CISA Information Systems Acquisition, Development, and Implementation — 40 Questions

Question 1

Which THREE of the following are essential elements of an emergency change request? (Select three.)

Accepted Answer

Test plan. Option A (Test plan) is correct because an emergency change still requires a documented test plan, even if abbreviated, to verify the change works and does not introduce new faults before or immediately after implementation. Option D (Rollback plan) is correct because emergency changes carry elevated risk, so a defined rollback (back-out) plan is essential to restore the previous known-good state if the change fails. Option E (Justification for emergency) is correct because the request must document why the change cannot wait for the normal change management cycle, legitimizing the use of the emergency process. Option B (Impact analysis) is not among the marked correct answers, and Option C (Pre-approval from CAB) is not required for emergency changes since they typically receive expedited or retrospective approval rather than prior CAB authorization.

Answer

Impact analysis

Answer

Pre-approval from CAB

Question 2

An IS auditor is reviewing a vendor's SOC 2 report as part of a systems acquisition. Which TWO aspects should the auditor verify to ensure the report is reliable?

Accepted Answer

The report was issued within the last 12 months. Option A is correct because a SOC 2 report is a point-in-time attestation, and the AICPA guidance expects the report to cover a recent period (typically within the last 12 months) so that the auditor can rely on the tested controls as current; an older report may not reflect the vendor's present control environment. Option C is correct because SOC 2 reports must be issued by an independent, licensed CPA firm under AT-C 205 (formerly SSAE 18), and independence is essential for the report's credibility and for the auditor to rely on the opinion. Options B, D, and E are not the reliability criteria: a business continuity plan description, a customer list, and internal control objectives may appear in or accompany the report but do not by themselves establish that the report is trustworthy or current.

Answer

The report includes a description of the vendor's business continuity plan

Answer

The report includes a list of the vendor's customers

Answer

The report contains the vendor's internal control objectives

Question 3

An organization is considering replacing its legacy financial system with a new ERP solution. Which of the following is the PRIMARY advantage of purchasing a commercial off-the-shelf (COTS) ERP package over building a custom system?

Accepted Answer

Faster implementation. The primary advantage of a COTS ERP package over a custom-built system is faster implementation, because the software is pre-built, pre-tested, and comes with vendor-provided functionality, documentation, and support. Organizations configure rather than code, dramatically shortening time-to-value. This speed is the most direct and universally applicable benefit.

Answer

Greater control over customization

Answer

Lower total cost of ownership

Answer

Complete alignment with business processes

Question 4

During a spiral model SDLC project, an IS auditor is reviewing risk assessment documentation. Which of the following would be the GREATEST concern?

Accepted Answer

Key risks identified in the first iteration are not reassessed in later iterations. The spiral model is risk-driven; failure to identify critical risks undermines the methodology and could lead to project failure.

Answer

Risk mitigation plans are not documented

Answer

The project uses a combination of waterfall and prototyping

Answer

Risk analysis is performed by the project manager alone

Question 5

An organization is deciding between developing a custom application and purchasing a commercial off-the-shelf (COTS) product. The project manager favors a COTS solution because it offers faster deployment. Which of the following is the MOST important consideration for the IS auditor to evaluate in this build vs. buy decision?

Accepted Answer

The degree of vendor dependency and ability to customize. Vendor dependency is a critical risk in COTS acquisitions. The organization may become reliant on the vendor for updates, support, and customizations, which can affect long-term flexibility and costs.

Answer

Availability of skilled developers to maintain the custom solution

Answer

User training requirements for the new system

Answer

Total cost of ownership including maintenance and licensing

Question 6

During an SDLC audit, the IS auditor finds that security requirements were not formally documented during the requirements phase. Which of the following is the BEST recommendation to mitigate the associated risk?

Accepted Answer

Include security requirements in the design phase and obtain sign-off. Security requirements should be defined early to ensure controls are designed in, not bolted on. The best practice is to include security requirements in the requirements phase and have them reviewed by security experts.

Answer

Perform a penetration test after go-live

Answer

Conduct a vulnerability scan after deployment to identify security gaps

Answer

Implement a firewall and intrusion detection system

Question 7

An IS auditor is reviewing an emergency change that was implemented to fix a critical security vulnerability. Which of the following post-implementation controls is MOST important to ensure the change was properly managed?

Accepted Answer

A post-implementation review was performed by the Change Advisory Board (CAB). Emergency changes bypass normal CAB approval, so it is critical to document the change and have it retrospectively reviewed by the CAB to ensure proper governance.

Answer

The change request included a rollback plan

Answer

The change was tested in a production-like environment before deployment

Answer

The change was documented and approved by the change manager after implementation

Question 8

An IS auditor is reviewing a contract for a new software solution. Which of the following contract types poses the HIGHEST risk to the buyer if requirements are not well-defined?

