CISA Domain 4A-10 Practice Test 002

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain A-10 (IT Service Level Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4A-10 IT Service Level Management Practice Test 002

10 questions • Single best answer

Question 1

A public university's IT department reports 99.9% monthly availability for its learning management system, meeting the SLA target. However, faculty complaints describe repeated outages during final exam weeks, and the IS auditor notes that maintenance windows are excluded from the calculation. What should the IS auditor do FIRST?

A. Recommend that IT stop scheduling maintenance during exam weeks and notify faculty well in advance B. Report that the availability SLA is being breached and escalate the matter to the audit committee C. Review how the SLA defines availability and test whether the exclusions and source data are valid D. Request that the platform vendor provide an independent assurance report covering system uptime

Question 2

A hospital network relies on a third-party provider to host its electronic health record system under an SLA requiring 99.95% availability and two-second response times. The provider's monthly reports show full compliance, and the IS auditor needs to validate these results. Which of the following is the BEST evidence of actual service performance?

A. Hospital-operated monitoring data on availability and response time, reconciled to the provider's reports B. The provider's monthly SLA compliance reports signed off by the provider's service delivery manager C. Minutes of quarterly service review meetings in which hospital IT formally accepted the reported results D. A written representation from the hospital's chief information officer confirming satisfaction with service

Question 3

An IS auditor at a logistics company is reviewing service level agreements between the IT department and business units. The auditor has identified several issues across the SLA portfolio and must decide which one to emphasize in the report to senior management. Which of the following findings is MOST significant?

A. Monthly SLA performance reports are often delivered to business units several days after month-end B. Service review meeting minutes are not formally signed off by both IT and business representatives C. SLA documents use inconsistent templates and formatting across the different business units served D. The warehouse management system has the same availability and recovery targets as the staff intranet

Question 4

At a pharmaceutical manufacturer, the IT department drafted service level agreements for all production-support applications and approved them internally without input from manufacturing or quality management. IT performance reports show that every target has been met for the past year. Which recommendation is MOST appropriate for the IS auditor to make?

A. Engage an external firm to benchmark the SLA targets against industry averages for pharmaceutical companies B. Require business process owners to participate in defining the service levels and to formally approve them C. Have the IT quality function independently recalculate SLA results before each monthly report is issued D. Raise the SLA targets for all production-support applications to demonstrate continuous improvement

Question 5

A credit union's IT service management team reports that 98% of priority-one incidents met the four-hour resolution target last year. The IS auditor learns that analysts can pause the SLA clock and change an incident's priority after it has been logged. Which testing approach provides the BEST assurance over the reported result?

A. Sample priority-one tickets and recompute resolution times from audit trails, including pauses and reclassifications B. Inspect the service management tool's configuration to confirm the four-hour target is applied to every priority-one ticket C. Interview service desk analysts about how they classify incidents and when they pause the SLA clock D. Compare the reported 98% result to the prior year's result and investigate any significant variances

Question 6

A software-as-a-service company commits to 99.95% monthly availability in its customer contracts. During an audit, the IS auditor finds that the company's cloud hosting contract guarantees only 99.5% availability and that no operational level agreement exists with the internal network team. Which of the following represents the GREATEST risk?

A. Customers may demand audit rights over the hosting provider that the company cannot contractually grant B. The internal network team may prioritize project work over day-to-day operational support activities C. The company may be unable to meet its customer commitments and may face penalties or reputational harm D. The hosting provider may not have an independent assurance report covering its availability controls

Question 7

An e-commerce retailer's SLA with its outsourced application support provider measures performance only by the number of tickets closed each month and the average first-response time. Business managers state that checkout outages continue to affect sales despite reported compliance. Which metric would BEST indicate whether the service meets business needs?

A. Percentage of tickets closed within the agreed response window during each monthly reporting period B. Number of support analysts assigned to the retailer's account during peak seasonal trading periods C. Average satisfaction score collected from internal IT staff and business users after each ticket is closed D. End-to-end checkout availability and transaction response time measured from the customer's perspective

Question 8

A utility company holds monthly service review meetings with its managed network provider. The IS auditor finds the same SLA breaches recurring for six months, with meeting minutes recording each breach but showing no root cause analysis, assigned action owners, or escalation. Which recommendation is MOST appropriate?

A. Terminate the contract with the network provider and issue a request for proposal for a replacement B. Establish a formal service improvement process with root cause analysis, tracked actions, and escalation C. Increase the frequency of service review meetings from monthly to weekly until breaches stop recurring D. Revise the SLA targets downward so they reflect the provider's demonstrated level of performance

Question 9

The chief audit executive at a national broadcaster is planning an audit of IT service level management covering more than 40 internal and outsourced services. Available audit hours will not allow detailed testing of every SLA. What should the chief audit executive do FIRST when determining the audit scope?

A. Select a random sample of SLAs from the service catalog so that every service has an equal chance of testing B. Focus on outsourced services because third-party providers present higher risk than internal IT teams C. Identify the services that support critical business processes and prioritize their SLAs for testing D. Review the SLAs with the most reported breaches last year, since these indicate the weakest controls

Question 10

A state transportation agency's outsourced service desk has met every SLA metric for twelve months, including 15-minute first response and 90% first-contact resolution. However, user satisfaction surveys have declined steadily, and the proportion of reopened tickets has doubled. Which conclusion is MOST appropriate based on this evidence?

A. The SLA metrics may not reflect service quality, so compliance alone does not show effective service B. The provider is likely manipulating ticket data, and the matter should be referred for fraud investigation C. User satisfaction surveys are subjective and should be excluded when evaluating the provider's performance D. The service desk is performing effectively because all contractually agreed SLA targets have been met

Related Posts

Leave a Comment Cancel Reply