CISA Domain 2B-3 Practice Test 002

This practice test covers Domain 2 (Governance & Management of IT) Subdomain B-3 (IT Performance Monitoring and Reporting) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 2B-3 IT Performance Monitoring and Reporting Practice Test 002

10 questions • Single best answer

Question 1

An internal audit manager at a state transportation department reviews the IT balanced scorecard presented to the executive committee. The scorecard reports financial and customer measures but no measures for internal process maturity or staff learning and growth, although the IT strategy emphasizes workforce modernization. Which finding is MOST significant to report?

A. The scorecard does not benchmark financial measures against peer agencies of similar size. B. The scorecard omits perspectives needed to track progress on stated strategic priorities. C. The customer perspective relies on survey data rather than transaction-level metrics. D. The executive committee receives the scorecard quarterly rather than on a monthly basis.

Question 2

During an audit of a hospital network's IT service desk, an IS auditor notes that first-call resolution improved from 62% to 85% in one quarter. Further inquiry reveals the service desk manager redefined 'resolved' to include tickets escalated to second-level support. What should the IS auditor do FIRST?

A. Recommend that the metric be removed from the executive IT dashboard until it is reviewed. B. Report the improvement as unsupported and a misstatement of IT performance results. C. Recalculate prior quarters using the new definition to confirm whether the trend holds. D. Determine whether the definition change was approved and disclosed to report users.

Question 3

A regional credit union's IT risk committee monitors system uptime, ticket closure rates, and project budget variance as its key risk indicators. An IS auditor reviewing the monitoring program notes that no indicator has triggered escalation in two years, despite several near-miss outages. Which recommendation is MOST appropriate?

A. Define leading indicators with thresholds that signal rising exposure before a loss occurs. B. Lower the escalation thresholds on the existing indicators so alerts trigger more often. C. Increase the reporting frequency of the existing indicators from monthly to weekly. D. Assign ownership of each existing indicator to a named member of senior management.

Question 4

An IS auditor at a telecommunications provider is assessing the reliability of monthly availability percentages that IT reports to the board. The figures are produced by the operations team from its monitoring tool and summarized in a slide presentation. Which of the following provides the BEST evidence that the reported figures are accurate?

A. A signed attestation from the IT operations manager confirming the reported figures B. Interviews with business unit leaders about their perception of system availability C. Independent recalculation from raw monitoring logs reconciled to incident records D. A walkthrough of the process the operations team follows to prepare the slide deck

Question 5

A pharmaceutical company's CIO designs all IT performance metrics and sets their targets, then reports results directly to the board's technology committee. An IS auditor evaluating the performance management process notes that business unit leaders have no input into metric selection. Which risk is MOST significant in this arrangement?

A. Metrics may be too technical for board members to interpret without support from IT. B. Board reporting may be delayed while the CIO compiles results at the end of each quarter. C. The CIO may lack the tools needed to collect performance data on a consistent basis. D. Metrics may reflect IT's own priorities rather than the value the business expects.

Question 6

An IS auditor is planning an audit of IT performance monitoring at a government revenue agency. The agency tracks more than 120 IT metrics across infrastructure, applications, and projects, and the audit is limited to four weeks. Which approach is MOST appropriate for scoping the audit?

A. Test a statistically random sample drawn from the full population of 120 metrics. B. Focus on metrics that support strategic objectives and inform key decisions. C. Select the metrics that have missed their targets most often during the last year. D. Review every metric at a high level to confirm each one has a documented owner.

Question 7

A follow-up review at a logistics firm finds that management implemented an automated IT performance dashboard to address a prior finding on inconsistent manual reporting. The dashboard pulls data from several systems, but no one has validated the data feeds since go-live six months ago. What is the IS auditor's BEST course of action?

A. Test the accuracy of the data feeds before concluding whether the finding is closed. B. Close the finding because automation has removed the manual errors cited previously. C. Reissue the original finding because the remediation approach has clearly failed. D. Recommend reverting to manual reporting until management completes validation.

Question 8

A retail bank's IT portfolio report shows that all 14 completed projects were delivered on time and within budget. An IS auditor notes that the report does not track whether the business benefits stated in the approved business cases were achieved after implementation. Which recommendation is MOST appropriate?

A. Add multi-year schedule and cost variance trends to show overall delivery performance. B. Require project managers to certify that deliverables met documented requirements. C. Measure realized benefits after implementation against business case targets. D. Benchmark project delivery rates against published industry success statistics.

Question 9

A municipal water utility's IT department reports monthly mean time to restore service for critical incidents. An IS auditor wants to test whether priority classifications are applied consistently, because misclassifying incidents as lower priority could make restoration times for critical incidents appear shorter. Which testing approach provides the BEST assurance?

A. Analyze the full incident population, comparing impact details to assigned priorities. B. Interview service desk analysts about how they decide which priority level to assign. C. Review the incident management policy to confirm that priority criteria are defined. D. Observe the service desk for a day to see how new incidents are being classified.

Question 10

An IS auditor at an online brokerage reviews key risk indicators reported to the enterprise risk committee. Thresholds for indicators such as failed backup jobs and overdue critical patches were set by the IT operations team with no reference to the organization's approved risk appetite. Which finding is MOST significant?

A. KRI values are reported to the risk committee monthly rather than in near real time. B. The IT operations team collects the underlying KRI data using manual procedures. C. Several KRIs measure operational activity rather than direct financial loss exposure. D. KRI thresholds are not linked to tolerance levels approved by governance bodies.

Related Posts

Leave a Comment Cancel Reply