CISA Readiness Test

10 questions, balanced across the exam's topics. Answer each one, then submit for your practice readiness estimate and per-topic breakdown. This is a practice estimate — not a prediction or guarantee of your official exam result.

Question 1

Critical processes have no defined RTOs; recovery speed is whatever happens. The RTO is four hours but recovery tests consistently take twelve. What should the auditor do in this situation?

Blame the test scenario as unrealistic Report the capability gap: either the RTO is unachievable or the recovery capability is inadequate -- one must change with business agreement. Recommend ignoring the test results Quietly extend the RTO to twelve hours

Question 2

A system is selected as cheapest based on license price alone, ignoring implementation and support. Which of the following is the MOST appropriate action for the auditor?

Recommend always buying the most expensive system Calculate TCO for the vendor Recommend TCO-based investment appraisal including implementation, operation, and retirement costs. Accept license-price comparison as sufficient

Question 3

Which of the following BEST describes ISACA Code of Professional Ethics?

The Code sets the ethical principles and conduct standards for ISACA members and certification holders. Statistical sampling uses probability theory to select items and measure sampling risk mathematically; nonstatistical sampling relies on auditor judgment without quantified risk measurement. Embedded audit modules are programmed routines built into an application that capture transaction data for audit purposes as processing occurs. Analytical procedures evaluate data by studying plausible relationships among financial and nonfinancial information.

Question 4

Which of the following BEST describes System development life cycle phases?

The SDLC structures development into phases -- initiation, requirements, design, build, test, deploy, and maintain -- each with defined deliverables and approvals. Software escrow places source code with a neutral third party, releasable to the customer if the vendor fails. Phased implementation rolls out the new system in stages -- by module, location, or business unit. Data conversion controls ensure legacy data is accurately transformed -- mapped, cleansed, validated -- for the new system.

Question 5

Any device can plug into the corporate network with full access. As the auditor, what should be done FIRST in this situation?

Recommend banning personal devices as the fix Accept open access as user-friendly Recommend MAC-address filtering as sufficient Report the uncontrolled network access and recommend NAC with compliance enforcement.

Question 6

The UPS has never been load-tested and the generator's fuel is years old. As the auditor, what should be done FIRST in this situation?

Trust the equipment's specifications Recommend removing the untested equipment Test only by unplugging during production Report the untested emergency power: backup systems must be tested under load with maintained fuel and maintenance.

Question 7

Nobody tracks whether IT investments deliver value; success is declared at go-live. As the auditor, what should be done FIRST in this situation?

Report the missing value-governance loop and recommend benefit tracking overseen at board level. Recommend declaring success earlier to boost morale Audit the technical quality of deliverables only Recommend the board approve more IT spending

Question 8

The draft audit plan devotes equal time to the cafeteria POS system and the core banking platform. Management insists the cafeteria POS receive a deep audit because of a suspected employee theft. What should the auditor do in this situation?

Replace the banking platform audit with the POS investigation Refuse the request to protect the plan Fold the fraud review into the banking platform audit Add a targeted fraud-focused POS review as a special request while keeping the plan's risk-based priorities intact.

Question 9

Which statement BEST defines Phased implementation?

Configuration management identifies, controls, and tracks all system components and their versions. Edit checks -- sequence, format, range, reasonableness, and check digits -- validate data against defined rules at entry. Regression testing re-verifies previously working functionality after changes, catching unintended breakage. Phased implementation rolls out the new system in stages -- by module, location, or business unit.

Question 10

The public web server sits on the internal LAN with full access to internal systems. Which concept does this scenario BEST illustrate?

Security information and event management (SIEM) Termination procedures Honeypots and honeynets Demilitarized zone (DMZ)

Unanswered questions count as incorrect. Your answers are graded on the server; no answer key is sent to your browser.

← Back to the CISA page

About Contact Privacy Policy Terms of Service Refund Policy

Home Exams Simulations WorkTrials GameScope Account