CISA Practice Test 32 — 15 Questions

Question 1

An IS auditor reviews the change request. Which of the following is the most significant risk?

Accepted Answer

The impact assessment is incorrect. An incorrect impact assessment (Option C) is the most significant risk because it directly undermines the change management process. If the impact is misjudged, the change may introduce unanticipated failures, data corruption, or security vulnerabilities into the production environment. Unlike vague descriptions or pending approvals, an incorrect impact assessment can lead to catastrophic system outages or compliance violations that are difficult to reverse.

Answer

The description is too vague

Answer

The approval is still pending close to the scheduled date

Answer

The change affects a financial module

Question 2

An IS auditor is evaluating a system development project that uses an outsourced team. The contract allows the vendor to reuse some of the developed code in other projects. What is the auditor's PRIMARY concern?

Accepted Answer

The organization may lose control of intellectual property.. The contract clause allowing the vendor to reuse developed code in other projects directly transfers ownership or licensing rights of the intellectual property (IP) to the vendor. This means the organization may lose exclusive control over the code, potentially allowing competitors to access proprietary logic or algorithms. The IS auditor's primary concern is safeguarding the organization's IP assets, as this loss can have long-term strategic and competitive implications.

Answer

The vendor might not deliver on time.

Answer

The vendor may not maintain the code after the project ends.

Answer

The vendor may use substandard development practices.

Question 3

Which TWO of the following are key controls for ensuring data privacy during system development?

Accepted Answer

Encrypting stored data. Encrypting stored data (Option B) is a key control for ensuring data privacy because it renders the data unreadable without the correct decryption key, protecting it from unauthorized access even if the storage medium is compromised. This aligns with data-at-rest protection requirements under regulations like GDPR and PCI DSS, and is a fundamental security control during system development to prevent exposure of sensitive information.

Answer

Using real customer data for testing

Answer

Disabling audit logs during development

Answer

Allowing developers unlimited access to production data

Question 4

Which of the following is the MOST important objective of system testing?

Accepted Answer

Verify that the system meets specified requirements. System testing is a formal, structured process that validates the entire integrated system against its specified requirements. The primary goal is to confirm that the system behaves as defined in the functional and technical specifications, ensuring that all requirements are correctly implemented before user acceptance testing. While user satisfaction and defect removal are important, they are secondary to verifying requirement compliance, which is the core objective of system testing.

Answer

Confirm that end users are satisfied

Answer

Ensure the code is free of defects

Answer

Validate system performance under load

Question 5

An IS auditor finds that a project failed to meet its objectives because key stakeholders were not involved in the requirements definition phase. Which phase of the SDLC was most neglected?

Accepted Answer

Requirements analysis. The requirements analysis phase is where stakeholder needs are formally captured and documented. Without key stakeholder involvement, the project lacks a validated baseline of what must be built, leading to misaligned objectives and scope creep. The IS auditor’s finding directly points to a failure in this phase, as it is the only SDLC phase that defines the project’s success criteria from the user’s perspective.

Answer

Development

Answer

Design

Answer

Testing

Question 6

Which TWO of the following are key controls that an IS auditor should expect to find in a well-managed system development life cycle (SDLC)?

Accepted Answer

Segregation of duties between development and testing.. Segregation of duties between development and testing is a key control because it ensures that code is independently verified before release, preventing developers from approving their own changes and reducing the risk of undetected defects or malicious code. In a well-managed SDLC, this separation enforces an independent testing phase, which is critical for maintaining code integrity and security.

Answer

Vendor due diligence reports.

Answer

Automated unit testing scripts.

Answer

Gantt chart for project scheduling.

Question 7

Which TWO of the following are BEST indicators that a system development project is at risk of failure?

Accepted Answer

Frequent scope changes. Frequent scope changes (A) are a classic risk indicator because they disrupt the project's baseline requirements, leading to rework, budget overruns, and schedule delays. In system development, uncontrolled scope creep often results in 'analysis paralysis' and can cause the final product to deviate from original objectives, increasing the likelihood of failure.

Answer

Clear communication

Answer

Robust testing

Answer

High team morale

Question 8

Which of the following is the BEST method to ensure that a system development project is completed on time?

Accepted Answer

A realistic project schedule with milestones. A realistic project schedule with milestones (Option B) is the best method because it establishes a time-phased plan with measurable checkpoints, enabling early detection of delays and facilitating proactive corrective actions. Without a realistic baseline, even the best tracking tools or meetings cannot prevent schedule overruns, as the schedule itself is the foundation for monitoring and controlling project progress.

Answer

Regular status meetings

Answer

Frequent scope changes

Answer

Use of a project management software

Question 9

During the requirements gathering phase for a new financial system, stakeholders disagree on the priority of security controls versus user convenience. Which of the following is the BEST approach?

