CISA Domain 4A Practice Test 001

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain A (Information Systems Operations) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA Practice Test — 4A (Information Systems Operations)

10 questions • Single best answer

Question 1

An IS auditor is reviewing the automated batch job scheduling environment at a large retail company's data center. The auditor observes that operators can manually modify production job schedules directly in the scheduler without any documented approval or activity logging. Which of the following should be the auditor's MOST significant concern?

A. Scheduled batch jobs may take longer to complete during peak processing windows, delaying downstream reports to business users. B. Unauthorized changes to production jobs could occur and remain undetected, threatening the integrity of processed data. C. Operators may require additional training on the job scheduling tool. D. The scheduler may not integrate with the enterprise monitoring dashboard.

Question 2

During an audit of a commercial bank's IT operations, the IS auditor notes that individual incidents are resolved quickly and within the agreed service targets, but the same incidents recur frequently across the environment because their underlying causes are rarely investigated or documented. Which recommendation is MOST appropriate to address this condition?

A. Establish a problem management process to identify and remediate the root causes of recurring incidents. B. Expand the incident response team so that tickets are closed more quickly. C. Require all users to report incidents through a single standardized intake channel so that ticket categorization becomes more consistent across teams. D. Escalate every incident to senior management to increase organizational visibility.

Question 3

During a review of a manufacturing company's IT change management process, an IS auditor finds that emergency changes are applied directly to the production environment and documented afterward, but many of the required retroactive approvals and impact assessments are never completed. What is the auditor's BEST course of action?

A. Recommend that emergency changes be eliminated entirely to enforce the standard change process across all environments. B. Conclude that the process is adequate because emergency changes are documented after implementation and reviewed during the next scheduled release cycle. C. Report the weakness because incomplete retroactive approvals reduce accountability and control over production changes. D. Recommend that all changes, including routine ones, be processed as emergency changes.

Question 4

An IS auditor is evaluating the capacity management practices of an e-commerce platform that suffered repeated outages during seasonal sales peaks. The auditor learns that current utilization thresholds are monitored, but no forecasting is performed against projected business growth or planned marketing campaigns. Which finding is MOST significant?

A. Capacity utilization reports are stored in a shared network folder rather than a managed document repository. B. The monitoring dashboard cannot be viewed on mobile devices by on-call operations staff. C. Utilization thresholds are reviewed on a monthly cycle rather than weekly, which may delay recognition of gradual upward trends in demand. D. The absence of capacity forecasting increases the risk that resources will be insufficient to meet future business demand.

Question 5

During an audit of a government agency's IT operations, the IS auditor finds that system and application logs are generated but are automatically overwritten after seven days and are never reviewed by operations staff. Which of the following represents the GREATEST risk associated with this condition?

A. Security and operational events may go undetected and cannot be reconstructed for investigation after the short retention period. B. Log files consume excessive storage capacity on the production servers. C. Log formats differ across applications and platforms, which complicates automated parsing and correlation of events during analysis. D. Administrators must manually enable logging each time a new system is deployed.

Question 6

An IS auditor reviewing end-user computing controls at an insurance company discovers that critical premium calculations are performed in a complex spreadsheet maintained by a single business analyst, with no version control, supporting documentation, or independent validation of the results. Which control weakness should the auditor consider MOST significant?

A. The spreadsheet is not stored on the organization's approved cloud collaboration platform. B. The analyst who maintains the spreadsheet has not completed the organization's formal training on spreadsheet design and data-integrity controls. C. The absence of validation and version control increases the risk of undetected errors in critical premium calculations. D. The spreadsheet does not use macros to automate the calculation steps.

Question 7

An IS auditor is reviewing the service level agreements between an organization and its outsourced IT service provider. The SLAs define availability targets, but there is no independent verification of the provider's reported performance and no defined reporting obligations. What should the auditor recommend FIRST?

A. Terminate the contract with the service provider immediately because the absence of performance controls represents a breach of the agreement. B. Establish independent monitoring and reporting to verify the provider's actual performance against SLA targets. C. Increase the availability targets currently defined within the SLA. D. Require the provider to self-report its performance on a monthly basis.

Question 8

During an audit of a financial services company's database management practices, the IS auditor finds that several database administrators share a single privileged account for maintenance, and activity performed under that account cannot be traced to any individual. Which of the following is the auditor's GREATEST concern?

A. Database maintenance tasks may take longer to coordinate because access is shared among several administrators working on overlapping schedules. B. The shared account password must be changed more frequently than standard user passwords. C. Administrators may need additional licenses to access the database management tools. D. The lack of individual accountability prevents attribution of unauthorized or erroneous changes to the database.

Question 9

An IS auditor reviewing IT asset management at a utility company finds that the asset inventory has not been reconciled to physical devices in over two years, and several decommissioned servers still appear as active in the register. Which finding is MOST significant from a control perspective?

A. An inaccurate asset inventory undermines patching, licensing, and risk decisions because assets cannot be reliably tracked or secured. B. The asset register is maintained in a manually updated spreadsheet rather than a dedicated asset management tool with automated discovery capabilities. C. Asset tags on several physical devices have faded and are difficult to scan. D. The asset inventory does not record the original purchase cost of each device.

Question 10

During an audit of an organization's system interfaces, the IS auditor observes that data transferred between the order-entry system and the billing system has no automated reconciliation or exception reporting. Which control provides the BEST assurance that data is transferred completely and accurately between the two systems?

A. Encrypting the data in transit as it moves between the order-entry and billing systems. B. Restricting access to the interface configuration to authorized administrators and logging all configuration changes for later review. C. Automated reconciliation of control totals and record counts between the source and target systems. D. Scheduling the interface to run during off-peak processing hours.

Related Posts

Leave a Comment Cancel Reply