CISA Practice Question: Information Systems Operations and Business Resilience
An organization is implementing a cloud resource management strategy to optimize costs and prevent waste. Which three practices should the auditor recommend?
⚠ Common exam trap
The trap here is that candidates may view 'consolidating into a single region' (Option A) as a cost-saving measure, but the CISA exam emphasizes that cost optimization must balance performance, compliance, and resilience—not just minimize data transfer fees.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Detect and remove orphaned resources
Orphaned resources (e.g., unattached EBS volumes, unused Elastic IPs, stale load balancers) continue to incur costs without providing any business value. Detecting and removing them directly eliminates waste, which is a core principle of cloud cost optimization. This practice aligns with the AWS Well-Architected Framework's Cost Optimization pillar, specifically the 'Stop Spending Money on Undifferentiated Heavy Lifting' design principle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Consolidate all resources into a single region
Why it's wrong here
Incorrect: Single region may not be optimal for performance or disaster recovery.
- ✓
Detect and remove orphaned resources
Why this is correct
Correct: Orphaned resources incur costs without providing value.
- ✓
Automate shutdown of idle resources during off-hours
Why this is correct
Correct: Automation reduces costs by turning off unused resources.
- ✗
Use only Reserved Instances for all workloads
Why it's wrong here
Incorrect: Reserved Instances are cost-effective for steady-state workloads, but not suitable for all.
- ✓
Implement resource tagging for cost allocation
Why this is correct
Correct: Tagging enables tracking and chargeback.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.