CISA IS Operations & Business Resilience Practice Questions
IS Operations & Business Resilience makes up 13 of every 50 questions on a Tigertest CISA practice test. Here are 10 of the 52 questions on it, each with the answer and the reason.
Updated by the Tigertest team. Based on ISACA's CISA job practice areas (effective August 2024). Original questions; 50 per test, weighted like the real exam. Not affiliated with ISACA.
1. What should come first when setting up IT asset management?
- A.A discount deal with one vendor
- B.A complete asset inventory
- C.A plan to replace every laptop
- D.A new helpdesk ticket category
Answer: B. Assets that are not known cannot be protected, patched, licensed or retired properly. The inventory, with an owner for each asset, is the base for everything else.
2. Old servers are sent to a recycler. What evidence should an IS auditor expect to see?
- A.The recycler's general privacy policy
- B.An email saying the servers were sent
- C.A signed asset transfer form only
- D.Certificates of data destruction
Answer: D. The organization needs proof that storage media were wiped or destroyed, matched to the asset inventory, so no data leaves on retired equipment.
3. Operators can change job parameters in the batch scheduler without approval. What should the IS auditor review?
- A.The scheduler's change logs
- B.The printer supply orders
- C.The operators' leave records
- D.The data center floor plan
Answer: A. Unapproved changes to job schedules or parameters can run the wrong programs or data. Logs of scheduler changes, matched to approved requests, show whether this happens.
4. An operator restarts a failed overnight job by overriding a control step. Which control matters most?
- A.Removing the step from the job
- B.Emailing users after the restart
- C.Logging and review of the override
- D.Rerunning the job twice to be sure
Answer: C. Overrides are sometimes needed, but each one should be recorded and reviewed by someone independent, so misuse or errors are noticed.
5. Orders pass from a web shop to the warehouse system through an interface. Which control best shows that none were lost?
- A.Checking the interface's uptime report
- B.Reading the interface design notes
- C.Reconciling counts on both sides
- D.Reviewing the interface specification
Answer: C. Comparing counts and totals sent with those received confirms complete transfer. Rejected records should land in an error queue that is worked and cleared.
6. Records rejected by an interface go to an error queue. What is the main control concern?
- A.The queue is monitored and cleared
- B.The queue is backed up every night
- C.The queue keeps items for a full year
- D.The queue runs on a supported database
Answer: A. An unmonitored error queue means transactions silently drop out of processing. Someone should own the queue, fix and resubmit items, and track their age.
7. A spreadsheet maintained by one analyst calculates figures used in the financial statements. What is the main risk?
- A.The spreadsheet cannot be printed in full
- B.The file is saved on a network drive
- C.Other staff cannot open the file
- D.Errors go undetected without controls
Answer: D. End-user computing tools often lack change control, testing and access protection. Critical spreadsheets should be inventoried, protected and independently checked.
8. Finance teams use several unapproved cloud tools. What should IT do first?
- A.Ask the vendors to sign new contracts
- B.Find the tools and assess their risk
- C.Block every cloud tool for finance users
- D.Let finance keep using them as they are
Answer: B. The first step is visibility: find what is in use and what data it holds, then approve, replace or retire each tool under normal governance.
9. Which activity best helps IT plan for future capacity?
- A.Reducing the number of backups
- B.Trend analysis of utilization data
- C.Buying the largest server available
- D.Waiting for users to report slowness
Answer: B. Monitoring use over time and projecting it forward shows when processing, storage or network limits will be reached, so upgrades can be planned before service suffers.
10. A database server has no redundant power supply or network link. Which concern does this raise?
- A.Weak password complexity
- B.Too many audit log entries
- C.Excessive licensing costs
- D.A single point of failure
Answer: D. One failed component would take the service down. Availability management looks for such points and adds redundancy where the business impact warrants it.
Practice all 52 is operations & business resilience questions, and the rest of the 200-question bank, in the free CISA training sets. Questions you miss come back until you have mastered them.
Start practicingFree to start. No account needed.