Accepted Answer

Fixed-price contract. A fixed-price contract locks the buyer into a set price regardless of actual costs, so if requirements are poorly defined, the vendor may cut corners, deliver a solution that does not meet needs, or demand costly change orders to address gaps. Because the price is fixed, the buyer bears the risk of scope misinterpretation and may end up paying for rework or disputes. In contrast, cost-reimbursable or time-and-materials contracts allow the buyer to pay for actual effort, which can be more flexible when requirements are unclear.

Answer

Time-and-materials contract

Answer

Cost-plus contract

Answer

Outcome-based contract

Question 9

During an ERP implementation, the project team decides to disable segregation of duties (SoD) controls in the system to accelerate go-live. After go-live, the IS auditor identifies that a single user can perform incompatible functions. What is the BEST course of action?

Accepted Answer

Implement compensating controls such as enhanced monitoring and audit logs. When SoD controls cannot be immediately restored, the IS auditor's role is to ensure the risk is mitigated rather than simply accepted or ignored. Compensating controls such as enhanced monitoring, audit logging, and supervisory review provide detective coverage that reduces the risk of a single user performing incompatible functions. This is the most practical and audit-aligned response because it addresses the residual risk while remediation is planned.

Answer

Require reconfiguration of SoD controls before the next audit

Answer

Document the issue and accept the risk

Answer

Advise management to terminate the project manager

Question 10

An IS auditor is reviewing vendor management practices for a cloud-based SaaS solution. Which TWO of the following are critical elements to include in the contract's service level agreement (SLA)? (Select TWO.)

Accepted Answer

Guaranteed uptime percentage with penalties for non-compliance. Option A is correct because a SaaS SLA must define a measurable availability commitment, such as a guaranteed uptime percentage (e.g., 99.9%), along with remedies or service credits/penalties when the vendor fails to meet it, giving the auditor an enforceable performance metric. Option C is correct because the contract must clearly establish that the organization retains ownership of its data and specify portability/exit rights (e.g., data export formats and return or deletion upon termination), which are essential to avoid vendor lock-in and protect the organization's information assets. Option B is not relevant because the vendor's marketing plan is a commercial matter that has no bearing on service performance, security, or audit assurance. Option D is not relevant because employee training program details are internal vendor operational matters, not a critical SLA element for the customer. Option E is not relevant because, while disaster recovery is important, the SLA typically addresses recovery time and recovery point objectives (RTO/RPO) rather than the vendor's internal DR testing schedule.

Answer

The vendor's marketing plan for the solution

Answer

The vendor's employee training program details

Answer

The vendor's disaster recovery testing schedule

Question 11

An IS auditor is reviewing an agile software development project. Which of the following is the most important control to assess?

Accepted Answer

Sprint review. In agile development, the sprint review is the most important control to assess because it is the primary ceremony where the product increment is inspected and adapted, and stakeholders provide feedback. It ensures transparency, validates that the work meets the definition of done, and confirms that the product backlog is aligned with business needs. This control directly addresses the risk of building the wrong product.

Answer

Daily standup meetings

Answer

Retrospective

Answer

Product backlog

Question 12

Which of the following is an example of a detective control in the SDLC testing phase?

Accepted Answer

Penetration testing. Dynamic application security testing (DAST) is a detective control that identifies vulnerabilities in a running application.

Answer

Security awareness training

Answer

Threat modeling

Answer

Code review

Question 13

An IS auditor is reviewing an agile project. Which THREE of the following are controls the auditor should evaluate?

Accepted Answer

Sprint review. Sprint review (A) is a control the auditor should evaluate because it is the formal inspection-and-adapt event at the end of each sprint where the increment is demonstrated to stakeholders and feedback is captured, providing assurance that deliverables meet acceptance criteria. Retrospective actions (C) are a control because the retrospective produces documented improvement actions that must be tracked to closure, giving the auditor evidence of continuous process improvement and recurring-issue remediation. Product backlog prioritization (E) is a control because it governs what work enters the sprint and ensures business value, risk, and requirements are ordered and approved before development, supporting scope and change management. Burndown charts (B) are merely informational progress-tracking artifacts, and daily standups (D) are coordination/communication ceremonies; neither by itself provides the governance, approval, or remediation evidence the auditor needs as a control.

Answer

Burndown charts

Answer

Daily standup

Question 14

During a change management audit, the IS auditor notes that an emergency change was implemented to fix a critical security vulnerability. Which of the following should the auditor expect to find in the change documentation?

Accepted Answer

A rollback plan. Even for emergency changes, a rollback plan is a required control because emergency fixes carry elevated risk of unintended consequences, and the organization must be able to revert quickly if the fix causes outages or new issues. The rollback plan demonstrates that recovery was considered despite the compressed timeline. Auditors expect to see it in the change documentation.

