CISA Domain 2A-1 Practice Test 002

This practice test covers Domain 2 (Governance & Management of IT) Subdomain A-1 (Laws, Regulations, and Industry Standards) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 2A-1 Laws, Regulations, and Industry Standards Practice Test 002

10 questions • Single best answer

Question 1

An IS auditor at a public university is planning a review of the student information system, which also processes tuition card payments. Management asserts the system is fully compliant with all external requirements but cannot produce an inventory of the laws, regulations, and industry standards that apply. What should the IS auditor do FIRST?

A. Test the system's security controls against the card-industry data security standard B. Obtain a written management representation confirming the compliance assertion C. Identify the legal, regulatory, and contractual requirements applicable to the system D. Report the missing compliance inventory to the audit committee as a significant deficiency

Question 2

A telecommunications provider learns that a new national cybersecurity regulation takes effect in six months, requiring incident reporting and supply chain risk controls. The board asks internal audit to independently assess management's readiness. Which evidence provides the BEST assurance that the organization is preparing effectively?

A. A gap assessment mapping each requirement to current controls, with remediation owners and dates B. An updated information security policy that cites the new regulation and its effective date C. A legal counsel memorandum summarizing the regulation's obligations and potential penalties D. Board approval of a budget increase for the security tools needed to satisfy the new requirements

Question 3

During an audit of a multinational logistics firm's regional subsidiary, the IS auditor finds that local law requires customer data to remain in-country. The corporate IT standard requires all backups to replicate to the headquarters data center abroad, and the subsidiary follows the corporate standard. Which recommendation is MOST appropriate?

A. Continue replication and disclose the practice to the local regulator in the next filing B. Encrypt the replicated backups so that data held abroad cannot be read by unauthorized parties C. Request that headquarters revise the standard at its next scheduled annual policy review D. Retain backups in-country and obtain a documented exception to the corporate standard

Question 4

An e-commerce retailer outsources card payment processing to a third-party provider. During a vendor compliance review, the IS auditor must determine whether the provider meets the applicable card-industry security standard for the services it performs on the retailer's behalf. Which of the following is the BEST evidence?

A. The provider's completed self-assessment questionnaire, signed by its chief information officer B. A current attestation of compliance from a qualified assessor covering the contracted services C. A contract clause in which the provider warrants continuing compliance with the standard D. A SOC 2 Type I report describing the design of the provider's information security controls

Question 5

An IS auditor reviewing a hospital network's governance finds that responsibility for complying with health data privacy regulations has been delegated entirely to the IT security manager since the program began. No compliance status reporting reaches executive leadership or the board of directors. Which finding is MOST significant?

A. Accountability for regulatory compliance has not been retained at the senior management level B. The IT security manager lacks the legal expertise needed to interpret the privacy regulations C. Compliance activities are not supported by a formal regulatory monitoring tool or database D. The privacy compliance function is not organizationally independent from IT operations staff

Question 6

An audit manager at a regional bank is preparing the annual IS audit plan. Regulators recently issued guidance on third-party and cloud risk management, and the bank migrated its core lending platform to a public cloud provider last year. How should the audit manager address this in the audit plan?

A. Defer coverage until the regulator's next examination identifies specific areas of concern B. Rely on the cloud provider's independent assurance report in place of an internal review C. Prioritize a review of cloud third-party risk management against the new regulatory guidance D. Include the review in the plan only if management formally requests assurance over the migration

Question 7

A publicly traded manufacturer must comply with financial reporting regulations requiring effective access controls over its ERP system. Management's documented control states that application owners review user access quarterly. Which testing approach provides the MOST reliable evidence that the control operated effectively throughout the year?

A. Inspect the access review policy and confirm it assigns quarterly responsibility to application owners B. Examine each quarterly review for sign-off, timeliness, and evidence that exceptions were remediated C. Interview application owners to confirm that they perform the reviews each quarter as required D. Reperform the most recent quarterly review and compare the results with the owners' conclusions

Question 8

A software-as-a-service company has adopted a widely recognized voluntary security framework and tells customers it is therefore compliant with all applicable regulations. The IS auditor identifies a state privacy law requiring consumer data deletion within specific timelines that the framework does not address. Which conclusion is MOST appropriate?

A. The framework is inadequate and should be replaced with a standard that specifically addresses privacy B. The company is compliant because the framework reflects recognized industry good practice C. The deletion requirement presents low risk because the adopted framework does not include it D. Framework adoption alone does not ensure compliance with specific legal obligations

Question 9

During an audit of a government contractor's incident management process, the IS auditor discovers that a data breach involving personal information was not reported to the regulator within the legally mandated timeframe. Management states the incident was minor and no harm occurred. What is the IS auditor's BEST course of action?

A. Report the noncompliance to senior management and the audit committee for prompt resolution B. Notify the regulator directly, because the legal reporting deadline has already passed C. Accept management's assessment and note the incident only in the audit working papers D. Recommend that management reassess the incident's severity before any further reporting

Question 10

A consumer lender plans to deploy an automated credit decision model next quarter. A newly enacted regulation requires lenders to explain adverse decisions to applicants and to test decision models for discriminatory outcomes. Which recommendation is MOST appropriate for the IS auditor to make before deployment?

A. Deploy the model on schedule and perform a regulatory compliance review after the first quarter B. Obtain a warranty from the model vendor that the model meets all applicable lending regulations C. Build explainability and bias-testing requirements into model validation before go-live D. Require legal counsel to approve each adverse decision generated by the model before release

Related Posts

Leave a Comment Cancel Reply