CISA Domain 2A-4 Practice Test 002

This practice test covers Domain 2 (Governance & Management of IT) Subdomain A-4 (Enterprise Architecture and Considerations) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 2A-4 Enterprise Architecture and Considerations Practice Test 002

10 questions • Single best answer

Question 1

A pharmaceutical manufacturer established an architecture review board (ARB) to approve new technology initiatives. The IS auditor finds the ARB consists solely of infrastructure engineers, meets only when the CIO requests it, and several business-funded platforms were deployed without any architecture review. Which recommendation is MOST appropriate?

A. Require all project managers to complete architecture training before initiating new technology projects B. Expand ARB membership to include security, network, and data architecture specialists from IT C. Formalize the ARB charter with business representation, a fixed cadence, and mandatory review gates D. Transfer architecture approval authority for business-funded initiatives to the project management office

Question 2

During an audit of a university hospital's enterprise architecture program, the IS auditor wants to verify that the documented current-state architecture accurately reflects the production environment. The architecture team last updated the EA repository eight months ago, and several infrastructure changes have occurred since. Which of the following provides the BEST evidence?

A. Reconciliation of the EA repository against CMDB records and automated network discovery results B. Written confirmation from the enterprise architect that the repository is fully maintained and current C. Review of the EA repository change log showing recent updates entered by architecture staff D. Interviews with application owners describing the systems that support their business processes

Question 3

An IS auditor is planning a periodic review to determine whether a manufacturing company's enterprise architecture remains aligned with organizational objectives. The board of directors recently approved a five-year strategy emphasizing direct-to-consumer digital sales and new subscription-based service offerings. What should the IS auditor do FIRST?

A. Evaluate the EA modeling tools used to document the current-state and target-state architectures B. Test whether recent technology projects obtained architecture review board approval before funding C. Benchmark the company's EA framework against TOGAF and other recognized industry reference models D. Obtain the new business strategy and identify the key capabilities it requires from technology

Question 4

A cloud migration review at a regional credit union finds that the target-state architecture was approved without a transition roadmap. Business units are migrating their applications independently, and several legacy integrations still depend on a shared middleware platform nearing end of support. Which risk is MOST significant from an enterprise architecture perspective?

A. Cloud hosting and subscription costs may exceed the board-approved migration budget B. Uncoordinated migrations may disrupt critical dependencies between business systems C. Business units may contract with cloud vendors not on the approved supplier list D. IT staff may lack the skills needed to administer and secure cloud-native services

Question 5

A government revenue agency's enterprise architecture function reports to the infrastructure manager, and its architecture principles have never been endorsed outside the IT department. The IS auditor notes that business divisions routinely bypass EA standards when sourcing applications. Who should approve the architecture principles to BEST ensure their enforceability?

A. An executive steering committee including senior business and IT leadership B. The chief information officer acting on the advice of the enterprise architect C. The enterprise architecture team as the designated architecture subject-matter experts D. The chief information security officer, given the security implications of the principles

Question 6

A retail bank's digital team plans to deploy a generative AI platform that will integrate with customer data stores. The current enterprise architecture standards do not address AI components, and the project sponsor has asked the architecture office for an exception to proceed. What is the IS auditor's BEST course of action?

A. Recommend halting the project until the EA standards are fully revised to address AI technologies B. Approve the exception, since the current standards do not explicitly prohibit AI platforms C. Recommend a formal architecture risk assessment and a time-bound exception with defined conditions D. Advise the sponsor to proceed and address architecture alignment later in the post-implementation review

Question 7

An audit manager reviews workpapers from an enterprise architecture audit at a state transportation department. The staff auditor concluded the EA is effective because a complete set of architecture artifacts exists in the repository and conforms to the department's adopted framework. What should the audit manager do regarding this conclusion?

A. Accept the conclusion, because framework conformance demonstrates an acceptable level of EA maturity B. Require evidence that the EA is actually used to guide investment and project decisions C. Request that the auditor re-perform the artifact inventory using a larger and more representative sample D. Recommend that the conclusion be validated by an independent external architecture consultant

Question 8

During an audit of an online marketplace's enterprise architecture, the IS auditor notes that application and technology layers are documented in detail. However, no enterprise data architecture exists, and customer records are defined and structured differently across the order, billing, and customer support systems. Which risk does this gap MOST directly create?

A. Increased licensing costs from duplicate database platforms across business units B. Slower application delivery due to a lack of reusable technology components C. Weakened network segmentation between customer-facing and back-office systems D. Inconsistent information used for business reporting and regulatory decisions

Question 9

An IS auditor is following up on a prior recommendation that a media company establish architecture compliance reviews for all new technology projects. Management reports the recommendation as implemented and provides the newly approved review procedure. What should the IS auditor do NEXT before concluding that the finding has been remediated?

A. Test a sample of recent projects for evidence that architecture compliance reviews occurred B. Obtain management's signed representation that the new procedure is being consistently followed C. Close the finding because the approved procedure directly addresses the original recommendation D. Interview the enterprise architect to confirm the new procedure was communicated to project teams

Question 10

A health insurer's target-state architecture replaces its on-premises claims and member systems with several SaaS applications. The IS auditor notes that the architecture defines required business capabilities in detail but does not address security, integration, or data residency requirements across the new platforms. Which recommendation is MOST appropriate?

A. Require every SaaS vendor to provide an independent SOC 2 Type 2 report before contract signing B. Defer SaaS adoption until an enterprise-wide cloud security policy has been formally approved C. Incorporate security, integration, and data residency requirements into the target-state architecture D. Assign the vendor management office to evaluate SaaS providers against the documented capabilities

Related Posts

Leave a Comment Cancel Reply