CISA Domain 4A-9 Practice Test 001

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain A-9 (Operational Log Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4A-9 Operational Log Management Practice Test 001

10 questions • Single best answer

Question 1

An IS auditor reviewing centralized logging at a cloud-based SaaS provider finds that application, database, and network logs are collected but retained for only seven days, with no documented policy defining required retention periods. Given potential legal and investigative needs, which finding is MOST significant?

A. Log data is retained only on the same servers that originally generated the events, with no independent copy. B. Retention periods vary slightly across the different log sources. C. No retention policy aligns log storage with legal, regulatory, and investigative requirements. D. Log storage consumes more disk space than originally forecasted.

Question 2

During an audit of a hospital's electronic health record system, the IS auditor is informed by a system administrator that privileged administrator activity is not logged, although clinician access is fully captured. Before drawing conclusions about the log management program, what should the IS auditor do FIRST?

A. Corroborate the claim by examining the logging configuration and the generated log records. B. Report the missing privileged administrator logging to management as a high-risk finding immediately. C. Recommend that privileged activity logging be enabled without delay. D. Interview additional administrators to gauge the severity of the gap.

Question 3

A government agency's security operations team stores all system logs in a central repository where system administrators have full read and write access to the stored log files. No integrity controls or write-once storage are in place. Which risk is MOST significant to the reliability of the logs?

A. Log storage costs may increase steadily over time. B. Administrators may be unable to retrieve logs quickly during an incident. C. Log formats may become inconsistent across different systems. D. Administrators could alter or delete logs, undermining their use as reliable audit evidence.

Question 4

During an audit of a manufacturing firm's ERP environment, the IS auditor finds that logs are generated and retained appropriately, but no one reviews them and no automated alerting is configured. Management asserts the logs provide an adequate detective control. Which conclusion is MOST appropriate?

A. The detective control is effective because complete logs are being retained. B. Without review or alerting, the logs do not function as an effective detective control. C. The program is adequate because log generation and retention are the primary control objectives here. D. Log retention alone satisfies the requirement for continuous monitoring.

Question 5

An IS auditor at an insurance company wants to determine whether security-relevant events on a critical database, such as failed logins and privilege changes, are actually being captured by the log management system, rather than merely configured to be captured. Which approach would provide the BEST evidence?

A. Reviewing the database logging policy and configuration standards. B. Interviewing the database administrator and reviewing the documented logging settings for the database. C. Generating controlled test events and confirming they appear in the collected logs. D. Inspecting the retention schedule that applies to the database logs.

Question 6

A cloud migration review reveals that log timestamps across various systems are inconsistent because the servers are not synchronized to a common, authoritative time source. During a later incident investigation, analysts could not reliably correlate events across the affected systems. Which recommendation is MOST appropriate?

A. Synchronize all systems to a common, authoritative time source such as NTP. B. Increase the retention period applied to all system logs. C. Consolidate all system logs into a single storage repository. D. Encrypt all log files while they are transmitted from each server to the central log collector.

Question 7

During a review of a telecommunications provider's logging environment, the IS auditor notes that logging levels were reduced to errors-only on several production servers to save storage space, and the security operations team was not consulted about the configuration change. Which finding is MOST significant?

A. Storage utilization may still exceed the projected limits. B. The change reduced log file sizes on the affected servers. C. Different servers now operate at different logging levels. D. Security-relevant events may no longer be captured, weakening detection and investigation.

Question 8

An IS auditor has identified that a retailer's log management program lacks defined review responsibilities and retention standards. Several stakeholders dispute the severity of the findings during the closing meeting, arguing that residual risk is low. What is the IS auditor's BEST course of action?

A. Remove the findings because stakeholders disagree with the assessment. B. Retain the findings and support them with the objective evidence gathered. C. Downgrade the findings to observations to reach consensus with management. D. Defer reporting until management formally agrees on the severity level.

Question 9

An organization forwards logs from thousands of endpoints and servers to a centralized SIEM platform. The IS auditor wants assurance that log records are not silently lost in transit or dropped before reaching the SIEM for analysis. Which control provides the BEST assurance of complete collection?

A. Encrypting the log data end-to-end while it is transmitted to the central SIEM platform. B. Restricting administrative access to the SIEM console. C. Reconciling event counts between the source systems and the SIEM. D. Scheduling periodic backups of the SIEM database.

Question 10

An IS auditor is evaluating whether an energy utility's log management program captures all privileged administrator actions in production. To conclude on completeness, the auditor needs to verify that every actual privileged change is reflected in the log records. Which testing approach is MOST appropriate?

A. Select a sample from the population of actual privileged changes and trace each one to the logs. B. Select a sample of log entries and trace each back to an approved change. C. Review the logging configuration to confirm privileged events are enabled. D. Interview administrators about which actions they typically perform in production.

Related Posts

Leave a Comment Cancel Reply