mediumMultiple ChoiceObjective-mapped
CISA Practice Question: During an audit of a cloud service provider, the…
During an audit of a cloud service provider, the IS auditor finds that the provider's datacenter access logs show multiple successful logins by an employee during non-business hours over several weeks. The employee works in the sales department. What should the auditor do first?
⚠ Common exam trap
Test-takers frequently confuse the auditor's role with that of a security incident responder, leading them to choose immediate disabling or escalation without first performing due diligence through inquiry and evidence gathering.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Discuss with the employee's supervisor to verify if access was authorized.
The IS auditor's first priority is to gather evidence and understand the context before taking action. The employee's sales role and non-business hours access may be legitimate (e.g., supporting a client in a different time zone). Discussing with the supervisor is a standard audit procedure to verify authorization, aligning with ISACA's audit evidence collection and due professional care.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Recommend disabling the employee's access immediately.
Why it's wrong here
Immediate disabling may be disruptive if access was authorized.
- ✗
Review the access rights policy and compare with actual access.
Why it's wrong here
This is a later step after obtaining initial explanation.
- ✓
Discuss with the employee's supervisor to verify if access was authorized.
Why this is correct
This is the appropriate first step to confirm authorization.
- ✗
Report the finding immediately to senior management.
Why it's wrong here
Reporting without verification may cause unnecessary alarm.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.