CISA Domain 1B-5 Practice Test 002

This practice test covers Domain 1 (Information Systems Auditing Process) Subdomain B-5 (Reporting and Communication Techniques) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 1B-5 Reporting and Communication Techniques Practice Test 002

10 questions • Single best answer

Question 1

A regional credit union's internal audit team holds a closing meeting on its online banking access review. The IT director disputes a finding on excessive privileged accounts, stating that several accounts were disabled before fieldwork ended and providing a screenshot as support. What should the IS auditor do FIRST?

A. Remove the finding from the draft report, since the IT director has shown the accounts are now disabled B. Issue the report as drafted and record the IT director's disagreement in the management response section C. Validate the new information against system records and assess whether it changes the finding's accuracy D. Escalate the disagreement to the audit committee chair before any further discussion with the IT director

Question 2

An IS auditor at a hospital network completes an audit of clinical application change controls and identifies a high-risk finding. Before the report is issued, the chief medical information officer asks that the finding be removed because remediation is already budgeted for next year. What is the auditor's BEST course of action?

A. Keep the finding in the report and include management's planned remediation and timeline in its response B. Remove the finding and document the planned remediation in the audit workpapers for later follow-up C. Downgrade the finding's risk rating to reflect that remediation funding has already been approved D. Defer issuing the report until the remediation project is completed next year and can be retested

Question 3

During an audit of a state revenue department's payment system, the IS auditor discovers that two terminated contractors still hold active administrator accounts, and logs show one account was used last week. Fieldwork is scheduled to continue for three more weeks. Which action is MOST appropriate?

A. Record the issue in the workpapers and include it as a high-priority finding in the final audit report B. Disable the two contractor accounts directly to contain the exposure while the audit continues C. Expand testing to all privileged accounts before informing anyone so the finding is fully substantiated D. Promptly notify appropriate management of the issue rather than waiting for the final audit report

Question 4

An audit manager at a global insurer is preparing the IS audit report on a claims platform migration for the board audit committee. Committee members have limited technical background and roughly ten minutes allotted for the item. Which content is MOST appropriate for the executive summary?

A. A complete list of technical exceptions identified, with configuration details and affected system names B. The overall conclusion and risk-rated key findings expressed in terms of their business impact C. A description of the audit methodology, sampling approach, and the testing procedures performed D. The detailed management action plans with owners and dates for every finding in the report

Question 5

An IS auditor reviewing a logistics company's patch management process finds that critical patches were missed on three separate occasions this year. Each time, the issue was traced to the absence of an owner assigned to track vendor security advisories. Which recommendation is MOST appropriate for the audit report?

A. Assign formal responsibility for monitoring vendor advisories and track patch status against defined timelines B. Apply all outstanding critical patches immediately and confirm deployment through a vulnerability scan C. Purchase an automated patch deployment tool to reduce the effort required to install critical patches D. Require the IT manager to report missed patches to the security committee at each monthly meeting

Question 6

Eight months after issuing a report on a pharmaceutical firm's laboratory data integrity controls, the IS auditor begins follow-up. The quality director provides a signed memo stating that all audit trail configuration weaknesses have been corrected. Which is the BEST evidence that the finding has been adequately addressed?

A. The signed memo from the quality director, supported by the change ticket numbers used to close the issues B. Minutes from the quality committee meeting at which management approved closing the remediation items C. The auditor's own reperformance of audit trail configuration tests on the affected laboratory systems D. A written confirmation from the system vendor that the latest software release enables audit trails

Question 7

An IS auditor at a fintech company is reviewing security logging for a payments application hosted by a third-party cloud provider. The provider declines to grant access to its infrastructure logs, and no independent assurance report is available. How should this be reflected in the audit report?

A. Report the absence of provider logs as a high-risk control deficiency owned by the fintech's security team B. Exclude the cloud-hosted components from the report since they fall outside the organization's control C. Issue an unqualified conclusion based on the application-level logs that the fintech itself was able to provide D. Disclose the scope limitation and explain its effect on the auditor's ability to reach an overall conclusion

Question 8

A telecommunications provider's management formally accepts the risk of an audit finding that offsite customer data backups are unencrypted, citing implementation cost. The IS auditor believes the residual risk exceeds the board-approved risk appetite and could trigger regulatory penalties. What should the IS auditor do NEXT?

A. Close the finding, because management has the authority to accept risk on behalf of the organization B. Communicate the matter to senior management and the audit committee for a risk acceptance decision C. Recommend a lower-cost compensating control and keep the finding open until management adopts it D. Report the unencrypted backups directly to the regulator given the potential for statutory penalties

Question 9

An IS auditor completes a penetration-test-supported review of a utility company's SCADA network and identifies several exploitable vulnerabilities. The draft report includes IP addresses, exploit steps, and screenshots. Management plans to share the report widely across operations. Which action is MOST appropriate before issuing it?

A. Remove the vulnerability findings from the report and communicate them verbally to the network team B. Delay issuing the report until management confirms that all identified vulnerabilities are remediated C. Restrict technical details to authorized recipients and summarize the related risks in the main report D. Issue the report as drafted, since management is responsible for controlling its internal distribution

Question 10

During an IS audit of a municipal government's permit system, the auditor identifies several low-risk observations, such as outdated version numbers on procedure documents. The audit charter permits flexibility in how minor issues are reported. How should the IS auditor MOST appropriately handle these observations?

A. Communicate them to process owners separately, such as in a management letter, and document it B. Include each observation as a formal finding in the audit report so that the report remains complete C. Omit them from all communications, since low-risk issues do not warrant management's attention D. Combine them into a single high-priority finding to encourage management to fix documentation issues

Related Posts

Leave a Comment Cancel Reply