CISA Domain 5A-8 Practice Test 001

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-8 (Cloud and Virtualized Environments) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-8 Cloud and Virtualized Environments Practice Test 001

10 questions • Single best answer

Question 1

During an audit of a financial services firm that recently migrated core workloads to a public cloud IaaS platform, the IS auditor finds the internal security team assumes the provider is responsible for hardening the guest operating systems and patching applications on provisioned virtual machines. Which action should the auditor recommend FIRST?

A. Require the provider to furnish an independent SOC 2 Type II assurance report. B. Review the provider's shared responsibility model to confirm which security controls each party owns. C. Encrypt all virtual machine storage volumes using customer-managed encryption keys. D. Deploy a cloud access security broker to inspect traffic reaching the platform.

Question 2

A healthcare organization outsources its patient scheduling system to a SaaS provider hosted in a multi-tenant cloud environment. Management cannot grant the IS auditor direct access to the provider's data centers or infrastructure. Which of the following provides the BEST assurance over the operating effectiveness of the provider's controls?

A. A SOC 2 Type II report covering the relevant trust services criteria. B. A SOC 2 Type I report issued as of the contract signing date. C. The provider's self-assessment questionnaire completed by its security team. D. Contractual clauses that require the provider to maintain adequate controls.

Question 3

During an audit of a government agency's virtualized server infrastructure, the IS auditor examines how the hypervisor hosting dozens of guest virtual machines of differing sensitivity levels is administered and secured. The same administrator team manages production and test guests on shared hosts. Which observation would be the MOST significant finding?

A. Guest virtual machines are not labeled with a standardized naming convention. B. Some low-sensitivity test guests run outdated versions of the guest operating system. C. Hypervisor administrative access is not restricted or logged, allowing unmonitored control of all guests. D. Virtual machine snapshots are retained for thirty days before automatic deletion.

Question 4

An IS auditor reviewing an enterprise's private cloud discovers that business units can self-provision virtual machines on demand, and the number of running instances has grown far beyond what the configuration management database records. Many instances have no identifiable owner. Which recommendation is MOST appropriate?

A. Disable self-service provisioning entirely and route every virtual machine request through the central IT help desk for manual approval. B. Increase the capacity of the underlying physical hosts to accommodate the growth. C. Delete all virtual machines that lack an assigned owner in the inventory. D. Establish a formal provisioning and decommissioning process with periodic reconciliation to the CMDB.

Question 5

A multinational bank's IS auditor is reviewing a contract with a public cloud provider. Regulations require that certain customer data remain within the country of origin. The provider replicates data across global regions for resilience and disaster recovery purposes. What should the auditor do FIRST?

A. Require the provider to encrypt all replicated data using customer-managed keys and store additional copies within the country of origin. B. Determine which regions store and process the regulated data under the contract terms. C. Recommend terminating the contract and selecting a domestic cloud provider. D. Conclude that the replication arrangement violates the data residency requirement.

Question 6

During a cloud security audit, the IS auditor finds that several administrators access the organization's cloud management console over the public internet using only a username and password. The console can create, modify, and delete production virtual machines. Which control provides the BEST assurance against unauthorized administrative access?

A. Require administrators to change their console passwords every thirty days. B. Restrict console access to a documented range of corporate IP addresses. C. Enforce multi-factor authentication for all administrative console logins. D. Log all administrative actions performed within the cloud console.

Question 7

A healthcare provider encrypts patient data stored in a public cloud, but the IS auditor learns that the cloud provider both stores the ciphertext and manages the encryption keys within the same environment. Management believes the data is adequately protected. Which conclusion is MOST appropriate?

A. Provider control of both keys and ciphertext weakens segregation and warrants customer-managed keys. B. The arrangement is acceptable because the sensitive patient data is already encrypted at rest within the provider's managed environment. C. Encryption is unnecessary because the provider already restricts physical access. D. The provider should rotate the encryption keys more frequently to reduce risk.

Question 8

An IS auditor reviews the service level agreement between an enterprise and its SaaS provider for a business-critical application. The agreement guarantees system availability but is silent on the provider's obligations if the contract is terminated or the provider ceases operations. Which finding is MOST significant?

A. The agreement does not specify financial penalties for missed availability targets. B. The availability guarantee is expressed as a monthly rather than annual percentage. C. The agreement does not require the provider to notify of planned maintenance. D. The agreement does not address data return and portability upon contract exit.

Question 9

During an audit of a company's cloud-native platform, the IS auditor observes that development teams deploy application containers from images pulled directly from public, untrusted registries into the production environment. No vulnerability scanning or security approval occurs before deployment. What should the auditor recommend FIRST?

A. Require developers to document each container image in the asset inventory. B. Migrate all container workloads onto dedicated physical hosts for isolation. C. Establish an approved image registry with mandatory vulnerability scanning before deployment. D. Restrict container deployment privileges to the operations team only.

Question 10

An organization is negotiating to move its ERP system to a public multi-tenant cloud. The IS auditor is asked to advise management on assurance provisions in the contract. Which provision would BEST enable ongoing independent assurance over the provider's control environment throughout the engagement term?

A. A clause requiring the provider to notify the customer of any security breach. B. A clause granting the right to obtain the provider's periodic independent audit reports. C. A clause obligating the provider to encrypt all customer data at rest. D. A clause allowing the customer to terminate the contract for convenience.

Related Posts

Leave a Comment Cancel Reply