Health Information & Coding · Independent exam preparation
CISA: Risk-Based Audit Decisions, Controls and Evidence Study Guide
Practise risk-based audit decisions, evidence evaluation, IT governance, system delivery, resilience and asset protection through 60 concepts and 20 original questions.
By CertMedbry · Updated 29 October 2026
Decide which risks deserve audit attention, what evidence supports a conclusion, who owns corrective action, and whether systems can protect information and sustain business services. This selective guide develops those decisions through 60 concepts, practical cases, 20 questions and 20 flashcards. It follows ISACA's CISA outline effective 1 August 2024, confirmed as current on 29 October 2026. The official outline defines the full examination scope, including topics beyond the depth covered here.
Try 20 free practice questionsWhat is the exam format?
Check the question types, timing and outline before planning your revision.
Which certification and pathway does this guide cover?
This guide covers ISACA's Certified Information Systems Auditor certification examination. It is an information systems auditing credential, including governance, system delivery, operations, resilience and security. It is not a healthcare coding examination, an ISACA certificate program, or a separate advanced AI audit credential. Passing the examination is one requirement for certification; applicants must also satisfy ISACA's experience and professional requirements.
Which blueprint applies, and when did it take effect?
The applicable outline became effective on 1 August 2024. ISACA's current outline and the 2026 Certification Exams Candidate Guide, Appendix A, agree on its five domains and weights. The May 2024 release of preparation materials was separate from the August examination launch. This guide uses the outline confirmed as current on 29 October 2026.
CISA Exam Content Outline · ISACA Certification Exams Candidate Guide, 2026 · ISACA's CISA Exam Updated to Reflect Innovations and Evolving Technologies Impacting IT Audit
How are the official domains weighted?
Information System Auditing Process carries 18%; Governance and Management of IT, 18%; Information Systems Acquisition, Development and Implementation, 12%; Information Systems Operations and Business Resilience, 26%; and Protection of Information Assets, 26%. The guide allocates its 60 concepts as 11, 11, 7, 16 and 15 respectively. Questions and flashcards each use a 4, 4, 2, 5 and 5 distribution to approximate those weights.
How many questions are on the examination, and how many are scored?
ISACA's current CISA outline confirms 150 examination questions. A separate count of scored and unscored pretest questions is not confirmed here; no scored/pretest allocation is asserted.
What delivery method, duration and item styles are confirmed?
ISACA confirms computer-based delivery through authorized PSI testing centers globally and remotely proctored examinations. CISA allows four hours for 150 multiple-choice questions, with four options and one best answer per question, as established in the 2026 Certification Exams Candidate Guide, printed pages 7 and 13. No adaptive delivery model or numerical item-style mix is asserted. The 20 questions in this guide are independent four-option, single-best-answer drills, rather than a timed or adaptive examination simulator.
CISA Certification — Certified Information Systems Auditor · ISACA Certification Exams Candidate Guide, 2026
How should these materials be used alongside official requirements?
Use the concepts to understand mechanisms, the questions to practise discriminating between plausible actions, and the flashcards to recall decision rules. Use the complete ISACA outline to identify remaining study needs and the current candidate guide for examination administration. These original learning materials are independent of ISACA and do not predict a passing result.
CISA is ISACA's professional certification in information systems auditing, control and assurance. This independent educational guide applies the auditor's perspective: evaluate business risk, control effectiveness and reliable evidence while preserving management accountability.
Outline used: CISA Examination Content Outline effective 1 August 2024, confirmed against ISACA's current CISA outline and the 2026 Certification Exams Candidate Guide, Appendix A, on 2026-10-11. The workbook examination label matches the official credential. Assigned workbook category '6. Health Information & Coding' is retained as administrative metadata but does not describe CISA's information systems audit scope.
60 key concepts: understand, apply and avoid the traps
Work through the questions by exam domain. Explain the answer in your own words, try the example, then check the common pitfall.
Information System Auditing Process18%
1.How does an audit charter protect independence?
An audit charter establishes the function's purpose, authority, responsibilities and access to information. Appropriate governing-body approval and functional reporting help auditors challenge management without management controlling the assurance conclusion. Independence concerns the audit function's position; objectivity concerns an individual's impartial judgment. When an auditor previously designed or operated a control, evaluate self-review threats and assign independent assurance responsibility rather than relying on personal confidence.
Apply it
A finance director asks the auditor who configured payment approvals to certify their effectiveness. The audit leader documents the prior responsibility, arranges an independent reviewer and confirms access and reporting authority under the charter.
Common pitfall: Reporting administratively to an executive does not automatically destroy independence; the decisive issues include functional oversight, unrestricted scope, access and freedom to report.
ISACA Interactive Glossary · An ITAF Approach to IT Audit Advisory Services
2.When can auditors advise without assuming management responsibility?
Assurance evaluates a subject against criteria and communicates a conclusion supported by evidence. Advisory work can help management understand risks or compare control options, but management must select, implement and own the solution. Define the engagement's purpose and responsibilities before work begins. If later assurance covers an area previously advised on, assess whether the advice created a self-review threat and apply appropriate safeguards.
Apply it
During a system project, auditors explain segregation-of-duties risks and review proposed acceptance criteria. The project sponsor chooses the controls and approves deployment; a separate assurance team subsequently evaluates implementation against the agreed requirements.
Common pitfall: Calling an engagement advisory does not permit auditors to approve production access, accept business risk or certify their own operational decisions as independent assurance.
3.How should risk determine audit priorities?
Risk-based planning links business objectives, threats, vulnerabilities and potential consequences to audit coverage. Consider inherent exposure, existing controls, changes, prior results and uncertainty about control effectiveness. A critical process with weak assurance may deserve attention before a familiar process with many minor exceptions. Document the rationale, select objectives that address the important risks, and revise the plan when significant business or technology changes alter exposure.
Apply it
An organization replaces its payment platform while its low-value expense system remains stable. Audit prioritizes payment authorization, conversion accuracy and access controls because the change affects high-value transactions and existing assurance no longer describes the environment.
Common pitfall: Auditing whichever area has the most historical findings can misallocate effort when those findings are minor or more consequential risks have recently emerged.
Information Systems Auditing: Tools and Techniques — Creating Audit Programs
4.How do control design and operating effectiveness differ?
Design effectiveness asks whether a control, performed as intended, could address its identified risk. Operating effectiveness asks whether the control actually operated consistently, by authorized people or systems, over the relevant period. Preventive controls block unwanted events; detective controls identify events requiring response. A documented approval rule may be well designed yet ineffective if approvals occur after transactions or exceptions receive no investigation.
Apply it
A purchasing policy requires approval before orders exceed a threshold. The auditor first assesses whether the threshold and approver authority address exposure, then examines dated approvals and system enforcement across the audit period for actual operation.
Common pitfall: The existence of a policy or configuration screenshot demonstrates only limited aspects of design; it does not establish that the control operated throughout the period.
Information Systems Auditing: Tools and Techniques — Creating Audit Programs · ISACA Interactive Glossary
5.Why must audit objectives, criteria and materiality be explicit?
