CISA Domain 4A-6 Practice Test 002

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain A-6 (Systems Availability and Capacity Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4A-6 Systems Availability and Capacity Management Practice Test 002

10 questions • Single best answer

Question 1

An external IS auditor at an airline reservation service provider is evaluating whether reported availability supports the 99.95 percent uptime commitment in customer contracts. Management provides monthly dashboards generated by the same operations team that is responsible for meeting the target. Which audit procedure provides the BEST assurance over the reported availability figures?

A. Interview operations managers about how outages are identified and recorded in the dashboard. B. Review the dashboard calculation methodology approved by the head of infrastructure operations. C. Reconcile dashboard outage periods to independent monitoring data and incident tickets. D. Obtain a management representation letter confirming the accuracy of reported uptime.

Question 2

During a capacity management audit at a regional stock exchange, the IS auditor notes that the trading platform's utilization thresholds were set five years ago and have never been revisited. Transaction volumes have since doubled, and several near-capacity alerts were recently dismissed as false positives. What should the IS auditor do FIRST?

A. Determine whether current thresholds still reflect business volume and performance requirements. B. Recommend that operations lower all utilization thresholds so that alerts are triggered earlier. C. Report the dismissed alerts to the audit committee as a significant control failure. D. Test whether the monitoring tool correctly generates alerts when thresholds are exceeded.

Question 3

A mid-sized insurer's IT steering committee approves infrastructure budgets annually, but capacity plans are prepared by individual system administrators without input from business units. An IS auditor learns that two product launches last year caused unplanned performance degradation in customer-facing systems. Which recommendation is MOST appropriate?

A. Require system administrators to add a 30 percent capacity buffer to every infrastructure plan. B. Acquire an automated capacity forecasting tool that analyzes historical utilization trends. C. Transfer responsibility for capacity planning from IT operations to business unit leaders. D. Integrate business demand forecasts and planned initiatives into the capacity planning process.

Question 4

An IS auditor reviewing a hospital's electronic health record platform finds that the primary and failover database servers are housed in the same rack and share a single power distribution unit. Management notes that failover testing was completed successfully last quarter and considers availability risk adequately addressed. Which conclusion is MOST appropriate?

A. Availability controls are effective because the most recent failover test was successful. B. The redundancy design contains a single point of failure that the failover test did not address. C. The risk is low because hardware redundancy already exists at the database server level. D. Failover testing frequency should be increased to compensate for the shared infrastructure.

Question 5

A software-as-a-service provider relies on public cloud auto-scaling to handle demand for its customer portal. During an audit, the IS auditor discovers that the cloud account's service quota caps the number of compute instances, and no one monitors how close peak usage comes to that ceiling. Which risk is MOST significant?

A. Auto-scaling may silently fail during demand peaks once the service quota ceiling is reached. B. Cloud consumption costs may exceed budget because scaling events occur without prior approval. C. The provider may be unable to demonstrate compliance with its approved cloud security baseline. D. Instances launched through auto-scaling may not receive the most recent security patches.

Question 6

An IS auditor at a national retail bank is testing whether capacity management procedures operated effectively throughout the audit period. The procedure requires monthly capacity reports to be reviewed by the infrastructure manager, with identified remediation actions tracked through to closure. Which testing approach is MOST appropriate?

A. Inspect the most recent capacity report and confirm it was signed by the infrastructure manager. B. Walk through the reporting process with the analyst who compiles the monthly capacity reports. C. Select a sample of monthly reports and trace identified actions to documented closure. D. Review the capacity procedure to confirm it assigns clear roles, responsibilities, and timelines.

Question 7

A follow-up audit at a logistics company examines management's remediation of a prior finding that no capacity plan existed for the warehouse management system. Management provides a newly approved capacity plan, but utilization data shows the system still reached 98 percent CPU during last month's peak shipping period. What is the auditor's BEST course of action?

A. Close the finding because management has produced and formally approved the capacity plan. B. Reissue the original finding and escalate it directly to the board of directors for action. C. Recommend immediate hardware upgrades to bring utilization below acceptable thresholds. D. Evaluate whether the plan's actions have been implemented before concluding on remediation.

Question 8

A government benefits agency reports 99.9 percent availability for its online claims portal each quarter, yet citizens frequently complain that the portal times out during month-end filing periods. An IS auditor determines that availability is measured by a server ping every fifteen minutes. Which finding is MOST significant?

A. The quarterly reporting cycle is too infrequent to support timely management action on issues. B. The measurement method does not reflect the service availability experienced by end users. C. The 99.9 percent availability target is insufficient for a public-facing government service. D. Citizen complaints are not being recorded in the agency's incident management system.

Question 9

An audit manager is planning an availability and capacity management audit at a manufacturing firm that operates more than two hundred applications. Available audit resources allow detailed testing of only a limited number of systems during the engagement. Which approach is MOST appropriate for selecting the systems to include in scope?

A. Select applications with the highest number of capacity-related incidents in the past month. B. Select applications on a rotating schedule so that every system is reviewed within three years. C. Select applications based on business criticality and availability requirements from the BIA. D. Select applications hosted on the oldest infrastructure because they are most likely to fail.

Question 10

A payment card processor's IS auditor reviews controls over maintenance windows for its authorization platform. Scheduled maintenance is approved through change management, but windows are frequently extended beyond agreed limits without notifying the business, occasionally breaching service levels. Which control would BEST reduce this availability risk?

A. Defined maintenance window limits with escalation and business approval required for any extension. B. Monthly reporting of maintenance-related downtime to the IT steering committee for oversight. C. Post-maintenance reviews documenting the root cause of each window overrun after completion. D. Service credits paid to affected merchants whenever maintenance causes a service level breach.

Related Posts