CISA Practice Question: Information Systems Operations and Business Resilience
Which TWO of the following are key considerations when managing software licenses in an organization? (Select TWO).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing automated license optimization tools
Option A is correct because automated license optimization tools (e.g., Software Asset Management/SAM platforms that reconcile entitlements against discovered installations) continuously track usage, identify unused or over-deployed licenses, and help reclaim or reassign seats, which directly reduces cost and compliance risk. Option B is correct because regular license compliance audits compare purchased entitlements against actual deployments and usage, producing the evidence needed to true-up agreements, avoid vendor penalties, and satisfy software audits. Option C is not a key license-management consideration; storing installation media securely is a media-handling/backup practice, not license entitlement management. Option D is not correct because a hardware inventory supports asset tracking and configuration management, but it does not by itself address license entitlements, usage rights, or compliance. Option E is not correct because patching to the latest version is vulnerability and configuration management, unrelated to tracking or optimizing software licenses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implementing automated license optimization tools
Why this is correct
Automated licence optimisation tools continuously reconcile installed software against entitlements, reclaiming unused seats and flagging over-deployment before true-up audits. This directly satisfies the stem's consideration of ongoing licence management, since manual tracking cannot scale across large estates and typically causes compliance breaches or unnecessary spend.
- ✓
Conducting regular license compliance audits
Why this is correct
Regular licence compliance audits reconcile deployed installations against entitlements, exposing under-licensing or unused seats before a vendor audit does. This directly satisfies the stem's need to manage licences proactively, since audits provide the evidence base for true-ups, renegotiation and cost recovery, and they demonstrate due diligence over software asset management controls.
- ✗
Storing all software installation media in a secure location
Why it's wrong here
Securing installation media protects distribution artefacts from tampering or theft; it does not govern licence counts, entitlements or renewals. It is tempting because controlled media repositories are a recognised software asset management control, so the practice appears licence-related; it would be correct if the question asked how to safeguard installation sources rather than manage licences.
- ✗
Maintaining a hardware inventory for asset tracking
Why it's wrong here
Hardware inventory tracks physical assets and their locations, not licence entitlements, installations or compliance positions. It is tempting because asset management underpins software discovery and reconciliation, so hardware records often feed licence true-ups; it would be correct if the question asked how to track physical devices rather than manage software licences.
- ✗
Ensuring all software is patched to the latest version
Why it's wrong here
Patching addresses vulnerability remediation on installed software, not licence entitlement, usage or compliance. It is tempting because unpatched or unmanaged installations frequently surface during licence audits, linking the two activities; it would be correct if the question asked how to maintain software security rather than manage licence obligations.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.