CISA Domain 4A-5 Practice Test 001

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain A-5 (Shadow IT and End-User Computing) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4A-5 Shadow IT and End-User Computing Practice Test 001

10 questions • Single best answer

Question 1

An IS auditor examining the finance function of a manufacturing company discovers a complex spreadsheet with embedded macros that consolidates plant-level data into the monthly financial close. The spreadsheet resides on an analyst's local drive, is unknown to IT, and operates with no version control or independent review. Which finding is MOST significant?

A. The spreadsheet is stored on an analyst's local drive rather than a shared, backed-up network location B. Material financial figures depend on an uncontrolled application with no review or change management C. The macros were developed by an analyst who has had no formal software development training D. IT was never informed that the consolidation spreadsheet had been created by the finance team

Question 2

During an audit of a financial services firm, an IS auditor learns that several business units have independently adopted unsanctioned cloud applications outside of IT's knowledge to speed up their work. The auditor has not yet assessed what data these tools process or how widely they are used. What should the auditor do FIRST?

A. Recommend that all of the unsanctioned cloud applications be immediately decommissioned by the IT department B. Report the shadow IT usage to the audit committee as a critical and pervasive control deficiency C. Identify and inventory the applications and the data they process to assess exposure D. Evaluate whether the cloud vendors involved hold recognized independent security certifications

Question 3

A government agency relies on a departmental database application that was built years ago by a staff member who has since left the organization. The application supports benefit eligibility decisions but has no documentation, no source code control, and no defined owner accountable for its accuracy or maintenance. Which recommendation is MOST appropriate?

A. Assign formal ownership and bring the application under IT governance and control B. Require the department to fully rebuild the application from scratch using an approved development methodology and testing C. Restrict access to the application until the original developer can be located and formally re-engaged as a contractor D. Document the current application logic so that future departmental staff can understand how it works

Question 4

An IS auditor is evaluating the compensating controls that management has implemented over end-user computing spreadsheets used to prepare regulatory reports. Management asserts that the existing controls are adequate to ensure the accuracy of the figures. Which of the following controls provides the BEST assurance over the integrity of these spreadsheets?

A. Requiring users to save the spreadsheets to a monitored network share that is backed up every day B. Restricting spreadsheet access to a small group of authorized reporting staff through folder permissions C. Independent reconciliation of spreadsheet outputs to authoritative source system data D. Password-protecting each individual spreadsheet workbook to prevent unauthorized changes to it

Question 5

A marketing team at a retail company has been using an unapproved consumer file-sharing service to store and exchange customer contact lists that contain personal data. The service was chosen for convenience, is not covered by any vendor agreement, and was never assessed by IT or legal. Which risk is MOST significant to the organization?

A. Marketing may incur unbudgeted subscription and renewal costs for the file-sharing service over time B. Personal data may be exposed or processed in violation of privacy and contractual obligations C. The file-sharing service may lack integration with the organization's approved productivity tools D. Employees may become increasingly dependent on a tool that the IT department does not support

Question 6

An IS auditor wants to assess whether an organization has effectively identified the shadow IT operating within its environment. Management provides several artifacts in support of its position. Which of the following is the BEST evidence that shadow IT is being detected on an ongoing basis rather than only discussed?

A. A formally signed corporate policy that prohibits the use of unauthorized applications and cloud services B. Network and cloud-access monitoring logs analyzed to detect unsanctioned application usage C. Minutes from a recent governance committee meeting where shadow IT risk was discussed by senior management D. An annual self-assessment questionnaire completed and returned by each of the department managers

Question 7

During a cloud migration review at an enterprise, an IS auditor identifies a business-critical analytics tool that a department procured directly on a corporate credit card, bypassing both IT and procurement entirely. The tool now processes sensitive customer data in production. Which recommendation should the auditor prioritize?

A. Establish a process to bring the tool under IT governance, including risk assessment and vendor due diligence B. Require the department head to justify the business need for the analytics tool in a written memo to management C. Cancel the corporate credit card that the department used to procure the unauthorized analytics tool without approval D. Add the analytics tool to the enterprise asset register so that its future license renewals can be tracked

Question 8

An IS auditor reviews four end-user-developed applications that are in use across an organization, and confirms that none of them are subject to formal change control or independent review. Considering audit risk and potential business impact, which of these applications represents the MOST significant concern?

A. A spreadsheet that a single analyst uses to track personal task deadlines and daily reminders B. A macro-based tool that a team uses to reformat internal reports before distributing them to colleagues C. A database that calculates regulatory capital figures submitted to a supervisory authority D. A spreadsheet that the training team uses to schedule and track internal staff development sessions

Question 9

An IS auditor concludes that shadow IT has become widespread across an organization primarily because business units feel that IT cannot deliver solutions quickly enough to meet their needs. Beyond remediating the individual unauthorized tools already discovered, which recommendation BEST addresses the root cause of the problem?

A. Implement technical controls that block employees from installing any unapproved software on their devices B. Issue formal disciplinary warnings to any staff members who procure technology outside of approved channels C. Establish a responsive demand-intake and governance process so business needs are met through sanctioned channels D. Increase the frequency of shadow IT audits so that unauthorized tools are identified much sooner than before

Question 10

In a follow-up audit, management reports that it has remediated the previously reported end-user computing risks by issuing a formal EUC policy and cataloging the organization's critical spreadsheets. To conclude whether the previously identified risk has now been sufficiently addressed, what is the auditor's BEST course of action?

A. Confirm that the new EUC policy has been formally approved and clearly communicated to all affected staff B. Verify that the catalog of critical spreadsheets is complete and is being kept current over time C. Test whether the defined EUC controls are operating effectively on cataloged spreadsheets D. Obtain a written representation from management stating that the EUC risks have now been remediated

Related Posts

Leave a Comment Cancel Reply