CISA Exam PDF [2025] Tests Free Updated Today with Correct 1435 Questions
ISACA CISA Exam Preparation Guide and PDF Download
The CISA certification exam is a comprehensive exam that consists of multiple-choice questions and is administered by ISACA. CISA exam is four hours long and consists of 150 questions. In order to pass the exam, candidates must score a minimum of 450 out of a possible 800 points.
NEW QUESTION # 253
Which of the following PBX feature provides the possibility to break into a busy line to inform another user of an important message?
- A. Account Codes
- B. Access Codes
- C. Tenanting
- D. Override
Answer: D
Explanation:
Explanation/Reference:
Override feature of PBS provides for the possibility to break into a busy line to inform another user an important message.
For CISA exam you should know below mentioned PBS features and Risks
System Features
Description
Risk
Automatic Call distribution
Allows a PBX to be configured so that incoming calls are distributed to the next available agent or placed on-hold until one become available Tapping and control of traffic
Call forwarding
Allow specifying an alternate number to which calls will be forwarded based on certain condition User tracking Account codes
Used to:
Track calls made by certain people or for certain projects for appropriate billing Dial-In system access (user dials from outside and gain access to normal feature of the PBX) Changing the user class of service so a user can access a different set of features (i.e. the override feature) Fraud, user tracking, non authorized features
Access Codes
Key for access to specific feature from the part of users with simple instruments, i.e. traditional analog phones.
Non-authorized features
Silent Monitoring
Silently monitors other calls
Eavesdropping
Conferencing
Allows for conversation among several users
Eavesdropping, by adding unwanted/unknown parties to a conference
override(intrude)
Provides for the possibility to break into a busy line to inform another user an important message Eavesdropping Auto-answer
Allows an instrument to automatically go when called usually gives an auditor or visible warning which can easily turned off Gaining information not normally available, for various purpose
Tenanting
Limits system user access to only those users who belong to the same tenant group - useful when one company leases out part of its building to other companies and tenants share an attendant, trunk lines,etc Illegal usage, fraud, eavesdropping Voice mail
Stores messages centrally and - by using a password - allows for retrieval from inside or outside lines.
Disclosure or destruction of all messages of a user when that user's password in known or discovered by an intruder, disabling of the voice mail system and even the entire switch by lengthy messages or embedded codes, illegal access to external lines.
Privacy release
Supports shared extensions among several devices, ensuring that only one device at a time can use an extension. Privacy release disables the security by allowing devices to connect to an extension already in use.
Eavesdropping
No busy extension
Allows calls to an in-use extension to be added to a conference when that extension is on conference and already off-hook Eavesdropping a conference in progress
Diagnostics
Allows for bypassing normal call restriction procedures. This kind of diagnostic is sometimes available from any connected device. It is a separate feature, in addition to the normal maintenance terminal or attendant diagnostics Fraud and illegal usage
Camp-on or call waiting
When activated, sends a visual audible warning to an off-hook instrument that is receiving another call.
Another option of this feature is to conference with the camped-on or call waiting Making the called individual a party to a conference without knowing it.
Dedicated connections
Connections made through the PBX without using the normal dialing sequences. It can be used to create hot-lines between devices i.e. one rings when the other goes off-hook. It is also used for data connections between devices and the central processing facility Eavesdropping on a line
The following were incorrect answers:
Account Codes - that are use to:
Track calls made by certain people or for certain projects for appropriate billing Dial-In system access (user dials from outside and gain access to normal feature of the PBX) Changing the user class of service so a user can access a different set of features (i.e. the override feature) Access Codes - Key for access to specific feature from the part of users with simple instruments, i.e.
traditional analog phones.
Tenanting - Limits system user access to only those users who belong to the same tenant group useful when one company leases out part of its building to other companies and tenants share an attendant, trunk lines,etc The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number358
NEW QUESTION # 254
Which of the following is the INCORRECT Layer to Protocol mapping used in the DOD TCP/IP model?
- A. Internet layer - IP
- B. Network Access layer - Ethernet
- C. Application layer - Telnet
- D. Transport layer - ICMP
Answer: D
Explanation:
Explanation/Reference:
The keyword INCORRECT is used within the question. You need to find out the incorrect Layer to Protocol mapping.
