CISA Domain 4A-2 Practice Test 002

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain A-2 (IT Asset Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4A-2 IT Asset Management Practice Test 002

10 questions • Single best answer

Question 1

An internal audit manager at a public university is scoping a review of IT asset management. Research departments buy laptops and lab servers with grant funds using purchasing cards, and these devices are never recorded in the central IT asset inventory. Which risk should the audit manager consider MOST significant when planning the audit?

A. Grant-funded devices may be depreciated incorrectly in the university's financial statements. B. Purchasing card transactions may exceed approved departmental spending limits for equipment. C. Unrecorded devices may hold sensitive research data without patching or security oversight. D. Central IT may be unable to negotiate volume discounts on future hardware purchases.

Question 2

During an audit of a manufacturing company, an IS auditor learns that the configuration management database is populated by automated discovery, while the IT asset register is updated manually by procurement. The two records report different numbers of production servers. What should the IS auditor do FIRST?

A. Reconcile a sample of discrepancies to determine their cause and whether assets are unmanaged. B. Recommend that the CMDB replace the manually maintained asset register as the authoritative record. C. Report the discrepancy to the audit committee as a significant control deficiency. D. Request that procurement update the asset register to match the discovery results.

Question 3

A health insurer allows employees and contractors to access its claims systems from personally owned smartphones. During fieldwork, an IS auditor finds that these devices are not tracked in any inventory, and the organization cannot identify which devices hold cached member data. Which recommendation is MOST appropriate?

A. Prohibit personally owned devices from connecting to any corporate system effective immediately. B. Require employees to sign an annual acceptable use agreement covering member data. C. Record personally owned devices in the fixed-asset ledger maintained by finance. D. Enroll the devices in mobile device management to register them and enforce controls.

Question 4

An IS auditor at a logistics firm reviews software asset management for a database product licensed per physical processor core. The infrastructure team recently moved the database to a large virtualized cluster, and license entitlements were not reassessed. Which evidence would BEST help the auditor determine the organization's compliance exposure?

A. The signed master license agreement and the most recent vendor invoice. B. Cluster host configuration data compared with the licensing terms for virtual deployments. C. A management representation letter stating that licensing remains compliant. D. The software asset management policy approved by the chief information officer.

Question 5

At lease end, a government agency returns retired laptops to the leasing company through the lessor's courier. An IS auditor finds that IT staff reset each device to factory settings but do not verify or document data sanitization before handover. Which finding should the auditor consider MOST significant?

A. Sensitive data may remain on returned drives without any evidence of sanitization. B. Lease-end dates are not tracked, potentially resulting in late return penalties. C. The courier does not sign a chain-of-custody form when collecting the laptops. D. Factory resets are performed by internal IT staff rather than by a certified disposal vendor.

Question 6

An audit manager reviewing an energy utility's IT asset register notes that assets are recorded with serial numbers and locations, but no business owner or criticality rating is assigned. The utility relies on the register to prioritize patching and recovery activities. Which conclusion is MOST appropriate?

A. The register is adequate because it supports physical existence testing of assets. B. The register should be replaced with an automated network discovery tool. C. The register cannot reliably support risk-based prioritization of protection efforts. D. The register is deficient mainly because it lacks depreciation schedules and acquisition cost data.

Question 7

A retail chain's business units subscribe to several software-as-a-service applications using corporate credit cards without involving IT. During an IT asset management audit, the IS auditor finds these subscriptions are absent from the asset inventory and license records. What is the auditor's BEST course of action?

A. Recommend blocking all SaaS domains at the corporate firewall until each is approved. B. Exclude the subscriptions from scope because they are not physical IT assets. C. Ask the business units to confirm that vendor contracts include security clauses. D. Analyze expense and network data to identify subscriptions and assess inventory gaps.

Question 8

An IS auditor is evaluating how a regional bank's IT management monitors its asset management process. The quarterly report presents the total number of assets owned and year-to-date hardware spending, and it is reviewed by the IT steering committee. Which additional metric would BEST indicate whether the asset inventory is reliable?

A. Percentage of discovered network devices matched to records in the asset register. B. Average age of end-user computing devices deployed across all of the bank's branch locations. C. Number of asset purchase orders processed by procurement during each quarter. D. Percentage of hardware purchased under preferred vendor pricing agreements.

Question 9

A law firm's HR system triggers account deactivation when staff leave, but laptops and encrypted USB drives are collected only when managers remember to request them. An IS auditor comparing termination records to the asset register finds several departed employees still assigned devices. Which control would BEST address this issue?

A. Quarterly physical inventory counts of all end-user devices performed by office staff. B. An offboarding workflow requiring asset return confirmation before final clearance. C. Remote wipe capability enabled on all laptops issued to fee-earning legal staff. D. Annual attestation from managers that their staff hold only assigned devices.

Question 10

After acquiring a smaller competitor, a pharmaceutical company plans to integrate the acquired firm's IT assets into its enterprise asset register. The chief audit executive asks the IS auditor to provide assurance on the integration. Which approach would provide the BEST assurance that acquired assets are completely captured?

A. Review the acquired firm's latest asset register and confirm it was formally approved. B. Obtain written confirmation of asset totals from the acquired firm's former IT manager. C. Perform network discovery and physical verification at acquired sites against the register. D. Compare the purchase agreement's asset schedule to the acquired firm's fixed-asset ledger.

Related Posts

Leave a Comment Cancel Reply