CISA Domain 4A-7 Practice Test 002

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain A-7 (Problem and Incident Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4A-7 Problem and Incident Management Practice Test 002

10 questions • Single best answer

Question 1

An internal audit team at a public university is reviewing the IT service desk's incident management process. Sampled tickets show that analysts close incidents as soon as a workaround restores service, and about one quarter of closed tickets are reopened within ten days for the same symptom. Which recommendation is MOST appropriate?

A. Require analysts to obtain user confirmation before closing any incident ticket. B. Increase service desk staffing so analysts have more time to resolve incidents. C. Refer recurring incidents to problem management for root cause analysis. D. Revise the resolution SLA so that reopened tickets restart the resolution clock.

Question 2

During an audit of a regional hospital's incident management process, the IS auditor wants to determine whether all significant operational and security incidents are being recorded. The IT director states that every incident is logged in the IT service management tool. Which evidence would BEST support a conclusion on the completeness of incident records?

A. Matching of monitoring alerts and service desk call logs to recorded incident tickets. B. A sample of recorded incident tickets traced to documented resolution and closure notes. C. Written confirmation from the service desk manager that incident logging is mandatory. D. The approved incident management policy requiring all incidents to be logged promptly.

Question 3

An IS auditor reviewing a payment processor's incident procedures finds that severity levels are defined, but there are no criteria for declaring a major incident or for notifying senior management and business owners. During a recent card authorization outage, executives first learned of the disruption from customer complaints. What is the MOST significant risk arising from this gap?

A. Service desk analysts may spend excessive time on lower-priority tickets. B. Incident tickets may lack sufficient detail to support later trend analysis. C. Post-incident reviews may not be completed within the required timeframes. D. Business impact may escalate before accountable decision-makers can respond.

Question 4

A telecommunications provider's problem management team documents root causes and workarounds in a known error database, but service desk analysts report they cannot search it from the ticketing tool. An IS auditor finds that average resolution time for recurring incidents has not improved in two years. Which conclusion is MOST appropriate based on the evidence?

A. Problem management is ineffective because root causes are not being identified. B. Known error records are not being used at the point where incidents are resolved. C. Service desk analysts require further training on standard resolution procedures. D. The resolution time target should be revised to reflect actual team performance.

Question 5

An audit manager at a government revenue agency is planning a review of incident management and has access to three years of ticket data exported from the IT service management tool. The oversight committee wants assurance that SLA compliance reported by IT is accurate. Which approach would provide the MOST efficient and reliable assurance?

A. Use data analytics to recalculate SLA compliance across the full ticket population. B. Select a random sample of tickets and manually verify their resolution timestamps. C. Review the monthly SLA reports provided to the committee for trends and anomalies. D. Interview service desk supervisors about how the SLA metrics are compiled each month.

Question 6

Following a ransomware incident at a manufacturing company, the IS auditor reviews the post-incident report presented to the IT steering committee. The report documents the timeline and recovery steps and lists seven corrective actions, but none has an assigned owner or target completion date. Which recommendation is MOST appropriate?

A. Engage an external firm to repeat the post-incident review independently. B. Require the security team to present the report to the audit committee. C. Assign accountable owners and target dates, and track actions to closure. D. Keep the incident record open until all corrective actions are complete.

Question 7

A regional insurer outsources hosting and support of its claims platform to a cloud service provider that manages incident response under contract. During an audit, the IS auditor finds that the insurer receives no incident reports and relies on the provider to judge which incidents affect claims processing. Which is the MOST significant concern?

A. The provider's incident tool may not integrate with the insurer's service desk tool. B. The insurer cannot oversee incidents for which it remains ultimately accountable. C. The provider may be incurring higher costs than necessary to resolve incidents. D. The provider's staff may lack familiarity with the insurer's claims processes.

Question 8

An IS auditor reviews incident management KPIs reported to the IT steering committee of a national retail chain. The reports show mean time to resolve improving every quarter, but the auditor learns that analysts can pause the SLA clock while awaiting information from users. What should the IS auditor do FIRST?

A. Recommend that the SLA pause function be disabled in the service management tool. B. Report to the IT steering committee that the resolution KPI is likely misleading. C. Recalculate resolution times for all tickets with paused periods fully included. D. Determine how frequently and for what reasons the SLA clock was paused.

Question 9

A post-implementation review at a pension administrator finds that 40 percent of high-priority incidents last quarter occurred within 48 hours of a production change. During the review, the IS auditor also notes that incident records have no field for referencing related change tickets. Which recommendation is MOST appropriate?

A. Require incident records to identify related changes to support root cause analysis. B. Impose a change freeze until the incident rate returns to its historical average. C. Require the CAB to review all changes, including standard pre-approved changes. D. Increase monitoring of production systems for 48 hours following each change.

Question 10

Last year, an IS auditor reported that a public transit authority had no problem management process for recurring incidents affecting its fare collection systems. Management has since issued a problem management procedure and appointed a problem manager. Which follow-up procedure provides the BEST evidence that the risk has been addressed?

A. Confirm that the approved procedure addresses each element of the original finding. B. Interview the problem manager about the new process and the current case volume. C. Examine recent recurring incidents for linked problem records and root cause actions. D. Verify that the problem manager role appears in the updated IT organization chart.

Related Posts

Leave a Comment Cancel Reply