CISA Information Systems Operations practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

CISA Information Systems Operations and Business Resilience: 754 practice questions

CISA 754 questions 12 shown free

12 of the 754 Information Systems Operations and Business Resilience questions in the Certsqill CISA bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISA? Take the free 5-min readiness check →

1. An auditor-verified inventory matched to observed: Which evidence most strongly supports whether technology co

Hard
During a regional bank audit, management provides a technology inventory and a dashboard showing server uptime. The inventory identifies owners, locations, and dependencies. Which evidence most strongly supports whether technology components are controlled?
  1. A vendor brochure describing recommended infrastructure monitoring capabilities for banks.
    Generic vendor information does not evidence the bank’s implemented controls.
  2. A monthly uptime dashboard showing all critical servers exceeded target availability.
    Availability results do not establish complete component inventory or dependency control.
  3. A signed statement from the infrastructure director confirming inventory accuracy.
    Management representation is less persuasive than independently corroborated operational evidence.
  4. An auditor-verified inventory matched to observed components and recorded dependencies. ✓
    Verification links recorded components, ownership, and dependencies to actual technology.
The trap
Relies primarily on management assertion Uses generic capability information Confuses availability with component governance

Verified inventory evidence directly connects technology components with ownership and dependencies.

2. Undocumented sanitization of retired devices: Which control gap is most consequential?

Hard
A healthcare network is retiring laptops used for patient administration. Asset records show ownership and retirement dates, but eight retired devices lack documented media sanitization, while licenses were properly removed. Which control gap is most consequential?
  1. Failure to record retirement dates for devices with documented sanitization and license removal.
    Retirement dates are recorded, making this concern unsupported by evidence.
  2. Undocumented sanitization of retired devices. ✓
    Patient data could remain recoverable despite otherwise completed retirement activities.
  3. Incomplete documentation of license removal evidence.
    License evidence is complete, so this does not represent the stated gap.
  4. Missing ownership records for devices already retired and removed from service.
    Ownership records are stated as complete for the retired devices.
The trap
Invents a missing lifecycle record Contradicts supplied asset evidence Overlooks completed license control

Missing sanitization evidence creates the greatest residual exposure for retained patient data.

3. Examine dependency handling: What should the auditor do next to evaluate automated production controls?

Medium
For a public agency’s payroll batch, the auditor reviewed approved schedules, sampled successful runs, and examined documented exceptions. Those steps are complete. What should the auditor do next to evaluate automated production controls?
  1. Conclude scheduling controls are effective based on successful sampled runs.
    Successful runs do not test dependencies, restarts, or duplicate prevention.
  2. Examine dependency handling, restart controls, and duplicate prevention. ✓
    These procedures address critical batch risks not covered by completed testing.
  3. Replace the approved schedule with a manually supervised payroll process.
    Manual replacement is not justified without establishing a control deficiency.
  4. Ask management to accept the risk of untested batch failure scenarios.
    The auditor should obtain evidence rather than direct management risk acceptance.
The trap
Substitutes acceptance for audit work Introduces unnecessary process change Concludes from incomplete operating evidence

Next testing should address dependencies, restarts, and duplicate processing risks.

4. Recommend reconciliation and error handling in addition: How should the auditor evaluate this response?

Hard
An energy supplier’s interface transfers meter readings to billing. Monitoring shows encrypted transmissions and successful delivery messages, but no reconciliation compares source and destination totals. Management proposes stronger encryption only. How should the auditor evaluate this response?
  1. Accept it because encryption protects transmitted data.
    Encryption protects confidentiality but does not demonstrate completeness or accuracy.
  2. Recommend reconciliation and error handling in addition to encryption. ✓
    Independent reconciliation addresses missing, altered, sequenced, or duplicate records.
  3. Require disabling the interface until management implements encryption.
    Encryption already exists, while the unresolved gap concerns reconciliation.
  4. Conclude delivery messages prove every meter reading reached billing accurately.
    Delivery messages do not prove record completeness, accuracy, or duplicate prevention.
The trap
Confuses confidentiality with interface completeness Treats transport confirmation as data validation Targets an already implemented control

Encryption does not establish completeness; reconciliation and error handling remain necessary.

