CISA Domain 4A-4 Practice Test 002

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain A-4 (System Interfaces) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4A-4 System Interfaces Practice Test 002

10 questions • Single best answer

Question 1

An internal audit manager at a national logistics company is scoping a review of the interfaces that move shipment data from the warehouse management system to the billing platform. Management estimates there are more than forty interfaces, but no current inventory or data flow documentation exists. What should the IS auditor do FIRST?

A. Test the reconciliation controls on the interfaces that process the highest volumes. B. Recommend that management implement an enterprise interface management tool. C. Obtain or develop an interface inventory that maps data flows and owners. D. Select a statistical sample of interfaces for detailed control testing.

Question 2

During an audit of a manufacturer's ERP environment, an IS auditor examines the nightly interface that sends production cost data to the general ledger. The interface owner provides screenshots showing that the job completed successfully each night. Which of the following provides the BEST evidence that the interface transfers data completely and accurately?

A. Reconciled record counts and control totals between the source and target systems. B. System-generated job logs showing successful completion for every scheduled run. C. A signed statement from the interface owner confirming no known transfer errors. D. A walkthrough of the interface design document with the application developer.

Question 3

A government benefits agency receives a daily eligibility file from a partner agency through an automated interface. During the audit, the IS auditor documents several observations about the interface's design and operation. Which of the following findings presents the MOST significant risk to the agency?

A. Interface documentation has not been updated since the last system upgrade. B. The file transfer occasionally completes after the scheduled processing window. C. Interface job failures generate alerts only during normal business hours. D. Rejected records are deleted without being logged or reported for correction.

Question 4

A retail chain uses a real-time API interface to send online orders to its fulfillment system. An IS auditor finds that when the fulfillment system is unavailable, orders fail silently and are not retried, resulting in periodic customer complaints about unfilled orders. Which recommendation is MOST appropriate?

A. Increase the fulfillment system's availability target in the service level agreement. B. Implement message queuing with retry logic and exception alerts for failed transactions. C. Require customer service staff to reconcile complaints against the order database weekly. D. Replace the real-time interface with a nightly batch file transfer between the systems.

Question 5

An IS auditor at an insurance company must determine whether input validation controls on the interface loading claims data from a third-party administrator reject invalid records. Management has provided design documentation describing edit checks for policy numbers, dates, and claim amounts. Which testing approach provides the BEST assurance that the controls operate effectively?

A. Run test transactions with known errors through a production-equivalent environment. B. Review the interface design documentation against the insurer's data quality standards. C. Interview the third-party administrator about validation performed before transmission. D. Inspect the interface configuration to confirm edit checks are enabled in production.

Question 6

At a pharmaceutical distributor, an interface transfers customer master data from the CRM system to the ERP. When mismatches occur, IT operations and the sales operations team each state that the other is responsible for resolving them, and unresolved errors have accumulated for several months. Which recommendation is MOST appropriate?

A. Assign IT operations responsibility for correcting all interface data errors. B. Implement automated monitoring that alerts both teams when mismatches occur. C. Designate a business owner accountable for resolving interface errors. D. Schedule a monthly meeting between both teams to review outstanding errors.

Question 7

A financial services firm integrated its on-premises HR system with a cloud-based payroll provider through an API. An IS auditor notes that the integration uses a single service account with full administrative access, and its static credential has not been changed since go-live. Which is the MOST appropriate recommendation?

A. Require the payroll provider to supply an annual SOC 2 Type II report. B. Enable detailed logging of all API calls made by the service account. C. Encrypt the interface traffic between the HR system and payroll provider. D. Limit the account to required functions and rotate its credential.

Question 8

Following an upgrade of a bank's core banking platform, an IS auditor learns that the field mapping for the interface feeding loan balances to the regulatory reporting system was modified. Developers approved and tested the change before release. Which of the following would BEST support that the modified interface is operating correctly?

A. Developer unit test results showing that the mapping logic executed without errors. B. Reconciliation of post-upgrade loan balances between the core and reporting systems. C. The approved change request documenting the business justification for the change. D. Confirmation from the vendor that the upgrade did not alter the standard interfaces.

Question 9

During follow-up on a prior audit finding, an IS auditor reviews a transportation authority's interface between its fare-collection system and its financial system. Management reports that the recommended automated control-total check was implemented last quarter. Which of the following provides the BEST evidence that the risk has been sufficiently addressed?

A. Management's written confirmation that the control was implemented as recommended. B. The approved change ticket showing the control was deployed to production. C. Results of testing the control's operation on transactions since implementation. D. An updated interface design document describing the control-total logic.

Question 10

An IS auditor at a university finds that the interface transferring student fee data to the finance system fails several times each term. When this happens, an analyst exports the data to a spreadsheet, edits it as needed, and uploads it directly into the finance system. Which of the following is the GREATEST concern?

A. Manual uploads bypass interface validation and may introduce unauthorized changes. B. The analyst lacks formal training on the finance system's upload functionality. C. Interface failures are not reported to the vendor that supports the finance system. D. Recurring interface failures indicate that root causes are not being identified.

Related Posts