CISA Domain 5A-1 Practice Test 001

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-1 (Information Asset Security Frameworks, Standards, and Guidelines) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-1 Information Asset Security Frameworks, Standards, and Guidelines Practice Test 001

10 questions • Single best answer

Question 1

An audit manager is reviewing a manufacturing company's decision to adopt ISO/IEC 27001 as the foundation for its information security program. Several competing frameworks were considered, and management now wants assurance that the selection is appropriate and defensible. What should the IS auditor evaluate FIRST?

A. Whether the framework is the single most widely adopted and recognized standard across the global manufacturing sector B. Whether the framework was selected based on the organization's risk profile and business objectives C. Whether formal certification against the framework can realistically be achieved within the current fiscal year D. Whether the framework specifies the largest number of individual security controls to implement

Question 2

A government agency has mapped its security controls to the NIST Cybersecurity Framework and asserts full alignment. Management points to the completed mapping as evidence of a strong security posture. During fieldwork, the IS auditor finds the mappings exist on paper but several mapped controls are not operating. Which conclusion is MOST appropriate?

A. Framework alignment alone does not provide assurance that mapped controls are operating effectively B. The agency has achieved its security objectives because every required control has been formally mapped to the framework C. The framework is unsuitable for the agency and should be replaced with a more prescriptive standard D. The completed mapping exercise satisfies the audit objective for evaluating control effectiveness

Question 3

An IS auditor is examining a SaaS provider's ISO/IEC 27001 implementation ahead of a certification audit. Management states that not all Annex A controls were implemented, citing documented risk-based treatment decisions. To determine which controls the organization deemed applicable and the justification for each exclusion, which document provides the BEST evidence?

A. The organization's overarching information security policy statement B. The most recently updated enterprise risk register C. The Statement of Applicability D. The external certification body's issued audit certificate

Question 4

During an audit of a retail company that processes card payments, the IS auditor is selecting the criteria to assess the cardholder data environment. The company also follows internal security guidelines that are less stringent than industry mandates. Which basis is MOST appropriate for evaluating these controls?

A. The company's internal security guidelines, since they reflect management's chosen risk appetite B. A general best-practice checklist compiled informally from several security frameworks C. The prior year's audit program, to maintain consistency across successive engagements D. The PCI DSS requirements applicable to the cardholder data environment

Question 5

An energy utility is beginning to adopt the NIST Cybersecurity Framework and asks the IS auditor how to establish where its security program currently stands. Management wants a structured, repeatable way to prioritize improvements and justify future security investment. Which activity should the auditor recommend the organization perform FIRST?

A. A gap analysis comparing current-state controls against the framework's target profile B. Immediate procurement of additional security tooling to close the most visible technical weaknesses first C. Certification against the framework to demonstrate commitment to regulators and stakeholders D. A penetration test to enumerate and rank exploitable technical vulnerabilities across the production environment

Question 6

A university adopts a recognized control baseline and applies every control in it uniformly across all systems, including low-risk public information portals that host no sensitive data. The IS auditor notes significant effort spent on controls with little bearing on those systems. Which recommendation is MOST appropriate?

A. Retain uniform application of all controls to guarantee complete consistency across the whole environment B. Remove the baseline entirely and let each system owner define controls independently C. Tailor the baseline so control selection reflects each system's risk and data sensitivity D. Escalate the wasted effort as a material weakness in the information security program

Question 7

An insurance company has implemented a security framework and can show documented policies for every control domain. However, the IS auditor finds no risk assessment underlies the control selection, and the controls appear to have been copied directly from the framework without tailoring. Which finding is MOST significant?

A. The documented policies are formatted inconsistently across the various control domains and lack a common template B. Controls were adopted without a risk assessment, so their relevance to actual risks is unverified C. The framework version referenced in the policies is one revision behind the current published release D. The policies do not cite the specific framework clause numbers for each individual control

Question 8

A telecommunications provider's IT department independently selected and rolled out a new security framework, but senior management was not involved and has not formally endorsed the initiative. The IS auditor is assessing governance over the effort. Which concern should the auditor raise as MOST important?

A. The IT department did not benchmark the chosen framework against those used by industry competitors B. The framework rollout did not include a formal launch communication distributed to all staff C. The framework documentation is stored on a shared drive rather than the official policy portal D. The absence of senior management endorsement, which undermines authority, resourcing, and organization-wide adoption

Question 9

An IS auditor reviews a logistics firm's security documentation and finds that its standards and detailed procedures were written before any framework or overarching security policy was ever established. As a result, staff are unsure which requirements are authoritative. Which recommendation would BEST address the underlying weakness?

A. Establish a policy hierarchy in which framework-aligned policies drive supporting standards and procedures B. Consolidate all existing standards and procedures into a single combined reference document for convenience C. Require each department to independently develop and maintain its own separate set of security procedures D. Adopt the technology vendor's default configuration hardening guides as the firm's authoritative security standards

Question 10

A hospital must satisfy multiple overlapping security frameworks and regulations, which has created duplicated and sometimes conflicting control requirements across its compliance teams. Management asks the IS auditor for guidance to reduce redundant effort without losing coverage. Which approach should the auditor recommend as MOST effective?

A. Designate one framework as primary and formally disregard the requirements of all the others going forward B. Have each compliance team continue managing its assigned framework independently to preserve clear ownership C. Develop a unified control set that maps common requirements across frameworks to shared controls D. Postpone any rationalization effort until regulators mandate a specific consolidated compliance approach

Related Posts

Leave a Comment Cancel Reply