Accepted Answer

Conduct a risk assessment to balance security and usability. Option C is correct because a risk assessment provides a structured, evidence-based framework for balancing security controls against user convenience during requirements gathering. By evaluating the likelihood and impact of threats specific to financial systems (e.g., transaction fraud, data breaches) against usability needs, the organization can prioritize controls that mitigate high-risk exposures without unnecessarily impeding legitimate business processes. This aligns with the COBIT 5 principle of balancing benefits, risk, and resource optimization.

Answer

Postpone security decisions to later phases

Answer

Let the project team decide based on development ease

Answer

Implement all security controls regardless of convenience

Question 10

A company is developing a custom application. During the requirements phase, the project manager documents that the system must encrypt all sensitive data at rest. Which of the following is the BEST control to ensure this requirement is met throughout the development lifecycle?

Accepted Answer

Create a requirements traceability matrix (RTM).. A requirements traceability matrix (RTM) links each requirement to corresponding design, development, and testing artifacts. By mapping the encryption-at-rest requirement to specific code modules, configuration settings, and test cases, the RTM ensures that the control is implemented and verified at every stage of the lifecycle, not just at the end. This makes it the best proactive control for continuous compliance throughout development.

Answer

Perform static code analysis on the final code.

Answer

Conduct a post-implementation security review.

Answer

Deploy a database activity monitoring tool.

Question 11

A company is migrating from a legacy system to a cloud-based ERP. Which of the following is the MOST important control to ensure data integrity during data conversion?

Accepted Answer

Reconciliation of control totals. Reconciliation of control totals is the most important control because it directly verifies that the sum of key fields (e.g., total account balances, record counts) in the source system matches the target cloud-based ERP after conversion. This ensures no data is lost, duplicated, or corrupted during the extraction, transformation, and loading (ETL) process, which is critical for maintaining data integrity in a migration from a legacy system.

Answer

Automated backup

Answer

User acceptance testing

Answer

Parallel running

Question 12

An organization is developing a critical application using an agile methodology. The project sponsor demands frequent deliveries but the development team is concerned about insufficient testing. Which of the following BEST mitigates this risk?

Accepted Answer

Implement continuous integration and automated testing. Option D is correct because continuous integration (CI) and automated testing enable frequent, reliable code integration and immediate feedback on defects, directly addressing the tension between rapid delivery and insufficient testing. Automated tests run on every commit, catching regressions early without manual overhead, which is essential for agile sprints where manual testing alone cannot scale to match delivery velocity.

Answer

Deploy with known defects and fix them in the next sprint

Answer

Increase manual testing effort at the end of each sprint

Answer

Extend the release cycle to allow more time for testing

Question 13

During a systems audit, the auditor finds that the project did not follow the organization's systems development methodology. What should the auditor do FIRST?

Accepted Answer

Report the deviation and assess the impact on controls. The auditor's first responsibility upon discovering a deviation from the organization's systems development methodology is to report the finding and assess the impact on internal controls. This aligns with ISACA's audit standards, which require auditors to evaluate whether the deviation introduces risks to data integrity, security, or project governance. Without this assessment, the auditor cannot determine the severity of the non-compliance or recommend appropriate corrective actions.

Answer

Accept if the project is on schedule

Answer

Recommend that the project be stopped

Answer

Interview the project team to understand why

Question 14

During a system deployment, the above error occurs. What is the MOST likely cause?

Accepted Answer

Firewall blocking the database port. The error message (not shown but implied from context) typically indicates a network-level connectivity failure, such as 'cannot connect to server' or 'connection timed out'. A firewall blocking the database port (e.g., TCP 1433 for SQL Server, 3306 for MySQL, 1521 for Oracle) is the most likely cause because it prevents the application from establishing a TCP handshake with the database server, even if the server name, password, and database service are all correct.

Answer

Incorrect server name in connection string

Answer

Invalid password

Answer

Database service not running on the server

Question 15

A company decides to outsource the development of a customer portal. Which of the following is the MOST critical control to include in the contract?

Accepted Answer

Service level agreements. Service level agreements (SLAs) are the most critical control because they define measurable performance targets (e.g., uptime, response time, throughput) for the outsourced customer portal. Without enforceable SLAs, the company has no contractual mechanism to ensure the portal meets availability and responsiveness requirements, directly impacting customer experience and business operations.

Answer

Fixed price clause

Answer

Non-disclosure agreement

Answer

Termination for convenience clause

CISA Practice Test 32 — 15 Questions

Exhibit

CISA Practice Test 32 — 15 Questions

Exhibit