The ICMP protocol works at Internet layer of the DoD TCP/IP model, not at the Transport Layer.
For your exam you should know below information about the TCP/IP models:
Network Models
Layer 4. Application Layer
Application layer is the top most layer of four layer TCP/IP model. Application layer is present on the top of the Transport layer. Application layer defines TCP/IP application protocols and how host programs interface with Transport layer services to use the network.
Application layer includes all the higher-level protocols like DNS (Domain Naming System), HTTP (Hypertext Transfer Protocol), Telnet, SSH, FTP (File Transfer Protocol), TFTP (Trivial File Transfer Protocol), SNMP (Simple Network Management Protocol), SMTP (Simple Mail Transfer Protocol) , DHCP (Dynamic Host Configuration Protocol), X Windows, RDP (Remote Desktop Protocol) etc.
Layer 3. Transport Layer
Transport Layer is the third layer of the four layer TCP/IP model. The position of the Transport layer is between Application layer and Internet layer. The purpose of Transport layer is to permit devices on the source and destination hosts to carry on a conversation. Transport layer defines the level of service and status of the connection used when transporting data.
The main protocols included at Transport layer are TCP (Transmission Control Protocol) and UDP (User Datagram Protocol).
Layer 2. Internet Layer
Internet Layer is the second layer of the four layer TCP/IP model. The position of Internet layer is between Network Access Layer and Transport layer. Internet layer pack data into data packets known as IP datagram's, which contain source and destination address (logical address or IP address) information that is used to forward the datagram's between hosts and across networks. The Internet layer is also responsible for routing of IP datagram's.
Packet switching network depends upon a connectionless internetwork layer. This layer is known as Internet layer. Its job is to allow hosts to insert packets into any network and have them to deliver independently to the destination. At the destination side data packets may appear in a different order than they were sent. It is the job of the higher layers to rearrange them in order to deliver them to proper network applications operating at the Application layer.
The main protocols included at Internet layer are IP (Internet Protocol), ICMP (Internet Control Message Protocol), ARP (Address Resolution Protocol), RARP (Reverse Address Resolution Protocol) and IGMP (Internet Group Management Protocol).
Layer 1. Network Access Layer
Network Access Layer is the first layer of the four layer TCP/IP model. Network Access Layer defines details of how data is physically sent through the network, including how bits are electrically or optically signaled by hardware devices that interface directly with a network medium, such as coaxial cable, optical fiber, or twisted pair copper wire.
The protocols included in Network Access Layer are Ethernet, Token Ring, FDDI, X.25, Frame Relay etc.
The most popular LAN architecture among those listed above is Ethernet. Ethernet uses an Access Method called CSMA/CD (Carrier Sense Multiple Access/Collision Detection) to access the media, when Ethernet operates in a shared media. An Access Method determines how a host will place data on the medium.
IN CSMA/CD Access Method, every host has equal access to the medium and can place data on the wire when the wire is free from network traffic. When a host wants to place data on the wire, it will check the wire to find whether another host is already using the medium. If there is traffic already in the medium, the host will wait and if there is no traffic, it will place the data in the medium. But, if two systems place data on the medium at the same instance, they will collide with each other, destroying the data. If the data is destroyed during transmission, the data will need to be retransmitted. After collision, each host will wait for a small interval of time and again the data will be retransmitted.
Protocol Data Unit (PDU) :
Protocol Data Unit - PDU
The following answers are incorrect:
The other options correctly describes the Layer to Protocol mapping of the DoD TCP/IP model protocols.
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 272
NEW QUESTION # 255
Who is responsible for authorizing access level of a data user?
- A. Data User
- B. Data Custodian
- C. Data Owner
- D. Security Administrator
Answer: C
Explanation:
Explanation/Reference:
Data owners are responsible for authorizing access level of a data user. These peoples are generally managers and directors responsible for using information for running and controlling the business. Their security responsibilities include authorizing access, ensuring that access rules are updated when personnel changes occur, and regularly review access rule for the data for which they are responsible.
