CISA Domain 4A-7 Practice Test 001

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain A-7 (Problem and Incident Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4A-7 Problem and Incident Management Practice Test 001

10 questions • Single best answer

Question 1

A managed IT service provider supports multiple client environments through a central service desk. During an audit of the incident management process, the IS auditor notes that recurring incidents are consistently resolved individually and closed, yet none are ever escalated into the problem management process for root cause analysis. Which finding is MOST significant?

A. Recurring incidents are resolved without identifying and correcting their underlying root cause, so the same disruptions continue. B. The service desk closes incidents before obtaining user confirmation of resolution. C. Incident tickets do not consistently record the first report time. D. Shared service desk staff handle client incidents rather than dedicated teams.

Question 2

An IS auditor is evaluating the effectiveness of a retail bank's problem management process. Management asserts that repeat incidents have declined steadily over the past year and that the process is operating well. The auditor must decide which support to rely on. Which of the following would provide the BEST evidence to support management's assertion?

A. A complete chronological list of every individual incident logged by the service desk across the entire review period. B. Trend analysis linking fewer recurring incidents to closed problem records. C. Minutes from the monthly IT steering committee meetings in which overall service performance was discussed by management. D. A management summary report stating that all problem resolution targets for the year were successfully met.

Question 3

During fieldwork, an IS auditor finds that a healthcare organization stores its incident records and its problem records in two separate systems with no cross-referencing between them. The audit lead is preparing to draw a conclusion on the maturity of the overall process. What should the IS auditor do FIRST?

A. Determine whether compensating controls exist to identify, link, and analyze recurring incidents across the two systems. B. Recommend that the two systems be consolidated onto one platform. C. Conclude that the organization's problem management process is ineffective. D. Report the separation of the two systems as a significant deficiency.

Question 4

A government agency prioritizes incidents based solely on the raw number of users who report each one, without reference to any other factor. An IS auditor reviewing the incident management process is assessing how incidents are ranked for response and remediation. Which weakness in this prioritization approach is MOST significant?

A. Incidents that happen to be reported by only a very small number of users may nonetheless still be logged within the ticketing system. B. The agency does not routinely survey its end users about their overall satisfaction with how reported incidents are ultimately handled. C. Priority ignores business impact and urgency, so critical low-volume incidents may be delayed. D. Target incident response times are not published to end users through any service catalog.

Question 5

Following a major outage that disrupted customer transactions, a financial services firm restored service within its recovery target but performed no structured review of the event afterward. An IS auditor is drafting recommendations intended to strengthen the incident management process. Which recommendation is MOST appropriate in these circumstances?

A. Establish a post-incident review to identify root cause and preventive actions for all major incidents. B. Reduce the recovery time target to improve future restoration speed. C. Increase the frequency of general service desk staff training sessions. D. Require executive approval before any major incident is formally closed.

Question 6

An IS auditor wants assurance that a telecommunications company resolves its high-priority incidents within agreed service levels. Management describes several different controls that operate over incident handling. The auditor must judge which offers the strongest ongoing assurance. Which control provides the BEST assurance that high-priority incidents are consistently resolved on time?

A. A documented incident management policy that has been formally reviewed and approved by senior management on an annual basis. B. Periodic classroom and online training for service desk analysts covering the organization's incident prioritization procedures. C. A monthly management report that lists the total number of incidents received by the service desk during the month. D. Automated SLA monitoring that escalates incidents nearing breach to management.

Question 7

An IS auditor reviewing an enterprise's problem management process notes that resolved problems and their associated workarounds are not recorded in any knowledge base. As a direct result, the service desk frequently re-diagnoses the same underlying issues from scratch each time they recur. Which finding is MOST significant?

A. The absence of a known error database causes repeated diagnostic effort and inconsistent resolution of recurring issues. B. Analysts occasionally apply workarounds before escalating to problem management. C. Problem records are reviewed monthly rather than weekly by the manager. D. The knowledge base, where it exists, is not accessible to end users.

Question 8

During an audit of an enterprise IT operations function, the IS auditor observes that the same analysts who resolve incidents can also close the related records and mark the root cause as identified, with no independent review of either action being performed. Which risk is MOST significant in this arrangement?

A. Analysts may end up spending an excessive amount of time documenting the incidents that they have already investigated and resolved. B. Incidents may be closed prematurely and unresolved root causes may go undetected. C. Incident volume figures reported upward to senior management each period may end up appearing somewhat higher than they truly are. D. End users affected by an issue may receive several duplicate notifications when a single incident is eventually closed out.

Question 9

An IS auditor is testing whether critical incidents at a manufacturing company are escalated in accordance with the organization's defined escalation procedures. Several possible sources of assurance are available to the auditor. Which of the following would provide the BEST evidence that escalation is functioning as intended?

A. A sample of critical incident tickets showing escalation times consistent with thresholds. B. The organization's approved incident escalation procedure document, formally signed and dated by the IT director. C. Structured interviews with several service desk staff members describing how the escalation process is supposed to work. D. An organizational chart that identifies each of the designated incident escalation contacts and their reporting lines.

Question 10

An IS auditor previously reported that recurring incidents at an insurance company were not being analyzed for root cause. During the follow-up engagement, management states that the corrective action is now fully complete and the issue resolved. What should the IS auditor do to determine whether the identified risk has been sufficiently addressed?

A. Obtain from management a signed written confirmation stating that the agreed corrective action was fully implemented on schedule. B. Confirm that the total number of incidents logged has decreased noticeably since the date of the prior audit report. C. Verify that problem records now link recurring incidents to root cause analysis and preventive actions. D. Review the newly updated incident management policy to check for references to the problem management process.

Related Posts

Leave a Comment Cancel Reply