CISA Practice Test 24 — 15 Questions

Question 1

During an ERP implementation, data migration is a critical activity. Which of the following controls would be most effective in ensuring the accuracy and completeness of migrated data?

Accepted Answer

Performing a trial migration and reconciling the results. Reconciliation reports compare source and target data, providing evidence of completeness and accuracy. Other options are less direct.

Answer

Using automated data extraction tools

Answer

Assigning a data owner for each data field

Answer

Running parallel processing for one month

Question 2

An IS auditor is evaluating the change management process for a critical financial application. The auditor finds that all standard changes are approved by the Change Advisory Board (CAB). However, emergency changes are approved by the IT manager and later ratified by the CAB. Which of the following is the greatest risk associated with this process?

Accepted Answer

There is no clear definition of what constitutes an emergency change.. Without a well-defined definition of what constitutes an emergency, changes could be misclassified to bypass CAB scrutiny, weakening controls.

Answer

The IT manager may not have sufficient technical expertise to approve emergency changes.

Answer

Emergency changes may be delayed while waiting for CAB ratification.

Answer

The CAB may not have enough time to review emergency changes properly.

Question 3

An organization is implementing an ERP system and is concerned about segregation of duties conflicts. What is the most effective control to address this risk during implementation?

Accepted Answer

Implementing role-based access controls. Segregation of duties conflicts are best addressed by designing and implementing role-based access controls tailored to the organization's processes.

Answer

Performing a data migration risk assessment

Answer

Reviewing vendor SOC 2 reports

Answer

Conducting user acceptance testing

Question 4

Which of the following is a key objective of a post-implementation review?

Accepted Answer

To determine if the system meets user requirements. A post-implementation review assesses whether the system meets its objectives and identifies lessons learned.

Answer

To conduct penetration testing

Answer

To approve the project budget

Answer

To select the vendor

Question 5

During the design phase of an SDLC, which TWO activities should be performed to ensure security is integrated into the system? (Select TWO)

Accepted Answer

Threat modeling. Architecture review ensures the system design meets security requirements, and threat modeling identifies potential threats and vulnerabilities early. Both are proactive security controls in the design phase.

Answer

User acceptance testing (UAT)

Answer

Code review

Answer

Penetration testing

Question 6

An organization is implementing an enterprise resource planning (ERP) system. The project team plans to migrate legacy data without performing a full reconciliation between source and target systems. As an IS auditor, which of the following should be your PRIMARY concern?

Accepted Answer

Incomplete or inaccurate data may be loaded into the new system. Data migration without reconciliation can cause undetected data corruption or loss, impacting financial reporting and operations.

Answer

The legacy system may be decommissioned prematurely

Answer

User acceptance testing may be delayed

Answer

The data migration may exceed the planned timeline

Question 7

An IS auditor is reviewing a contract with a vendor for a new financial system. Which of the following clauses is MOST critical to ensure auditability?

Accepted Answer

Right to audit the vendor's operations and controls. Audit rights allow the organization to review the vendor's controls and operations, which is essential for assurance.

Answer

Penalties for non-performance

Answer

Service level agreements (SLAs) for system uptime

Answer

Data ownership and confidentiality provisions

Question 8

An organization is implementing a new CRM system using an iterative development methodology. The IS auditor wants to verify that appropriate controls are in place. Which THREE of the following are essential controls for iterative development? (Select THREE.)

Accepted Answer

Risk assessment at the start of each iteration. Iterative development requires continuous stakeholder involvement, version control, and risk assessment each iteration. These controls ensure the evolving system meets requirements and manages risks.

Answer

Formal sign-off on a complete requirements document before development begins

Answer

A mandatory change control board for every change

Question 9

An IS auditor is reviewing a project that uses an iterative SDLC approach. Which THREE controls should the auditor expect to see in place during the development iterations? (Select THREE)

Accepted Answer

Code reviews. Code reviews ensure code quality and security. Static application security testing (SAST) identifies vulnerabilities in source code. Unit testing validates individual components. These are key controls in iterative development.

Answer

Formal sign-off on requirements before each iteration

Answer

User acceptance testing (UAT) before each iteration

Question 10

During a change management audit, which TWO of the following are essential elements of a normal change request? (Select two.)

Accepted Answer

Justification for the change. A change request should include justification and an impact analysis to assess risks and benefits before approval.

Answer

The name of the developer who will implement the change

Answer

The project manager's approval

Answer

A list of all users affected

Question 11

An organization is implementing a new CRM system and has chosen a build (in-house development) approach over buying a COTS product. Which of the following is the most significant risk of this decision?

Accepted Answer

Higher likelihood of project delays and budget overruns. In-house development carries a higher risk of project delays and budget overruns due to unforeseen technical challenges, scope creep, and resource constraints. This is a well-known risk in custom development projects.

Answer

Inability to customize the system to meet user requirements

Answer

Reduced control over security and data privacy

Answer

Vendor lock-in due to proprietary technology

Question 12

In the context of ITIL change management, which change type requires approval from the Change Advisory Board (CAB)?

Accepted Answer

Normal change. Normal changes require CAB approval because they have a higher risk and impact, unlike pre-approved standard changes or emergency fast-track changes.

Answer

Emergency change

Answer

Minor change

Answer

Standard change

Question 13

Which TWO of the following are typical controls in the testing phase of the SDLC? (Select two.)

Accepted Answer

Security testing (DAST/pen test). UAT ensures user acceptance, and security testing (e.g., DAST) identifies vulnerabilities before deployment.

Answer

Rollback plan testing

Answer

Code reviews

Answer

Threat modeling

Question 14

An IS auditor is reviewing vendor management practices for a cloud-based SaaS solution. Which TWO of the following are critical elements to include in the contract's service level agreement (SLA)? (Select TWO.)

Accepted Answer

Guaranteed uptime percentage with penalties for non-compliance. The SLA should define performance metrics (uptime) and data ownership/portability to ensure business continuity and data control. Audit rights are also important but are often in a separate clause.

Answer

The vendor's marketing plan for the solution

Answer

The vendor's employee training program details

Answer

The vendor's disaster recovery testing schedule

Question 15

An organization uses automated job scheduling for nightly batch processing. One job fails due to a missing dependency file. What is the most effective control to prevent recurrence?

Accepted Answer

Define dependencies within the job scheduler. Implementing dependency management in the job scheduler ensures that jobs only run when prerequisites are met, preventing such failures.

Answer

Use a different scheduling tool

Answer

Increase the frequency of job reruns

Answer

Assign manual operators to monitor jobs