CISA Practice Question: Information Systems Operations and Business Resilience
An organization uses a cloud-based CRM system. The asset management team has implemented tagging to track resource costs by department. During an audit, the IS auditor finds that several orphaned resources (e.g., virtual machines, storage volumes) exist that are not tagged and have been running for months. The cloud service provider's cost allocation report shows these resources under a default account. What is the most significant risk associated with this finding?
⚠ Common exam trap
The trap here is that candidates often focus on security risks (like increased attack surface) because orphaned resources are commonly associated with security vulnerabilities, but the question's emphasis on tagging and cost allocation reports directly points to financial risk as the most significant finding.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inaccurate cost allocation and potential budget overruns.
The most significant risk is inaccurate cost allocation and potential budget overruns because the orphaned resources are not tagged and are billed under a default account, preventing the organization from accurately attributing cloud costs to the responsible departments. This undermines the purpose of the tagging strategy implemented by the asset management team and can lead to unplanned expenses that are not tracked against any budget owner, directly impacting financial control and operational accountability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increased attack surface from forgotten resources.
Why it's wrong here
Security is a concern, but the most direct risk is financial.
- ✗
Security misconfiguration due to lack of ownership.
Why it's wrong here
While possible, the immediate issue is cost and accountability.
- ✓
Inaccurate cost allocation and potential budget overruns.
Why this is correct
Orphaned resources cause unnecessary costs and distort cost allocation.
- ✗
Compliance violation with data residency requirements.
Why it's wrong here
No evidence of data residency issues.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.