Objectives state what the engagement will determine, scope establishes its boundaries, and criteria define the expected condition against which evidence is evaluated. Materiality reflects the significance of an issue in context, including operational, financial, legal and reputational consequences. Agreeing a workable audit program connects these elements to procedures and resources. A small monetary discrepancy can still be significant when it reveals privileged misuse or systematic regulatory noncompliance.
Apply it
An interface audit defines its objective as assessing complete and accurate transfer of customer orders. The program specifies source and destination systems, audit dates, reconciliation requirements and escalation criteria before the team selects records for testing.
Common pitfall: A large sample cannot compensate for an undefined objective or unsuitable criteria; extensive testing may still fail to answer the engagement's actual business question.
Information Systems Auditing: Tools and Techniques — Creating Audit Programs · ISACA Interactive Glossary
6.How should sampling support an audit conclusion?
Sampling examines less than an entire population to support a defined conclusion. Attribute sampling commonly evaluates control deviations; substantive procedures assess transaction details or amounts. Specify the population, sampling unit, selection method and acceptable uncertainty before selecting items. Statistical selection permits quantified sampling risk when its assumptions are met. Judgmental selection can target risky items, but findings from that selection cannot automatically be projected to the whole population.
Apply it
To test timely account removal, an auditor defines all employee departures during the period, validates the list and selects a representative sample. Separately, the auditor examines every privileged departure because those cases present greater potential consequences.
Common pitfall: A sample containing only convenient records or known exceptions may reveal problems, but its deviation rate does not establish a reliable population-wide estimate.
ISACA Interactive Glossary · Information Systems Auditing: Tools and Techniques — Creating Audit Programs
7.Which evidence best supports an audit conclusion?
Useful evidence must be sufficient in quantity and appropriate in relevance and reliability for the conclusion. Direct observation, reperformance, corroborated records and independently obtained information often provide stronger support than unsupported inquiry. Reliability still depends on the controls over the source and collection method. A system report is persuasive only when its completeness, accuracy, parameters and relevant time period support the audit objective being tested.
Apply it
A manager states that access is reviewed quarterly. The auditor obtains review records, checks their population against active accounts, examines reviewer decisions and follows selected removals into the identity system to verify that decisions were implemented.
Common pitfall: Collecting several copies of the same unsupported assertion increases volume without increasing assurance; contradictory evidence requires investigation rather than selective omission from the conclusion.
Information Systems Auditing: Tools and Techniques — Creating Audit Programs
8.Why must audit analytics begin with data validation?
Analytics can identify anomalies across large populations, but its conclusions depend on reliable input and sound test logic. Reconcile record counts and control totals, inspect extraction criteria, test relevant fields and understand joins before interpreting results. An anomaly indicates a condition requiring investigation rather than proof of misconduct. Preserve reproducible queries and explain exclusions so another reviewer can trace the analysis to its underlying evidence.
Apply it
A duplicate-payment query flags matching supplier, amount and date fields. Before reporting losses, the auditor reconciles the extract to the ledger, checks whether credit notes were excluded and investigates whether flagged pairs represent legitimate installment payments.
Common pitfall: Testing every extracted record does not remove completeness risk when the extraction omitted transactions; population coverage and correctness of the analytical logic remain essential.
Information Systems Auditing: Tools and Techniques — Creating Audit Programs
9.How should an audit finding connect evidence to business risk?
A useful finding explains the expected condition, observed condition, supporting evidence, cause and actual or potential effect. Its significance should reflect business exposure rather than the auditor's preference for a particular technology. Validate factual accuracy with responsible management while retaining independent judgment. Recommendations should address the cause or reduce the relevant risk, and management's action plan should identify accountable ownership and a realistic completion date.
Apply it
Several terminated contractors retain production access because procurement does not notify identity administrators. The finding links the missing notification process to unauthorized-access exposure and recommends an accountable termination workflow rather than merely deleting the accounts found during testing.
Common pitfall: Describing only a missing document leaves readers unable to judge significance; describe the control objective and resulting exposure before recommending additional paperwork or technology.
Information Systems Auditing: Tools and Techniques — Creating Audit Programs
10.When is a corrective action ready for audit closure?
Follow-up determines whether management's response sufficiently addresses the identified risk. Obtain evidence of implementation and, where relevant, operation over a suitable period. Management may implement a different effective solution or formally accept residual risk within its authority. Closure should reflect the risk outcome rather than whether the original recommendation was copied exactly. Escalate overdue actions or acceptance decisions that exceed authorized tolerance through established reporting channels.
Apply it
Management reports that emergency changes now receive review. Before closing the finding, the auditor examines changes made after implementation, verifies review timeliness and checks that unresolved exceptions reach an accountable manager under the revised process.
Common pitfall: A completed project ticket or management promise demonstrates an action was recorded; it does not establish that the underlying exposure has been adequately reduced.
CISA Exam Content Outline · Information Systems Auditing: Tools and Techniques — Creating Audit Programs
11.How does audit quality assurance improve reliable conclusions?
Audit quality assurance evaluates whether engagements follow applicable standards, use sound methods and support conclusions with traceable evidence. Supervision and independent review can detect unsupported judgments before reports are issued. Improvement also requires examining recurring causes of weak scoping, delayed work or inconsistent testing. Measures should consider usefulness and quality alongside efficiency, because faster completion alone can conceal inadequate evidence or insufficient attention to significant risks.
Apply it
A quality reviewer finds that several reports cite analytics without documenting extraction checks. The audit function introduces a proportionate data-validation requirement and later reviews new engagements to determine whether conclusions have become more reproducible and better supported.
Common pitfall: Counting issued reports rewards output volume but cannot establish audit quality; a productive team may still miss important risks or issue conclusions unsupported by evidence.
CISA Exam Content Outline · Information Systems Auditing: Tools and Techniques — Creating Audit Programs
Governance and Management of IT18%
12.How do governance responsibilities differ from IT management?
Governance evaluates stakeholder needs, sets direction and monitors whether enterprise objectives are achieved within acceptable risk. Management plans, builds, runs and monitors activities consistent with that direction. The distinction matters when assigning accountability: executives and governing bodies cannot transfer oversight responsibility simply by outsourcing operations. Auditors examine whether decision rights, escalation paths and performance information allow the appropriate authority to direct and challenge technology-related decisions effectively.
Apply it
A board approves a digital-service strategy and risk boundaries. IT management selects implementation plans and operates services, while the board receives benefits, risk and performance reporting sufficient to challenge progress and authorize changes in direction.
Common pitfall: A steering committee meeting regularly does not establish effective governance if it lacks decision authority, relevant information or a clear connection to enterprise objectives.
The Governance Game of Chess: Mapping ISO/IEC 27001:2022 to COBIT
13.Why should IT strategy and architecture follow business objectives?
IT strategy translates enterprise goals into technology priorities, while enterprise architecture describes the relationships among capabilities, processes, information, applications and infrastructure. Their alignment helps identify unnecessary duplication, incompatible interfaces and dependencies that could obstruct intended benefits. Auditors look for traceability from proposed investments to business outcomes and constraints. Emerging technologies require the same analysis, including data quality, explainability, integration and ongoing ownership where automated decisions affect important processes.
