CISA Domain 2B Practice Test 001

This practice test covers Domain 2 (Governance & Management of IT) Subdomain B (IT Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA Practice Test — 2B (IT Management)

10 questions • Single best answer

Question 1

During a review of a manufacturing company's outsourced IT operations, an IS auditor finds the service contract has no defined service level agreements or performance penalties. Which is the auditor's MOST significant concern?

A. The organization cannot hold the vendor accountable for the quality or availability of delivered services. B. The vendor may charge higher fees than competing service providers in the market. C. The contract was not reviewed by the organization's external legal counsel before signing. D. The vendor has not provided a copy of its most recent financial statements.

Question 2

An IS auditor is evaluating IT resource management at an enterprise where several critical projects are delayed. Investigation shows the same senior engineers are assigned across most initiatives with no capacity planning. Which recommendation is MOST appropriate?

A. Hire additional contractors immediately to complete all delayed projects in parallel. B. Implement a resource capacity and demand management process aligned to project priorities. C. Reduce the number of active projects until the current backlog is cleared. D. Require the senior engineers to work extended hours until deadlines are met.

Question 3

An audit manager reviews IT performance reports presented to executive leadership. The reports show only system uptime percentages. Which is the auditor's BEST observation regarding the reporting?

A. The reports should include the cost of each server used to achieve the uptime figures. B. Uptime should be reported daily rather than monthly to improve responsiveness. C. The reports lack key risk indicators and outcome metrics linking IT performance to business objectives. D. The uptime figures should be independently recalculated by the internal audit team.

Question 4

During an audit of IT quality management, an IS auditor notes that quality metrics are collected but no corrective actions follow identified defects. Which conclusion is MOST appropriate?

A. The quality management process is effective because metrics are being captured consistently. B. The quality management process is deficient because it lacks a feedback loop driving continuous improvement. C. The organization should discontinue metric collection to reduce administrative overhead. D. Defect data should be reported only to the vendor responsible for the affected systems.

Question 5

A financial institution outsources core processing to a cloud provider that in turn relies on a subcontractor for data storage. The audit finds no assessment of the subcontractor. Which risk should the IS auditor highlight FIRST?

A. Fourth-party concentration and supply chain risk is unmanaged and could affect service integrity. B. The cloud provider may raise its subscription fees at the next renewal period. C. The subcontractor may use a different data center location than the primary provider. D. The institution's staff may require training on the cloud provider's user interface.

Question 6

An IS auditor evaluates how IT performance is monitored at a government agency. Metrics exist but thresholds triggering escalation are undefined. Which control improvement provides the BEST assurance?

A. Increasing the number of metrics tracked on the operational dashboard. B. Defining tolerance thresholds and escalation procedures for each key indicator. C. Publishing the metrics on the agency's public-facing website. D. Assigning metric collection to an external service provider.

Question 7

An IS auditor reviews a technology firm's project portfolio and finds IT resources are allocated on a first-come, first-served basis without reference to strategic priorities. Which is the MOST significant governance weakness?

A. Resources may not be directed toward the initiatives delivering the greatest business value. B. Project managers may need to submit their requests using a standardized template. C. The portfolio contains more projects than the previous fiscal year. D. Some project teams are located in different regional offices.

Question 8

During an audit of vendor management at a retailer, an IS auditor finds the cloud services contract omits a right-to-audit clause. Which is the auditor's BEST course of action?

A. Conclude the vendor relationship is unauditable and recommend immediate termination. B. Recommend the contract be amended to include audit rights or acceptance of independent assurance reports. C. Rely solely on the vendor's marketing materials to assess control effectiveness. D. Ignore the omission because cloud providers are generally considered secure.

Question 9

An IS auditor examines IT service level management at an insurer. Incidents are resolved, but resolution times are not measured against agreed targets. Which finding is MOST significant?

A. Service performance cannot be objectively evaluated against commitments, weakening accountability. B. The service desk uses a ticketing tool from a smaller software vendor. C. Some incident tickets are closed by a different analyst than the one who opened them. D. The service desk operates from a single physical location.

Question 10

An IS auditor evaluates key risk indicators reported by IT management at an energy company. The KRIs are tracked but never reviewed by the board or risk committee. Which is the MOST appropriate recommendation?

A. Discontinue KRI tracking since leadership does not use the information. B. Establish periodic reporting of KRIs to the board and risk committee to support oversight. C. Convert all KRIs into KPIs to simplify the reporting structure. D. Delegate KRI review entirely to the IT operations team.

Related Posts

Leave a Comment Cancel Reply