CISA Domain 2B-3 Practice Test 001

This practice test covers Domain 2 (Governance & Management of IT) Subdomain B-3 (IT Performance Monitoring and Reporting) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 2B-3 IT Performance Monitoring and Reporting Practice Test 001

10 questions • Single best answer

Question 1

An IS auditor reviewing the IT performance management framework of a retail enterprise finds that all reported metrics are operational or technical, such as server uptime and help-desk ticket volume. None of the measures are linked to business objectives or strategic goals. Which of the following should the auditor recommend FIRST?

A. Automate the collection of the existing technical metrics to improve efficiency B. Establish performance measures that link IT results to defined business objectives C. Increase the frequency of metric reporting to senior management D. Benchmark the current metrics against comparable industry organizations

Question 2

An IS auditor examines a financial institution's IT performance dashboard. All key performance indicators are reported as within target, yet the number of security incidents has climbed steadily over the past two quarters despite the favorable metrics. Which of the following findings is MOST significant?

A. Key performance indicator targets have not been revised in the past year B. The dashboard is refreshed monthly rather than on a weekly basis C. The dashboard lacks key risk indicators that would give early warning of emerging risk D. Incident statistics are maintained separately from the performance dashboard

Question 3

An IS auditor wants to determine whether an enterprise's IT performance metrics genuinely support its strategic objectives. The IT department reports dozens of metrics each period, but management provides no documentation linking them to corporate goals. Which of the following would provide the BEST evidence of alignment?

A. Documented traceability between balanced-scorecard measures and approved business objectives B. A complete inventory of all key performance indicators currently collected across the IT department C. Evidence that dashboards are distributed to senior management each month D. Interviews with IT staff describing which metrics they personally track

Question 4

During a review of a government agency's IT performance reports, an IS auditor notes that key performance indicator values are manually keyed into a spreadsheet by the same operations team whose performance the metrics measure. No independent check is performed on the figures. Which of the following should concern the auditor MOST?

A. Manual data entry is slower than automated metric collection B. Spreadsheet-based reporting is difficult to place under version control C. The reporting format varies from one period to the next D. The absence of independent validation could allow performance figures to be manipulated

Question 5

An IS auditor is evaluating controls over the reliability of an organization's reported IT performance metrics. Several stakeholders rely on these figures for investment and staffing decisions. Which of the following controls provides the BEST assurance that the reported metrics are accurate and complete?

A. Review of the compiled metrics by the IT manager before they are published each period B. Automated extraction from source systems combined with periodic reconciliation C. A requirement that each metric owner formally signs off on submissions D. Retention of historical metric data in a securely access-controlled repository

Question 6

A manufacturer's IT risk dashboard shows that a key risk indicator for unpatched critical vulnerabilities has exceeded its defined threshold for three consecutive months. No corresponding remediation or escalation activity has been recorded during that period. Which conclusion is MOST appropriate?

A. The key risk indicator threshold has been configured at too low and unrealistic a level for the environment B. The key risk indicator should be reclassified and reported as a performance indicator C. Escalation and response processes tied to risk thresholds are not operating effectively D. The indicator should be measured and refreshed on a more frequent basis

Question 7

An IS auditor finds that IT performance results are compiled each quarter by the IT department but are never presented to the board or the IT steering committee. Management states the results are used only internally by IT. What is the auditor's BEST course of action?

A. Report a governance gap, because performance results do not reach the body responsible for IT oversight B. Recommend that the IT department publish the results on an internal portal C. Advise IT to reduce the total number of metrics that are compiled D. Suggest that the quarterly results be archived for future reference

Question 8

An organization establishes all of its IT performance targets based solely on its own prior-year results. An IS auditor is assessing whether this practice yields meaningful insight into IT effectiveness. Which recommendation is MOST appropriate to improve the value of the organization's performance monitoring?

A. Report performance results to executive management on a more frequent schedule B. Incorporate external benchmarking against industry peers and standards C. Increase the number of internal metrics collected during each reporting period D. Automate the calculation of prior-year baseline figures for consistency

Question 9

An IS auditor is assessing whether an organization's IT key performance indicators actually drive corrective action rather than serving only as reporting formalities. The organization reports numerous indicators each quarter across several systems. Which of the following testing approaches would provide the BEST evidence?

A. Trace selected out-of-target results to documented remediation actions B. Confirm that the indicators are formally defined within the IT policy manual C. Verify that the performance dashboards are visually clear and kept current D. Review the total number of indicators reported in each quarterly cycle

Question 10

A cloud migration review finds that although the service provider issues detailed monthly performance reports, the organization does not independently verify the reported figures against its own monitoring data. Service credits and renewal decisions rely on these reports. Which finding is MOST significant?

A. The provider delivers its reports as PDF files rather than through a live dashboard B. Performance results are reported monthly instead of on a weekly cycle C. Reliance on unverified vendor metrics may misstate actual service performance D. The organization retains only twelve months of historical performance reports

Related Posts

Leave a Comment Cancel Reply