mediumMultiple Choice
CISA Practice Question: When an organization uses an external provider to…
When an organization uses an external provider to manage its IT help desk, this is an example of which sourcing model?
⚠ Common exam trap
CISA often tests the distinction between outsourcing and co-sourcing; candidates may incorrectly choose co-sourcing when the scenario describes full external management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Outsourcing
Outsourcing is the sourcing model where an external provider manages a specific IT function, such as the help desk, under a contract. This transfers operational responsibility to the third party while the organization retains oversight. It is distinct from cloud services, insourcing, and co-sourcing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud services
Why it's wrong here
Cloud services describe delivery of computing resources over the internet, not the contractual transfer of help desk functions to a third party. It tempts because external providers often host tooling in the cloud, but the sourcing model here is outsourcing, which covers delegating an entire function to an external provider.
- ✓
Outsourcing
Why this is correct
Outsourcing transfers the help desk function to an external provider under contract, with the vendor owning delivery and staffing. This differs from insourcing, which retains the function internally, and from managed services models that typically cover broader infrastructure operations.
- ✗
Insourcing
Why it's wrong here
Insourcing means the organisation's own staff deliver the service, whereas an external provider delivering it is outsourcing. It is tempting because the help desk still serves internal users, but the sourcing decision concerns who performs the work. The provider's involvement makes this outsourcing, not insourcing.
- ✗
Co-sourcing
Why it's wrong here
Co-sourcing splits a function between internal staff and an external provider sharing responsibility and risk. The scenario hands the entire help desk to the external provider, which is full outsourcing; co-sourcing would apply only if internal IT retained part of the service delivery.
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.