CISA Domain 2A-4 Practice Test 001

This practice test covers Domain 2 (Governance & Management of IT) Subdomain A-4 (Enterprise Architecture and Considerations) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 2A-4 Enterprise Architecture and Considerations Practice Test 001

10 questions • Single best answer

Question 1

An IS auditor is reviewing the enterprise architecture (EA) program at a regional bank. The documented target-state architecture was approved three years ago, yet business units continue to procure systems that conflict with it and no exceptions are recorded. What should the IS auditor recommend FIRST?

A. Recommend establishing an EA governance process with a formal architecture exception and review mechanism. B. Recommend that all noncompliant systems be immediately decommissioned to enforce the target state across every business unit. C. Recommend updating the target-state architecture to match the systems already deployed. D. Recommend that IT security block all future procurement requests from the business units.

Question 2

During an audit of a government agency's enterprise architecture (EA), the IS auditor wants to determine whether the EA is actually influencing technology investment decisions rather than serving as documentation. Which of the following would provide the BEST evidence that the EA is operating effectively?

A. The EA framework selected is a widely recognized industry standard such as TOGAF, with published maturity guidance and reference models. B. Investment proposals show architecture review sign-off and alignment assessment before funding is approved. C. The enterprise architecture repository is complete and updated with current-state diagrams. D. Senior management has publicly endorsed the enterprise architecture program in strategy documents.

Question 3

An IS auditor is reviewing the enterprise architecture (EA) function of a healthcare organization that recently completed several acquisitions and must consolidate overlapping clinical systems. The auditor observes multiple conditions across the integrated environment. Which of the following findings is MOST significant from a control assurance perspective?

A. The EA repository uses a different modeling notation than the one used before the acquisitions. B. Some current-state architecture diagrams have not been updated with the latest network changes. C. The EA has no process for assessing acquired systems against the approved target architecture. D. The EA team has not yet scheduled its annual enterprise architecture awareness training.

Question 4

An IS auditor determines that an insurance company's enterprise architecture was developed independently by the IT department without input from business leadership. The architecture emphasizes technical standardization but does not clearly reference business capabilities or the organization's strategic objectives. What should the IS auditor do FIRST?

A. Evaluate how the EA governance process incorporates business strategy and stakeholder requirements. B. Report that the enterprise architecture is deficient and recommend it be rebuilt from scratch with business leadership involved throughout. C. Recommend that the business appoint a chief architect to replace the IT department's role. D. Conclude that technical standardization alone is sufficient evidence of an effective EA program.

Question 5

A financial services firm is implementing new applications across several business lines. The IS auditor wants to assess whether the enterprise architecture is being enforced during solution delivery rather than only at design time. Which control provides the BEST assurance that new systems conform to the approved enterprise architecture?

A. The enterprise architecture standards are published on the company's internal collaboration portal. B. Developers attend annual training on the enterprise architecture principles and reference models. C. The architecture review board meets quarterly to discuss emerging technology trends. D. Architecture compliance checkpoints are embedded as gate reviews within the project life cycle.

Question 6

During a periodic review of enterprise architecture at a retail enterprise, the IS auditor notes that the current-state architecture contains numerous redundant and end-of-life technologies that the target-state architecture was intended to retire two years ago. Which of the following represents the GREATEST risk to the organization?

A. The gap between current and target states may reduce the credibility of the EA team. B. Continued reliance on unsupported technology increases security and operational continuity exposure. C. The architecture repository will require added effort to document the redundant legacy systems. D. Technology vendors may increase licensing costs for the redundant platforms over time.

Question 7

An enterprise architecture program at a telecommunications company has produced detailed reference models, but architecture decisions are frequently overridden by project teams with no accountability. The IS auditor is evaluating the effectiveness of EA governance and enforcement. Which of the following is the MOST appropriate recommendation?

A. Increase the level of detail in the reference models so project teams have clearer guidance. B. Require project teams to document their reasons whenever they override an architecture decision. C. Establish an architecture review board with authority to approve deviations and enforce decisions. D. Assign the enterprise architects to attend all project status meetings as observers.

Question 8

An IS auditor is assessing whether a logistics company's enterprise architecture (EA) remains aligned with organizational objectives following a strategic shift toward cloud-based operations. The auditor must determine whether the EA is periodically revisited. Which of the following would BEST demonstrate that ongoing alignment is maintained?

A. Scheduled EA reviews reassess the target architecture against updated business strategy and objectives. B. The EA repository is backed up regularly and stored in a secure offsite location. C. The number of applications documented in the architecture repository increases each year. D. Enterprise architects hold recognized professional certifications in the chosen EA framework.

Question 9

An IS auditor plans to test whether the enterprise architecture standards are consistently applied when new technology is introduced at an energy company. The auditor wants results that reflect actual practice rather than stated intent. Which testing approach would provide the MOST reliable evidence of compliance?

A. Interview the enterprise architects about how architecture standards are typically enforced. B. Review the enterprise architecture policy to confirm that compliance requirements are documented. C. Confirm that architecture standards were formally approved by the architecture review board. D. Select a sample of recently deployed systems and verify conformance to architecture standards.

Question 10

A public-sector organization is adopting multiple cloud platforms and wants its enterprise architecture to address the risk of vendor lock-in and poor interoperability. The architecture must support the organization's long-term flexibility. From an EA perspective, which consideration is MOST important for the IS auditor to evaluate?

A. Whether the selected cloud providers offer the lowest total cost among the available vendors. B. Whether the EA defines standards for interoperability, data portability, and cross-platform integration. C. Whether the cloud platforms are certified against the most recent security frameworks. D. Whether the EA repository documents the technical specifications of each cloud service.

Related Posts

Leave a Comment Cancel Reply