CISA Domain 1B-3 Practice Test 002

This practice test covers Domain 1 (Information Systems Auditing Process) Subdomain B-3 (Audit Evidence Collection Techniques) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 1B-3 Audit Evidence Collection Techniques Practice Test 002

10 questions • Single best answer

Question 1

A healthcare organization's internal IS auditor is testing whether terminated clinicians lose electronic health record access promptly. The HR manager provides a termination spreadsheet and states that all accounts were disabled within 24 hours of departure. Which evidence would provide the BEST assurance that access removal was timely?

A. A signed attestation from the HR manager confirming that all terminated accounts were disabled B. Screenshots supplied by the EHR administrator showing a sample of accounts in disabled status C. System audit logs of account disable timestamps compared against HR termination dates D. Interview notes from the EHR administrator describing each step of the deprovisioning workflow

Question 2

During an audit of a retail bank's loan origination system, the IS auditor receives a system-generated report listing all loans approved above delegated authority limits. The auditor intends to use the report as the population for testing approval controls. What should the IS auditor do FIRST?

A. Validate the completeness and accuracy of the report against the underlying source data B. Select a statistical sample of loans from the report for detailed approval testing C. Obtain written confirmation from management that the report parameters and logic are reliable D. Compare the report totals with the population used in the prior year's working papers

Question 3

An IS auditor at a manufacturing company is assessing whether a production change freeze was enforced during the quarter-end financial close. In a walkthrough, the change manager states that no changes were deployed and displays the freeze announcement email. Which additional procedure would MOST strengthen the evidence supporting the auditor's conclusion?

A. Obtaining a written representation from the change manager that confirms the freeze B. Reviewing the change advisory board meeting minutes for the quarter-end period C. Interviewing developers to confirm they were aware of the freeze window dates D. Extracting deployment logs from production systems covering the freeze window

Question 4

An audit manager reviews working papers for an audit of a cloud-hosted payroll application and notes that the staff auditor relied on the provider's SOC 2 Type II report. The report's coverage period ended seven months before the audit's reporting date. What is the MOST appropriate action to address the evidence gap?

A. Accept the report because a Type II report already provides operating effectiveness assurance B. Obtain a bridge letter and perform additional procedures covering the uncovered period C. Request the provider's current SOC 2 Type I report to cover the more recent period D. Replace the report with a security questionnaire completed by the provider's staff

Question 5

A government agency's IS auditor is evaluating whether the data center's visitor sign-in procedure is consistently followed. The facilities team was notified of the audit date in advance, and the visitor log for that day appears complete. Which technique would provide the MOST reliable evidence that the procedure operates consistently?

A. Unannounced observation on several dates combined with review of historical log entries B. Inspection of the visitor log entries recorded on the day of the scheduled audit visit C. Inquiry of on-duty security guards regarding how visitors are normally recorded at the entrance D. Review of the documented visitor procedure and its approval by facilities management

Question 6

An insurance company's internal audit team is testing an automated control that blocks claim payments exceeding policy limits. Management provides configuration screenshots showing the approved limit parameters currently set in the production claims processing system. Which procedure would BEST provide evidence that the control operates as designed?

A. Reviewing the change tickets that approved the most recent limit parameter configuration B. Inquiring of the application owner about recent exceptions to the payment limit rule C. Reperforming the control with test claims processed against the production configuration D. Inspecting a sample of paid claims to confirm each carried a supervisory sign-off

Question 7

A regional hospital's IS auditor is assessing whether critical patient data backups can be recovered within the documented recovery time objective. The infrastructure team offers several forms of evidence to support its claim that recovery is achievable. Which evidence is MOST reliable for concluding that backups are restorable within the objective?

A. Backup job completion reports showing a successful status for the past six months B. An auditor-observed restoration test with measured timing and data integrity checks C. The backup vendor's certification that its software meets recovery specifications D. The infrastructure team's documented restoration procedure as approved by the CIO

Question 8

An IS auditor at an e-commerce firm detects unusual discount overrides in the order management system and suspects possible fraud. The auditor has already extracted the relevant transaction data and wants it to remain usable if the matter is escalated. What should the IS auditor do FIRST to preserve the evidentiary value of the data?

A. Notify the sales manager whose team approved the discount overrides B. Run additional analytics to identify the users behind the overrides C. Provide the extract to the legal department for an initial review D. Document the extraction and secure the data using hash values

Question 9

An audit manager reviewing a telecommunications company's network access audit finds that the key conclusions rest on interview statements from the network operations lead. No other supporting evidence is documented in the working papers. What is the MOST significant concern with the evidence supporting these conclusions?

A. The interview notes were not signed or acknowledged by the network operations lead B. The interview was not recorded to support subsequent quality assurance review C. Inquiry alone does not provide sufficient appropriate evidence to support a conclusion D. The network operations lead may not be aware of every device on the network

Question 10

A multinational company's IS auditor must verify that database administrator privileges are restricted to authorized personnel across 40 production databases. The DBA team offers to run the privilege queries itself and email the results to the auditor. Which approach would provide the MOST reliable evidence?

A. Privilege queries run by or directly observed by the auditor against each database B. Query outputs prepared by the DBA team and exported into spreadsheets for the auditor's review C. A listing of authorized administrators maintained by the IT security function D. Approved access request forms on file for each current administrator account

Related Posts

Leave a Comment Cancel Reply