CISA Domain 5A-8 Practice Test 002

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-8 (Cloud and Virtualized Environments) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-8 Cloud and Virtualized Environments Practice Test 002

10 questions • Single best answer

Question 1

A mid-sized law firm moved its case management database to a cloud provider's managed PaaS database service. During an access control review, partners tell the IS auditor that database user provisioning is now the provider's responsibility. Several former associates still hold active database accounts. Which conclusion is MOST appropriate?

A. The provider is accountable because the PaaS contract transfers database administration B. The finding should be reported to the provider for remediation under the service agreement C. The firm retains responsibility for managing database user access under the shared model D. The risk is low because the provider's platform controls prevent unauthorized connections

Question 2

An IS auditor at an investment advisory firm is relying on a cloud provider's SOC 2 Type II report to assess controls over hosted client data. The report uses the carve-out method for the colocation company operating the provider's data centers. What should the IS auditor do FIRST?

A. Determine how assurance will be obtained over the carved-out subservice organization B. Conclude that physical controls are effective because the report opinion is unqualified C. Request the provider's permission to perform an on-site inspection of the data centers D. Exclude physical and environmental controls from the audit scope as not applicable

Question 3

A retail company uses a cloud security posture management tool to monitor its public cloud environment. An IS auditor reviews six months of alerts and finds that alerts for publicly accessible storage buckets were repeatedly closed as accepted without documented risk acceptance. Some buckets contained customer order files. Which finding is MOST significant?

A. The tool generated a high volume of low-priority alerts that slowed team triage B. Alert closure codes were not standardized across the cloud operations team C. The tool's licensing covered only production accounts and not development accounts D. Customer data was publicly exposed while alerts were dismissed without approval

Question 4

During an audit of a manufacturer's virtualized server environment, an IS auditor finds dozens of powered-off virtual machines and snapshots that have not been patched for over a year. Several snapshots contain cached administrator credentials and copies of production financial data. Which recommendation is MOST appropriate?

A. Patch all dormant virtual machines monthly during the regular maintenance cycle B. Implement a VM life cycle process with ownership, periodic review, and secure removal C. Encrypt the storage volumes on which dormant virtual machines and snapshots reside D. Move dormant virtual machines and snapshots to a lower-cost archival storage tier

Question 5

An IS auditor reviewing a university's private cloud discovers that the hypervisor management console is reachable from the general campus network used by students and staff. Access requires a username and password, and the console controls all virtual machines hosting student records and research data. Which risk is MOST significant?

A. Compromise of the console would grant control over every hosted virtual machine B. Students may experience slower network performance due to management traffic C. Virtual machine resource allocation may be inefficient across research departments D. Console login pages may display outdated branding and support contact information

Question 6

A regional insurer plans to move its policy administration system to a SaaS provider. While reviewing the draft contract during the planning phase, an IS auditor notes that it does not specify the format, timing, or cost of returning data when the agreement ends. Which risk does this omission MOST directly create?

A. Service availability may fall below the levels the business requires during operations B. The provider may process policyholder data in jurisdictions that are not approved C. The insurer may be unable to exit the service or migrate data without disruption D. The provider's staff may access policyholder records without the insurer's knowledge

Question 7

An IS auditor at a payment services company learns that the public cloud provider's control-plane audit logs are retained for the default 30 days. The company's incident response policy requires investigators to review account activity for up to one year, and regulators expect similar retention. Which conclusion is MOST appropriate?

A. Retention is adequate because the provider is responsible for preserving its logs B. Logging is deficient because retention does not support investigation requirements C. Retention is acceptable because events older than 30 days are rarely ever investigated D. Logging is adequate provided administrators review the logs on a weekly basis

Question 8

During an audit of a fintech startup's container platform, an IS auditor finds that developers pull base images directly from public registries and deploy them to production clusters. No step verifies image contents or vulnerabilities before deployment. Which control would provide the BEST assurance over this risk?

A. Requiring developers to attest that images come from reputable public sources B. Running quarterly external penetration tests against the production clusters C. Restarting all production containers weekly so they refresh from the public registries D. Using a trusted internal registry with automated scanning enforced in the pipeline

Question 9

A healthcare analytics company stores data for multiple hospital clients in a shared SaaS application. A hospital's IS auditor needs assurance that its patient data is logically segregated from other tenants' data. The vendor does not permit customer penetration testing. Which of the following is the BEST evidence?

A. The vendor's marketing materials describing its multitenant security architecture in detail B. A vendor questionnaire completed and signed by the vendor's security manager C. An independent assurance report that includes testing of tenant segregation controls D. Screenshots from the hospital's own account showing only its own patient records

Question 10

A government contractor uses customer-managed encryption keys in its public cloud environment to meet a contractual requirement for control over data. An IS auditor finds the keys are stored in the same cloud account as the data, and the cloud operations administrators can both access the data and schedule key deletion. Which finding is MOST significant?

A. Administrators combine data access with key deletion rights, defeating separation of duties B. Key rotation intervals are set to the provider default rather than a custom period C. The provider's key management service is located in the same geographic region D. Key usage logs are reviewed monthly rather than continuously by the security team

Related Posts