CISA Domain 4A-8 Practice Test 002

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain A-8 (IT Change, Configuration, and Patch Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4A-8 IT Change, Configuration, and Patch Management Practice Test 002

10 questions • Single best answer

Question 1

An external auditor reviewing a pharmaceutical manufacturer's validated production systems finds that developers use individually assigned emergency IDs to apply urgent fixes directly in production. Twelve emergency changes occurred last quarter, and none show evidence of after-the-fact review or approval by the change advisory board. Which recommendation is MOST appropriate?

A. Revoke developer emergency access and route all urgent fixes through operations staff only. B. Require each emergency change to receive documented retroactive review and approval by the CAB. C. Reclassify emergency changes as standard changes so they follow a pre-approved workflow. D. Extend retention of emergency ID activity logs so changes can be investigated if needed.

Question 2

During an audit of a logistics company's change management process, the IS auditor confirms that every sampled change ticket contains approvals, test results, and CAB sign-off. However, the audit objective also requires assurance that no changes reached production outside the formal process. Which testing approach BEST addresses this objective?

A. Select additional approved change tickets and verify that each contains complete testing evidence. B. Interview the change manager about how unauthorized production changes are detected and escalated. C. Review CAB meeting minutes to confirm that all tickets were discussed before deployment dates. D. Extract production change history and trace a sample of changes back to approved change tickets.

Question 3

A state tax agency's policy requires critical security patches to be applied within 14 days. Quarterly metrics show 96 percent compliance, but the IS auditor notes that the unpatched 4 percent includes internet-facing web servers processing taxpayer data, and no risk acceptance has been documented for these exceptions. Which finding is MOST significant?

A. Critical patches are missing on internet-facing servers without documented risk acceptance. B. Overall critical patch compliance falls short of the agency's internal target for the quarter. C. Patch compliance metrics are compiled by the same team that deploys the patches. D. Patches are tested in a staging environment that differs slightly from production.

Question 4

An IS auditor at a health insurer compares configuration management database records with automated discovery scans and finds that 30 percent of sampled servers have attributes that differ from their CMDB entries. Change tickets show the servers were modified through approved changes, but CMDB records were never updated. Which recommendation is MOST appropriate?

A. Perform an annual manual inventory to refresh CMDB records for all production servers. B. Assign a dedicated configuration librarian to review a sample of CMDB entries each week. C. Make CMDB updates a mandatory change closure step, verified against automated discovery. D. Restrict CMDB write access to the infrastructure manager to prevent unauthorized edits.

Question 5

An IS auditor at a small credit union finds that the sole application developer also migrates approved changes into production because no other staff have the required technical skills. Management states that hiring additional staff is not feasible this year. Which compensating control BEST mitigates the risk of unauthorized production changes?

A. Independent periodic review of production change logs reconciled to approved change requests. B. Requiring the developer to document every modification in detailed program source comments. C. Having the IT manager approve all change requests before any development work begins. D. Running automated regression tests before each change is migrated to the production system.

Question 6

A municipal government's internal audit function is reviewing change management for its ERP financial modules after several payroll calculation errors followed recent releases. The IS auditor wants to confirm that business users tested and accepted each sampled change before it was deployed to production. Which of the following is the BEST evidence?

A. Developer unit testing notes attached to each change ticket in the tracking system. B. User acceptance sign-off dated before the recorded production migration timestamp. C. An email from the project manager stating each change was tested successfully. D. CAB meeting minutes listing each change as approved for the scheduled release window.

Question 7

A cloud migration review at a regional media company finds that production workloads were moved to infrastructure-as-a-service virtual machines. The IT team assumed the provider handles all patching, and vulnerability scans show guest operating systems have not been patched since migration six months ago. Which recommendation is MOST appropriate?

A. Obtain the provider's SOC 2 Type II report to confirm that its patching controls operate effectively. B. Negotiate a contract amendment requiring the provider to patch all customer virtual machines. C. Migrate the workloads to a platform-as-a-service offering to remove patching responsibilities. D. Clarify shared responsibilities and bring guest operating systems into the internal patch process.

Question 8

An IS auditor reviews a fintech company's continuous deployment pipeline, in which code merged into the main branch is automatically deployed to production. Repository settings allow developers to approve and merge their own pull requests. Which control provides the BEST assurance that only authorized changes are deployed?

A. Automated unit tests that must pass before the pipeline deploys any build to production. B. Monthly review of deployment logs by the development team lead for unusual activity. C. Branch protection requiring an independent reviewer's approval before any code is merged. D. Daily vulnerability scanning of the production environment following each deployment.

Question 9

An audit manager at an online travel agency is performing follow-up on a prior finding that emergency changes lacked post-implementation approval. Management reports that a new emergency change procedure was implemented four months ago and that the issue is fully remediated. What is the BEST way to verify remediation?

A. Test a sample of emergency changes made since the new procedure took effect. B. Review the updated emergency change procedure document for completeness. C. Obtain a signed management representation that the finding is fully remediated. D. Interview CAB members about their understanding of the revised procedure.

Question 10

An IS auditor at a stock exchange operator is planning an annual change management audit. During the walkthrough, the auditor learns that the change ticketing system was replaced in the fifth month of the audit period and that only open tickets were migrated to the new tool. What is the auditor's BEST course of action?

A. Limit testing to the new system, because it reflects the current control environment. B. Request that IT migrate all historical tickets before audit fieldwork can begin. C. Rely on the vendor's certification of the new tool's workflow approval controls. D. Define the test population from both systems and confirm its completeness.

Related Posts

Leave a Comment Cancel Reply