CISA Domain 2A-3 Practice Test 001

This practice test covers Domain 2 (Governance & Management of IT) Subdomain A-3 (IT Policies, Standards, Procedures and Practices) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 2A-3 IT Policies, Standards, Procedures and Practices Practice Test 001

10 questions • Single best answer

Question 1

During an external audit of a manufacturing company, the IS auditor notes that IT policies exist but have not been reviewed or updated in five years. During that period the company adopted several cloud services and became subject to new data protection regulations. Which finding is MOST significant?

A. The policies are no longer aligned with current business processes and regulatory requirements. B. The policy documents are stored on a shared network drive instead of a formal repository. C. Employees were not required to re-sign the existing policy documents each year. D. The policies do not reference several of the specific cloud service providers currently in use.

Question 2

An IS auditor reviews a bank's information security documentation and finds a high-level policy stating that access to systems must be restricted. However, there is no document specifying the mandatory password length, complexity, and account lockout thresholds that employees are required to follow. Which type of document is MOST likely missing?

A. A guideline B. A procedure C. A standard D. A charter

Question 3

During a governance audit of a government agency, the IS auditor discovers that several IT procedures conflict with the agency's overarching IT security policy. Business units consistently follow the local procedures rather than the policy, and no exceptions were formally documented. What should the IS auditor do FIRST?

A. Recommend that all conflicting procedures be immediately rewritten to match the security policy. B. Determine the extent of the deviations and the associated risk exposure. C. Report the conflict to executive management as a critical audit finding. D. Instruct the affected business units to begin following the security policy at once.

Question 4

An IS auditor is assessing whether a retail organization's acceptable use policy is operating effectively, not merely whether it exists. Management asserts that all employees comply with the policy and that violations are rare. Which of the following provides the BEST evidence that the policy is effective?

A. The existence of a formally approved and published acceptable use policy document. B. Monitoring results and disciplinary records demonstrating the policy is actively enforced. C. Signed acknowledgment forms collected from all employees during onboarding. D. Interviews with department managers confirming employees are aware of the policy.

Question 5

A financial services firm maintains a comprehensive set of IT policies, but the IS auditor finds no evidence that the policies are periodically reviewed or that a specific owner has been assigned to maintain them. Several policies reference obsolete systems. Which recommendation is MOST appropriate?

A. Assign formal policy ownership and establish a scheduled periodic review process. B. Require all employees to re-acknowledge the IT policies every year. C. Convert the existing policies into more detailed operational procedures. D. Publish the policies on the corporate intranet to improve visibility.

Question 6

An IS auditor examines an insurance company's IT policies and notes they were adapted directly from a generic industry template. The auditor is concerned the policies may not address the company's specific legal and regulatory obligations, including recently enacted data privacy requirements. What should the auditor evaluate NEXT?

A. Whether the policy template was purchased from a reputable and well-established industry vendor. B. Whether the policies map to the specific laws and regulations applicable to the company. C. Whether employees have formally acknowledged the templated IT policies. D. Whether the policies use terminology consistent with the original template.

Question 7

An IS auditor determines that a company's IT standards are frequently ignored because they were developed by the IT department without input from business units or senior management endorsement. Employees state they were unaware the standards applied to them. Which of the following is the MOST significant underlying cause of the non-compliance?

A. Insufficient technical detail contained within the published IT standards. B. Absence of automated enforcement tools for the IT standards. C. Failure to translate the high-level standards into detailed step-by-step operational procedures. D. Lack of senior management endorsement and stakeholder involvement in the standards.

Question 8

An IS auditor wants to determine whether a telecommunications company's data retention procedures are actually being followed in practice, rather than simply confirming that an approved procedure document exists. Management insists that compliance is consistently high across all departments. Which testing approach would provide the MOST reliable assurance?

A. Reviewing the approved data retention procedure document for completeness and clarity. B. Interviewing the records manager about how data retention is handled. C. Obtaining management's written representation that data retention is enforced. D. Inspecting a sample of records to verify actual disposal against the defined retention schedule.

Question 9

An IS auditor notes that a manufacturing firm's IT policy prohibits the use of removable media, yet several departments routinely use USB drives under exceptions that the CISO states were approved verbally. No documentation of the exceptions or supporting risk analysis is available. What should the IS auditor do FIRST?

A. Evaluate whether the exceptions were risk-assessed and formally approved. B. Report the removable media usage to the audit committee as a significant policy violation. C. Recommend that the removable media prohibition be removed from the IT policy. D. Test whether the USB drives currently in use contain properly encrypted data.

Question 10

A prior audit recommended that an energy company formalize and document its IT standards to strengthen governance. During the follow-up review, the IS auditor finds that the standards were drafted but never formally approved, published, or communicated to staff, and no owner was assigned. Which conclusion is MOST appropriate?

A. The recommendation has been fully implemented because the standards were drafted. B. The recommendation is no longer relevant and can be formally closed. C. The recommendation has not been effectively implemented and the risk remains. D. Implementation is adequate because the act of drafting demonstrates sufficient management commitment.

Related Posts

Leave a Comment Cancel Reply