Availability for an SLA is measured as server uptime. Users report that the application is often unusable while the servers remain running. What should the IS auditor recommend?

Measure availability as users experience it, such as end-to-end transaction success

Who should approve the results of a business impact analysis?

Business management responsible for the processes analyzed

A spreadsheet used to calculate sales commissions has been edited by several people, and different versions circulate by email. Which control BEST ensures the correct version is used?

Storing a single master in a controlled location with versioning and edit restrictions

SLAs with internal business units were agreed five years ago and have not been reviewed since. What is the MOST significant risk?

Service targets may no longer fit business needs

An IS auditor wants to verify that incident escalation rules are being followed. Which audit procedure provides the MOST reliable evidence?

Sample high-priority incidents and compare actual escalation times with the defined rules

Some systems cannot be patched due to vendor support constraints. Which control BEST manages these exceptions?

A patch exception register with risk assessment, compensating controls and review dates

A BIA rates every business process as critical with the shortest possible recovery time. What is the MOST likely consequence?

Resources cannot be prioritized, leading to excessive cost or ineffective recovery

Which practice BEST provides early warning that storage capacity will run out?

Monitoring usage trends with thresholds that trigger alerts and early procurement

Free CISA Domain 4 Practice Questions with Answers

2026-10-19

These five CISA Domain 4 questions are drawn from Auditor Path's bank. Each follows ISACA's item-writing style: a scenario, four plausible options and one BEST answer. Read the explanation even when you get it right — it names the judgment the exam is testing.

Domain 4, Information Systems Operations and Business Resilience, is 26% of the CISA exam.

Question 1: Disaster Recovery Plans

An organization has just written its first disaster recovery plan. Which type of test is MOST appropriate to perform first?

A. A full interruption test that shuts down the production data center
B. A parallel test that runs live processing at the recovery site
C. A tabletop walk-through of the plan with the recovery team members
D. An unannounced simulation of a site loss outside business hours

Answer: C. Tabletop walk-throughs cheaply identify gaps, unclear roles and errors in a new plan without disrupting operations. More demanding tests should follow once the plan has been refined.

Exam mindset: Test progressively, from low risk to high.

Question 2: Shadow IT and End-User Computing

An IS auditor is relying on a report produced by an end-user query tool to select an audit sample. What should the auditor do BEFORE using the report?

A. Verify the report's completeness and accuracy, including query logic and source data
B. Ask management to sign a written statement confirming that the report is accurate
C. Use the report as given, because it was produced from the auditee's production system
D. Confirm that the report author holds an appropriate job title and system access level

Answer: A. Audit evidence derived from user-built reports can be wrong if the query or data is incomplete. The auditor must test the information before relying on it to select samples.

Exam mindset: Test the evidence before trusting it.

Question 3: Job Scheduling and Production Process Automation

A robotic process automation (RPA) bot posts journal entries using a shared administrator account. What is the MOST significant concern?

A. The bot's processing volume may exceed its license limit
B. Staff may lose the skills to post entries manually
C. Actions cannot be attributed, and the bot is over-privileged for its task
D. The bot may fail when the application's interface changes

Answer: C. Bots should run under dedicated, least-privilege identities so their actions are traceable and limited to what the task needs.

Exam mindset: Bots are identities — apply least privilege and accountability.

Question 4: Business Continuity Plan

Remote working is the main continuity strategy if offices are unavailable. What should the IS auditor verify?

A. That office buildings have a documented and tested evacuation plan for staff
B. That staff have signed the remote working policy and completed related training
C. That most staff have said in a survey that they prefer working from home
D. That access, devices and support can securely serve all staff

Answer: D. A continuity strategy only works if its supporting capacity has been verified.

Exam mindset: Test the capacity of the strategy.

Question 5: Business Impact Analysis

A BIA lists a critical customer process but not the IT services and data feeds it depends on. What is the MOST significant gap?

A. The BIA does not name trained deputies who can stand in for each of the process owners
B. Recovery planning may miss supporting services, so the process cannot be restored
C. The process may be assigned a higher criticality rating than its business impact justifies
D. The BIA lacks a cost estimate for each candidate recovery strategy

Answer: B. Processes depend on underlying services; recovery must include them.

Exam mindset: Recover the whole chain.

Keep practising

The quiz below draws more questions from every CISA Domain 4 subtopic. Sign in to practise the full bank, take timed 150-question mocks and see your readiness by domain.