For your exam you should know below roles in an organization
Data Owners - Data Owners are generally managers and directors responsible for using information for running and controlling the business. Their security responsibilities include authorizing access, ensuring that access rules are updated when personnel changes occur, and regularly review access rule for the data for which they are responsible.
Data Custodian or Data Steward -are responsible for storing and safeguarding the data, and include IS personnel such as system analysis and computer operators.
Security Administrator -Security administrator is responsible for providing adequate physical and logical security for IS programs, data and equipment.
Data Users - Data users, including internal and external user community, are the actual user of computerized data. Their level of access into the computer should be authorized by data owners, and restricted and monitor by security administrator.
The following were incorrect answers:
Security Administrator -Security administrator is responsible for providing adequate and logical security for IS programs, data and equipment.
Data Users - Data users, including internal and external user community, are the actual user of computerized data.
Data custodian is responsible for storing and safeguarding the data, and include IS personnel such as system analyst and computer operators.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number361
NEW QUESTION # 256
An organization is in the process of deciding whether to allow a bring your own device (BYOD) program. If
approved, which of the following should be the FIRST control required before implementation?
- A. Device registration
- B. An acceptable use policy
- C. An awareness program
- D. Device baseline configurations
Answer: A
Explanation:
Section: Information System Acquisition, Development and Implementation
NEW QUESTION # 257
Which of the following term in business continuity defines the total amount of time that a business process can be disrupted without causing any unacceptable consequences?
- A. WRT
- B. MTD
- C. RTO
- D. RPO
Answer: B
Explanation:
Explanation/Reference:
The sum of RTO and WRT is defined as the Maximum Tolerable Downtime (MTD) which defines the total amount of time that a business process can be disrupted without causing any unacceptable consequences. This value should be defined by the business management team or someone like CTO, CIO or IT manager.
For your exam you should know below information about RPO, RTO, WRT and MTD:
Stage 1: Business as usual
Business as usual
Image Reference - http://defaultreasoning.files.wordpress.com/2013/12/bcdr-01.png At this stage all systems are running production and working correctly.
Stage 2: Disaster occurs
Disaster Occurs
Image Reference - http://defaultreasoning.files.wordpress.com/2013/12/bcdr-02.png On a given point in time, disaster occurs and systems needs to be recovered. At this point the Recovery Point Objective (RPO) determines the maximum acceptable amount of data loss measured in time. For example, the maximum tolerable data loss is 15 minutes.
Stage 3: Recovery
Recovery
Image Reference - http://defaultreasoning.files.wordpress.com/2013/12/bcdr-03.png At this stage the system are recovered and back online but not ready for production yet. The Recovery Time Objective (RTO) determines the maximum tolerable amount of time needed to bring all critical systems back online. This covers, for example, restore data from back-up or fix of a failure. In most cases this part is carried out by system administrator, network administrator, storage administrator etc.
Stage 4: Resume Production
Resume Production
Image Reference - http://defaultreasoning.files.wordpress.com/2013/12/bcdr-04.png At this stage all systems are recovered, integrity of the system or data is verified and all critical systems can resume normal operations. The Work Recovery Time (WRT) determines the maximum tolerable amount of time that is needed to verify the system and/or data integrity. This could be, for example, checking the databases and logs, making sure the applications or services are running and are available.
In most cases those tasks are performed by application administrator, database administrator etc. When all systems affected by the disaster are verified and/or recovered, the environment is ready to resume the production again.
MTD
Image Reference - http://defaultreasoning.files.wordpress.com/2013/12/bcdr-05.png The sum of RTO and WRT is defined as the Maximum Tolerable Downtime (MTD) which defines the total amount of time that a business process can be disrupted without causing any unacceptable consequences. This value should be defined by the business management team or someone like CTO, CIO or IT manager.
The following answers are incorrect:
RPO - Recovery Point Objective (RPO) determines the maximum acceptable amount of data loss measured in time. For example, the maximum tolerable data loss is 15 minutes.
RTO - The Recovery Time Objective (RTO) determines the maximum tolerable amount of time needed to bring all critical systems back online. This covers, for example, restore data from back-up or fix of a failure.
