ISACA CISA Exam Questions
Certified Information Systems Auditor (Page 16 )

Updated On: 24-Feb-2026

When auditing the security architecture of an online application, an IS auditor should FIRST review the:

  1. location of the firewall within the network.
  2. firewall standards.
  3. firmware version of the firewall.
  4. configuration of the firewall.

Answer(s): B



An organization is planning an acquisition and has engaged an IS auditor to evaluate the IT governance framework of the target company. Which of the following would be MOST helpful in determining the effectiveness of the framework?

  1. Recent third-party IS audit reports
  2. Current and previous internal IS audit reports
  3. IT performance benchmarking reports with competitors
  4. Self-assessment reports of IT capability and maturity

Answer(s): A



Due to limited storage capacity, an organization has decided to reduce the actual retention period for media containing completed low-value transactions. Which of the following is MOST important for the organization to ensure?

  1. The policy includes a strong risk-based approach.
  2. The retention period complies with data owner responsibilities.
  3. The retention period allows for review during the year-end audit.
  4. The total transaction amount has no impact on financial reporting.

Answer(s): B



Which of the following should an IS auditor be MOST concerned with during a post-implementation review?

  1. The system does not have a maintenance plan.
  2. The system contains several minor defects.
  3. The system deployment was delayed by three weeks.
  4. The system was over budget by 15%.

Answer(s): A



Which of the following is the PRIMARY basis on which audit objectives are established?

  1. Audit risk
  2. Consideration of risks
  3. Assessment of prior audits
  4. Business strategy

Answer(s): B






Post your Comments and Discuss ISACA CISA exam dumps with other Community members:

Join the CISA Discussion