Apply it
A company proposes an AI forecasting service to reduce stock shortages. The auditor checks whether its business objective, source-data responsibilities, integration dependencies, monitoring arrangements and accountable owner are reflected in strategy and architecture before evaluating claimed benefits.
Common pitfall: A technology roadmap can be internally consistent yet strategically weak if it lists upgrades without explaining which enterprise outcomes or risk reductions those investments support.
CISA Exam Content Outline · The Governance Game of Chess: Mapping ISO/IEC 27001:2022 to COBIT
14.How should policies translate applicable requirements into practice?
Policies establish management's required direction, standards define mandatory specifications, and procedures describe how activities are performed. Their requirements should reflect applicable laws, contracts, industry obligations and enterprise risk decisions. Applicability depends on jurisdiction, data, services and organizational circumstances; a technical framework does not automatically create a legal duty. Effective governance assigns owners, approves exceptions, communicates changes and checks whether operational practices actually satisfy the relevant requirements.
Apply it
An organization expands a customer service into another jurisdiction. Legal and privacy owners identify applicable obligations; management updates retention and access requirements, assigns implementation responsibilities and tests whether system settings and procedures reflect the approved changes.
Common pitfall: Treating a published security framework as universally binding can produce incorrect compliance conclusions; establish the actual obligation and its applicability before evaluating conformity against it.
CISA Exam Content Outline · NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
15.Who owns residual IT risk?
A risk owner is accountable for managing a defined exposure and making or escalating treatment decisions within delegated authority. Control owners operate specific safeguards; auditors independently evaluate the resulting assurance. Residual risk is the exposure remaining after controls and other responses. Acceptance requires an informed decision by an authorized owner, with escalation when exposure exceeds appetite or tolerance. Outsourcing a service changes responsibilities but does not eliminate enterprise accountability.
Apply it
An unsupported application cannot be replaced immediately. Its business owner assesses consequences, funds temporary isolation and obtains the required approval for remaining exposure, while audit evaluates whether the decision follows the organization's risk authority and escalation rules.
Common pitfall: Security staff or auditors may advise on exposure, but expertise alone does not authorize them to accept business risk on behalf of accountable management.
16.Why is privacy broader than information security?
Security protects information against threats to confidentiality, integrity and availability. Privacy also concerns whether personal information is collected, used, shared and retained appropriately for legitimate purposes and applicable obligations. An encrypted dataset can still create privacy risk if its collection is unnecessary or its reuse exceeds authorized purposes. Audit the information lifecycle, assigned accountability and actual processing practices rather than treating technical access protection as complete privacy assurance.
Apply it
A marketing team securely stores detailed customer location histories indefinitely. The auditor examines the purpose, necessity, authorized uses, retention basis and deletion process, because encryption alone does not resolve whether keeping those histories is appropriate.
Common pitfall: A system can prevent unauthorized access while enabling inappropriate authorized processing; privacy conclusions require examining purpose, minimization, retention and relevant individual protections as well.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations · CISA Exam Content Outline
17.How do data ownership and classification guide controls?
Data owners are accountable for decisions about information's business use, sensitivity and protection requirements. Custodians implement and operate assigned safeguards. Classification groups information according to relevant consequences and obligations, allowing handling rules to follow the data across systems. Effective classification influences access, sharing, retention, encryption and disposal. Reassess classifications when purpose, aggregation or context changes, because combined datasets may reveal information more sensitive than their individual fields.
Apply it
A sales export combines public company names with confidential pricing and personal contacts. The designated owner classifies the combined dataset and specifies permitted recipients and retention, while IT configures the access and sharing controls accordingly.
Common pitfall: Letting infrastructure administrators classify data solely by storage location overlooks business meaning; classification decisions require accountable ownership and an understanding of the information's consequences.
18.How should IT resource decisions address capability risk?
Resource management aligns people, skills, budgets and technology capacity with enterprise priorities. Auditors assess whether critical responsibilities have competent coverage, sustainable workloads and appropriate separation of duties. A service dependent on one specialist presents availability and knowledge-retention risk even when current performance is acceptable. Resource decisions should consider alternatives, succession, training and dependency exposure, rather than using utilization or immediate cost as the sole measure of efficiency.
Apply it
Only one engineer can restore a critical database. Management documents recovery procedures, trains a second operator and exercises the handover, allowing audit to assess whether the service can recover when the original specialist is unavailable.
Common pitfall: Operating every team at full utilization can remove capacity for incidents, maintenance and learning; high utilization does not by itself demonstrate effective or resilient resource management.
CISA Exam Content Outline · Performance Measurement Metrics for IT Governance
19.Which contract provisions make vendor oversight enforceable?
Vendor oversight begins with requirements and due diligence, then relies on contracts that make responsibilities measurable and enforceable. Relevant provisions include service levels, security duties, incident notification, data ownership, subcontracting, assurance access, recovery expectations and exit support. Their adequacy depends on service criticality and applicable obligations. Auditors examine whether contractual rights are exercised and whether monitoring detects deterioration, rather than assuming a signed agreement establishes effective ongoing control.
Apply it
A payroll outsourcing agreement promises availability but omits data return and deletion obligations. Before renewal, management adds an exit process, usable export formats, retention requirements and verification rights to reduce dependency and information exposure during termination.
Common pitfall: A strong service credit clause may compensate for some failures without restoring operations or data; contractual remedies should complement operational assurance and practical exit arrangements.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations · CISA Exam Content Outline
20.How should auditors evaluate outsourced assurance and supply-chain dependencies?
External assurance is useful only when its scope, period, criteria and results address the enterprise's actual reliance. Examine excluded services, subcontractors, reported exceptions and controls the customer must operate. A provider's assurance cannot establish customer-side access governance or cover an unexamined dependency. Supply-chain oversight should identify critical downstream providers, concentration and change risks, then obtain proportionate evidence or compensating arrangements for material gaps in the assurance chain.
Apply it
A hosting report covers physical facilities but excludes the managed database subcontractor. The customer identifies that database as essential, obtains appropriate assurance over it and verifies its own access responsibilities before relying on the combined service.
Common pitfall: A provider's clean assurance conclusion does not automatically extend to every product, period, region or subcontractor; reliance must follow the specific boundaries and conditions examined.
CISA Exam Content Outline · NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
21.How do KPIs and KRIs support different decisions?
A key performance indicator measures progress toward a defined objective; a key risk indicator signals changes in exposure or the likelihood of adverse outcomes. The same underlying data can inform both perspectives, but each measure needs a clear purpose, owner, threshold and response. Meaningful reporting connects indicators to business consequences. A technically accurate dashboard has limited value if decision-makers cannot determine when to intervene or which action is required.
Apply it
An online retailer tracks successful checkout completion as a service KPI and unsupported internet-facing components as a KRI. Owners investigate declining completion rates and escalating exposure using different response thresholds tied to business priorities and risk tolerance.
Common pitfall: Labeling every available statistic a key indicator produces noise; a useful measure must connect to an objective or risk and support a defined management decision.
Performance Measurement Metrics for IT Governance · ISACA Interactive Glossary
22.How does IT quality management turn defects into improvement?
