CISA Domain 2A-3 Practice Test 002

This practice test covers Domain 2 (Governance & Management of IT) Subdomain A-3 (IT Policies, Standards, Procedures and Practices) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 2A-3 IT Policies, Standards, Procedures and Practices Practice Test 002

10 questions • Single best answer

Question 1

An audit manager at a public university reviews the IT policy framework ahead of a system-wide governance audit. Sampling shows that IT managers routinely grant exceptions to the password and encryption standards by verbal approval, with no record of the business justification, risk assessment, or expiry date. Which finding is MOST significant?

A. Several standards have not been reviewed within the required annual cycle B. IT managers have not received formal training on the exception procedure C. Exceptions are not documented, risk-assessed, or subject to expiry and review D. The password standard is less restrictive than those used by peer universities in the region

Question 2

A regional hospital network is revising its information security policy after a merger. The CIO proposes that the IT steering committee approve the final policy so it can be issued quickly, and the IS auditor is asked to comment on the arrangement. Which approach provides the BEST governance assurance?

A. Approval by the board or senior management, with defined ownership and periodic review B. Approval by the IT steering committee, with the CISO accountable for monitoring compliance C. Approval by the CIO after legal and compliance teams confirm regulatory alignment D. Approval by the CISO, with the internal audit function validating policy content annually

Question 3

During an audit of a credit union's acceptable use policy, the IS auditor confirms that every employee signed an acknowledgment form at onboarding and that the policy is posted on the intranet. The auditor wants to determine whether staff actually understand the policy's key requirements. Which of the following is the BEST evidence?

A. The completed signed acknowledgment forms retained in each personnel file B. The HR onboarding checklist showing the policy was distributed to all new hires on day one C. Intranet access logs showing how often staff opened the policy document D. Results of interviews and scenario-based questions posed to sampled employees

Question 4

A payments processor becomes subject to a new data protection regulation that takes effect in six months and imposes new encryption, retention, and breach notification obligations. Internal audit is asked to evaluate whether the company's IT policies and standards will support compliance by the deadline. What should the IS auditor do FIRST?

A. Test whether existing access control standards are operating effectively B. Obtain the regulatory requirements and map them to current policies and standards C. Recommend that management rewrite the information security policy immediately to reflect the new rules D. Review how peer processors have updated their IT policy frameworks

Question 5

A multinational insurer's subsidiaries each develop and maintain their own IT policies with minimal oversight from group headquarters. An IS auditor finds that password length, data retention periods, and remote access requirements differ widely, and two subsidiaries have no documented patching standard. Which recommendation is MOST appropriate?

A. Establish a group-wide baseline policy set that subsidiaries may tighten but not weaken B. Require each subsidiary to benchmark its policies against a recognized industry framework C. Direct each subsidiary to adopt the most restrictive policy currently used in the group D. Assign the group CISO to approve every subsidiary procedure before it is issued

Question 6

A state agency's access management standard requires business owners to review user access to critical systems quarterly. Management asserts to the IS auditor that all reviews for the year were completed on time. Which of the following provides the BEST evidence that the standard is being followed?

A. A written confirmation from the CIO that all quarterly reviews were completed B. The access management standard showing the review frequency and responsibilities C. Sampled review records with owner sign-off, dates, and resulting access removals D. A walkthrough of the review procedure performed with the identity management team

Question 7

During a review of a telecom provider's change management procedures, the IS auditor observes that operations staff require two independent approvals for emergency changes. Management confirms this practice was deliberately adopted after a major outage, but the documented procedure, last updated three years ago, still requires only one approval. What is the IS auditor's BEST course of action?

A. Conclude that no finding exists because actual practice is stronger than the documented requirement B. Report a control failure because staff are not following the documented procedure C. Expand testing to determine whether the two-approval step delays emergency fixes D. Recommend that management update the documented procedure to reflect current practice

Question 8

A newly appointed CISO at a retail chain asks the internal IS auditor to write the company's new cloud security standard, citing the auditor's expertise and a tight regulatory deadline. The auditor is scheduled to audit cloud security controls next year. What is the MOST appropriate response?

A. Draft the standard but ask a different audit team member to perform next year's audit B. Offer advisory input on the draft while management retains authorship and approval C. Decline any involvement until the cloud security audit has been completed D. Draft the standard and disclose the involvement in next year's audit report

Question 9

A pharmaceutical company's encryption standard requires all laptops to use full-disk encryption. Management formally accepted the risk of leaving 40 legacy laboratory devices unencrypted because vendor software is incompatible, and during follow-up the IS auditor must determine whether this deviation is being properly governed. What should the auditor verify FIRST?

A. Whether the laboratory devices can be replaced within the current budget cycle B. Whether the encryption standard should be revised to exclude laboratory devices C. Whether the risk acceptance was approved at the appropriate authority level D. Whether the legacy devices contain regulated data subject to breach notification

Question 10

An energy utility's board receives a quarterly dashboard showing 98 percent compliance with IT policies. The IS auditor learns that the figures come entirely from self-assessment questionnaires completed by the IT managers responsible for each area, and no one independently checks the results before they are reported. Which recommendation is MOST appropriate?

A. Introduce independent validation of a sample of self-assessed compliance results B. Require IT managers to attach supporting evidence to every questionnaire response C. Replace the self-assessments with an annual compliance audit by internal audit D. Expand the questionnaire to cover every policy statement in the IT framework

Related Posts

Leave a Comment Cancel Reply