CISA Domain 4A-3 Practice Test 002

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain A-3 (Job Scheduling and Production Process Automation) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4A-3 Job Scheduling and Production Process Automation Practice Test 002

10 questions • Single best answer

Question 1

A regional hospital system recently moved its production job scheduling to a cloud-hosted orchestration service run by a third-party provider. During the external IS audit, the auditor learns that provider staff can modify job definitions, but the hospital receives no notification or report of those changes. What should the IS auditor do FIRST?

A. Recommend that the hospital move job scheduling back to an on-premises platform. B. Review the service agreement and provider assurance reports for change control coverage. C. Test a sample of job definitions to confirm they match approved configurations. D. Recommend that the hospital obtain quarterly change attestations from the provider's staff.

Question 2

An IS auditor at a credit union is evaluating whether critical end-of-day processing jobs completed successfully throughout the audit period. Operations staff provide a signed monthly memo stating that all critical jobs ran without exception. Which of the following would provide the BEST evidence of job completion?

A. Interviews with the operators who monitored each overnight batch processing cycle. B. The operations manager's monthly memo countersigned by the IT director. C. The documented production schedule showing job dependencies and run times. D. Scheduler logs showing system-generated completion codes for each job run.

Question 3

During an audit of a manufacturing company's ERP batch environment, an IS auditor reviews scheduler configuration, operator logs, and job documentation. Several observations are documented, and management has limited time and staff to remediate issues before the year-end financial close. Which finding is MOST significant?

A. Operators can force-complete failed jobs without approval, releasing dependent jobs. B. Documentation for several low-volume reporting jobs has not been updated in two years. C. The scheduler console session times out after thirty minutes rather than fifteen. D. Rerun procedures are stored on a shared drive rather than in the runbook tool.

Question 4

A telecommunications company uses unattended software bots to post customer credits in its billing system. The IS auditor finds that IT created the bot credentials and schedules, but no business unit has accepted responsibility for bot outputs or exception handling. Which recommendation is MOST appropriate?

A. Transfer bot credential management to the information security team for oversight. B. Have internal audit review bot-posted credits monthly until ownership is resolved. C. Assign a business process owner accountable for bot outputs, exceptions, and access. D. Require the IT developers who built the bots to approve every customer credit they post.

Question 5

An IS auditor at a state revenue agency must determine whether only authorized changes were made to production job schedules during the fiscal year. The scheduler keeps a complete audit trail of job definition changes, and the change management system records approved tickets. Which testing approach provides the BEST assurance?

A. Extract all scheduler definition changes and trace each one to an approved ticket. B. Select a sample of approved tickets and confirm each was implemented in the scheduler. C. Review change advisory board minutes for discussion of scheduling-related changes. D. Interview the scheduling team lead about how schedule changes are implemented.

Question 6

An audit manager at an insurance company is planning a review of production process automation. The company runs over 4,000 scheduled jobs across claims, billing, and reporting, and the engagement is limited to three weeks of fieldwork. How should the audit manager BEST scope the testing of job scheduling controls?

A. Select a random statistical sample of jobs across all business areas for testing. B. Focus testing on jobs added to the schedule during the audit period only. C. Review scheduler configuration settings and exclude job-level controls entirely. D. Prioritize jobs that support financially significant or regulated processes.

Question 7

During a review at a pension fund administrator, an IS auditor finds that the monthly benefit calculation job was rerun twice after abnormal terminations. Rerun logs show operators restarted the job from the beginning without restoring input files, and no reconciliation of output totals was performed. Which conclusion is MOST appropriate?

A. Rerun controls are effective because the job ultimately ended with a successful status. B. Benefit payments may be duplicated or misstated since restart integrity was unverified. C. The scheduling tool is unreliable and should be replaced with a more stable product. D. Operators lack adequate training, which is the root cause of the abnormal terminations.

Question 8

A retail bank's IS auditor observes that production control staff can both create job definitions and execute jobs in the enterprise scheduler. Management states that compensating controls exist but cannot describe them in detail. Which control would provide the BEST assurance that unauthorized jobs are not executed?

A. Quarterly management review of production control staff activity reports. B. Annual recertification of access rights for all users of the scheduling tool. C. Independent daily comparison of executed jobs against the approved schedule. D. Automated alerts to operators when a job fails or exceeds its expected runtime.

Question 9

A prior audit at a logistics company reported that dependency failures caused shipping invoices to be generated before rate tables were updated. Management has reported the issue as closed after adding dependency rules to the job scheduler. During follow-up, what is the IS auditor's BEST course of action?

A. Accept closure because the IT steering committee approved the remediation plan. B. Review the updated scheduler documentation describing the new dependency rules. C. Keep the finding open until an external firm certifies the scheduler configuration. D. Verify the rules in the scheduler and review later invoice runs for correct sequencing.

Question 10

A government benefits agency automated its nightly eligibility updates using a workload automation tool. The IS auditor finds that job failure alerts are routed to a shared mailbox that is not monitored on weekends, and two weekend failures delayed citizen payments. Which recommendation is MOST appropriate?

A. Route critical job alerts to an on-call escalation process with defined response times. B. Reschedule all critical eligibility jobs to run only on weekdays during staffed business hours. C. Require the vendor to guarantee that the automation tool will not fail on weekends. D. Extend the shared mailbox retention period so weekend alerts are not lost or purged.

Related Posts

Leave a Comment Cancel Reply