Quality management establishes requirements, monitors process and product results, and improves the causes of recurring defects. Quality assurance emphasizes confidence in the processes used; quality control examines outputs against requirements. Auditors look for measurable objectives, reliable defect information, accountable corrective action and evidence that changes improve outcomes. A maturity assessment can identify capability gaps, but achieving a maturity label does not establish that important business requirements are being met.
Apply it
Repeated releases require manual corrections after deployment. Management analyzes defect origins, improves requirements review and testing, then tracks escaped defects and business disruption to determine whether the revised process produces more reliable service outcomes over time.
Common pitfall: Adding inspections without addressing recurring causes may increase effort while leaving quality unchanged; improvement should be judged against relevant outcomes rather than additional process documentation.
CISA Exam Content Outline · Performance Measurement Metrics for IT Governance
Information Systems Acquisition, Development and Implementation12%
23.Which business-case evidence supports a project decision?
A business case should connect a proposed investment to objectives, feasible alternatives, expected benefits, lifecycle costs, dependencies and risks. Project governance assigns sponsorship, decision authority and stage approvals so changes remain accountable. Benefits need measurable outcomes and owners who can realize them after delivery. Financial attractiveness alone is insufficient when assumptions are unsupported or essential capabilities are absent. Auditors challenge traceability and assumptions without taking ownership of the investment decision.
Apply it
A replacement platform promises lower processing costs but excludes migration and support expenses. The auditor identifies the incomplete cost basis and asks management to reassess alternatives, dependencies and measurable benefits before the authorized committee approves further investment.
Common pitfall: A favorable payback calculation cannot validate omitted costs or unrealistic benefits; governance should challenge the underlying assumptions rather than treating the calculation as sufficient evidence.
24.How can Agile development preserve auditable control?
Agile development delivers increments through frequent feedback rather than eliminating requirements, approval or evidence. Control can be embedded in acceptance criteria, a definition of done, automated tests, version history and accountable product decisions. Auditors evaluate whether each release satisfies business and control requirements appropriate to its risk. The essential distinction is between flexible delivery and uncontrolled change: documentation may be concise, but decisions and results must remain traceable.
Apply it
A team releases weekly using automated pipelines. The auditor traces a financial-calculation requirement from its backlog acceptance criteria through reviewed code, test results and business acceptance, confirming that rapid delivery still preserves an accountable record of control.
Common pitfall: Requiring a traditional document package for every iteration can miss equivalent evidence; accepting verbal assurances because a team is Agile creates the opposite assurance failure.
25.Why should application controls be designed before deployment?
Application controls enforce valid, complete, accurate and authorized processing at input, processing, output and interface stages. Designing them with business requirements reduces dependence on manual correction after deployment. Controls should address identified failure modes, including invalid values, duplicates, unauthorized overrides and incomplete processing. For automated decisions, examine input quality, rule or model changes, exception handling and monitoring. A technically correct program can still implement an inappropriate business rule consistently.
Apply it
A claims system must reject duplicate submissions and route unusually large claims for approval. The team defines these controls before coding, tests bypass and override paths, and assigns ownership of exception review before production use begins.
Common pitfall: Successful execution proves that software ran, not that its business rules were appropriate; control design must begin with business risk and authorized processing requirements.
CISA Exam Content Outline · NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
26.Which tests demonstrate readiness for production?
Readiness testing should demonstrate that a system meets business, technical, security and operational requirements under realistic conditions. Unit tests assess components; integration tests assess interactions; user acceptance tests assess business fitness. Performance, security, recovery and exception testing address different failure modes. Authorized business acceptance and operational readiness are separate decisions. Passing technical tests does not justify deployment when users cannot complete essential workflows or recovery arrangements remain unproven.
Apply it
A billing system passes unit and integration tests, but users cannot reverse an incorrect invoice. The business owner withholds acceptance for the affected workflow while the team corrects and retests the requirement before an authorized deployment decision.
Common pitfall: Treating developer test completion as business acceptance overlooks whether intended users can perform required work, including exception handling, using realistic data and appropriate access.
Auditing Agile — A Brave New World · CISA Exam Content Outline
27.How should release controls preserve tested configurations?
Release management moves an authorized, identifiable set of changes into service. Configuration control preserves the relationship among approved code, dependencies, settings and deployed artifacts. Independent approval, restricted deployment authority and traceable pipeline records reduce unauthorized substitutions. Verify that the production artifact matches what was tested and that rollback or recovery arrangements address failure. Automated deployment strengthens consistency only when its permissions, approvals and configuration sources are themselves controlled.
Apply it
A release pipeline builds a signed artifact after testing and deploys that same version following approval. The auditor checks artifact identity, production configuration changes and restricted pipeline credentials rather than assuming automation alone prevents unauthorized software changes.
Common pitfall: Approving source code does not prove the deployed package or environment matches it; dependencies, configuration settings and build or deployment privileges can change production behavior.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations · CISA Exam Content Outline
28.How do migration reconciliations establish complete and accurate conversion?
Migration assurance compares source information with the converted destination using approved mappings and business rules. Record counts support completeness, while financial totals, field-level checks and exception analysis address accuracy and meaning. Rehearsals expose timing, dependency and rollback problems before cutover. Equal totals alone can conceal offsetting errors or incorrect assignments. Accountable business owners should resolve exceptions and accept the converted information before it becomes the authoritative production record.
Apply it
A customer migration preserves the total account balance but places some balances against incorrect customer identifiers. The team supplements totals with key-level reconciliation and mapping checks, resolves mismatches and obtains business acceptance before the final cutover decision.
Common pitfall: Matching source and destination totals can conceal duplicate, omitted or misassigned records; choose reconciliation evidence that tests both population completeness and the meaning of converted fields.
CISA Exam Content Outline · ISACA Certification Exams Candidate Guide, 2026
29.What should a post-implementation review determine?
A post-implementation review compares actual outcomes with approved requirements, expected benefits, costs and control objectives. It assesses unresolved defects, operational performance, user adoption and lessons for future projects after sufficient experience exists. Delivery on schedule is one dimension, not proof of business success. Separate project completion from benefits realization: some benefits emerge later and require continued measurement by accountable business owners rather than closure of the implementation team.
Apply it
A procurement platform launches on time, yet manual workarounds prevent expected savings. The review examines adoption, workflow defects and control exceptions, assigns corrective actions and retains benefits tracking with the business owner after the project team disbands.
Common pitfall: Closing a project because software was installed can conceal unmet outcomes; review whether approved business requirements and controls work in actual use after implementation.
Information Systems Operations and Business Resilience26%
30.Why does asset lifecycle management matter to operations?
Asset management maintains reliable knowledge of hardware, software, services, ownership and lifecycle status. That knowledge supports maintenance, licensing, capacity, vulnerability response and disposal. Operational importance depends on relationships: an inexpensive component may support a critical service. Auditors compare inventories with discovery and procurement records, examine unsupported assets and verify ownership. Disposal must address information removal and accountability rather than treating physical removal from a building as completed retirement.
Apply it
A discovery scan identifies an unsupported server missing from the inventory. Investigation shows it processes overnight settlement files, so management assigns ownership, assesses dependencies and plans controlled replacement rather than removing an apparently unused device immediately.