In most cases this part is carried out by system administrator, network administrator, storage administrator etc.
WRT - The Work Recovery Time (WRT) determines the maximum tolerable amount of time that is needed to verify the system and/or data integrity. This could be, for example, checking the databases and logs, making sure the applications or services are running and are available. In most cases those tasks are performed by application administrator, database administrator etc. When all systems affected by the disaster are verified and/or recovered, the environment is ready to resume the production again.
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 284
http://defaultreasoning.com/2013/12/10/rpo-rto-wrt-mtdwth/
NEW QUESTION # 258
Which of the following applications has the MOST inherent risk and should be prioritized during audit planning?
- A. An onsite application that is unsupported
- B. An outsourced accounting application
- C. An internally developed application
- D. A decommissioned legacy application
Answer: C
NEW QUESTION # 259
An employee loses a mobile device resulting in loss of sensitive corporate data. Which of the following would have BEST prevented data leakage?
- A. Awareness training for mobile device users
- B. Complex password policy for mobile devices
- C. The triggering of remote data wipe capabilities
- D. Data encryption on the mobile device
Answer: C
Explanation:
Section: Protection of Information Assets
NEW QUESTION # 260
Which of the following controls BEST ensures appropriate segregation of duties within an accounts payable department?
- A. Including the creator's user ID as a field in every transaction record created
- B. Restricting program functionality according to user security profiles
- C. Ensuring that audit trails exist for transactions
- D. Restricting access to update programs to accounts payable staff only
Answer: C
Explanation:
Segregation of duties (SoD) is a key internal control that aims to prevent fraud and errors by ensuring that no single individual can perform incompatible or conflicting tasks within a business process. SoD reduces the risk of unauthorized or improper transactions, manipulation of data, or misappropriation of assets.
In the accounts payable department, SoD involves separating the following functions: invoice processing, payment authorization, payment execution, and reconciliation. For example, the person who approves an invoice should not be the same person who issues the payment or reconciles the bank statement.
One of the best ways to ensure appropriate SoD within the accounts payable department is to restrict program functionality according to user security profiles. This means that each user of the accounts payable system should have a unique login and password, and should only have access to the functions that are relevant to their role and responsibilities. For instance, an invoice processor should not be able to approve payments or modify vendor records. This way, the system can enforce SoD and prevent unauthorized or fraudulent activities.
The other options are not as effective as restricting program functionality according to user security profiles.
Restricting access to update programs to accounts payable staff only is a general access control measure, but it does not address the SoD issue within the accounts payable department. Including the creator's user ID as a field in every transaction record created is a useful audit trail feature, but it does not prevent users from performing incompatible functions. Ensuring that audit trails exist for transactions is a detective control that can help identify and investigate any irregularities, but it does not prevent them from occurring in the first place.
NEW QUESTION # 261
An IS auditor is reviewing the maturity of a large organizations IT governance. Which of the following BEST demonstrates that IT governance has been effectively implemented?
- A. The board reviews compliance with legal and regulatory requirements
- B. The board monitors adherence to the organizations information security policy.
- C. The board approves necessary resources for IT security reviews.
- D. The board reviews strategic IT hey performance Indicators (KPIs).
Answer: C
NEW QUESTION # 262
Which of the following can be thought of as the simplest and almost cheapest type of firewall?
- A. None of the choices.
- B. packet filter
- C. PIX firewall
- D. stateful firewall
- E. hardware firewall
Answer: B
Explanation:
Explanation/Reference:
Explanation:
The simplest and almost cheapest type of firewall is a packet filter that stops messages with inappropriate network addresses. It usually consists of a screening router and a set of rules that accept or reject a message based on information in the message header.
NEW QUESTION # 263
Which of the following provides the GREATEST assurance of message authenticity?
- A. The sender attains the recipient's public key and verifies the authenticity of its digital certificate with a certificate authority.
- B. The prehash code and the message are encrypted using the secret key.
- C. The prehash code is encrypted using the sender's private key.
- D. The prehash code is derived mathematically from the message being sent.
