CISA Domain 5A-1 Practice Test 002

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-1 (Information Asset Security Frameworks, Standards, and Guidelines) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-1 Information Asset Security Frameworks, Standards, and Guidelines Practice Test 002

10 questions • Single best answer

Question 1

An internal audit team at a regional credit union is relying on management's assertion that information security is ISO/IEC 27001 certified. The IS auditor finds the certificate's scope covers only the corporate data center, while the new online banking platform is hosted by a third party. Which conclusion is MOST appropriate?

A. The certification provides adequate assurance because the ISMS applies across the organization B. The third-party host should be required to obtain its own ISO/IEC 27001 certification C. The certification provides no direct assurance over controls for the online banking platform D. The certification body should be asked to extend the current scope during its next surveillance visit

Question 2

During an audit of a pharmaceutical company, the IS auditor notes that encryption of laptops containing clinical trial data is described only in a security guideline. Several research teams have chosen not to encrypt their devices, citing the guideline's advisory status. Which recommendation is MOST appropriate?

A. Move the encryption requirement into a mandatory standard backed by policy B. Reissue the guideline with stronger wording and broader distribution to staff C. Require research teams to document why they chose not to encrypt laptops D. Add laptop encryption to the annual security awareness training curriculum

Question 3

A mid-sized logistics company's CIO selected a security control framework because the company's managed service provider already used it. An IS auditor is asked to evaluate whether the framework is appropriate for the organization. Which of the following should the auditor use as the PRIMARY basis for this evaluation?

A. The framework's level of international recognition among peer organizations B. The provider's ability to report control status using the framework's structure C. The number of controls the framework contains compared with alternatives D. The framework's alignment with business objectives, legal obligations, and risk profile

Question 4

A state transportation agency used the NIST Cybersecurity Framework to build a target profile and set every subcategory at the highest implementation tier to show leadership commitment. The IS auditor notes that no risk assessment or business impact input was used to establish these targets. Which concern is MOST significant?

A. The agency may be unable to demonstrate compliance with federal reporting rules B. Remediation resources may not be prioritized toward the most significant risks C. The highest tiers may conflict with controls required by the agency's insurer D. The current profile may overstate maturity because it was self-assessed

Question 5

An IS auditor is reviewing a telehealth provider's ISO/IEC 27001 Statement of Applicability before a certification audit. Eleven Annex A controls are marked as excluded, but the document provides no rationale, and the security manager says the exclusions were agreed informally. What should the IS auditor do FIRST?

A. Determine whether the exclusions are justified by the documented risk assessment B. Recommend that all excluded controls be implemented before the certification audit C. Report the exclusions to the audit committee as a significant control deficiency D. Ask the certification body whether informal approval of exclusions is acceptable

Question 6

A national insurer's security policy framework permits temporary exceptions to its standards. During an audit, the IS auditor finds that 40 exceptions remain open past their expiry dates, and most were approved by IT project managers rather than business data owners. Which finding is MOST significant?

A. The exception register is not reconciled to the policy framework each quarter B. The number of exceptions suggests that several standards are impractical to follow C. Risks from noncompliance have not been formally accepted by an accountable owner D. Project managers lack training on the organization's exception approval process

Question 7

A software company migrated most workloads to public cloud services three years ago. An IS auditor finds that its information security standards were last updated before the migration and still reference only on-premises firewalls and server hardening, and no review cycle is defined. Which recommendation is MOST appropriate?

A. Adopt the cloud provider's published security baselines in place of internal standards B. Have the security team draft cloud addenda that business units can apply voluntarily C. Commission an external assessment against a cloud security certification scheme D. Establish scheduled and change-triggered reviews to keep security standards current

Question 8

An audit committee at a publicly traded retailer asks the IS auditor whether the newly adopted information security framework is functioning as intended. Management has provided approved policies, a framework mapping document, and a completed self-assessment. Which of the following provides the BEST evidence for the auditor's conclusion?

A. Board minutes showing formal approval of the framework and supporting policy set B. Results of independent testing of key controls' operating effectiveness over time C. The self-assessment scores reviewed and signed by each accountable control owner D. A mapping showing every framework requirement is linked to a documented control

Question 9

At a mining company, the CISO issued a new information security policy framework directly to IT staff after obtaining approval from the IT steering committee only. An IS auditor notes that business unit leaders are unaware of the framework and continue to follow legacy practices. Which is the MOST significant concern?

A. IT staff were not consulted on the procedures that support the new policies B. The framework was not benchmarked against peer companies before release C. The framework lacks senior management endorsement needed for enterprise-wide authority D. The legacy practices have not yet been formally retired from the document repository

Question 10

A multinational bank requires all subsidiaries to follow its group information security standards, which are reviewed annually by the group CISO. An IS auditor reviewing a European subsidiary finds that local banking regulations impose stricter data retention and breach notification requirements than the group standard does. Which recommendation is MOST appropriate?

A. Map local requirements to the group standard and apply whichever is more stringent B. Follow the group standard because it is the subsidiary's approved governing framework C. Seek a formal exception so the subsidiary can follow local rules instead of group rules D. Revise the group standard so every subsidiary adopts the European regulatory requirements

Related Posts