How many Troubleshooting Scenario Questions questions are on this page?

This page has 7 Troubleshooting Scenario Questions scenario questions for the CISA exam, each with detailed explanations and wrong-answer analysis.

How should I approach CISA scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Certified Information Systems Auditor CISA questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Certified Information Systems Auditor CISA practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CISA

exam code

ISACA

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummultiple choice

Full question →

During user acceptance testing (UAT) of a new financial system, users report that the system fails to enforce a segregation of duties rule where the same user should not be able to create a purchase order and approve it. The requirement was documented in the functional specifications. Which of the following is the MOST likely cause of this issue?

A
Performance testing was prioritized over functional testing.
Why wrong: Performance testing does not affect functional control enforcement.
B
The functional requirements were incomplete.
Why wrong: The requirement was documented, so incomplete requirements are not the cause.
C
The requirements were ambiguous and misinterpreted by developers.
Why wrong: Ambiguity could cause misinterpretation, but the requirement was clearly documented.
D
The system was not configured to enforce the control.
The system likely has the capability but was not properly configured.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

Refer to the exhibit. A security administrator is troubleshooting why external users cannot reach the web server at 203.0.113.10 from the internet. Based on the configuration, what is the MOST likely issue?

Exhibit

Refer to the exhibit.

```
! Cisco ASA configuration snippet
access-list OUTSIDE_IN extended permit tcp any host 203.0.113.10 eq www
access-list OUTSIDE_IN extended permit tcp any host 203.0.113.10 eq https
access-list OUTSIDE_IN extended deny ip any any log
!
object network WEB_SERVER
 host 203.0.113.10
nat (inside,outside) source static any any destination static WEB_SERVER WEB_SERVER no-proxy-arp route-lookup
!
```

A
No NAT rule is configured for the web server
Why wrong: A NAT rule exists.
B
The 'no-proxy-arp' option prevents the ASA from responding to ARP requests for the public IP
Without proxy ARP, the ASA does not claim the public IP, so traffic is not received.
C
The source address is not translated
Why wrong: Source translation is not required for inbound traffic; destination translation is the issue.
D
The access list denies incoming web traffic
Why wrong: The ACL permits tcp to port 80 and 443.

Full breakdown with real-world context →

Question 3easymulti select

Read the full NAT/PAT explanation →

During a disaster recovery test, the team discovers that the backup server is unable to restore data because of incompatible software versions. Which TWO controls should have been implemented to prevent this?

A
Maintaining a configuration management database
Correct: CMDB tracks software versions across environments.
B
Using cloud-based backup solutions
Why wrong: Cloud does not inherently solve version incompatibility.
C
Implementing intrusion detection systems
Why wrong: IDS is unrelated to backup compatibility.
D
Increasing the frequency of full backups
Why wrong: Frequency does not address compatibility.
E
Performing regular patch management
Correct: Patch management ensures software stacks are consistent.

Full breakdown with real-world context →

Question 4mediummultiple choice

Full question →

A company's IT service desk receives multiple reports of users being unable to access a cloud-based CRM system. The network team confirms that internet connectivity is working. Which of the following should be the FIRST step in troubleshooting the issue?

A
Ask a user to try accessing from a different device
Why wrong: This may help isolate the problem but is not the first step; start with service provider status.
B
Restart the company's firewall and proxy servers
Why wrong: Restarting network devices should be done only after confirming the issue is internal.
C
Check the vendor's service status page for any reported outages
This quickly identifies if the issue is widespread and outside the organization's control.
D
Review recent change requests for the CRM system
Why wrong: Change review is important but should follow after confirming the service is not down.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full NAT/PAT explanation →

An organization has recently implemented a cloud-based identity provider (IdP) for single sign-on (SSO) across all SaaS applications. Users authenticate using their corporate credentials via SAML 2.0. After a week, the IT security team notices a significant increase in failed login attempts from various IP addresses targeting a specific user account. The helpdesk reports that the user, a senior executive, has not complained about any issues. The security team investigates and finds that the account lockout policy is set to 5 failed attempts within 15 minutes, after which the account is locked for 30 minutes. The failed attempts are occurring in bursts of 4, then stopping, then resuming from different IPs. The organization uses conditional access policies that require MFA from unknown locations. However, the failed attempts appear to be stopped at the authentication prompt and never reach the MFA stage. What is the most likely explanation and the best course of action?

