CISA Domain 2B-2 Practice Test 001

This practice test covers Domain 2 (Governance & Management of IT) Subdomain B-2 (Vendor Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 2B-2 IT Vendor Management Practice Test 001

10 questions • Single best answer

Question 1

During an audit of a healthcare provider, an IS auditor finds that a critical claims-processing function was outsourced without a formal service-level agreement. Vendor performance is tracked only through occasional informal email updates from the account manager, and no metrics or remedies are documented. Which of the following should the auditor recommend FIRST?

A. Establish an SLA that defines performance metrics, responsibilities, and remedies. B. Require the vendor to submit an independently issued SOC 2 assurance report each year. C. Introduce financial penalties to be applied whenever a service target is missed. D. Arrange a periodic on-site inspection of the vendor's claims-processing facility.

Question 2

An IS auditor is evaluating whether an outsourced payroll provider is meeting its contractual obligations. The business owner asserts that the vendor performs very well but is unable to produce any supporting records to substantiate that assertion. Which of the following would provide the BEST evidence of the vendor's actual performance against the contract?

A. The vendor's published service brochure describing its capabilities and advertised uptime. B. Verbal confirmation obtained from the organization's internal business relationship manager. C. SLA performance reports that are independently reviewed and reconciled to source data. D. The signed master services agreement together with its associated statement of work.

Question 3

During a review of vendor management at a manufacturing firm, an IS auditor examines several cloud provider contracts that support production systems and notes a number of weaknesses across the agreements. The provider hosts sensitive engineering data critical to operations. Which of the following findings should the auditor consider the MOST significant?

A. The contracts use inconsistent document formatting and display outdated corporate logos. B. The renewal notice periods differ by a few days between two of the providers. C. Several of the contracts still reference a superseded internal procurement policy number. D. No right-to-audit or independent assurance clause exists for the provider hosting critical data.

Question 4

An IS auditor is assessing the vendor selection process for a new core banking platform. Management awarded the contract to the supplier that scored lowest against the defined security requirements because it offered the lowest overall price. The security gap was significant. Which of the following is the auditor's BEST course of action?

A. Conclude that the selection was inappropriate because price was allowed to outweigh security. B. Determine whether the residual security risk was formally evaluated and accepted by an appropriate authority. C. Recommend that the contract award be reversed and reissued to the higher-scoring vendor. D. Accept the decision on the basis that competitive pricing benefits the organization overall.

Question 5

A financial services firm relies on a third-party provider that in turn subcontracts application hosting to another company. During the vendor audit, the IS auditor learns that the organization has no visibility into the subcontractor's control environment and does not monitor it in any way. Which risk should the auditor highlight as MOST relevant?

A. The primary vendor may seek to increase its annual service fees at the next renewal. B. The subcontractor could adopt a different helpdesk ticketing system over time. C. Unmonitored fourth-party concentration and supply-chain risk within the delivery model. D. Contract documentation for the arrangement may be stored across multiple repositories.

Question 6

During a government agency audit, an IS auditor reviews SLA monitoring for an outsourced network services contract. The vendor's reported metrics consistently show near-perfect availability, yet business users complain of frequent outages that disrupt daily operations. The reported figures and user experience clearly diverge. Which of the following should the auditor do FIRST?

A. Determine how the reported availability metrics are defined, measured, and sourced. B. Conclude that the vendor is deliberately falsifying the performance figures it reports. C. Recommend immediate termination of the outsourced network services contract. D. Advise management to withhold the vendor's next scheduled service payment.

Question 7

An IS auditor is reviewing an organization's process for offboarding a software-as-a-service vendor whose contract has been terminated. The organization stored significant volumes of customer data in the vendor's environment. Which of the following controls would provide the BEST assurance that organizational data is protected at contract exit?

A. A contractual clause requiring the vendor to give thirty days of termination notice. B. A final invoice reconciliation confirming that all outstanding service charges are settled. C. An exit meeting in which the vendor verbally confirms that the outsourcing relationship has now formally ended. D. A documented data-return and certified-destruction clause that is verified upon termination.

Question 8

An IS auditor is evaluating how an enterprise oversees its portfolio of IT vendors. Every supplier currently receives the same annual due-diligence questionnaire regardless of the services it provides or how critical it is to operations. Which of the following recommendations would MOST improve the vendor management program?

A. Substantially increase the number and depth of questions included in the standard annual due-diligence questionnaire. B. Apply a risk-based tiering model that aligns oversight intensity to each vendor's criticality. C. Require every vendor in the portfolio to complete the questionnaire twice each year. D. Migrate the questionnaire from a shared spreadsheet into a dedicated survey platform.

Question 9

During an audit of a retailer, an IS auditor finds that a key vendor's most recent SOC 2 Type II report contains several exceptions affecting access-management controls. The business owner acknowledges that no one has reviewed the report since it was received. What is the auditor's BEST recommendation?

A. Disregard the exceptions because an independent service auditor already issued the report. B. Immediately terminate the vendor relationship and suspend all services until the provider supplies a fully clean assurance report. C. Assess the relevance of the exceptions and whether compensating controls mitigate the risk. D. File the report and revisit the noted exceptions at the next scheduled annual review.

Question 10

An IS auditor is reviewing contract management for a critical ERP support vendor. The agreement contains no provision addressing continuity of service if the vendor becomes insolvent or ceases operations, even though the organization depends entirely on this supplier to maintain the system. Which of the following findings should the auditor rank as the HIGHEST priority?

A. No source-code escrow or exit-continuity arrangement exists for the critical ERP system. B. The contract does not specify the vendor's preferred day-to-day communication channels. C. Invoices are approved by a departmental manager rather than by the finance director. D. The agreement omits a clause covering annual cost-of-living price adjustments for services.

Related Posts

Leave a Comment Cancel Reply