Free Certified Information Systems Auditor (CISA) practice test: 30 questions with answers

The recovery point objective is the maximum acceptable age of data restored after a failure, which measures data loss in time. RTO measures how long restoration may take, MTBF measures reliability, and MTO measures the outage the business can tolerate overall.

A parallel test brings systems up at the recovery site while production continues, which gives realistic assurance without disrupting operations. A production failover at peak hours causes disruption, and reviews or no testing do not prove the plan works.

A configuration monitoring tool that compares current settings with an approved baseline detects unauthorised changes. Password policies, outbound blocks and leave policies address other risks and do not compare configurations to a baseline.

Change management ensures changes are authorised, tested and documented before production implementation, which reduces disruption and risk. Direct developer changes bypass control, delays are not the purpose, and change management does not replace incident management.

An incident response plan defines roles, escalation paths and the steps for containment, eradication and recovery. Marketing claims, press requirements and social media accounts do not guide the technical response.

A business impact analysis determines the criticality of processes and the recovery priorities and dependencies they need. Administrator counts, asset values and licence costs are inputs to other processes rather than the purpose of the analysis.

Strong encryption at rest, with keys managed separately, protects data even if storage is accessed without authorisation. Plain text on shared folders, perimeter-only controls and unencrypted removable media all expose the data.

Least privilege grants only the permissions needed for assigned tasks. Separation of duties addresses conflicts between tasks, mandatory access control applies central labels, and shared accounts remove accountability.

A vulnerability scanning tool identifies known weaknesses and rates their severity to prioritise remediation. A last-year report is out of date, firewall logs record blocked traffic, and backup reports confirm recovery, not vulnerabilities.

Data classification determines the level of protection information needs, based on its sensitivity and value. Deletion decisions, colour schemes and vendor lists are separate matters.

Central, protected log storage with restricted access and retention periods keeps logs trustworthy and available for investigation. Logs on the same server can be altered if it is compromised, and turning off or deleting logs removes accountability.

Purpose limitation restricts collection and use of personal data to stated, legitimate purposes. Availability, integrity and portability are important data qualities or rights, but they do not restrict the purpose of collection.

An information security policy approved by senior management sets the high-level direction and expectations for security. Procedures, technical standards and user manuals operate at lower levels and do not set organisation-wide direction.

The board and senior management approve and oversee the IT strategy and its alignment with business objectives. Administrators, help desk managers and developers execute the strategy but do not approve it.

COBIT provides governance and management objectives for enterprise IT. ITIL focuses on service management, ISO 9001 on quality management, and PRINCE2 on project management, so none of them is primarily an enterprise IT governance framework.

A benefits realisation process links IT investments to measurable business outcomes, which demonstrates alignment. Personal approval of every purchase, fixed budgets and hour tracking do not show whether investments deliver business value.

Separating requesting, approving and implementing changes among different people reduces the opportunity for error or fraud. Combining create and approve roles, giving developers production rights and merging security with operations all remove that separation.

Clear roles reduce duplication and gaps, and regular reporting to the board enables informed oversight. Unclear accountability, informal risk management and never-reviewed policies weaken governance rather than strengthening it.

A risk-based plan focuses limited audit effort on the areas where risk is highest, which is the standard planning approach. Auditing everything every year is not practical, and starting without reviewing prior reports or ignoring risk leads to poorly targeted work.

Evidence obtained directly by the auditor from an independent source, such as a system-generated report, is more reliable than statements or material prepared by the auditee. Verbal statements and auditee-prepared summaries are weaker evidence, and screenshots are a single moment chosen by the auditee.

Statistical random sampling gives each item a known probability of selection, which allows results to be projected to the population with a stated confidence. Judgemental, haphazard and owner-selected samples cannot support statistical projection.

The audit charter sets out the authority, responsibility and scope of the audit function and is approved by the governing body, such as the audit committee. Server configurations, billing terms and password policy are outside its purpose.

During fieldwork the auditor gathers evidence to support conclusions and documents the work in working papers. Implementing fixes, approving management responses and setting risk appetite are responsibilities of management, not of the independent auditor.

Defining objectives and scope from the risk assessment and audit universe is the first step, because everything else depends on it. Reporting before testing, approving controls before review and interviewing everyone before scoping all reverse the logical order of the engagement.

User acceptance testing belongs in the testing phase, before the system moves to production and is accepted by the business. Feasibility studies and requirements gathering come before any system exists to test, and post-implementation reviews come after go-live.

A review of status and risks against the approved plan and business case establishes the facts before any decision is made. Cancelling without review, dropping testing and extending without changes all make decisions without evidence.

Evaluating the vendor's security and continuity, and including audit rights and service levels in the contract, both protect the organisation after acquisition. Accepting a standard contract without review, installing without testing and keeping default passwords all leave gaps.

Agile delivers working increments in short iterations with regular feedback from stakeholders. Waterfall is sequential, big-bang deploys once at the end, and throwaway prototypes do not form the delivered system.

A go-live approval based on testing, validated data migration and a rollback plan is the key control before production. Deleting legacy data, bypassing operations review and turning off logging each remove a safeguard at the point of greatest risk.

Uncontrolled scope creep and unmeasured benefits are classic project risks. Clear milestones, approved requirements and regular reporting are controls that reduce risk rather than create it.