CISA Domain 4A-9 Practice Test 002

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain A-9 (Operational Log Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4A-9 Operational Log Management Practice Test 002

10 questions • Single best answer

Question 1

An audit manager at a regional airline is planning a review of operational log management across flight operations, crew scheduling, and reservation systems. Audit hours are limited, and more than 400 servers forward logs to a central platform. Which approach should the audit manager take FIRST when scoping the review?

A. Select a statistical sample of servers across all platforms and test their log configuration settings B. Review the log platform vendor's SOC 2 report to determine whether the platform's controls are reliable C. Identify the systems that support critical business processes and the log-related risks for each system D. Interview system administrators to identify which logging settings have changed since the prior audit

Question 2

An IS auditor at a state university is testing whether security analysts review privileged access alerts generated by the SIEM. The security manager provides a signed policy requiring daily review and states that analysts consistently perform it. Which of the following provides the BEST evidence that the review control is operating effectively?

A. System-generated records showing alert dispositions, reviewer IDs, and timestamps for sampled days B. A signed attestation from each security analyst confirming daily completion of all alert reviews C. The approved log review procedure detailing escalation paths and assigned reviewer responsibilities D. A walkthrough in which an analyst demonstrates the alert review process for the current business day

Question 3

During an audit of a commercial bank's core banking platform, the IS auditor notes that database administrators can disable database audit logging and purge audit tables. Management states that the DBAs are trusted senior staff and that logs are reviewed weekly by the DBA team lead. Which finding is MOST significant?

A. Weekly review frequency may delay the detection of unauthorized changes made to database records B. The DBA team lead who reviews the logs belongs to the same team whose activity is being reviewed C. Audit log retention within the database may be insufficient to satisfy regulatory requirements D. Users whose actions are recorded can alter or remove the audit logs that record those actions

Question 4

A payment processor follows an industry standard requiring security logs to be retained for one year, with the most recent three months immediately available for analysis. The IS auditor finds that logs are kept online for 90 days and then deleted because storage costs have increased. What should the IS auditor recommend?

A. Reduce the volume of logged events so that one full year of logs fits within current online storage B. Archive logs to lower-cost protected storage after 90 days and retain them for the required year C. Obtain a documented risk acceptance from the CIO for the shortened log retention period D. Increase online storage capacity so that all logs remain immediately searchable for one year

Question 5

An IS auditor at a logistics company wants to determine whether all production servers forward logs to the central SIEM. Management provides a SIEM dashboard showing that 100 percent of registered log sources reported within the last 24 hours. What should the IS auditor do NEXT?

A. Accept the dashboard as sufficient evidence because it is generated directly by the SIEM B. Review the SIEM parsing rules to confirm that incoming events are normalized correctly C. Reconcile the inventory of production servers to the list of log sources registered in the SIEM D. Select a sample of events in the SIEM and trace them back to the originating source servers

Question 6

An IS auditor at an online retailer finds that the SIEM generates about 8,000 alerts per day and that analysts close most of them in bulk without investigation. Management plans to hire two additional analysts to address the growing workload. Which recommendation is MOST appropriate?

A. Tune correlation rules and alert thresholds based on risk so analysts focus on meaningful events B. Hire the additional analysts and require that every alert be investigated individually C. Disable alerting for lower-risk systems so that alert volume falls within current analyst capacity D. Extend the alert review window so that analysts can work through the backlog over several days

Question 7

During a review of a telehealth provider's application logging, the IS auditor finds that debug-level logs capture full patient names, diagnoses, and session tokens. These logs are accessible to the entire development team for routine troubleshooting. What is the IS auditor's BEST course of action?

A. Recommend disabling application logging until the privacy impact has been fully assessed B. Recommend restricting log access to the development team lead and the security staff only C. Recommend increasing log retention so that later access to the patient data can be audited D. Report the exposure and recommend masking sensitive data before it is written to the logs

Question 8

A manufacturer outsources infrastructure log monitoring to a managed security service provider that reviews logs and escalates incidents. The IS auditor finds that the contract defines escalation timeframes, but the company has not received a single escalation in 18 months. What should the IS auditor do FIRST?

A. Conclude that the environment experienced no significant security events during the period B. Obtain evidence of the provider's log review activity and test whether escalation criteria are applied C. Recommend that the company terminate the contract and bring log monitoring back in-house D. Request that the provider's independent service auditor report be expanded to cover escalations

Question 9

An IS auditor at an investment firm confirms that trading system logs are forwarded to a write-once repository. However, testing shows that when a server's logging service stops, no alert is generated and the gap is discovered only during monthly reviews. Which control provides the BEST assurance over this risk?

A. Automated monitoring that alerts security staff when an expected log source stops reporting B. A monthly reconciliation of log volumes by source performed by the security operations team C. A policy requiring administrators to notify security before stopping any logging service D. Restricting administrator privileges so that only senior staff can restart logging services

Question 10

An audit manager is following up on a prior finding that firewall logs at a county government were not being reviewed. Management reports the finding as closed, providing a new review procedure and screenshots of a SIEM dashboard configured for firewall events. What is the MOST appropriate action before closing the finding?

A. Close the finding, since management has documented the procedure and configured the dashboard B. Test a sample of review records over a period to confirm the review is actually being performed C. Obtain a management representation letter confirming that the log reviews are now performed D. Reissue the finding because screenshots are not acceptable forms of audit evidence for follow-up

Related Posts

Leave a Comment Cancel Reply