CISA Domain 4A-11 Practice Test 001

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain A-11 (Database Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4A-11 Database Management Practice Test 001

10 questions • Single best answer

Question 1

An IS auditor is reviewing database management practices at a government tax agency. The database administrator uses one privileged account to modify taxpayer records, alter schemas, and purge database audit logs. This activity is not independently reviewed, and the logs are stored on the same server the DBA controls. Which finding is MOST significant?

A. The DBA can alter or delete database audit logs, eliminating accountability for changes made to taxpayer data B. Schema changes are applied without approval from an enterprise data modeling committee C. Taxpayer records are modified directly in production rather than through application controls D. The privileged account was not renamed from its vendor-assigned default value

Question 2

During an audit of a hospital's clinical database, an IS auditor finds that several terminated employees' database accounts remain active with elevated privileges months after departure. The deprovisioning process relies on manual email notifications that were never sent. What should the IS auditor do FIRST?

A. Conclude that the deprovisioning control is ineffective and issue a high-risk finding B. Recommend the database team disable the dormant accounts and reset all associated service credentials immediately C. Determine whether the active accounts were used after the employees' departure D. Review the organization's overall identity and access management policy for adequacy

Question 3

An IS auditor wants to confirm that structural and data changes to a financial reporting database are authorized and traceable to approved requests. The database supports automated month-end postings feeding the general ledger. Which of the following would provide the BEST evidence that changes are properly controlled?

A. The vendor's documentation confirming the database supports role-based change logging B. A signed policy stating that all database changes require change advisory board approval C. Interviews with the database administrators describing their standard change procedures D. Reconciliation of database change logs against approved change tickets and DBA access records for the period

Question 4

A financial services firm has deployed database activity monitoring to detect unauthorized access to customer data. During testing, the IS auditor notes the tool captures privileged queries, but all alerts are routed to the DBA team, which also administers the databases being monitored. Which conclusion is MOST appropriate?

A. Monitoring is effective because all privileged database queries are captured within the activity log B. Monitoring lacks independence because those being monitored also receive and triage the alerts C. Monitoring is adequate provided the database activity monitoring tool is patched and updated regularly D. Monitoring should be replaced with native database auditing to reduce licensing and maintenance costs

Question 5

During a review of a retailer's e-commerce database, an IS auditor identifies several weaknesses in the database's configuration and access controls while evaluating how stored cardholder data is protected. Given the objective of preserving data confidentiality, which of the following findings represents the GREATEST risk to the organization?

A. Cardholder data is stored in clear text within the database tables B. Database backups are retained for seven years rather than the required three-year period C. The database patch cycle occasionally exceeds the vendor's recommended thirty-day window D. Database performance statistics are not reviewed by the capacity management team on a monthly basis

Question 6

An IS auditor is evaluating database management practices at a manufacturing company. Application developers hold standing read and write access to the production database to expedite troubleshooting, and no records show who approved the access or when it is exercised. Which recommendation is MOST appropriate?

A. Rotate the shared developer credentials on a defined schedule to limit exposure over time B. Require developers to complete annual security awareness training covering data handling C. Document the current access in the risk register and formally accept it as a business decision D. Remove standing access and grant time-limited, logged emergency access approved case by case

Question 7

An IS auditor plans to test whether access privileges in a large ERP database align with employees' current job responsibilities. The database contains thousands of user accounts, roles, and privilege grants. Which testing approach would provide the MOST effective and efficient basis for a conclusion?

A. Interview the database administrators about how privileges are normally assigned and reviewed B. Select a judgmental sample of users and manually inspect their assigned database privileges C. Use data analytics to extract and compare all privilege grants against an authoritative role-to-access matrix D. Review the database vendor's default role definitions and standard configuration documentation

Question 8

Following a prior audit, management agreed to implement quarterly reviews of privileged database accounts to address an access-creep finding. During follow-up testing, the IS auditor finds only one review was performed, eight months ago, with none since. What is the auditor's BEST course of action?

A. Close the finding because management demonstrated intent by performing at least one review B. Report that the agreed management action remains unimplemented and the original access risk is not adequately addressed C. Extend the remediation deadline and re-test the control during the next audit cycle D. Recommend automating the privileged-account review and consider the finding resolved

Question 9

An IS auditor is assessing a bank's database backup and recovery capability. Nightly backups complete successfully and copies are stored offsite, but restoration of the database from those backups has never been tested in a production-equivalent environment. Which conclusion is MOST appropriate regarding the database's recoverability?

A. Backup success does not assure recoverability, so recovery capability remains unverified B. The backup control is effective because jobs complete and copies are stored offsite securely each night C. Recoverability is adequate provided backup completion is monitored and logged every night D. The finding is minor because offsite storage sufficiently protects the data from loss

Question 10

An IS auditor reviews an insurance company's database operations. A single database administrator develops schema changes, migrates them into production, and reconciles the resulting data outputs, all with no independent review or verification. Which control weakness should the auditor report as MOST significant to management?

A. Schema changes are not scheduled during an approved maintenance window to limit downtime B. The database administrator has not documented the schema change procedures in an approved operational runbook C. Inadequate segregation of duties over database changes and reconciliation D. Data reconciliation is performed manually rather than through an automated comparison tool

Related Posts

Leave a Comment Cancel Reply