CISA Domain 2A-6 Practice Test 002

This practice test covers Domain 2 (Governance & Management of IT) Subdomain A-6 (Privacy Program and Principles) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 2A-6 Privacy Program and Principles Practice Test 002

10 questions • Single best answer

Question 1

An IS auditor at a public university has been asked to evaluate the institution's newly approved privacy program. The university processes student records, applicant data, research participant information, and employee health data across several campuses and cloud platforms. What should the IS auditor do FIRST?

A. Review the privacy notices posted on the university's websites for clarity B. Identify the privacy laws and regulations that apply to the data processed C. Test access controls on the student information system for excessive rights D. Interview the privacy officer about the training delivered to staff this year

Question 2

A retail chain launched a customer loyalty application that collects purchase history and location data. During a post-implementation review, an IS auditor finds that the privacy impact assessment (PIA) was completed three weeks after go-live and identified several unaddressed risks. Which recommendation is MOST appropriate?

A. Require the privacy officer to approve all future loyalty program marketing campaigns B. Suspend collection of location data until the legal department completes a review C. Commission an external firm to repeat the PIA for the loyalty application D. Integrate the PIA into the project life cycle as a gate before design approval

Question 3

An IS auditor reviewing a logistics company's customer portal notes that users subscribing to a shipping-updates newsletter must provide their full date of birth, home address, and government ID number. Management states the data could be useful for future identity verification services. Which recommendation is MOST appropriate?

A. Limit collection to the data elements needed for the newsletter's stated purpose B. Encrypt the government ID numbers stored in the newsletter subscriber database C. Update the privacy notice to disclose possible future identity verification uses D. Restrict access to the subscriber database to the marketing team members only

Question 4

During an IT governance audit at a manufacturing firm, an IS auditor learns that privacy responsibilities have been informally assigned to the IT security manager. Business units decide independently how customer and employee personal data are used, and no privacy matters have been reported to senior management. Which finding is MOST significant?

A. The IT security manager has not obtained a professional privacy certification B. Business units have not documented their personal data processing activities C. No senior-level role is formally accountable for the privacy program D. Privacy incidents are not tracked in the IT service management tool

Question 5

A pharmaceutical company's retention schedule requires deletion of unsuccessful job applicants' personal data after 12 months. The HR director confirms that an automated monthly purge job in the recruiting system enforces this requirement. Which of the following provides the BEST evidence that the retention requirement is being met?

A. A query of the recruiting database showing no applicant records older than 12 months B. The approved retention schedule signed by the chief privacy officer and HR director C. The purge job configuration settings reviewed with the HR system administrator D. Written representation from the HR director that the purge job runs each month

Question 6

A healthcare billing company outsources payroll processing to a third-party provider that receives employee names, bank account details, and tax identifiers. An IS auditor finds that the service agreement covers pricing and uptime but contains no provisions on personal data handling. Which recommendation is MOST appropriate?

A. Obtain the provider's most recent independent assurance report on security controls B. Require the provider to complete an annual privacy self-assessment questionnaire C. Transfer payroll processing back in-house until a new provider can be selected D. Amend the contract to add data protection, breach notice, and audit right terms

Question 7

A commercial bank collects customer transaction data under a privacy notice stating it will be used for fraud detection. An IS auditor learns the analytics team is now using the same data to train a model that targets customers with personalized loan offers. Which issue is MOST significant?

A. The model has not been validated for accuracy by the model risk group B. The data is being used for a purpose not disclosed to customers C. The analytics team has not documented the model's input variables D. The fraud detection system and the model share one data warehouse

Question 8

An online marketplace must respond to customer requests to access or delete their personal data within 30 days of receipt. An IS auditor is designing tests to determine whether the data subject request process has operated effectively throughout the year. Which testing approach provides the BEST assurance?

A. Review the documented request procedure and compare it with regulatory requirements B. Submit a test request through the web portal and observe the response received C. Select a sample of logged requests and trace each to a timely, complete response D. Interview customer service staff about how they handle incoming privacy requests

Question 9

During a review of a state revenue agency, an IS auditor observes that developers routinely copy full production databases containing taxpayer names, addresses, and income details into test environments. These test environments have broader user access and weaker monitoring than production. Which recommendation is MOST appropriate?

A. Apply production-level access controls and monitoring to all test environments B. Require developers to sign confidentiality agreements before accessing test data C. Limit production data copies to test cycles approved by the change advisory board D. Mask or de-identify personal data before it is loaded into nonproduction systems

Question 10

A prior audit reported that a telecommunications provider's mobile app collected behavioral analytics data before users gave consent to tracking. Management now states that the consent mechanism has been reconfigured and asks that the finding be closed. What is the IS auditor's BEST course of action?

A. Test the app to verify that no analytics data is collected before consent is given B. Obtain the change ticket and approval records for the consent mechanism update C. Close the finding based on the written confirmation provided by management D. Review the updated privacy notice to confirm it describes the analytics collection

Related Posts

Leave a Comment Cancel Reply