CISA Domain 2A Practice Test 001

This practice test covers Domain 2 (Governance & Management of IT) Subdomain A (IT Governance) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA Practice Test — 2A (IT Governance)

10 questions • Single best answer

Question 1

An IS auditor evaluating IT governance at a hospital network finds the IT steering committee has not convened in over a year, and major IT investment decisions are made solely by the CIO. Which is the auditor's MOST significant concern?

A. IT investments may not align with the organization's strategic objectives and lack cross-functional accountability B. The CIO may be overburdened with operational responsibilities C. Project documentation may be incomplete for recent initiatives D. Committee meeting minutes are unavailable for the auditor to review

Question 2

During a regulatory examination of a bank, an IS auditor assesses whether the IT strategy supports business goals. Which finding provides the BEST evidence of alignment?

A. The IT strategy is documented as a detailed multi-year technical roadmap B. IT initiatives are traceable to defined business objectives and approved by the board C. The IT department consistently operates within its annual budget D. The CIO reports directly to the chief technology officer

Question 3

An IS auditor is engaged to assess a government agency's compliance with data protection requirements across multiple jurisdictions. What should the auditor do FIRST?

A. Test the agency's encryption controls over stored personal data B. Review breach notification records from the prior year C. Identify the specific laws and regulations applicable to the agency's data and operations D. Interview data subjects about the agency's consent practices

Question 4

During an audit of an enterprise's governance documents, an IS auditor finds the information security policy was approved five years ago and has never been reviewed or updated. Which is the MOST significant concern?

A. Employees may not have signed the latest acknowledgment form B. The policy may no longer address current risks, technologies, and regulatory obligations C. The policy lacks a version-control footer on each page D. The policy is longer than comparable industry benchmarks

Question 5

An IS auditor evaluates how IT risk is governed at an insurance company. Which provides the BEST assurance that IT risk is managed within the enterprise's risk appetite?

A. IT risks are tracked in a spreadsheet maintained solely by the IT department B. IT risks are integrated into the enterprise risk management framework with a defined risk appetite and reported to the board C. The company purchases cyber insurance coverage each year D. Penetration tests are performed twice a year by an external firm

Question 6

A privacy audit at an e-commerce company reviews how personal data is handled across the business. Which is the BEST indicator of an effective privacy program?

A. A privacy notice is published on the company's public website B. A data inventory and privacy-by-design practices are maintained with defined accountability for personal data C. Marketing retains all customer data indefinitely to support analytics D. Privacy complaints are handled informally by help-desk staff

Question 7

An IS auditor reviewing an enterprise's data governance practices finds that no data classification scheme has been established. Which risk is MOST significant?

A. Storage costs may rise because of redundant copies of data B. Protective controls cannot be applied commensurate with data sensitivity, risking over- or under-protection C. Employees may save working files in personal network folders D. Backup jobs may run longer than the scheduled maintenance window

Question 8

A post-implementation review across several business units reveals multiple overlapping applications performing the same function. Which governance weakness does this MOST likely indicate?

A. Inadequate enterprise architecture governance to align systems and reduce redundancy B. Insufficient user acceptance testing before deployment C. Weak database backup and restoration procedures D. A shortage of end-user training on the applications

Question 9

An IS auditor observes that when IT control failures occur, no business or IT owner is clearly accountable for remediation. To strengthen IT governance, which is MOST important?

A. Increasing the frequency of internal audit engagements B. Defining clear ownership of IT risks, controls, and standards across the organization C. Acquiring an automated governance, risk, and compliance tool D. Expanding the enterprise's security awareness training program

Question 10

A financial services firm adopts a recognized IT governance framework. Which activity BEST reflects the board's governance responsibility rather than management's role?

A. Configuring access controls for the core banking ERP system B. Setting the organization's risk appetite and IT strategic direction and overseeing performance C. Executing daily IT operational and maintenance procedures D. Preparing detailed technical system implementation plans

Related Posts

Leave a Comment Cancel Reply