CISA Domain 2A-7 Practice Test 002

This practice test covers Domain 2 (Governance & Management of IT) Subdomain A-7 (Data Governance and Classification) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 2A-7 Data Governance and Classification Practice Test 002

10 questions • Single best answer

Question 1

A pharmaceutical company is migrating clinical trial and manufacturing datasets to a SaaS analytics platform. An IS auditor reviewing the migration finds that existing classification labels are not carried over and that cloud administrators have been told to assign sensitivity levels during the move. What should the IS auditor do FIRST?

A. Determine whether business data owners have classified the datasets before migration B. Recommend that cloud administrators apply the highest classification to all migrated data C. Test the encryption settings configured for storage on the SaaS platform D. Review the provider's SOC 2 Type II report for its data handling controls

Question 2

An IS auditor at an electric utility is testing whether the data classification scheme is applied consistently across operational technology and corporate repositories. Management states that labeling has been working as designed since rollout. Which of the following provides the BEST evidence that classification is operating effectively?

A. The board-approved classification policy and its supporting labeling standard B. Interviews with data owners confirming that they understand their labeling duties C. Sampled repository files reconciled to the inventory and classification criteria D. Annual training completion records showing staff have finished classification modules

Question 3

During an audit of an e-commerce company's data governance program, an IS auditor compiles several findings for the audit committee report. Management has asked that only the single most important issue be highlighted in the executive summary. Which of the following findings is MOST significant?

A. Some internal meeting minutes stored on the intranet are missing classification labels B. Cardholder data in the analytics data lake is unclassified and absent from the inventory C. The data governance council met three times this year rather than the planned four D. The classification policy's annual review was completed two months after its due date

Question 4

A defense contractor classifies nearly all engineering documents as Restricted, regardless of their content. During a data governance review, an IS auditor finds that engineers routinely send files to personal email accounts to avoid the heavy handling requirements, and managers approve exceptions without documentation. Which recommendation is MOST appropriate?

A. Deploy data loss prevention rules that block all outbound email containing Restricted files B. Require disciplinary action for engineers who send files to personal email accounts C. Deliver mandatory refresher training on handling requirements for Restricted information D. Have data owners refine classification criteria and reclassify documents based on impact

Question 5

An IS auditor at a regional bank wants to determine whether customer Social Security numbers exist in file shares and databases classified as Internal or Public. The environment contains several thousand repositories, and the data inventory was last updated eighteen months ago. Which testing approach is MOST effective?

A. Select a judgmental sample of databases and manually review their table schemas B. Run automated discovery scans for sensitive patterns and compare to classifications C. Interview repository owners to confirm that no sensitive data is held in their systems D. Review the data inventory and trace each Internal or Public entry to its assigned owner

Question 6

A global logistics firm has created a shared services center that hosts payroll and employee medical leave records for all regions. An IS auditor reviewing data governance roles finds disagreement over who should decide the classification of these records. Who should be accountable for classifying this data?

A. The senior human resources executive who owns the business process and data B. The chief information security officer who sets enterprise security standards C. The database administrator who manages the shared services payroll platform D. The chief data officer who maintains the enterprise data governance framework

Question 7

An audit manager is planning a data governance audit at a mid-sized insurer with limited audit hours available this year. The organization maintains dozens of data domains, including claims, underwriting, marketing, and facilities data, each with a designated owner. Which of the following should PRIMARILY determine the audit scope?

A. The data domains owned by business units that have not been audited in several years B. The data domains that have the largest volume of records and storage consumption C. The data domains that management identifies as having the most known quality issues D. The data domains ranked highest for sensitivity and criticality in the risk assessment

Question 8

An IS auditor at a health insurer finds that the classification policy aligns with HIPAA, data owners are formally assigned, and records are labeled accurately. However, no handling, access, encryption, or retention requirements have been defined for any classification level. Which conclusion is MOST appropriate based on the evidence?

A. The program is effective because ownership and labeling are consistently in place B. The program is effective but requires additional user training on handling data C. The program is not effective because classifications do not drive protection controls D. The program is not effective because the policy has not been approved by the board

Question 9

A prior audit at a state transportation department reported that numerous shared drives held unclassified data. Management's response states the finding is remediated because an updated classification standard was issued and communicated to all staff. What is the IS auditor's BEST course of action during follow-up?

A. Test a sample of shared drives to verify that data is now classified per the standard B. Close the finding after confirming the updated standard was formally approved by management C. Obtain a signed management attestation confirming the remediation is complete D. Re-perform the full data governance audit to reassess all previously tested areas

Question 10

A consumer lending company trains internal machine learning models on combined customer application, credit bureau, and transaction data. An IS auditor finds that the resulting training datasets and model outputs are stored in a data science workspace without assigned owners or classifications. Which recommendation is MOST appropriate?

A. Restrict workspace access to data scientists who have completed privacy training B. Encrypt the data science workspace and all stored model outputs using approved key management C. Require the model risk team to validate model accuracy before outputs are deployed D. Extend the classification program to cover training datasets and model outputs with owners

Related Posts

Leave a Comment Cancel Reply