Common pitfall: An accurate equipment count does not establish a useful inventory when service dependencies, accountable owners or support status are missing from the asset records.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations · CISA Exam Content Outline
31.How should scheduled processing handle failures and reruns?
Scheduled production processing requires authorized job definitions, correct sequencing, dependency checks and monitored completion. Failure handling should prevent incomplete or duplicate business effects when jobs restart. Checkpoints, transaction controls and reconciliations can establish what completed before recovery. Auditors examine actual exceptions and operator interventions, not just scheduler settings. A job marked successful may still produce incomplete output if its completion status does not validate business processing results adequately.
Apply it
A nightly payment job fails after sending part of its output. Operators determine which payments were committed, use the approved restart procedure and reconcile results, avoiding a full rerun that could transmit the same payments a second time.
Common pitfall: Automatically rerunning every failed job can create duplicates or inconsistent records; recovery must account for partial completion and the receiving system's handling of repeated submissions.
CISA Exam Content Outline · NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
32.Which interface controls detect missing or duplicate transactions?
Interfaces need controls over completeness, accuracy, authorization and timely transfer between systems. Sequence checks, transaction identifiers, acknowledgments, control totals and reconciliations address different failure modes. Exception handling must assign ownership and preserve unresolved items for investigation. A successful network connection establishes transport availability, not complete business processing. Evaluate the entire transfer from source creation through destination acceptance, including retry behavior, rejected records and changes to mappings or formats.
Apply it
An order interface reports successful file delivery, but the destination rejects several records. Operations reconciles source counts and values to accepted and rejected transactions, assigns the exceptions and confirms correction without duplicating orders that were already accepted.
Common pitfall: A transport acknowledgment may confirm receipt of bytes without confirming valid application posting; end-to-end reconciliation must account for rejected, missing and repeatedly transmitted business transactions.
CISA Exam Content Outline · ISACA Certification Exams Candidate Guide, 2026
33.When do spreadsheets and shadow IT require stronger controls?
End-user computing and shadow IT can support legitimate business needs while bypassing normal development, access and recovery controls. Assess exposure by business impact, sensitive information, complexity and reliance, rather than by the tool's apparent simplicity. Critical spreadsheets may need controlled inputs, protected logic, independent review, version management and recoverable storage. Unapproved cloud tools also require attention to data location, sharing and ownership before deciding whether to restrict or formalize their use.
Apply it
A treasury spreadsheet determines daily funding transfers. Management inventories it as critical, protects formulas, independently reviews changes and reconciles outputs, while ensuring backups and alternate staff can support its use if the original author is unavailable.
Common pitfall: Classifying all spreadsheets as low risk overlooks their business role; a small workbook can determine material transactions without the safeguards applied to enterprise applications.
CISA Exam Content Outline · NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
34.How do availability and capacity management interact?
Availability concerns whether a service is usable when required; capacity concerns whether resources can meet demand and performance requirements. A running server can provide an unavailable business service when response times or dependencies prevent useful transactions. Capacity planning therefore combines observed utilization, demand trends, growth assumptions and workload tests. Auditors assess whether thresholds trigger timely action and whether redundancy remains adequate during peaks, component failure or scheduled maintenance periods.
Apply it
A booking service meets average utilization targets but stalls during seasonal sales. Operations tests peak transaction loads and dependency limits, then adjusts capacity and alert thresholds using business response-time requirements rather than relying on monthly average CPU figures.
Common pitfall: Low average utilization can conceal short bottlenecks, while redundant infrastructure can still fail together; evaluate peak demand, dependencies and degraded-operation capacity against actual service requirements.
CISA Exam Content Outline · NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
35.How do incident and problem management differ?
Incident management restores an interrupted or degraded service and limits business impact. Problem management investigates underlying causes and prevents recurrence or reduces its consequences. A workaround can resolve the immediate incident while leaving an open problem requiring analysis and corrective action. Effective processes link recurring incidents to investigation, known errors and controlled changes. Auditors evaluate restoration performance and recurrence reduction separately because rapid recovery does not demonstrate that persistent causes have been addressed.
Apply it
Restarting a service restores customer access after repeated outages. Incident records document restoration, while a linked problem investigation identifies a memory leak and routes its permanent correction through change management before verifying that recurrence has stopped.
Common pitfall: Closing each outage as soon as service returns can hide a recurring failure pattern; restoration and root-cause elimination require related but distinct accountability and evidence.
36.How should change, configuration and patch processes work together?
Change management evaluates and authorizes modifications; configuration management records approved states and relationships; patch management addresses updates according to exposure and operational requirements. Together they support controlled, traceable production conditions. Assess impact, test appropriately, authorize deployment, prepare recovery and verify results. Emergency changes may use accelerated approval but still require records and subsequent review. Patch priority should reflect exploitation, exposure and service impact rather than release date alone.
Apply it
An actively exploited flaw affects an internet-facing service. Management uses its emergency path to approve and test a proportionate fix, records the deployed version, monitors results and completes retrospective review instead of bypassing accountability because deployment is urgent.
Common pitfall: A universal patch timetable can ignore actual exposure and operational consequences; risk-based urgency should operate within a controlled process, including justified exceptions and compensating safeguards.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations · CISA Exam Content Outline
37.What makes operational logs useful and trustworthy?
Operational logs support troubleshooting, accountability and reconstruction when they record relevant events with reliable timestamps, source identity and sufficient detail. Controls must address collection failures, retention, access and unauthorized alteration. Centralization can reduce dependence on a failed host, but it does not guarantee complete coverage or review. Auditors verify that logs support defined operational questions and that exceptions receive timely investigation, with retention aligned to business and applicable obligations.
Apply it
A batch reconciliation fails, but local logs disappear when the server restarts. Operations configures protected central forwarding, checks ingestion alerts and tests whether timestamps and transaction identifiers allow staff to reconstruct the failed processing sequence reliably.
Common pitfall: Large log volumes provide little assurance if critical events are absent, clocks disagree or nobody reviews failures; usefulness depends on relevant content and an effective response process.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
38.How should service levels reflect business needs?
Service levels translate business requirements into measurable commitments such as availability, response time, support and recovery. Define measurement periods, exclusions, data sources and responsibilities so results are interpretable. Component-level targets should support the complete business service rather than obscure its failure. Auditors assess both reported performance and the suitability of the agreement: consistently meeting an easy target can still leave essential users unable to complete time-critical work.
Apply it
A provider reports excellent monthly server availability, yet order processing fails at the daily dispatch deadline. Management revises service measures to include the required transaction window and end-to-end processing, then monitors exceptions against the business commitment.
Common pitfall: Service credits and favorable infrastructure averages do not establish business fitness; measures must cover the service users require, including critical periods and relevant dependencies.
CISA Exam Content Outline · Performance Measurement Metrics for IT Governance
39.How do database controls preserve transaction integrity?
Database integrity depends on authorized access, appropriate constraints, controlled changes and reliable transaction processing. Transaction boundaries help ensure related updates complete together or are reversed together; constraints restrict invalid relationships and values. Logging and recoverable backups support restoration to a consistent state. Auditors also examine privileged administration and maintenance because direct database changes can bypass application approvals. Technical consistency remains distinct from whether a transaction was legitimately authorized by the business.
