ISACA CISA Certified Information Systems Auditor Exam Questions

The IS auditor's primary focus when evaluating a cybercrime response process should be on evidence collection and preservation. This is the foundational element upon which all other response activities are built. Without a sound process for collecting and maintaining the integrity of evidence (i.e., chain of custody), any subsequent legal action, root cause analysis, or reporting to regulators and law enforcement would be unreliable and potentially inadmissible. A failure in evidence collection undermines the entire investigation and recovery effort, making its evaluation the most critical aspect for the auditor.

A. Communication with law enforcement is a crucial procedural step, but its effectiveness is contingent upon having credible and properly collected evidence to share.

B. Notification to regulators is a compliance-driven activity, but the accuracy and completeness of the notification depend on the facts established through evidence.

C. Root cause analysis is a post-incident activity performed to prevent recurrence, which fundamentally relies on the quality and integrity of the evidence gathered during the response.

1. ISACA. (2019). CISA Review Manual

27th Edition. Domain 4: Information Systems Operations and Business Resilience

Section 4.7.3

"Incident Response Procedures

" emphasizes that procedures must be in place to ensure evidence is identified

collected

and secured in a manner that preserves its integrity for potential use in legal proceedings. The auditor's role is to verify these procedures are adequate and followed.

2. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide. Section 3.3

"Evidence Gathering and Handling

" details the criticality of proper evidence collection

stating

"In order for evidence to be admissible in court

it must be handled and stored in a forensically sound manner that maintains the chain of custody." An auditor would use this as a benchmark

making evidence handling a primary focus.

3. Kent

K.

Chevalier

S.

Grance

T.

& Dang

H. (2006). NIST Special Publication 800-86

Guide to Integrating Forensic Techniques into Incident Response. Section 3.1

"Evidence

" states that a primary goal of forensic data collection is to "collect evidence in a manner that preserves its integrity." The guide underscores that the entire forensic process

which is central to cybercrime response

is built upon this principle

making it a primary point of audit scrutiny.

The annual audit plan must be based on a formal risk assessment, not on the preferences of the auditee. The CIO's request to suspend audits represents a significant scope limitation and a potential impairment to the independence of the audit function. The IS auditor's immediate responsibility is to follow the established internal chain of command. Therefore, the first and most appropriate action is to escalate the issue to audit management (e.g., the Chief Audit Executive). Audit management has the authority and responsibility to discuss the matter with the CIO, evaluate the risks of not performing the audits, and, if necessary, present the issue to the audit committee for final resolution.

B. Notify the chief operating officer (COO) and discuss the audit plan risks: This action bypasses the audit function's internal reporting structure. The IS auditor should first report to audit management, not directly to another senior executive.

C. Exclude IS audits from the upcoming year's plan: This would be a dereliction of the auditor's duty. Accepting the auditee's request without challenge compromises the independence and objectivity of the audit function.

D. Increase the number of IS audits in the clan: This is an unprofessional and punitive reaction. The audit plan must be based on a documented risk assessment, not on personal disagreements with management.

1. ISACA

CISA Review Manual

27th Edition. Chapter 1

Section 1.3.2

"Steps for Audit Planning." The manual emphasizes that the audit plan is developed based on a risk assessment to provide reasonable assurance on the management of material risks. The responsibility for creating and managing this plan rests with audit management

not the auditee. Any attempt by management to limit the scope of the audit should be communicated to the audit committee.

2. ISACA

ITAF: A Professional Practices Framework for IS Audit/Assurance

4th Edition. Standard 1202

"Planning." This standard states

"IS audit and assurance professionals shall plan each audit and assurance engagement to address the engagement’s objectives..." The responsibility for the overall annual plan rests with the head of the IS audit function

who must ensure it addresses key risk areas.

