CISA Domain 4A-6 Practice Test 001

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain A-6 (Systems Availability and Capacity Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4A-6 Systems Availability and Capacity Management Practice Test 001

10 questions • Single best answer

Question 1

A large e-commerce retailer experiences unpredictable traffic spikes during promotional events. An IS auditor reviewing capacity management observes that infrastructure is sized to average daily demand and that scaling actions occur reactively only after users report slow response times to the service desk. Which finding is MOST significant?

A. Real-time dashboards do not display memory utilization alongside processor utilization for each server. B. The production servers are approaching the vendor's stated end-of-support date within the year and lack a documented hardware replacement plan. C. Capacity is not forecasted against projected peak demand, leaving availability at risk during anticipated high-volume promotions. D. The capacity management plan is formally reviewed once a year rather than each quarter.

Question 2

During an audit of a hospital's clinical systems, the IS auditor learns that a core application repeatedly reached maximum server utilization last quarter, causing intermittent outages during peak shifts that affected patient care. No capacity thresholds or alerts were configured. What should the IS auditor do FIRST?

A. Determine the business impact of the outages and how utilization is currently monitored and reported. B. Recommend immediate procurement of additional server capacity to eliminate the utilization ceiling. C. Report the outages as a critical control deficiency to the audit committee without further review. D. Conclude that capacity management is ineffective and expand the audit scope to all applications.

Question 3

An IS auditor is assessing whether a financial services firm's capacity management process anticipates future resource needs. Management asserts that infrastructure growth is planned proactively and tied to business forecasts. Which of the following would provide the BEST evidence that capacity planning is effective over time?

A. A vendor proposal recommending an upgrade to higher-specification server hardware. B. Capacity forecasts derived from utilization trends and documented business growth projections. C. Help desk tickets showing that recent performance complaints have declined. D. A signed policy stating that capacity must be reviewed and formally approved by senior management on an annual basis.

Question 4

A payment processor requires near-continuous availability of its transaction platform, where downtime directly translates to lost revenue and penalties. An IS auditor is evaluating controls that protect against single points of failure in the production environment. Which control provides the BEST assurance of sustained availability?

A. A monitoring tool that emails administrators when a server becomes unreachable. B. A documented escalation procedure invoked when outages exceed one hour. C. Scheduled nightly backups of the transaction database to offsite storage. D. Redundant components configured for automatic failover with regularly tested recovery.

Question 5

An IS auditor reviewing a government agency's data center finds that capacity issues are identified only when systems fail or users escalate complaints. Utilization is captured monthly and reported after the fact, with no forward-looking analysis. Which recommendation is MOST appropriate to strengthen capacity management?

A. Establish utilization thresholds with automated alerts and trend-based capacity forecasting. B. Increase the reporting frequency of utilization metrics from monthly to weekly. C. Purchase additional storage and compute resources to create a permanent surplus of capacity across the data center. D. Require users to submit performance complaints through a formal ticketing system.

Question 6

During an audit of IT operations at an insurance company, the IS auditor notes that no role is accountable for capacity management; infrastructure teams add resources ad hoc when problems arise. Recurring performance incidents have followed each quarter. Which finding represents the MOST significant control weakness?

A. Infrastructure teams occasionally add resources without completing a formal change request. B. Ownership of capacity management is undefined, so no one plans or monitors resource adequacy. C. The capacity management procedure document has not been reviewed or updated in more than twelve consecutive months. D. Performance incident records are stored separately from the capacity planning documentation.

Question 7

An IS auditor reviews a media company's migration to a public cloud platform that uses auto-scaling to match capacity to demand in near real time. Management believes auto-scaling entirely eliminates the need for capacity planning and cost forecasting. Which conclusion is MOST appropriate based on the evidence?

A. Auto-scaling removes availability risk, so ongoing capacity monitoring is no longer required. B. The migration should be halted until on-premise capacity planning is fully reinstated. C. Capacity planning remains necessary to manage cost, scaling limits, and performance assumptions. D. Cloud providers guarantee unlimited capacity, making demand forecasting an unnecessary activity.

Question 8

A telecommunications provider commits to 99.9% platform availability in its customer service level agreements. An IS auditor must independently verify whether the availability target was actually achieved across all production regions over the past year. Which of the following provides the BEST evidence of achieved uptime?

A. System-generated uptime and outage logs reconciled to independent monitoring records. B. Management's quarterly availability report presented to the operations committee. C. The service level agreement clause specifying the 99.9% availability commitment. D. Customer satisfaction survey results collected quarterly indicating relatively few complaints about service outages this year.

Question 9

An IS auditor examines a bank's capacity forecasting model and finds it projects future demand solely from historical utilization trends. The bank plans to launch a new mobile product expected to triple its active customer base within the next year. Which finding is MOST significant to the auditor?

A. The model relies on utilization data that is more than six months old. B. The forecasting model is maintained in a spreadsheet rather than a dedicated tool. C. The model does not separate storage capacity from network bandwidth capacity. D. The model ignores planned business changes, understating the capacity needed for anticipated growth.

Question 10

While auditing IT operations at a logistics company, an IS auditor observes that availability and capacity metrics are collected but never reported to management or compared against defined targets. Trends therefore go unnoticed until an incident occurs and services degrade. What is the auditor's BEST course of action?

A. Recommend that the collected metrics be reported daily to the chief information officer and operations committee immediately. B. Document the gap in monitoring and reporting and evaluate its impact on operational decision-making. C. Conclude that capacity management is adequate because the required metrics are being collected. D. Advise management to stop collecting the metrics that are not currently used for reporting.

Related Posts