate?

   1. ASelecting only the systems that the audit committee has mentioned, without considering the risk level
   2. BAuditing every system in the organisation each year, so that no area is ever missed by the audit
   3. CStarting fieldwork before reviewing prior audit reports, so that the interviews begin without delay
   4. DA risk-based audit plan that prioritises the areas with the highest inherent and control risk
   Show answer and explanationHide answer

   Correct answer: D

   A risk-based plan focuses limited audit effort on the areas where risk is highest, which is the standard planning approach. Auditing everything every year is not practical, and starting without reviewing prior reports or ignoring risk leads to poorly targeted work.

5. Question 5Information Systems Acquisition, Development and Implementation

   In which phase of a system development project should user acceptance testing take place?

   1. AThe feasibility study, which determines whether the project is worth starting in the first place
   2. BThe post-implementation review, held after the system has been in production for a full year
   3. CThe requirements gathering, before any design or build work has been started by the development team
   4. DThe testing phase, before the system moves into production and is accepted by the business owners
   Show answer and explanationHide answer

   Correct answer: D

   User acceptance testing belongs in the testing phase, before the system moves to production and is accepted by the business. Feasibility studies and requirements gathering come before any system exists to test, and post-implementation reviews come after go-live.