CISA Domain 2B-4 Practice Test 002

This practice test covers Domain 2 (Governance & Management of IT) Subdomain B-4 (Quality Assurance and Quality Management of IT) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 2B-4 Quality Assurance and Quality Management of IT Practice Test 002

10 questions • Single best answer

Question 1

An external IS auditor engaged by a SaaS payroll provider tests the release quality gate, which requires QA sign-off before production deployment. In a sample of 40 releases, 12 sign-off records are timestamped after deployment, and developers state that reviews occurred informally beforehand. Which conclusion is MOST appropriate based on the evidence?

A. The quality gate is operating effectively because developers confirmed that reviews were performed before each release. B. The exceptions are low risk because none of the 12 releases was linked to a reported production incident. C. The quality gate is not operating as a preventive control, and the exceptions represent a control deficiency. D. No conclusion should be reached until the sample is expanded, because the deviation rate may be overstated.

Question 2

A mid-sized manufacturer is creating a formal IT quality assurance function and asks the IS auditor for guidance on where the function should report. Leadership wants QA reviews of development and operations deliverables to be objective and taken seriously. Which reporting arrangement BEST supports the effectiveness of the QA function?

A. Reporting to a manager independent of development and operations, with escalation rights to senior IT leadership. B. Reporting to the application development manager, so that reviewers stay close to the technical work they inspect. C. Reporting to the project management office, which sets delivery schedules and can enforce quality gates directly. D. Assigning QA reviews to internal audit, since auditors are already independent of IT development and operations.

Question 3

An IS auditor is planning an audit of the IT quality management program at a large private university. The IT department supports student records, research computing, and online learning platforms across several campuses. Which of the following should the IS auditor review FIRST to establish the audit criteria?

A. Defect logs and production incident trends for the major student and learning applications over the last year. B. Test scripts and test results for the most recent release of the student records system and learning platform. C. Survey results measuring student and faculty satisfaction with IT services and application reliability. D. The quality policy, objectives, and standards that management has formally approved for IT delivery.

Question 4

An e-commerce retailer's IT quality manager reports that defect density per release has fallen by 40% over four quarters, and the figure supports a bonus payout for the delivery teams. The IS auditor is asked to assess whether the metric is reliable. Which of the following provides the BEST evidence?

A. A signed management representation that the defect density metric was calculated consistently in each quarter. B. Recalculating the metric for sampled releases and reconciling defect records to related production incident tickets. C. The quality dashboard trend charts, which show a consistent quarterly decline across all of the delivery teams. D. An interview with the QA lead describing the counting rules and data sources used for the defect density metric.

Question 5

During a review of a new claims processing system at a health insurer, the IS auditor finds that performance, maintainability, and security requirements were never defined. Acceptance testing covered only functional features, and all functional tests passed. Which risk is MOST significant to the IS auditor?

A. The system may fail to meet operational quality expectations because no agreed baseline exists to test against. B. User acceptance testing may take longer than planned because business users must retest functional features. C. Project costs may exceed budget because developers will need to rework features that already passed testing. D. Developers may not have followed internal coding standards during construction of the claims processing modules.

Question 6

An IS auditor at an energy utility reviews the IT quality assurance function, which performs annual internal quality audits of change, release, and configuration management. Findings from the last two cycles remain open, have no assigned owners, and are not reported beyond the QA team. Which recommendation is MOST appropriate?

A. Increase the frequency of internal quality audits so that open findings are identified and revisited more often. B. Transfer responsibility for internal quality audits to internal audit, which has stronger reporting authority. C. Establish a corrective action process with assigned owners, target dates, and management tracking of findings. D. Expand the internal quality audit program with more detailed test steps for change and release management.

Question 7

A software developer that builds case management systems for public sector clients analyzes its defect data. Over 70% of defects are first detected in production, while most QA staff effort is concentrated in final system testing. Which recommendation would MOST effectively reduce the organization's cost of poor quality?

A. Add QA staff to final system testing so that more defects are detected before each production release. B. Extend the user acceptance testing period so that client users have more time to identify missed defects. C. Strengthen post-release incident response so that production defects are corrected more quickly by support staff. D. Introduce quality reviews and inspections at the requirements and design phases of the development life cycle.

Question 8

At a pharmaceutical company, the IT steering committee declares the QA team accountable for every defect that reaches production and ties QA bonuses to defect escape counts. Development managers are not measured on the quality of their deliverables. Which of the following should concern the IS auditor MOST?

A. The defect escape metric has not been benchmarked against industry data for comparable pharmaceutical IT functions. B. Accountability is misplaced, since delivery teams own the quality of their work while QA provides assurance. C. The bonus arrangement may raise operating costs for the QA function if defect escape targets are routinely achieved. D. Defect escape counts are reported to the steering committee but are not escalated to the board of directors.

Question 9

An IS auditor at a stock exchange evaluates whether peer code reviews required by the IT quality standard are effective rather than merely performed. Review records show 100% completion, each with a reviewer name and approval date. Which testing approach provides the BEST assurance over review effectiveness?

A. Confirming that each sampled review record contains the required reviewer approval, date, and change reference. B. Interviewing a sample of reviewers to understand how they assess code against the quality standard's criteria. C. Comparing review comments for sampled changes with defects later found in testing and production for that code. D. Examining the quality standard to confirm that it clearly defines code review criteria and reviewer qualifications.

Question 10

While auditing IT quality management at a hospital network, an IS auditor discovers that the QA manager raised the defect escape rate target from 2% to 8% midyear. The change was not approved by the IT steering committee, and year-end reports state the target was achieved. What is the IS auditor's BEST course of action?

A. Report the unapproved target change to senior management and evaluate performance against the approved target. B. Accept the revised target, because the QA manager is responsible for setting operational quality thresholds. C. Correct the year-end quality report directly so that it reflects performance against the original 2% target. D. Defer reporting the matter until the steering committee has had an opportunity to ratify the revised target.

Related Posts

Leave a Comment Cancel Reply