Answer: C
Explanation:
Explanation/Reference:
Explanation: Encrypting the prehash code using the sender's private key provides assurance of the authenticity of the message. Mathematically deriving the prehash code provides integrity to the message.
Encrypting the prehash code and the message using the secretkey provides confidentiality.
NEW QUESTION # 264
Which of the following should be an IS auditor's PRIMARY focus when evaluating the response process for cyber crimes?
- A. Notification to regulators
- B. Communication with law enforcement
- C. Evidence collection
- D. Root cause analysis
Answer: C
NEW QUESTION # 265
Which of the following is MOST helpful for measuring benefits realization for a new system?
- A. Function point analysts
- B. Business impact analysis (BIA)
- C. Post-implantation review
- D. Balanced scorecard review
Answer: C
NEW QUESTION # 266
What would be an IS auditor's BEST recommendation upon finding that a third-party IT service provider hosts the organization's human resources (HR) system in a foreign country?
- A. Perform background verification checks.
- B. Implement change management review.
- C. Review third-party audit reports.
- D. Conduct a privacy impact analysis.
Answer: D
NEW QUESTION # 267
When auditing the closing stages of a system development project, which of the following should be the MOST important consideration?
- A. Control requirements
- B. Functional requirements documentation
- C. Rollback procedures
- D. User acceptance test (UAT) results
Answer: B
NEW QUESTION # 268
What is the BEST action to prevent loss of data integrity or confidentiality in the case of an e-commerce application running on a LAN, processing electronic fund transfers (EFT) and orders?
- A. Using virtual private network (VPN) tunnels for data transfer
- B. Auditing the access control to the network
- C. Logging all changes to access lists
- D. Enabling data encryption within the application
Answer: A
Explanation:
Explanation/Reference:
Explanation:
The best way to ensure confidentiality and integrity of data is to encrypt it using virtual private network (VPN) tunnels. This is the most common and convenient way to encrypt the data traveling over the network. Data encryption within the application is less efficient than VPN. The other options are good practices, but they do not directly prevent the loss of data Integrity and confidentiality during communication through a network.
NEW QUESTION # 269
During the implementation of an upgraded enterprise resource planning (ERP) system, which of the following is the MOST important consideration for a go-live decision?
- A. Rollback strategy
- B. Test cases
- C. Post-implementation review objectives
- D. Business case
Answer: D
Explanation:
Explanation
The most important consideration for a go-live decision when implementing an upgraded enterprise resource planning (ERP) system is the business case. The business case is the document that defines and justifies the need, value, feasibility, and risks of the project. It also outlines the expected costs, benefits, outcomes, and impacts of the project. The business case provides the basis for measuring and evaluating the success of the project. Therefore, before deciding to go live with an upgraded ERP system, it is essential to review and validate the business case to ensure that it is still relevant, accurate, realistic, and achievable.
A rollback strategy, test cases, and post-implementation review objectives are not the most important considerations for a go-live decision when implementing an upgraded ERP system. These are important elements of project planning, execution, and evaluation, but they are not sufficient to determine whether the project is worth pursuing or delivering. These elements should be aligned with and derived from the business case.
NEW QUESTION # 270
.What is a primary high-level goal for an auditor who is reviewing a system development project?
- A. To ensure that proper approval for the project has been obtained
- B. To ensure that projects are monitored and administrated effectively
- C. To ensure that business objectives are achieved
- D. To ensure that programming and processing environments are segregated
Answer: C
Explanation:
A primary high-level goal for an auditor who is reviewing a systems-development project is to ensure that business objectives are achieved. This objective guides all other systems development objectives.
NEW QUESTION # 271
......
The Certified Information Systems Auditor (CISA) certification exam is one of the most recognized and respected certifications in the field of information security. The CISA certification is awarded by the Information Systems Audit and Control Association (ISACA) and is designed to provide professionals with the knowledge and skills necessary to effectively audit, control, and monitor information systems.
Verified & Correct CISA Practice Test Reliable Source Oct 05, 2025 Updated: https://pass4lead.newpassleader.com/ISACA/CISA-exam-preparation-materials.html