CISA Domain 5A-2 Practice Test 001

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-2 (Physical and Environmental Controls) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-2 Physical and Environmental Controls Practice Test 001

10 questions • Single best answer

Question 1

During a walkthrough of a colocation data center, an IS auditor observes that a single badge-controlled door leads directly onto the server floor. Staff routinely hold the door open for colleagues carrying equipment, and no secondary barrier is present. What should the IS auditor do FIRST?

A. Recommend installing a mantrap or turnstile to physically eliminate the tailgating exposure at the entrance. B. Assess whether compensating controls adequately mitigate the tailgating risk. C. Report the badge access system as an ineffective physical security control. D. Test whether badges are promptly deactivated for terminated employees.

Question 2

A healthcare provider's data center relies on smoke detectors and a water-based sprinkler system for fire protection. An IS auditor reviewing environmental controls notes the room houses live electrical equipment and storage arrays supporting patient systems, and no alternative suppression method is available. Which finding is MOST significant?

A. The sprinkler system could discharge water onto energized equipment during a fire. B. Smoke detectors are not integrated with the central building fire alarm and monitoring panel. C. Portable fire extinguishers on the server floor are inspected only once annually. D. Detector placement was not formally documented in the facilities environmental plan.

Question 3

An IS auditor is evaluating access controls at a financial institution's secure server room, where management states that biometric readers provide strong assurance against unauthorized entry. The auditor must confirm the control operated effectively during the review period. Which piece of evidence would provide the BEST assurance that only authorized personnel entered the room?

A. The vendor specification sheet describing the biometric reader's rated accuracy and false-acceptance error rates. B. A signed policy requiring biometric authentication at the server room entrance. C. Reconciled biometric access logs matched against the authorized-personnel list. D. Interviews confirming that staff use their fingerprints to enter the room.

Question 4

A post-incident review at a government agency reveals that a server outage was caused by an air-conditioning failure that gradually raised the room temperature until equipment automatically shut down. The IS auditor is now assessing the adequacy of environmental monitoring. Which control would have BEST prevented the outage?

A. A logbook where facilities technicians manually record the room temperature reading each day. B. Automated temperature sensors that alert staff and trigger backup cooling. C. A maintenance contract requiring quarterly servicing of the HVAC units. D. Redundant network links to keep servers reachable during heat events.

Question 5

An IS auditor reviewing a retailer's data center notices that visitor access is recorded in a paper log kept at the reception desk. Several entries lack sign-out times, escorts are not consistently recorded, and no one reconciles the log afterward. Which recommendation is MOST appropriate to strengthen visitor accountability?

A. Replace the paper log with an electronic visitor system enforcing complete records. B. Require the receptionist to review the visitor log at the end of every working shift. C. Post signage reminding visitors to sign out when leaving the facility. D. Retain the paper logs for a longer period to support later review.

Question 6

During an audit of a manufacturing firm's server room, an IS auditor finds that an uninterruptible power supply protects the servers but no standby generator exists. Management acknowledges that regional power outages can last several hours during severe weather. Which conclusion is MOST appropriate based on the evidence?

A. Availability is adequately protected because the UPS already supports the servers. B. The absence of a generator is acceptable given that the servers are backed up regularly offsite. C. Power protection is sufficient because outages are infrequent in the area. D. Extended outages exceeding UPS runtime pose an unmitigated availability risk.

Question 7

An IS auditor evaluating a cloud provider's on-premises operations center reviews physical zoning across the site. Public reception, general office space, and the raised-floor server area all share the same badge credential with no differentiated access levels between zones. Which control weakness should the auditor rate as MOST significant?

A. Reception staff can badge into the general office areas outside their assigned function. B. A single credential grants server-floor access to every badge holder. C. Office employees can enter the reception area without a visitor escort. D. Badge credentials are not colour-coded according to employee department.

Question 8

A business continuity audit at an insurer identifies that the primary data center and its backup power fuel supply are both located in the same basement, which is prone to flooding. The IS auditor is assessing environmental resilience. What is the auditor's BEST course of action?

A. Recommend relocating the fuel supply above the identified flood level. B. Report the co-located data center and fuel supply as a single point of failure threatening power and site availability. C. Verify that flood sensors are installed throughout the basement area. D. Confirm the generator has been tested within the last twelve months.

Question 9

While auditing a bank's server room, an IS auditor reviews the water-leak detection and humidity monitoring installed beneath the raised floor. Management asks which environmental objective these particular controls primarily support for the information assets housed there. From an assurance perspective, which response is MOST accurate?

A. They enforce accountability by logging who accessed the raised-floor space. B. They ensure confidentiality by preventing the unauthorized viewing of stored data. C. They preserve integrity by validating that stored records are not altered. D. They protect availability by detecting conditions that could damage equipment.

Question 10

An IS auditor performing an outsourced facilities review finds that CCTV cameras cover the data center entrance, but recorded footage is automatically overwritten every 48 hours and no one reviews the associated alerts. Which finding should the auditor consider MOST significant when reporting on physical security?

A. The short retention period may destroy footage before incidents can be detected and investigated. B. Camera housings are not tamper-resistant against physical interference. C. Signage informing staff of CCTV monitoring is absent at the entrance. D. Recorded footage is stored on the same rack the cameras monitor.

Related Posts

Leave a Comment Cancel Reply