Apply it
A transfer must reduce one account and increase another together. The auditor examines transaction handling and failure tests, then separately checks who can post transfers or modify balances directly through privileged database access outside the application workflow.
Common pitfall: A database can remain technically consistent while storing unauthorized transactions; integrity assurance requires business authorization and privileged-access controls alongside transaction processing and structural constraints.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations · CISA Exam Content Outline
40.How does a business impact analysis set recovery priorities?
A business impact analysis identifies critical processes, dependencies and consequences as disruption continues. It supports priorities and recovery requirements, including recovery time and recovery point objectives. The recovery time objective concerns the targeted time to restore an activity or resource; the recovery point objective concerns tolerable data loss measured backward in time. These objectives must reflect business need and feasible dependencies rather than whichever backup schedule or infrastructure target already exists.
Apply it
A settlement process must resume within four hours and lose no more than thirty minutes of transactions. The business impact analysis documents these distinct requirements and the supporting identity, network, data and staffing dependencies needed to achieve them.
Common pitfall: An existing backup interval describes current capability, not acceptable business loss; recovery objectives should drive solution design rather than being inferred from available infrastructure.
NIST SP 800-34 Revision 1: Contingency Planning Guide for Federal Information Systems
41.Why must resilience address common dependencies?
Resilience is the ability to sustain or restore required outcomes despite disruption. Redundancy helps only when alternative components do not share an unaddressed cause of failure. Map dependencies across facilities, identity, networks, providers, staff and data, then test realistic loss scenarios. A second application instance may add little resilience if both instances require the same unavailable identity service. Design should reflect the business impact of correlated failures and degraded operation.
Apply it
Two regional application deployments both rely on one identity tenant and a single network gateway. A resilience review models loss of those shared dependencies and develops tested alternatives instead of treating geographic application separation as sufficient continuity.
Common pitfall: Counting duplicate components can exaggerate resilience when they share power, administration, credentials or provider dependencies; evaluate independence of failure modes and actual service continuity.
NIST SP 800-34 Revision 1: Contingency Planning Guide for Federal Information Systems · NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
42.How do backup strategy and restoration testing support recovery?
Backups create recoverable copies, while restoration testing demonstrates whether those copies can rebuild usable information and services. Full, incremental and differential approaches create different restore dependencies and durations. Protection must address unauthorized deletion, corruption, location and access to recovery keys. Replication may reproduce accidental deletion or malicious encryption, so it does not inherently provide historical recovery. Evaluate the entire restore sequence against required data loss and recovery time.
Apply it
A database backup reports success, but a restore exercise reveals that its encryption key is unavailable and required logs are missing. Management corrects those dependencies and repeats restoration before relying on the backup to satisfy recovery objectives.
Common pitfall: A successful backup job proves that a process completed according to its checks; it does not prove recoverability, consistency or restoration within business time limits.
NIST SP 800-34 Revision 1: Contingency Planning Guide for Federal Information Systems · NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
43.What must a business continuity plan enable people to do?
A business continuity plan directs how essential activities continue or resume during disruption. It identifies activation authority, priorities, communications, people, facilities, suppliers and workable alternate procedures. Technology recovery supports continuity but does not replace business decisions about degraded service, manual processing or customer obligations. Plans need accessible copies, trained participants and maintained dependencies. Evaluate whether alternate methods can handle required volumes and reconcile their results when normal processing returns.
Apply it
During a system outage, staff record urgent orders manually under an approved continuity procedure. The plan defines authorization, capacity limits, secure storage and later reconciliation so restored systems do not omit orders or process them twice.
Common pitfall: A contact list and technical recovery document cannot by themselves sustain business operations; continuity must explain prioritized work, decision authority and practical alternate processing.
NIST SP 800-34 Revision 1: Contingency Planning Guide for Federal Information Systems
44.How should a disaster recovery plan sequence restoration?
A disaster recovery plan defines the technical arrangements and procedures for restoring systems after a significant disruption. Recovery sequence should follow business priorities and prerequisite dependencies, including networks, identity, keys, data and external connectivity. An application restored before its required services may remain unusable. Include activation, restoration, validation and return-to-normal procedures with accountable roles. Auditors compare demonstrated recovery capability with the recovery requirements established through business impact analysis.
Apply it
A recovery exercise brings an application online but users cannot authenticate. The team revises the recovery sequence to restore identity and network services first, then validates business transactions before declaring the application recovered and available to users.
Common pitfall: Server startup is an incomplete recovery milestone; restoration should be validated through required business functions, usable data and functioning dependencies before recovery objectives are judged.
NIST SP 800-34 Revision 1: Contingency Planning Guide for Federal Information Systems
45.Which recovery exercises provide evidence of capability?
Exercises provide different assurance according to what participants actually perform. A tabletop tests understanding, decisions and coordination; a technical restoration tests selected recovery procedures; broader exercises test integrated service recovery and dependencies. Match exercise scope to the claim being evaluated and control production risk. Record results, gaps and corrective actions, then verify improvements. A plan review is useful preparation but cannot establish that data and services can be restored within objectives.
Apply it
A tabletop confirms that managers know who declares a disaster, but nobody restores a database. Audit records the coordination assurance obtained and requests separate technical recovery evidence before concluding that the documented recovery time is achievable in practice.
Common pitfall: Treating all exercises as equivalent overstates assurance; distinguish discussing a response from demonstrating restoration, integrated transactions and sustained operation under the tested disruption scenario.
NIST SP 800-34 Revision 1: Contingency Planning Guide for Federal Information Systems · NIST SP 800-61 Revision 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
Protection of Information Assets26%
46.How should security frameworks be tailored to actual risk?
A security framework organizes control objectives and practices, while tailoring selects and adapts safeguards to the system's information, threats, dependencies and obligations. Auditors assess whether exclusions and alternatives have a documented rationale and authorized residual-risk decisions. Control implementation must be tested rather than inferred from framework adoption. NIST controls can support technical evaluation, but their use does not automatically establish universal legal compliance or determine the CISA examination's scope.
Apply it
A small service adopts a control framework but excludes logging because it has few users. The auditor challenges the rationale against privileged access and transaction risk, then examines whether alternative monitoring actually provides sufficient accountability for the service.
Common pitfall: A completed framework checklist can conceal ineffective or inapplicable controls; evaluate risk coverage, implementation and operation rather than equating a framework label with adequate protection.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations · NIST SP 800-53 Revision 5 — Publication and Update Record
47.Which physical and environmental safeguards protect availability?
Physical safeguards restrict unauthorized access to facilities and equipment, while environmental safeguards address threats such as power loss, heat, water and fire. Their design should reflect site conditions, asset sensitivity and operational dependencies. Visitor records alone do not prevent entry; evaluate authorization, barriers, escort practices and monitoring together. Environmental alarms also require tested response arrangements because detecting excessive temperature without timely intervention does not preserve service or prevent equipment damage.
Apply it
A server room has temperature sensors, but alerts reach an unattended mailbox after hours. Management changes escalation and tests response, while audit examines entry authorization and power dependencies to evaluate the room's combined physical and environmental protection.
