mediumMultiple Choice
CISA Practice Question: A company's IT service desk receives multiple…
A company's IT service desk receives multiple reports of users being unable to access a cloud-based CRM system. The network team confirms that internet connectivity is working. Which of the following should be the FIRST step in troubleshooting the issue?
⚠ Common exam trap
CISA often tests troubleshooting sequencing — candidates jump to internal remediation (firewall restart, change review) before ruling out a vendor-side outage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the vendor's service status page for any reported outages
When multiple users report the same cloud service outage and internet connectivity is confirmed working, the fastest way to determine whether the issue is internal or vendor-side is to check the vendor's service status page. This is a low-cost, non-disruptive first step that can immediately confirm a known outage and avoid unnecessary internal troubleshooting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ask a user to try accessing from a different device
Why it's wrong here
Testing a second device does not establish scope across the affected user population, and the fault may be client-side or server-side; it delays identifying whether the CRM service itself is reachable. It is tempting because isolating a single endpoint is useful when one user reports a fault, but here multiple users are already affected.
- ✗
Restart the company's firewall and proxy servers
Why it's wrong here
Restarting the firewall and proxy servers disrupts all network traffic before any evidence implicates them, and internet connectivity is already confirmed working. It is tempting because a proxy or firewall fault would block cloud access, making a restart the right action once logs actually show that device dropping CRM traffic.
- ✓
Check the vendor's service status page for any reported outages
Why this is correct
Confirming the vendor's service status page first isolates whether the outage is external, avoiding wasted internal troubleshooting when internet connectivity is already verified. This satisfies the stem's requirement for the first step, since a SaaS CRM failure commonly originates with the provider.
- ✗
Review recent change requests for the CRM system
Why it's wrong here
Change requests are reviewed later in the troubleshooting flow, after confirming the scope and checking the CRM service status. It is tempting because recent changes often cause outages, but the first step is to verify whether the CRM provider or service itself is unavailable.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.