Answer

A post-implementation review scheduled six months later

Answer

A formal change request approved by the Change Advisory Board (CAB) before implementation

Answer

A complete test plan executed before deployment

Question 15

An IS auditor is evaluating the change management process for a critical financial application. The auditor finds that all standard changes are approved by the Change Advisory Board (CAB). However, emergency changes are approved by the IT manager and later ratified by the CAB. Which of the following is the greatest risk associated with this process?

Accepted Answer

There is no clear definition of what constitutes an emergency change.. The greatest risk is that without a clear definition of what constitutes an emergency change, the emergency change process can be abused to bypass CAB review for changes that are not truly emergencies. This undermines the control environment and can lead to unauthorized or risky changes being implemented without proper oversight.

Answer

The IT manager may not have sufficient technical expertise to approve emergency changes.

Answer

Emergency changes may be delayed while waiting for CAB ratification.

Answer

The CAB may not have enough time to review emergency changes properly.

Question 16

An IS auditor is reviewing an agile software development project. Which TWO controls should the auditor expect to see in place?

Accepted Answer

Sprint retrospective meetings. Sprint retrospective meetings (D) are a core Scrum/agile ceremony where the team inspects its process and identifies improvements after each sprint, so an IS auditor should expect this control to be present to ensure continuous process improvement and team accountability. Sprint reviews with stakeholder participation (E) are likewise a standard agile control that provides transparency, validates delivered increments against stakeholder needs, and gives feedback for the product backlog, which supports governance and value delivery. The unmarked options do not belong because formal phase-gate approvals (A) and detailed pre-approved requirements documentation (B) reflect traditional waterfall controls rather than agile practices, and pair programming for all critical code (C) is an optional engineering practice, not a control the auditor should universally expect in an agile project.

Answer

Formal phase-gate approvals between design and development

Answer

Detailed requirements documentation approved before coding

Answer

Pair programming for all critical code

Question 17

An IS auditor is reviewing a project to replace a legacy claims processing system with a new cloud-based SaaS solution. The project team has completed the business case and feasibility study. Which of the following should be the auditor's PRIMARY concern at this stage?

Accepted Answer

The feasibility study includes a cost-benefit analysis that considers ongoing operational costs and exit strategies.. The correct answer focuses on the completeness of the feasibility study and business case, ensuring that all costs and strategic implications are considered. This is critical because an incomplete analysis can lead to budget overruns and failure to deliver value. Other options, while important, pertain to later phases such as vendor selection or implementation planning.

Answer

The data migration plan includes a rollback strategy in case of failure.

Answer

The SaaS contract includes a service level agreement (SLA) with uptime guarantees.

Answer

The project team has selected a vendor based on a demo that met all functional requirements.

Question 18

An IS auditor is reviewing the implementation of a new payroll system. The project manager has decided to use a pilot conversion approach, running the new system in parallel with the legacy system for one pay cycle. Which of the following is the MOST significant risk associated with this approach?

Accepted Answer

Reconciliation of output between the two systems may be complex and errors could go undetected.. The correct answer highlights the reconciliation risk, which is central to a parallel conversion. If not managed, discrepancies can lead to payroll errors and legal issues. Other risks like cost or confusion are secondary to the integrity of the payroll data and the controls ensuring accurate payments.

Answer

The parallel run may cause confusion among employees regarding which system is authoritative.

Answer

The legacy system may not be able to handle the additional processing load during the parallel run.

Answer

The cost of running two systems simultaneously may exceed the project budget.

Question 19

During an audit of a software development project, the IS auditor finds that the project team is using a DevOps approach with continuous integration and continuous deployment (CI/CD). Which of the following controls is MOST important to ensure the integrity of code changes in this environment?

Accepted Answer

The CI/CD pipeline enforces segregation of duties between developers and production deployers.. Segregation of duties is the most important control to ensure code integrity in a CI/CD environment because it prevents unauthorized changes and ensures that deployment is performed by someone other than the developer. Other controls like unit tests and peer reviews are valuable but can be circumvented or are not sufficient alone.

Answer

Code changes are peer-reviewed before being merged into the main branch.

Answer

Automated unit tests are run as part of the build pipeline.

Answer

The deployment process includes a rollback mechanism in case of failure.

Question 20

An IS auditor is reviewing the testing phase of a new system development project. The project team has conducted unit testing and system testing. Which TWO of the following additional tests are MOST important to ensure the system is ready for production? (Choose two.)

Accepted Answer

Performance testing. User acceptance testing and performance testing are critical before production. UAT confirms the system meets business needs and is usable, while performance testing ensures it can handle expected loads and meets non-functional requirements. Other tests like code review, regression testing, and disaster recovery testing are valuable but are either conducted earlier or are part of broader operational readiness.

Answer

Regression testing

Answer

Disaster recovery testing

Answer

Code review