3. ISACA

ITAF: A Professional Practices Framework for IS Audit/Assurance

4th Edition. Standard 1006

"Independence." This standard requires that the IS audit function be independent of the area being audited. Any conflict of interest or influence exerted by the auditee

such as a request to cancel audits

must be managed and reported through the proper channels

starting with audit management and potentially escalating to the audit committee.

In an adequately segregated IT environment, the principle of Segregation of Duties (SoD) is paramount. A network administrator's role is to manage and secure the network infrastructure, including routers, switches, and firewalls. Changing application configurations is the responsibility of an application administrator or a systems administrator. Granting a network administrator privileges to alter applications would violate SoD. This consolidation of roles could allow an individual to bypass network-level controls to make unauthorized changes to an application, increasing the risk of fraud or error. Restricting this privilege ensures that different individuals manage the network and the applications that run on it.

A. Monitoring network traffic is a core responsibility of a network administrator for performance tuning, troubleshooting, and security analysis.

C. Hardening network ports is a fundamental security task for a network administrator to protect the network infrastructure from unauthorized access.

D. Ensuring transmission protocols are functioning correctly is a primary operational duty of a network administrator to maintain network connectivity and performance.

1. ISACA

CISA Review Manual

27th Edition

Domain 4: Information Systems Operations and Business Resilience

Section 4.4.2

Segregation of Duties. This section emphasizes that incompatible functions

such as network administration and application management

should be segregated to prevent a single individual from having end-to-end control over a process.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives

DSS05 Manage Security Services

DSS05.04 Managed user identity and logical access. This practice supports implementing access controls based on the principle of least privilege

where roles like network administrator are granted access only to the infrastructure components they manage

not to business applications.

3. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5

"Security and Privacy Controls for Information Systems and Organizations

" Control Family: Access Control (AC)

AC-6 Least Privilege. This standard mandates that organizations "employ the principle of least privilege

allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks

" which inherently supports the separation of network and application administration duties.

The primary goal of an Enterprise Architecture (EA) program is to ensure that technology and business processes are aligned with the organization's strategic objectives. Granting sole responsibility for architecture approval to individual IT application owners fundamentally undermines this goal. This approach promotes the development of technology silos, where decisions are optimized for a single application or department rather than the enterprise as a whole. It leads to inconsistent standards, poor integration, increased complexity, and higher long-term costs. Effective EA governance requires a centralized body, such as an architecture review board, with cross-functional authority to ensure all solutions adhere to enterprise-wide principles and standards. The observation in option B represents a critical failure in governance and a significant risk to the organization.

A. The CIO is an appropriate leader for an architecture review board, as this role has the enterprise-level visibility and authority necessary to drive strategic IT alignment.

C. A mature EA program should extend its governance to non-IT-related projects to ensure holistic alignment of business processes and capabilities across the entire enterprise.

D. Integrating information security requirements into the EA program is a security best practice ("security by design") that ensures security is a foundational component, not an afterthought.

1. ISACA. (2019). CISA Review Manual

27th Edition. Domain 2: Governance and Management of IT

Section 2.4

IT Governance Structure and Organizational Structure. This section emphasizes the role of steering committees and architecture review boards in providing oversight and ensuring that IT activities

including architectural decisions

align with enterprise objectives

which contradicts the concept of sole approval by an application owner.

2. ISACA. (2018). COBIT 2019 Framework: Governance and Management Objectives. APO03 Managed Enterprise Architecture. Management Practice APO03.05

"Provide architecture oversight and governance

" explicitly calls for defining architecture decision-making rights and establishing an architecture review board to ensure compliance

directly opposing the siloed approval process described in the incorrect option.

3. Ross

J. W.

Weill

P.

& Robertson

D. C. (2006). Enterprise Architecture as Strategy: Creating a Foundation for Business Execution. Harvard Business School Press. Chapter 5

"Building the Foundation: The Role of the IT Engagement Model

" describes how effective EA governance models require enterprise-level decision-making bodies to overcome the "local optimization" that occurs when individual business units or application owners have sole authority.