Common pitfall: A visible safeguard can create false confidence when its response chain is broken; alarms, access records and backup power need demonstrated operation and appropriate oversight.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
48.How should identity controls follow the user lifecycle?
Identity lifecycle controls establish users, authorize access, adjust permissions when roles change and remove access when no longer justified. Joiner, mover and leaver events need reliable triggers and accountable approval. Periodic reviews detect access that event-driven processes miss, but reviews are effective only when decisions lead to actual changes. Auditors reconcile authoritative personnel or sponsor records with accounts and evaluate nonemployee, service and dormant identities as well as employees.
Apply it
An employee transfers from purchasing to supplier maintenance but keeps purchasing approval rights. The auditor traces the role change, identifies the missing removal step and evaluates whether access reviews detect incompatible accumulated permissions across business applications.
Common pitfall: A strong account-creation process does not prevent privilege accumulation; role changes, contractor expiry and nonhuman accounts require explicit lifecycle ownership and timely removal mechanisms.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
49.How do least privilege and segregation of duties work together?
Least privilege limits access to what a person or service needs for authorized tasks. Segregation of duties separates incompatible capabilities so one party cannot complete a sensitive action without independent involvement. Privileged access requires additional attention to approval, duration, attributable use and monitoring. Where staffing prevents full separation, evaluate compensating controls that independently detect or constrain misuse. Merely splitting account names is ineffective if one person controls both credentials.
Apply it
A small team cannot separate all database administration tasks. Management restricts standing privileges, approves temporary elevation and sends protected activity records to an independent reviewer who can investigate unauthorized changes outside the administrator's control and reporting chain.
Common pitfall: Logging alone is a weak compensating control when the privileged user can alter the records or when reviewers lack independence, relevant detail or timely follow-up.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
50.Why is phishing-resistant authentication different from ordinary MFA?
Multifactor authentication combines distinct factor types, but some methods still allow an attacker to relay a user's response to a fraudulent login. Phishing resistance depends on the authentication protocol, not simply the number of steps. Properly implemented WebAuthn binds authentication to the legitimate verifier, preventing use at an impostor origin. Passwords plus manually entered one-time codes lack that binding. Enrollment, account recovery and session protection must also preserve the intended assurance.
Apply it
A company replaces password-and-code logins for administrators with appropriately configured WebAuthn authenticators. The security review also examines enrollment and recovery, because an attacker who can bypass those processes may avoid the stronger routine authentication mechanism.
Common pitfall: Two passwords are not two distinct factors, and a second factor is not automatically phishing resistant; evaluate factor independence and the protocol's verifier binding.
NIST SP 800-63B-4: Authentication and Authenticator Management
51.How do network segmentation and endpoint controls limit compromise?
Network segmentation restricts communication paths so compromise of one area does not automatically expose another. Endpoint controls reduce or detect malicious execution, insecure configurations and unauthorized activity on individual devices. Their effectiveness depends on enforceable rules, managed configurations and monitored exceptions. Auditors test permitted paths and denied paths against business need. A segmented architecture provides limited protection if broad administrative access, unmanaged devices or shared credentials bypass the intended boundaries.
Apply it
A workstation becomes infected, but network rules prevent it from contacting production databases directly. The response team also checks endpoint telemetry and privileged pathways to determine whether the attacker could reach sensitive systems through an allowed management route.
Common pitfall: Drawing separate network zones does not demonstrate isolation; test actual communication rules and administrative paths, including exceptions that could permit movement across the boundary.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
52.When can data loss prevention reduce information exposure?
Data loss prevention identifies or restricts sensitive information moving through monitored channels, using classification, content patterns or contextual rules. Its value depends on accurate policy, coverage and response to alerts. Test both successful detections and inappropriate blocking because false positives can drive users toward unmonitored workarounds. DLP complements access control and user education; it cannot guarantee protection where encrypted, unsupported or unmanaged channels prevent inspection or enforcement.
Apply it
A DLP rule blocks customer identifiers in outbound email but misses uploads through an unmanaged sharing application. Management evaluates that channel, improves permitted sharing options and tests detection before claiming that the information is protected against external disclosure.
Common pitfall: A high number of blocked messages does not establish comprehensive protection; assess channel coverage, classification accuracy, exception handling and whether important losses could bypass inspection.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
53.Why is key management essential to encryption assurance?
Encryption protects information by transforming it with cryptographic keys, but its security depends on who can obtain or use those keys. Key generation, storage, access, rotation, revocation and recovery must match the information's lifecycle and threats. Encryption at rest does not prevent an authorized application or compromised privileged identity from reading decrypted data. Auditors evaluate the relevant exposure and separation of key access rather than treating an encryption setting as complete confidentiality assurance.
Apply it
Backups are encrypted, but their keys are stored in the same broadly accessible folder. The auditor identifies the shared exposure and evaluates restricted key storage, accountable use and tested recovery arrangements before concluding that stolen backups would remain protected.
Common pitfall: Encrypting data while exposing its keys through the same access path can defeat the intended protection; key availability also matters when legitimate recovery is required.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
54.How does a digital certificate support trust?
A digital certificate associates a public key with an asserted identity through a trusted issuer's signature. Relying systems must validate the trust path, intended use, identity match and validity status as applicable. The corresponding private key must remain protected because its compromise can enable impersonation. Digital signatures support integrity and origin verification when keys and validation are trustworthy; encryption and signing serve different purposes and should not be treated as interchangeable assurances.
Apply it
A service presents a certificate for a different hostname. The client rejects the identity mismatch even though the certificate has not expired, demonstrating that a valid date alone does not establish that the intended service owns the connection.
Common pitfall: A certificate's presence does not prove trustworthy communication; identity matching, chain validation, private-key protection and relevant status checks determine whether the asserted trust is justified.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
55.How should cloud and virtualization responsibilities be evaluated?
Cloud service models allocate operational responsibilities differently, but customers retain responsibilities for their information, access decisions and appropriate service use. Identify which party controls each relevant layer and obtain evidence for that allocation. Virtualization introduces management-plane and isolation dependencies whose compromise can affect multiple workloads. Auditors assess tenant configuration, privileged access, interfaces, logging and provider assurance together rather than assuming that provider-managed infrastructure also manages every customer-side risk.
Apply it
A cloud provider secures its storage infrastructure, but a customer configures a sensitive container for public access. The review assigns the configuration failure to the customer's responsibilities and evaluates preventive settings, monitoring and data-owner approval for external sharing.
Common pitfall: A provider's infrastructure certification does not establish secure tenant configuration; assurance must distinguish provider-controlled safeguards from customer-managed identities, data, permissions and service settings.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
56.Which risks distinguish mobile, wireless and IoT devices?
Mobile, wireless and connected devices expand exposure through physical loss, radio access, constrained security features and inconsistent update support. Controls should reflect device capability and business use: inventory, secure configuration, strong authentication, supported updates and restricted network access remain central. Device management can protect enrolled equipment but may not cover every connected sensor or personal device. Evaluate sensitive data, remote administration and end-of-support plans before allowing persistent connectivity.
