CISA Domain 2B-2 Practice Test 002

This practice test covers Domain 2 (Governance & Management of IT) Subdomain B-2 (IT Vendor Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 2B-2 IT Vendor Management Practice Test 002

10 questions • Single best answer

Question 1

An external IS auditor at a regional insurance company plans to rely on a SaaS claims vendor's SOC 2 Type II report, which contains an unqualified opinion. The report lists several complementary user entity controls, but the insurer has never identified who performs them. What should the IS auditor do FIRST?

A. Request that the service auditor issue a bridge letter covering the period gap B. Recommend that the insurer perform its own onsite audit of the vendor's facilities C. Determine whether the insurer has implemented the listed user entity controls D. Accept the unqualified opinion as sufficient evidence that vendor risks are controlled

Question 2

A hospital network is selecting a vendor to host its electronic health records in the cloud. The IS auditor finds that proposals were scored mainly on price and functionality, and security and financial viability reviews were deferred until after contract signing. Which recommendation is MOST appropriate?

A. Complete risk-based due diligence, including security and financial viability, before award B. Add a right-to-audit clause so security can be assessed after the service goes live C. Increase the weighting of price in the scoring model to reflect budget constraints D. Obtain a performance bond from the vendor to cover potential service disruption losses

Question 3

A state revenue agency plans to outsource hosting of its taxpayer portal to a managed service provider that relies on several subcontractors. The IS auditor is asked to review the draft contract before execution. Which provision provides the BEST assurance that the agency can verify the provider's controls over time?

A. Service credits payable when monthly availability falls below the agreed target B. A mutual indemnification clause covering losses arising from contractual breaches C. A confidentiality clause requiring the provider to protect taxpayer information D. A right-to-audit clause extending to subcontractors that process agency data

Question 4

A manufacturing firm's vendor management team monitors its logistics software provider through an annual security questionnaire completed by the vendor. During the audit, the IS auditor must assess whether the vendor's controls operated effectively during the year. Which of the following is the BEST evidence?

A. A signed attestation letter from the vendor's chief information security officer B. An independent SOC 2 Type II report covering the relevant systems and period C. The vendor's completed security questionnaire with supporting policy documents D. An ISO 27001 certificate issued for the vendor's corporate headquarters office

Question 5

During a follow-up audit at a telecommunications provider, an IS auditor confirms that quarterly vendor performance meetings now occur as previously recommended. However, meeting minutes show the network maintenance vendor missed response-time targets for three consecutive quarters with no escalation or service credits claimed. Which conclusion is MOST appropriate?

A. The recommendation is fully implemented because the quarterly reviews now take place B. The finding should be closed and a new observation raised about the SLA targets C. The underlying risk remains unaddressed because performance issues are not acted on D. The vendor should be replaced because repeated SLA failures show poor capability

Question 6

A pharmaceutical company outsourced its IT service desk and desktop support to a global provider. During the audit, the CIO states that because the provider is contractually responsible for service delivery, risks from the arrangement are now the provider's responsibility. Which response by the IS auditor is MOST appropriate?

A. Agree, provided the contract includes adequate indemnification and insurance clauses B. Recommend formally transferring accountability through a revised services agreement C. Advise that accountability shifts once the provider achieves ISO 20000 certification D. Explain that management retains accountability for the outsourced function and risks

Question 7

An audit manager at a large public university is planning a vendor management audit covering more than 300 IT suppliers. Audit hours are limited, and the vendor inventory records contract value but not data access or service criticality. What should the audit manager do FIRST?

A. Assess whether the university has a risk-based method for classifying vendors B. Select a statistical sample of vendors weighted by contract value for testing C. Request SOC reports from all suppliers to identify reported control exceptions D. Limit the audit scope to the ten vendors with the highest annual contract spend

Question 8

A payment processor relies on a single hardware vendor for its hardware security modules. Firmware updates are downloaded directly from the vendor's support portal and applied to production devices without verification. Which recommendation BEST addresses the supply chain integrity risk identified by the IS auditor?

A. Qualify a second hardware security module vendor to reduce supplier concentration B. Validate firmware digital signatures before deployment through change management C. Require the vendor to provide an annual SOC 1 Type II report on its update process D. Restrict firmware downloads to administrators who have completed vendor training

Question 9

An energy utility's procurement team plans to renew a five-year SCADA support contract on unchanged terms. Since the original award, the vendor was acquired by a foreign-owned company and relocated its support staff offshore, where they retain remote access to control systems. What should the IS auditor recommend FIRST?

A. Terminate the contract and issue a new request for proposal to alternative vendors B. Add data residency clauses to the renewed contract restricting offshore support C. Request that the new parent company provide a guarantee of contract performance D. Perform a reassessment of vendor risk before approving the contract renewal

Question 10

During an audit of a mid-sized credit union, an IS auditor learns that the core banking vendor has persistent VPN access for support purposes. The vendor management policy requires each remote session to be approved through a support ticket. Which audit procedure provides the BEST evidence that the policy is operating effectively?

A. Inspect the vendor access policy and confirm it was approved by senior management B. Interview the IT manager about how vendor support sessions are usually authorized C. Reconcile VPN session logs for the vendor account to approved support tickets D. Review the contract to confirm it requires the vendor to follow access procedures

Related Posts

Leave a Comment Cancel Reply