The greatest concern is the lack of an approval and review process for changes to the job scheduler's parameters. The job scheduler is a critical component of IT operations, controlling the automated execution of essential business processes such as data backups, batch transaction processing, and report generation. Allowing unapproved and unreviewed changes introduces a significant risk of unauthorized, erroneous, or malicious modifications. This could lead to the failure of critical jobs, incorrect data processing, or circumvention of security controls, directly impacting the confidentiality, integrity, and availability of key business systems and data. This finding points to a fundamental failure in the change management process for a critical operational system.

A. The absence of pop-up error messages is a system design issue, but it is a minor concern as errors are typically recorded in system logs for later review.

B. The number of staff with access is not inherently a risk; the key control is ensuring access is based on the principle of least privilege, not an arbitrary number.

C. Not using turnover logs is a procedural weakness that can cause operational inefficiencies or errors, but it is less critical than allowing unapproved changes to a core system.

1. ISACA. (2019). CISA Review Manual

27th Edition. Domain 4: Information Systems Operations and Business Resilience

Section 4.4 IT Operations. The manual emphasizes that an IS auditor must verify that changes to job schedules are subject to formal change control procedures

including proper authorization

to prevent unauthorized alterations that could disrupt business processing.

2. Hall

J. A. (2018). Information Technology Auditing

4th Edition. Cengage Learning. Chapter 15

IT Controls and the Audit

discusses the control objectives for operations

which include preventing and detecting unauthorized changes to program and job scheduling parameters. The lack of supervisory approval is cited as a critical control deficiency.

3. Krutz

R. L.

& Vines

R. D. (2003). The CISA Prep Guide: Mastering the Certified Information Systems Auditor Exam. Wiley Publishing

Inc. Chapter 6

"Protection of Information Assets

" details the importance of access controls and change management for operational systems. It highlights that changes to production job control language (JCL) or scheduling parameters must be authorized by management to ensure the integrity of processing.

The discrepancy between the findings of the external and internal audits for the same process indicates a potential flaw in the internal audit's methodology. External auditors identified recurring exceptions, which suggests the issues were present when the internal audit was conducted but were not detected. A primary reason for failing to detect existing exceptions is an inadequate testing strategy, most commonly related to the sampling methodology. By reviewing the sample size, selection method, and the period covered, the IS auditor can determine if the sample was representative of the population and sufficiently large to provide a reasonable level of assurance. This review directly addresses the effectiveness of the internal audit process itself.

A. Increasing the frequency of the audit will not correct a flawed methodology; it would only mean repeating an ineffective test more often.

B. Reviewing changes to the user termination process focuses on the business process, not the audit process that failed to identify the exceptions.

D. Reviewing control self-assessment (CSA) results examines management's assessment, not the independent internal audit process that should have verified those controls.

---

1. ISACA

CISA Review Manual

27th ed.

2019. Chapter 2: The Process of Auditing Information Systems

page 87. The manual discusses sampling risk as "the risk that the sample chosen by the auditor is not representative of the population and

as a result

the auditor will arrive at an incorrect conclusion." This directly relates to the scenario where the internal audit concluded controls were effective while the external audit found recurring exceptions.

2. ISACA

IS Audit and Assurance Guideline 2208: Audit Sampling

2014. Section 3.1 states

"The objective of audit sampling is to draw conclusions about an entire population based on the results of testing a representative sample of the population... If the sample is not representative of the population

the auditor’s conclusion may be flawed." This supports reviewing the methodology when audit conclusions are proven to be incorrect.

3. Sayana

S. A. (2003). The IIA's CIA review: business analysis and information technology. The Institute of Internal Auditors Research Foundation. While not a CISA-specific source

this foundational internal audit text

often used in university curricula

emphasizes that when audit results are questioned

the first step is to review the audit's scope and methodology

including sampling techniques

to ensure the evidence gathered was sufficient and appropriate. This principle is central to IS auditing. (Referenced in various university auditing courses).