A
The user's credentials have been compromised, and the attacker is testing them across the IdP. The organization should immediately force a password reset for the user and enable MFA for all users.
Why wrong: No successful authentication has occurred, so credentials may not be compromised yet. Forcing a reset is premature and does not address the attack vector.
B
A misconfiguration in the IdP allows pre-authentication enumeration. The organization should disable account lockout and implement rate limiting at the application proxy.
Why wrong: Account lockout is a valuable control; disabling it would increase risk. The attack pattern is consistent with password spraying, not enumeration.
C
The attacker is performing a password spraying attack, attempting to guess the password for that specific account. The organization should implement a CAPTCHA requirement after a few failed attempts.
The burst pattern with IP rotation is classic password spraying. CAPTCHA or progressive delay will effectively slow automated attacks.
D
The IdP is experiencing integration issues with the AD domain controller, causing authentication failures that are logged as failed attempts. The organization should check the synchronization status and network connectivity.
Why wrong: Integration issues would likely affect many users, not a single targeted account, and the pattern of bursts is inconsistent with connectivity problems.

Full breakdown with real-world context →

Question 6mediummultiple choice

Full question →

A hospital is implementing a new electronic health record (EHR) system. The project team includes clinicians and IT staff. During integration testing, the system fails to exchange lab results with the existing legacy system due to format mismatches. The IT team suggests developing a custom interface. The clinical team is concerned that any custom solution may not comply with health data privacy regulations. The project sponsor pressures the team to quickly fix the issue to avoid delays. The IS auditor is reviewing this situation. What is the MOST appropriate action for the auditor to recommend?

A
Conduct a privacy impact assessment on the custom interface and ensure controls are in place before deployment.
Balances speed with compliance.
B
Proceed with the custom interface to meet the project deadline.
Why wrong: Compliance risk is unacceptable.
C
Reject the custom interface and delay the project until a standard solution is found.
Why wrong: Unnecessary delay; alternative acceptable.
D
Replace the legacy system with a new one that is compatible.
Why wrong: Too costly and time-consuming.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full NAT/PAT explanation →

A nonprofit organization develops a small online donation platform using a third-party payment gateway. The project team skips formal security testing because of budget constraints. After launch, a security researcher discovers that the application fails to validate input on the donation amount field, allowing manipulation. The nonprofit loses several thousand dollars before the issue is patched. The IS auditor is asked to review the system development process. Which of the following is the PRIMARY finding?

A
The donation amount field was not validated.
Why wrong: This is the vulnerability, not the root cause.
B
The organization lost money due to the exploit.
Why wrong: Impact, not process deficiency.
C
Security testing was not performed during development.
Testing would have identified the input validation issue.
D
The payment gateway was not properly integrated.
Why wrong: Integration was fine; the flaw was in the app.

Full breakdown with real-world context →

These CISA practice questions are part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style CISA questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related CISA topic practice pages

Governance and Management of IT practice questions

Information Systems Acquisition, Development and Implementation practice questions

Information Systems Operations and Business Resilience practice questions

Protection of Information Assets practice questions

Information System Auditing Process practice questions

CISA fundamentals practice questions

CISA scenario practice questions

CISA troubleshooting practice questions

Practice scenarios

Refer to the exhibit. A security administrator is troubleshooting why external users cannot reach the web server at 203.0.113.10 from the internet. Based on the configuration, what is the MOST likely issue?

Exhibit

During a disaster recovery test, the team discovers that the backup server is unable to restore data because of incompatible software versions. Which TWO controls should have been implemented to prevent this?

A company's IT service desk receives multiple reports of users being unable to access a cloud-based CRM system. The network team confirms that internet connectivity is working. Which of the following should be the FIRST step in troubleshooting the issue?