5. The population has control deficiencies requiring: How should the auditor interpret these results?

Medium
A telecommunications audit tested twelve business-critical spreadsheets outside formal IT inventory. All had identified owners, but five lacked version control, three allowed shared editing, and four had unreviewed formulas. How should the auditor interpret these results?
  1. The population has control deficiencies requiring proportionate oversight. ✓
    Results indicate insufficient safeguards over inventory, access, versioning, and formula integrity.
  2. Formal IT inventory is unnecessary because business users maintain these spreadsheets.
    Business-user tools still require proportionate inventory and control oversight.
  3. Ownership alone makes the spreadsheets acceptable.
    Ownership does not address versioning, access, or formula reliability risks.
  4. The results represent documentation weaknesses without substantive control concerns.
    Shared editing and unreviewed formulas can impair integrity and processing reliability.
The trap
Treats ownership as complete governance. Minimizes substantive spreadsheet risks. Exempts end-user computing without basis.

Ownership exists, but testing shows broader shadow-IT governance weaknesses affecting integrity.

6. Design appears suitable: What conclusion is best supported?

Easy
A research organization defines storage-capacity thresholds and assigns review responsibility. During the audit period, threshold alerts were generated, but no evidence shows management reviewed or acted on three alerts. What conclusion is best supported?
  1. Capacity controls are ineffective by design because thresholds exist.
    Thresholds and assigned responsibility may constitute an appropriate control design.
  2. Replace threshold monitoring immediately with load testing.
    Load testing may supplement monitoring but does not resolve missing review evidence.
  3. Design appears suitable; operation is unproven. ✓
    Defined thresholds support design, while missing review evidence prevents confirming operation.
  4. Availability is effective because testing found no outage.
    No outage does not demonstrate that capacity monitoring operated effectively.
The trap
Confuses operation with design. Uses outage absence as evidence. Prescribes an unsupported replacement.

Thresholds support design, but missing alert reviews prevent confirming operating effectiveness.

7. Require problem analysis and tracked corrective actions: What recommendation is most appropriate?

Hard
A distribution center experienced four similar warehouse-system outages in one quarter. Incident records document restoration times and communications, but no recurring-cause analysis or corrective action exists. What recommendation is most appropriate?
  1. Focus only on reducing the documented restoration times.
    Faster restoration does not address the repeated underlying failure pattern.
  2. Close the incidents because service was restored within targets.
    Meeting restoration targets does not eliminate the need for problem management.
  3. Transfer outage-risk acceptance to the auditor until recurrence stops.
    Management owns risk acceptance; auditors evaluate and recommend improvements.
  4. Require problem analysis and tracked corrective actions for recurring outages. ✓
    Repeated incidents require investigation of underlying causes beyond restoring service.
The trap
Treats restoration as complete resolution Optimizes recovery without addressing recurrence Assigns risk ownership to auditor

Recurring outages require problem management, not merely incident restoration and communication.

8. The conclusion is limited to servers: What limitation should the auditor report?

Medium
A transport operator’s patch report covers production servers and shows approval, testing, and rollback evidence for sampled changes. Network devices are excluded, and no documented compensating-control assessment exists. What limitation should the auditor report?
  1. The auditor should implement network-device patching before concluding.
    Auditors evaluate and recommend; management owns implementation of patch controls.
  2. The conclusion is limited to servers; enterprise-wide patch assurance is unsupported. ✓
    Excluded devices and unassessed compensating controls restrict the assurance conclusion.
  3. The server sample proves network devices receive equivalent patch governance.
    Evidence from servers cannot establish controls over excluded network devices.
  4. Patch controls are ineffective because rollback evidence was retained.
    Rollback evidence is a control strength, not evidence of ineffectiveness.
The trap
Extrapolates beyond audit scope Assigns implementation responsibility to auditor Misinterprets positive change evidence

Evidence supports sampled servers only; excluded network devices prevent enterprise-wide assurance.

