CISA Practice Test 21 — 15 Questions

Question 1

An organization is migrating data from a legacy system to a new ERP. What is the most critical data migration risk?

Accepted Answer

Data loss or corruption. Data integrity is the top risk during migration, as errors can lead to incorrect business operations and decisions.

Answer

Increased storage costs

Answer

Longer migration time

Answer

Incompatible hardware

Question 2

During a post-implementation review of a new accounting system, the IS auditor notes the following: the project was completed on time and within budget, but user satisfaction is low and there are several outstanding defect reports. Which THREE of the following are the MOST appropriate recommendations?

Accepted Answer

Compare actual benefits achieved against the business case. The review should identify lessons learned, address outstanding defects, and assess whether objectives were met beyond budget/schedule.

Answer

Request additional budget to fix the defects

Answer

Immediately escalate the defect reports to the project sponsor

Question 3

An IS auditor is reviewing an emergency change that was implemented to fix a critical security vulnerability. What is the most important post-implementation step?

Accepted Answer

Document the change and obtain retrospective approval. After an emergency change, it is essential to document the change and obtain retrospective approval to maintain change management integrity.

Answer

Update the configuration management database

Answer

Notify all users

Answer

Conduct a risk assessment

Question 4

An organization is considering whether to build a custom application or purchase a commercial off-the-shelf (COTS) product. Which of the following factors would most strongly support a build decision?

Accepted Answer

The required functionality is unique to the organization's competitive advantage.. When the organization's processes are unique and provide a competitive advantage, custom development allows for exact fit and control.

Answer

Short time to market is critical.

Answer

The vendor offers a robust service-level agreement (SLA).

Answer

The organization has limited in-house development resources.

Question 5

Which of the following is the PRIMARY objective of a post-implementation review of an information system?

Accepted Answer

To evaluate whether the system achieved its planned objectives and benefits. The post-implementation review aims to assess whether the system meets its intended objectives, including performance, user satisfaction, and business goals. Lessons learned are a secondary outcome.

Answer

To assess the performance of the project team

Answer

To document the technical architecture for future reference

Answer

To identify new requirements for future enhancements

Question 6

During a post-implementation review of a new payroll system, the IS auditor identifies several outstanding issues. Which TWO issues should be considered most critical to address immediately? (Select TWO)

Accepted Answer

The system's tax calculation module produced incorrect results for a subset of employees. Unauthorized overtime payments indicate a segregation of duties or control weakness that could lead to fraud. Inaccurate tax calculations could result in regulatory penalties and employee dissatisfaction. Both have significant financial and compliance impacts.

Answer

The system is running 5% slower than expected

Answer

Some employees have not completed training

Answer

The user manual is not yet finalized

Question 7

An IS auditor is reviewing a post-implementation review report for a new ERP system. Which of the following findings would be of greatest concern to the auditor?

Accepted Answer

Several segregation of duties conflicts were identified and not resolved.. Segregation of duties conflicts in an ERP can lead to fraud or errors. The other findings are important but not as critical from a control perspective.

Answer

The implementation took three months longer than planned.

Answer

The project exceeded the budget by 15%.

Answer

User acceptance testing (UAT) was completed with only 80% test coverage.

Question 8

An IS auditor is reviewing an agile software development project. Which of the following is the most important control to assess?

Accepted Answer

Sprint review. In agile, the sprint review provides an opportunity to demonstrate completed work and obtain stakeholder feedback, acting as a key control for quality and acceptance.

Answer

Daily standup meetings

Answer

Retrospective

Answer

Product backlog

Question 9

An IS auditor is reviewing the change management process for a critical financial application. Which of the following is the most important element to verify in an emergency change request?

Accepted Answer

A documented rollback plan. For emergency changes, speed is critical, but a rollback plan is essential to ensure the change can be reversed if it causes issues. This minimizes the impact on operations.

Answer

Approval from the Change Advisory Board (CAB)

Answer

Extensive user acceptance testing (UAT) results

Answer

A completed impact analysis

Question 10

Which THREE of the following are typical controls in the design phase of the SDLC?

Accepted Answer

Designing security controls. Architecture review, threat modeling, and designing security controls are key design-phase controls to ensure security is built in.

Answer

Code review

Answer

User acceptance testing

Question 11

An IS auditor finds that a project failed to meet its objectives because key stakeholders were not involved in the requirements definition phase. Which phase of the SDLC was most neglected?

Accepted Answer

Requirements analysis. The requirements analysis phase is where stakeholder needs are formally captured and documented. Without key stakeholder involvement, the project lacks a validated baseline of what must be built, leading to misaligned objectives and scope creep. The IS auditor’s finding directly points to a failure in this phase, as it is the only SDLC phase that defines the project’s success criteria from the user’s perspective.

Answer

Development

Answer

Design

Answer

Testing

Question 12

In a waterfall SDLC, which phase requires formal sign-off from the business owner before proceeding to the next phase?

Accepted Answer

Requirements phase. In waterfall, each phase ends with a formal sign-off; the requirements phase is critical to ensure business needs are documented and approved.

Answer

Development phase

Answer

Design phase

Answer

Testing phase

Question 13

Which TWO of the following are key elements of a change request document?

Accepted Answer

Justification. A change request should include justification for the change and a rollback plan to mitigate risks.

Answer

Vendor contract

Answer

Project budget

Answer

User manual

Question 14

An IS auditor is reviewing a contract for a new software solution. Which of the following contract types poses the HIGHEST risk to the buyer if requirements are not well-defined?

Accepted Answer

Fixed-price contract. Fixed-price contracts are risky when requirements are unclear because the vendor may understate effort or charge high change orders. Time-and-materials contracts are safer for undefined requirements.

Answer

Time-and-materials contract

Answer

Cost-plus contract

Answer

Outcome-based contract

Question 15

An IS auditor is reviewing a systems acquisition project that involves purchasing an ERP system. Which of the following is the MOST significant risk related to data migration during implementation?

Accepted Answer

Incomplete or inaccurate data conversion from legacy systems. Data migration is a critical risk in ERP implementations. Poor data quality from legacy systems can lead to errors, inconsistencies, and business disruption. Ensuring data integrity is paramount.

Answer

Inadequate security controls in the new system

Answer

Insufficient training of end users on the new system

Answer

Lack of integration testing between modules