CISA Domain 4A-1 Practice Test 001

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain A-1 (IT Components) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4A-1 IT Components Practice Test 002

10 questions • Single best answer

Question 1

An IS auditor begins an operations review at a global manufacturing enterprise and requests the inventory of servers, operating systems, and network devices supporting production. The provided list has not been reconciled to the physical environment in over two years. What should the auditor do FIRST?

A. Recommend that management immediately replace all unsupported IT components. B. Assess whether a complete and accurate inventory of IT components exists before relying on it. C. Conclude that operational controls over IT components are ineffective. D. Test the configuration settings of a sample of the listed servers.

Question 2

During a data center review at a government agency, the IS auditor examines the operating systems running on production servers. Several host critical citizen-facing applications and are running versions for which the vendor no longer issues security updates or patches. Which finding is MOST significant to the auditor?

A. The operating system versions are inconsistent across the server estate. B. The data center lacks a standardized operating system build image. C. Some administrators are unfamiliar with the older operating system versions. D. The affected operating systems no longer receive vendor security patches, exposing critical applications to unmitigated vulnerabilities.

Question 3

An IS auditor at a healthcare provider is verifying that network components such as routers and firewalls are configured according to the organization's approved hardening standards. Management states that all devices are fully compliant. Which of the following would provide the BEST evidence to support the auditor's conclusion?

A. Management's written attestation that the hardening standards are applied. B. Interviews with the network administrators responsible for the devices. C. Extracts of the actual running configurations compared against the approved hardening baseline. D. Change tickets showing the devices were configured at deployment.

Question 4

A cloud-hosting provider's IS auditor reviews privileged utility software installed on production servers that can bypass normal application and operating system access controls. The tools are broadly available to the operations team. Which control provides the BEST assurance that this software is not being misused?

A. The utility software is licensed, supported, and kept at a current, fully patched version. B. Use of the utility software is logged and the logs are independently reviewed. C. The operations team is trained on the utility software. D. The software is documented in the IT component inventory.

Question 5

During an operations audit of an online retailer, the IS auditor notes that a single physical server hosts the database, application, and web tiers for the primary e-commerce platform, with no redundancy or failover. Which of the following represents the MOST significant risk to the organization?

A. A failure of the single server would take the entire platform offline. B. Server capacity may be insufficient to handle traffic during seasonal peaks. C. Consolidating the tiers makes performance tuning more difficult. D. Applying patches to the consolidated server requires coordinating downtime across multiple business teams.

Question 6

During an IT operations audit at a large public university, the IS auditor finds that several critical IT components reached end-of-vendor-support during the year without being identified in advance, forcing rushed and costly emergency replacements that disrupted services. Which recommendation is MOST appropriate to prevent recurrence?

A. Increase the frequency of vulnerability scanning across the server estate. B. Require management approval before purchasing any new IT components. C. Maintain a component inventory linked to vendor support lifecycles with proactive monitoring of end-of-support dates. D. Perform an annual physical count of all IT hardware assets.

Question 7

An IS auditor observes that no single role is accountable for tracking the configuration and vendor-support status of the organization's IT components; these responsibilities are split informally across several different operations teams. From a governance perspective, which of the following is the auditor's PRIMARY concern?

A. Different teams may use inconsistent configuration tools and documentation formats across the entire environment. B. Staff may duplicate effort when updating component records in multiple places. C. Audit fieldwork will take longer because information is spread across several teams. D. Undefined ownership means no one is accountable for identifying and remediating component risks.

Question 8

An IS auditor wants to determine whether the organization's IT component inventory is complete and accurately reflects the hardware actually deployed in the data center. Management relies on this inventory for critical operational and capacity decisions. Which testing approach would be MOST effective for assessing completeness?

A. Review the documented inventory records and confirm they were formally approved by senior IT management. B. Select physical devices in the data center and trace each to the inventory records. C. Select records from the inventory system and confirm supporting purchase orders exist for each. D. Interview the operations team about how the inventory is maintained.

Question 9

An IS auditor's review of IT components at a logistics company produced several observations of differing severity, and management has asked the auditor which issue to remediate first. Considering the impact on confidentiality, integrity, and availability, which of the following should be reported as the HIGHEST priority?

A. A production database server runs an operating system that lost vendor support two years ago. B. The IT component inventory spreadsheet is not password protected. C. Some server naming conventions do not follow the documented standard. D. Firmware release notes for network devices are not retained by the operations team after each update.

Question 10

Following an audit that identified poorly documented and inconsistently configured IT components across the data center, management asks the IS auditor for guidance to strengthen ongoing control over the production environment. Which of the following recommendations would BEST address the root cause of these issues?

A. Purchase a more capable enterprise network monitoring and alerting platform for the operations team. B. Require operations staff to complete additional vendor product training. C. Establish and enforce standardized configuration baselines for each IT component. D. Increase the number of internal audits performed on the data center each year.

Related Posts