9. Management sets requirements: During the audit, who holds decision rights for defining logging requirements an

Medium
An outsourced provider collects and reviews operational logs for a customer-facing platform. The contract assigns daily operations to the provider, while management approves service requirements and risk acceptance. During the audit, who holds decision rights for defining logging requirements and retention?
  1. The auditor determines retention after comparing provider logging practices.
    Auditors independently evaluate controls but do not select management’s requirements.
  2. The provider and auditor jointly approve requirements and accept residual logging risk.
    Risk acceptance remains management’s decision, not a shared auditor-provider decision.
  3. The provider alone decides log retention and review requirements.
    Operational delegation does not transfer management’s accountability for control requirements.
  4. Management sets requirements; the provider operates logs under the contract. ✓
    Management owns requirements and risk; the provider performs contracted operational activities.
The trap
Confuses operation with control ownership. Assigns control design to auditor. Treats independent assurance as approval.

Management owns logging requirements; the provider operates them under contractual direction.

10. Prioritize measurable customer-impacting targets: Which priority best reduces significant operational risk fir

Easy
After two companies merge, their service catalogs contain conflicting targets. Customer availability is measurable, but several internal targets lack owners, exclusions, or business-impact rationale. Management has capacity for one immediate remediation priority. Which priority best reduces significant operational risk first?
  1. Document exclusions for all internal services first.
    Exclusions matter, but customer-impacting performance currently presents greater operational risk.
  2. Prioritize measurable customer-impacting targets. ✓
    This addresses the clearest material exposure before lower-risk catalog harmonization work.
  3. Assign owners throughout the merged catalog before measuring performance.
    Ownership is necessary, but measurable customer-impacting exposure requires earlier attention.
  4. Standardize every service target immediately.
    Broad standardization may consume capacity without reducing the highest business exposure.
The trap
Addresses definitions before consequences. Favors completeness over risk. Prioritizes governance over urgent exposure.

Prioritize measurable customer-impacting commitments before lower-risk catalog harmonization.

11. Require independent review of privileged database activity: Which recommendation is best?

Medium
A regional bank permits database administrators to perform emergency production changes. The exception is documented, but independent review is not consistently performed. Management asks whether a compensating control can justify continuing the exception. Which recommendation is best?
  1. Ask the auditor to approve each emergency database change after completion.
    Auditor approval compromises independence and does not establish management’s operating control.
  2. Allow unrestricted DBA access because emergencies require speed.
    Emergency needs do not justify unrestricted, unaudited privileged access.
  3. Remove all emergency database access from administrators.
    Eliminating access may impair necessary recovery without addressing controlled emergency use.
  4. Require independent review of privileged database activity. ✓
    Independent review compensates for unavailable segregation during emergency privileged access.
The trap
Confuses restriction with effective compensation. Treats urgency as control exemption. Turns assurance into operational authorization.

Independent review provides a compensating check over emergency privileged activity.

12. Yes; approved BIA results support priorities: Is that conclusion adequately supported?

Easy
A healthcare network’s business impact analysis identifies critical processes, impacts over time, dependencies, and recovery requirements. Business owners approved the documented results, and management concludes recovery priorities are supported. Is that conclusion adequately supported?
  1. No; every process must have identical recovery objectives.
    Recovery requirements appropriately differ according to business impact and criticality.
  2. Yes; auditors may define priorities from management’s BIA.
    The evidence supports management’s conclusion; auditors do not define business priorities.
  3. Yes; approved BIA results support priorities. ✓
    Approved BIA evidence directly supports priorities based on impacts, dependencies, and requirements.
  4. No; only technical recovery testing supports priorities.
    Business-owned BIA evidence can establish recovery priorities before technical testing.
The trap
Misstates the auditor’s role. Assumes uniform business requirements. Requires technical evidence prematurely.

Approved BIA evidence supports priorities through documented impacts, dependencies, and recovery requirements.

742 more Information Systems Operations and Business Resilience questions

The remaining 742 questions in this domain are part of the full CISA bank — 2900 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your CISA readiness — free

Other CISA domains

Part of the Certsqill CISA question bank · Information Systems Operations and Business Resilience · Every answer, right and wrong, comes with its own explanation.