CISA Domain 4A-5 Practice Test 002

This practice test covers Domain 4 (Information Systems Operations & Business Resilience) Subdomain A-5 (Shadow IT and End-User Computing) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 4A-5 Shadow IT and End-User Computing Practice Test 002

10 questions • Single best answer

Question 1

A regional healthcare network's pharmacy department uses a desktop database, built by a former pharmacist, to calculate pediatric dosage adjustments. The IS auditor learns that IT was unaware of the tool and that no documentation describes its calculation logic. What should the IS auditor do FIRST?

A. Recommend that IT migrate the database to a validated, centrally supported clinical platform. B. Assess the criticality of the tool and the impact of calculation errors on patient safety. C. Require the pharmacy department to document the database logic and obtain management sign-off. D. Test a sample of recent dosage calculations against independently computed results.

Question 2

An IS auditor at a commercial bank is evaluating a spreadsheet that calculates the allowance for credit losses reported in quarterly financial statements. Management states that the spreadsheet cannot be replaced by a controlled application before year-end. Which compensating control provides the BEST assurance over the integrity of the reported results?

A. Password protection on the workbook, with the password known only to the spreadsheet owner. B. Monthly backups of the spreadsheet to a restricted network share with version history retained. C. An annual attestation by the owner that no formulas were changed without documented approval. D. Quarterly independent review that reconciles outputs to source ledgers and recalculates key formulas.

Question 3

A government agency's CIO asserts that shadow IT has been eliminated after a survey asked staff to self-report any unapproved applications. The IS auditor has been asked to validate management's conclusion before it is reported to the oversight committee. Which of the following provides the BEST evidence to support or refute the CIO's assertion?

A. Analysis of proxy, firewall, and cloud access security broker logs for traffic to unsanctioned services. B. Survey responses signed by each department head confirming that no unapproved applications remain. C. The IT-approved software catalog, reconciled to current license purchase and renewal records. D. Interviews with a judgmental sample of employees about the applications used in their daily work.

Question 4

During an audit of end-user computing at an insurance company, the IS auditor identifies four spreadsheets that are not subject to formal change control. Each spreadsheet is maintained by a single analyst in the claims department. Which of these spreadsheets represents the MOST significant finding?

A. A tracker that monitors adjuster workloads and is used to balance weekly case assignments. B. A model actuaries use to test alternative pricing assumptions for products still in development. C. A workbook that calculates claims reserve amounts posted directly to the general ledger monthly. D. A dashboard summarizing complaint volumes that is presented at monthly management meetings.

Question 5

A manufacturing company is drafting an end-user computing policy after an audit found hundreds of undocumented spreadsheets and scripts in finance and operations. Management asks the IS auditor who should be accountable for ensuring that each critical EUC application is adequately controlled. Which response is MOST appropriate?

A. The IT department, because it has the technical expertise to secure and maintain the applications. B. The business owner of the supported process, with IT defining standards and providing support. C. Internal audit, because it independently identifies EUC risks and evaluates the related controls. D. The individual developer of each application, because they best understand its design and logic.

Question 6

A university's administrative staff have built more than sixty automated workflows on an enterprise-licensed low-code platform. An IS auditor finds that several of these workflows write financial aid award data directly into the student information system without any IT involvement or review. Which recommendation is MOST appropriate?

A. Establish risk-tiered governance requiring IT review and change control for workflows that update systems of record. B. Suspend the platform until the IT development team rebuilds every workflow under the standard development life cycle. C. Require all workflow creators to complete platform training and certify that their workflows function as intended. D. Restrict platform licenses to IT personnel so business users must request new workflows through the service desk.

Question 7

An IS auditor is planning an audit of end-user computing at a pharmaceutical distributor that relies on more than four hundred business-developed spreadsheets and databases. Available audit resources allow detailed testing of only a limited number of these applications. Which approach is MOST appropriate for selecting the applications to test?

A. Select a random statistical sample so that every application has an equal chance of selection. B. Test the applications with the largest file sizes, since complexity generally increases with size. C. Focus on the applications created most recently, as they are least likely to have been reviewed. D. Prioritize applications using a ranking of their financial, regulatory, and operational impact.

Question 8

A follow-up audit at a utility company examines a new control requiring that changes to critical spreadsheets be logged and approved by a supervisor. The spreadsheet owner provides a change log showing twelve approved changes during the quarter. What should the IS auditor do NEXT to determine whether the control is operating effectively?

A. Obtain written confirmation from the supervisor that each logged change was reviewed and approved. B. Review the EUC policy to confirm that the change log format satisfies the documented requirements. C. Compare file version history and metadata to the log to identify changes that were never recorded. D. Re-perform the twelve logged changes in a test copy to confirm that they produce expected results.

Question 9

A law firm's IT risk review reveals that attorneys have been pasting client documents into a publicly available generative AI service to draft case summaries. The service has not been approved, and its terms of use permit the provider to retain submitted content. Which risk should the IS auditor consider MOST significant?

A. Unauthorized disclosure of confidential client information to a third party outside the firm's control. B. Inaccurate summaries being relied upon by attorneys without adequate professional review of output. C. Growth in unbudgeted subscription costs as the unapproved service spreads across practice groups. D. Lack of integration between the service and the firm's document management and retention systems.

Question 10

A retail company's IS auditor finds that a regional sales team adopted an unapproved SaaS CRM that holds customer purchase histories. After the finding was raised, management enforced SSO with MFA, obtained a signed data processing agreement, and began quarterly access reviews. Which conclusion is MOST appropriate based on this evidence?

A. The tool must be decommissioned, because unapproved applications violate policy regardless of any controls applied. B. The controls reduce access risk, but the tool should still undergo formal vendor risk and data governance review. C. The risk is fully mitigated, because the implemented controls match those required for sanctioned applications. D. No further action is needed, because the data processing agreement transfers accountability for the data to the vendor.

Related Posts

Leave a Comment Cancel Reply