The most fundamental principle for a firewall to be effective is that it must serve as a mandatory "choke point" for all network traffic between the protected internal network and the untrusted external network. If any communication can bypass the firewall (e.g., through unauthorized modems, misconfigured network segments, or wireless access points), the security policies enforced by the firewall become irrelevant for that traffic. This architectural requirement is the prerequisite for any other firewall rule or policy to provide comprehensive protection.

A. A firewall is not placed in a demilitarized zone (DMZ); rather, it is a device used to create and enforce the boundaries of a DMZ.

B. While permitting only essential services (the principle of least privilege) is a critical security policy for configuring a firewall, it is ineffective if traffic can bypass the firewall entirely.

C. Defining filters is the basic function of a firewall, but this option is too general. The effectiveness comes from the principle behind the filters, which is secondary to ensuring all traffic is subject to them.

---

1. Stallings

W.

& Brown

L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson.

In Chapter 20

"Firewalls and Intrusion Prevention Systems

" a key design goal for a firewall is stated: "All traffic from the outside to the inside

and from the inside to the outside

must pass through the firewall. This is achieved by physically blocking all access to the local network except via the firewall." This directly supports the principle that all communication must be routed through the firewall.

2. National Institute of Standards and Technology (NIST). (2009). Special Publication 800-41 Revision 1: Guidelines on Firewalls and Firewall Policy.

Section 2.1

"Firewall Overview

" describes that firewalls are "typically deployed as a gateway or choke point between a protected network and a less trusted network." This establishes the fundamental architectural role of the firewall as the sole transit point

which is essential for its effectiveness.

3. ISACA. (2019). CISA Review Manual

27th Edition.

Domain 4: Information Technology Operations

Section 4.4.2

"Network Security

" discusses firewalls as a primary perimeter defense mechanism. The entire concept of a perimeter defense relies on the establishment of a controlled boundary where all traffic is inspected. A failure to route all traffic through this control point represents a fundamental breakdown of the perimeter security model.

Discovery sampling is a statistical sampling method used when the expected occurrence rate of a specific event (e.g., fraud, critical control failure) is very low. The objective is to find at least one example of the deviation. The sample size is calculated to provide a specified probability of finding at least one error if the actual error rate in the population is at or above a certain level. If a single such error is discovered, the audit objective is met, and it is concluded that the population contains an unacceptable level of irregularity, often triggering a more extensive investigation.

B. Variable sampling: This method is used to estimate a numerical value, such as a monetary amount, not to find a single critical error.

C. Stop-or-go sampling: This is a sequential method designed to minimize sample size; finding an error may lead to more sampling but does not automatically condemn the entire population.

D. Judgmental sampling: This is a non-statistical method where the auditor's judgment determines the next steps; there is no predefined statistical rule for the impact of a single error.

---

1. ISACA. (2019). CISA Review Manual

27th Edition. Chapter 1: The Process of Auditing Information Systems

Section: "Audit Evidence and Sampling

" Subsection: "Sampling Techniques." The manual states

"Discovery sampling is used when an IS auditor is trying to determine whether a type of event has occurred... If one exception is found

the IS auditor may stop testing and conclude that the control objective is not being met." This implies the area is considered irregular.

2. Arens

A. A.

Elder

R. J.

& Beasley

M. S. (2016). Auditing and Assurance Services: An Integrated Approach (16th ed.). Pearson. Chapter 15

"Audit Sampling for Tests of Controls and Substantive Tests of Transactions

" discusses discovery sampling as a modification of attribute sampling used when auditors expect a very low rate of deviation and are looking for evidence of serious issues like fraud. The discovery of a single instance is significant enough to warrant further action.

3. University of Illinois at Urbana-Champaign. (n.d.). Audit Sampling. Courseware for ACCY 405/505 - Auditing. The course materials describe discovery sampling as a technique where "the auditor wants to be sure to see at least one example of a particular type of error if it exists in the population at a specified rate." This highlights its use in situations where any occurrence is critical.

