Which of the following is the MOST important characteristic of an information security policy?

It is approved by senior management and communicated to staff

Managers sign annual compliance attestations without any supporting evidence or testing. What is the MOST significant concern?

Attestations may give false assurance that requirements are met

Many documents in a shared repository carry no classification label, and data owners will need months to review them. Which policy provision BEST reduces risk in the meantime?

Treat unlabeled data as internal or confidential until classified

Which role is MOST appropriate for approving access to a customer database?

The data owner within the business unit

Who should define the targets for IT service performance metrics?

The business and IT jointly, based on business requirements

Legal requires transaction records to be kept for seven years, while privacy principles favor minimizing personal data. How should the organization reconcile these?

A retention schedule, set with legal, that keeps records seven years then deletes or anonymizes them

Free CISA Domain 2 Practice Questions with Answers

2026-10-19

These five CISA Domain 2 questions are drawn from Auditor Path's bank. Each follows ISACA's item-writing style: a scenario, four plausible options and one BEST answer. Read the explanation even when you get it right — it names the judgment the exam is testing.

Domain 2, Governance and Management of IT, is 18% of the CISA exam.

Question 1: Laws, Regulations, and Industry Standards

An IS auditor finds that a new regulation affecting customer data retention took effect three months ago, but IT was not informed. What is the MOST significant concern?

A. The IT retention policy was last approved before the regulation took effect
B. No effective process exists to identify and communicate new regulations to IT
C. The legal department is understaffed for regulatory monitoring
D. The retention period configured in the system no longer meets the regulation

Answer: B. The root cause is the lack of a process to monitor regulatory change and translate it into IT requirements. Without it, further gaps will keep occurring.

Exam mindset: Look for the root cause, not just the symptom.

Question 2: IT Policies, Standards, Procedures and Practices

An organization wrote its IT policies by compiling the procedures that its IT teams already followed. What is the GREATEST risk of this bottom-up approach?

A. The policies will be too short to be useful as a reference for IT teams and auditors
B. The policies may reflect existing practice instead of business objectives and risk appetite
C. IT teams may find the policies hard to follow
D. The policies will take longer to approve

Answer: B. A bottom-up approach is practical, but it risks codifying current habits, including weaknesses. Policies should be driven by business objectives and risk so that procedures are aligned to them.

Exam mindset: Policy should lead practice, not copy it.

Question 3: IT Vendor Management

A provider's SOC 2 report uses the carve-out method for a subservice organization that hosts the provider's systems. What should the IS auditor consider?

A. Obtaining separate assurance over the subservicer's controls
B. Treating the subservice organization as out of scope for the risk assessment
C. Requesting that the provider remove the subservice organization from its supply chain
D. Relying on the provider's report alone for the hosting and infrastructure controls

Answer: A. Under carve-out, the subservice organization's controls are excluded from the report, so assurance must come from elsewhere.

Exam mindset: Know what the assurance report does not cover.

Question 4: Data Governance and Classification

Two departments both claim ownership of the product pricing data, and changes conflict. What is the BEST resolution?

A. Both departments continue to edit the data, with every change logged and reviewed monthly
B. Data governance assigns one accountable owner, with defined rights for others
C. IT decides which department's changes take priority when updates to the data conflict
D. Each department maintains its own copy of the pricing data and reconciles it quarterly

Answer: B. Clear ownership prevents conflicting changes and supports quality.

Exam mindset: One owner per data set.

Question 5: Enterprise Architecture and Considerations

During a review of a major ERP replacement, the IS auditor finds that the architecture review took place after the vendor was selected and the contract was signed. What is the MOST significant concern?

A. The review could no longer influence the decision or prevent conflicts
B. The financial stability of the selected vendor may have been overlooked during the procurement process
C. The architecture review documentation was likely less thorough than usual given the time pressure
D. The project team may have lacked qualified enterprise architects during the vendor selection

Answer: A. Architecture review is a preventive control that must occur before commitment. Performed afterward, it can only document problems that are now expensive or impossible to correct.

Exam mindset: A preventive control applied late becomes a detective one.

Keep practising

The quiz below draws more questions from every CISA Domain 2 subtopic. Sign in to practise the full bank, take timed 150-question mocks and see your readiness by domain.