Apply it
A warehouse deploys sensors that cannot support the organization's normal endpoint agent. Management inventories them, restricts their network communication, replaces default credentials and establishes an update and retirement process instead of granting unrestricted access to operational systems.
Common pitfall: A device's limited user interface does not make it low risk; persistent connectivity, default credentials and weak update mechanisms can create an entry point into critical environments.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
57.How should awareness training address real attack behavior?
Awareness programs should help people recognize relevant threats and perform safe actions, including reporting suspicious events promptly. Tailor content to roles and attack methods such as credential phishing, impersonation and fraudulent payment changes. Evaluate observed behavior and reporting quality rather than attendance alone. Simulations can identify improvement needs when interpreted fairly and followed by instruction. Training complements technical and process controls; it does not justify assigning users sole responsibility for preventing attacks.
Apply it
Accounts-payable staff receive a plausible supplier bank-change request. Training directs them to verify changes through an established independent contact channel and report suspicious requests, while the payment workflow retains approval controls even when a message appears legitimate.
Common pitfall: Completion rates measure participation rather than safe behavior; an awareness program should test relevant decisions and reporting without treating one simulation outcome as complete security assurance.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
58.How do vulnerability scanning and penetration testing differ?
Vulnerability scanning identifies potential weaknesses using automated checks and configuration information. Penetration testing investigates whether weaknesses can be exploited within an authorized scope and rules of engagement. Neither method guarantees absence of vulnerabilities. Validate findings, consider exploitability and business exposure, then track treatment and retesting. Auditors should understand test boundaries, credentials, exclusions and production risks because a technically thorough test can still omit the asset or attack path central to the assurance objective.
Apply it
A scanner identifies an exposed management service. An authorized penetration test demonstrates access through a configuration weakness, and management prioritizes correction based on the reachable business systems before retesting both the specific flaw and relevant access path.
Common pitfall: Counting scanner findings without validating context can misdirect effort; a small number of exploitable weaknesses on critical paths may deserve priority over numerous low-impact observations.
NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations · CISA Exam Content Outline
59.How should monitoring lead to an effective incident response?
Security monitoring turns relevant telemetry into signals requiring validation, prioritization and response. A useful alert needs sufficient context, an accountable recipient and an escalation path. Incident response coordinates investigation, containment, eradication and recovery according to business impact and authorized procedures. These activities can overlap as circumstances change. Evaluate detection coverage and response exercises together, because collecting events without timely decisions leaves exposure untreated and response plans without detection may activate too late.
Apply it
Monitoring detects suspicious privileged logins and unusual data access. The response team validates the activity, follows authorized containment procedures, preserves relevant evidence and coordinates business recovery, then uses lessons learned to improve detection logic and escalation arrangements.
Common pitfall: An alert dashboard does not demonstrate effective response; measure whether significant signals are investigated, escalated and acted on with appropriate authority, evidence preservation and business coordination.
NIST SP 800-61 Revision 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management · NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
60.How should digital evidence be preserved for defensible analysis?
Evidence handling should preserve relevant information, document collection and maintain traceability of custody and analysis. Choose collection methods according to volatility, system impact, authority and investigation needs. Forensic copies and appropriate cryptographic integrity checks can demonstrate that acquired data has not changed, while working copies reduce alteration of originals. Integrity verification does not establish that content was truthful before collection. Document handlers, times, tools and transfers so conclusions remain reproducible and accountable.
Apply it
An investigator acquires a disk image using an approved method, records its integrity value and custody details, protects the original and analyzes a verified working copy. Volatile information is considered separately before shutdown because it may otherwise be lost.
Common pitfall: A matching integrity value supports unchanged data, but it does not prove who created the content, whether it was authentic originally or whether custody was properly documented.
NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
What to focus on during revision
The following are CertMedbry study suggestions. Use the official outline to check the full scope of your examination.
- Allocate study time using the official 18%/18%/12%/26%/26% weights, with sustained attention to operations, resilience and information protection.
- Translate each scenario into a business objective, risk, control objective, responsible owner and evidence needed for an audit conclusion.
- Distinguish design from operation, representative sampling from targeted selection, and an analytical anomaly from a confirmed exception.
- Keep governance direction, management execution, business risk acceptance and independent audit judgment attached to the correct roles.
- Practise release traceability, business acceptance, migration reconciliation and post-implementation benefits evaluation as separate decisions.
- Calculate recovery-point exposure and recovery-time requirements from stated assumptions, then examine dependencies and demonstrated restore capability.
- Evaluate identity lifecycle, privileged access, phishing resistance, cloud responsibilities, key management and evidence preservation through their actual mechanisms.
A practical preparation plan
1. Map the full official scope
Read the complete current CISA outline and mark every subtopic as unfamiliar, explainable or applicable. Use this selective guide to build decision skills while keeping uncovered outline topics visible in your study plan.
2. Build a risk-to-evidence chain
For each concept, write the business objective, a plausible failure, the control that addresses it and the evidence that would demonstrate operation. Identify who owns the risk and who independently evaluates it.
3. Work through contrasting decisions
Compare paired ideas such as incident versus problem management, RTO versus RPO, governance versus management, and encryption versus key protection. Explain the scenario cue that makes one action appropriate.
4. Answer and justify the 20 drills
Choose one answer before reading the explanation. Then explain why each alternative is less appropriate using the facts in the scenario. Record the misunderstood principle rather than memorizing the answer position.
5. Revisit weak mechanisms with active recall
Use the flashcards to recall a rule and its reason without looking. Rework missed applications with changed assumptions, especially sampling populations, migration controls, recovery dependencies and access responsibilities.
6. Close scope gaps and confirm arrangements
Revisit the complete outline, prioritizing weak areas and the two 26% domains. Consult the current candidate guide and your appointment information for examination administration; use learning results to direct further study rather than predict a pass.
Use your sample score as a starting point
The free set contains 20 original practice questions. It is a small learning sample, not an official examination or a validated pass prediction. Review each explanation and its source before moving to another topic.
Start the free sampleOfficial sources and updates
- CISA Certification — Certified Information Systems Auditor
- CISA Exam Content Outline
- Exam Candidate Guides
- ISACA Certification Exams Candidate Guide, 2026
- ISACA's CISA Exam Updated to Reflect Innovations and Evolving Technologies Impacting IT Audit
- ISACA Interactive Glossary
- Information Systems Auditing: Tools and Techniques — Creating Audit Programs
- An ITAF Approach to IT Audit Advisory Services
- The Governance Game of Chess: Mapping ISO/IEC 27001:2022 to COBIT
- Performance Measurement Metrics for IT Governance
- Auditing Agile — A Brave New World
- NIST SP 800-53 Revision 5 — Publication and Update Record
- NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
- NIST SP 800-34 Revision 1: Contingency Planning Guide for Federal Information Systems
- NIST SP 800-63B-4: Authentication and Authenticator Management
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
- NIST SP 800-61 Revision 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
- An ITAF Approach to IT Audit Advisory Services
- 2018 Volume 4 Tools Using Audit Tools to Support Strategic Objectives
Confirm current eligibility, fees, scheduling and policies directly with the examination provider. CertMedbry is independent and is not endorsed by these organisations. How we handle content and corrections.