The primary purpose of a risk-based IS audit strategy is to ensure that finite audit resources (such as time, budget, and personnel) are allocated and utilized in the most effective and efficient manner. This approach directs the audit focus toward systems, processes, and functions that pose the greatest potential risk to the organization's strategic objectives and operations. By prioritizing areas with significant risk, the IS audit function provides the most value and relevant assurance to management and the board, ensuring that critical vulnerabilities and control weaknesses are addressed.

A. Achieving synergy is a beneficial outcome of aligning with enterprise risk management, but it is not the primary reason for adopting the strategy itself.

C. While efficiency and time reduction can be a result, the main goal is effective risk coverage and providing value, not simply completing the audit faster.

D. Management holds the primary responsibility for identifying organizational risks; the audit function's role is to provide independent assurance on how effectively those risks are managed.

---

1. ISACA

CISA Review Manual

27th Edition. Domain 1: Information System Auditing Process

Section 1.3.1

"Develop a Risk-Based IS Audit Strategy." This section explicitly states

"The risk-based audit approach is used by IS auditors to assess risk and to assist in planning the audit and selecting the areas to be audited... This allows the audit function to prioritize its work and focus on the areas that are most critical to the organization."

2. ISACA

ITAF™: A Professional Practices Framework for IS Audit/Assurance

4th Edition. Guideline 2201 Audit Planning

Section 3.1. This guideline states that the annual IS audit plan should be based on a risk assessment and that "The risk assessment process should identify and assess the risk relevant to the auditable areas to provide reasonable assurance that all material items will be addressed. The outcome of this process should be used to develop the annual IS audit plan and direct the focus of IS audit resources to areas of high risk."

3. Gramling

A. A.

& Schneider

A. (2018). "The role of the internal audit function in the corporate governance of a publicly traded company." Current Issues in Auditing

12(2)

A31-A41. This academic publication discusses how internal audit adds value by using a risk-based approach to focus its limited resources on the most significant risks to the organization's objectives

reinforcing the principle of resource prioritization. (DOI: https://doi.org/10.2308/ciia-52201)

The primary role of an IS auditor in any process, including software acquisition, is to provide independent assurance regarding risk management and the adequacy of controls. Involving an auditor early helps ensure that potential threats (e.g., security vulnerabilities, data integrity issues, noncompliance) are identified and that appropriate controls are considered and integrated into the system requirements and design from the outset. This proactive approach is more effective and cost-efficient than addressing control deficiencies after implementation.

A. This is a technical task for the IT project team. The auditor's concern is whether a controlled process exists to determine these requirements, not the requirements themselves.

B. Reviewing contracts and SLAs is an important audit activity, but it is a mechanism to enforce controls, not the primary reason for involvement, which is the overall assurance of risk mitigation.

C. While auditors review compliance with project management policies, the ultimate objective is to ensure the project delivers a secure and controlled product, not just to follow a process.

1. ISACA. (2019). CISA Review Manual

27th Edition. Domain 3: Information Systems Acquisition

Development

and Implementation

Section 3.1.2

p. 168. The manual states

"The IS auditor’s role in a system development or acquisition project is to provide advice on controls and security and to monitor the project’s progress." This directly supports the focus on controls to address risks.

2. ISACA. (2019). CISA Review Manual

27th Edition. Domain 3: Information Systems Acquisition

Development

and Implementation

Section 3.2.1

p. 170. It notes that when reviewing a project plan

an IS auditor should ensure it "addresses risk and controls." This reinforces that the primary focus is on risk and control

which is the essence of option D.

3. ISACA. (2014). IS Audit and Assurance Guideline 2203: Project Management. Section 3.3. The guideline states that the IS auditor should "provide assurance that the project is meeting its objectives and is in compliance with organisational policies and procedures by evaluating that...risk is being managed effectively."