CISA Domain 5A-2 Practice Test 002

This practice test covers Domain 5 (Protection of Information Assets) Subdomain A-2 (Physical and Environmental Controls) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 5A-2 Physical and Environmental Controls Practice Test 002

10 questions • Single best answer

Question 1

A state university's research computing center houses clustered servers in a raised-floor room protected by a wet-pipe sprinkler system mounted directly above the equipment racks. Facilities staff explain that the system was selected because it was inexpensive and has never discharged accidentally. Which recommendation should the IS auditor make?

A. Replace the sprinkler system with a halon-based gas suppression system to avoid water damage B. Remove the sprinklers from the room and rely on additional portable carbon dioxide extinguishers C. Evaluate converting to a preaction system so pipes fill with water only after fire detection D. Retain the wet-pipe system and increase smoke detector testing to a monthly frequency

Question 2

An IS auditor at a regional hospital is testing whether physical access to the data center is restricted to authorized personnel. Management provides the access control policy and a list of approved badge holders signed by the IT director. Which of the following would provide the BEST evidence that the control is operating effectively?

A. Comparing badge system access logs for a sample period against the approved list and HR records B. Obtaining written confirmation from the IT director that the access list was reviewed during the year C. Observing the data center entrance for one afternoon to confirm that employees badge in D. Reviewing the access control policy for alignment with the hospital's information security standards

Question 3

During an audit of a government agency's primary data center, an IS auditor identifies several physical and environmental weaknesses. The agency processes benefit payments that must be issued within 24 hours, and the facility currently has no alternate processing site or reciprocal agreement. Which finding is MOST significant?

A. Visitor logs are retained for six months rather than the twelve months required by agency policy B. Fire extinguishers in the corridor outside the data center were last inspected fourteen months ago C. Closed-circuit television footage of the loading dock is overwritten every fourteen days D. The uninterruptible power supply has never been load tested and no backup generator is installed

Question 4

An IS auditor reviewing a logistics company's server room finds that temperature and humidity sensors send alerts to a shared mailbox. Alert history shows multiple high-temperature warnings during the past quarter with no recorded response, ticket, or follow-up by any team. What should the IS auditor do FIRST?

A. Recommend replacing the sensors with a building management system that performs automated shutdown B. Determine who is responsible for monitoring the mailbox and how alerts are escalated and resolved C. Report the condition to the audit committee as a critical control failure requiring immediate action D. Test the sensors to confirm that temperature thresholds are configured to vendor specifications

Question 5

A financial services firm installed a mantrap at its data center entrance after an unauthorized contractor followed an employee inside. During testing, an IS auditor observes that the interlock between the two doors has been disabled so both can open simultaneously, reducing delays during shift changes. Which conclusion is MOST appropriate?

A. The control no longer prevents tailgating, and its design objective has been defeated B. The control remains effective because both doors still require a valid badge to open C. The weakness is mitigated because cameras record all individuals entering the facility D. The change is acceptable because operational efficiency is a valid business justification

Question 6

A healthcare software-as-a-service provider hosts its production servers in a third-party colocation facility. While planning an audit of physical and environmental controls, the IS auditor learns that the provider's contract does not grant on-site inspection rights, and the colocation vendor has declined a site visit. Which approach is MOST appropriate?

A. Exclude physical controls from the audit scope because the colocation provider is responsible for them B. Rely on the SaaS provider's internal policy requiring vendors to maintain adequate physical security C. Obtain and evaluate an independent assurance report covering the facility's physical controls D. Request the colocation provider's floor plans, equipment inventory, and policies to confirm controls exist

Question 7

An internal audit of a manufacturing company finds that data center access reviews are performed by the facilities manager, who also administers the badge system and grants access. The CIO considers this efficient because the facilities manager knows all staff personally. Which recommendation is MOST appropriate?

A. Require the facilities manager to document each review with a signed attestation of completeness B. Increase the frequency of access reviews from quarterly to monthly to detect errors sooner C. Implement automated badge expiration so inactive access rights are removed after ninety days D. Assign periodic access reviews to the data center owner, who is independent of badge administration

Question 8

An IS auditor at an electric utility is assessing whether backup power will sustain the grid control center during an extended outage. Management provides monthly generator maintenance records showing oil changes, battery checks, and visual inspections, all completed on schedule by the vendor. Which additional procedure would provide the BEST assurance?

A. Interviewing the facilities supervisor about the generator's rated capacity, fuel supply, and runtime B. Reviewing results of periodic load tests that transferred the actual facility load to the generator C. Confirming that the generator vendor's maintenance contract includes four-hour emergency response D. Inspecting the generator enclosure to verify that it is physically secured and fire protected

Question 9

In a prior-year audit of an insurance company, the IS auditor reported that the server room lacked water detection beneath its raised floor. Management's response stated that sensors were installed in the second quarter. During follow-up, what should the IS auditor do to BEST confirm that the risk has been addressed?

A. Obtain the purchase order and installation invoice for the water detection sensors B. Accept management's written response and close the finding in the issue tracking system C. Verify sensor placement under the raised floor and test that alerts reach monitoring staff D. Review the updated facilities policy and procedures requiring water detection in equipment rooms

Question 10

A retail chain plans to relocate its primary data center to a leased building. The IS auditor reviewing site selection notes that the preferred location is in a designated flood zone, below ground level, and adjacent to a chemical storage warehouse. Which action is MOST appropriate for the IS auditor?

A. Advise management that site-related environmental risks should be assessed before finalizing the lease B. Recommend installing water detection sensors and raised flooring throughout the basement facility C. Recommend storing backup media at the new site to improve restoration speed after an incident D. Defer the review until construction is complete so that the installed controls can be tested

Related Posts