CISA Information Systems Acquisition, Development, and Implementation — 50 Questions

Question 1

During a post-implementation review of a new financial system, the IS auditor finds that user acceptance testing (UAT) was completed with only 60% of test cases passed. Which of the following is the MOST significant risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The system may not fully meet business requirements, leading to user workarounds. Low UAT pass rate indicates unresolved defects or unmet user requirements, leading to user dissatisfaction and potential workarounds that compromise controls.

Answer

The system deployment was delayed

Answer

The system performance is below expectations

Answer

The project was not completed within the planned budget

Question 2

An organization is implementing an enterprise resource planning (ERP) system. The project team plans to migrate legacy data without performing a full reconciliation between source and target systems. As an IS auditor, which of the following should be your PRIMARY concern?

Accepted Answer

Incomplete or inaccurate data may be loaded into the new system. Data migration without reconciliation can cause undetected data corruption or loss, impacting financial reporting and operations.

Answer

The legacy system may be decommissioned prematurely

Answer

User acceptance testing may be delayed

Answer

The data migration may exceed the planned timeline

Question 3

In a waterfall SDLC, which phase requires formal sign-off from the business owner before proceeding to the next phase?

Accepted Answer

Requirements phase. In waterfall, each phase ends with a formal sign-off; the requirements phase is critical to ensure business needs are documented and approved.

Answer

Development phase

Answer

Design phase

Answer

Testing phase

Question 4

An IS auditor is reviewing an agile software development project. Which of the following would be the BEST evidence that adequate controls are in place for user acceptance?

Accepted Answer

Each sprint concludes with a sprint review attended by stakeholders. In agile, the sprint review is a ceremony where stakeholders inspect the increment and provide feedback, serving as a control for user acceptance.

Answer

The product backlog is managed by the product owner

Answer

Daily standup meetings are held to track progress

Answer

Retrospectives are conducted after each sprint

Question 5

During a vendor evaluation for a critical system, the IS auditor notes that the vendor's SOC 2 report includes an adverse opinion. What should be the auditor's PRIMARY recommendation?

Accepted Answer

Evaluate compensating controls or seek an alternative vendor. An adverse SOC 2 opinion indicates material weaknesses in controls; the organization should seek compensating controls or consider alternative vendors.

Answer

Negotiate a lower price to offset the risk

Answer

Accept the risk because the vendor is well-known

Answer

Request a customized SOC 2 report

Question 6

An organization is using a spiral model for a high-risk project. The IS auditor wants to ensure that risk assessment is performed at each iteration. Which of the following is the BEST evidence that this control is effective?

Accepted Answer

Each spiral iteration includes a risk analysis document. In the spiral model, each cycle includes risk analysis; documented risk assessments in iteration artifacts demonstrate this.

Answer

The project schedule shows spiral iterations

Answer

The project manager has a risk management plan

Answer

The system has passed user acceptance testing

Question 7

Which of the following is a primary advantage of fixed-price contracts in systems acquisition?

Accepted Answer

Predictable cost for the buyer. Fixed-price contracts provide cost certainty for the buyer, as the vendor bears the risk of cost overruns.

Answer

Vendor has incentive to complete quickly

Answer

Greater flexibility to change requirements

Answer

Lower total cost compared to time-and-materials

Question 8

An IS auditor is reviewing change management procedures. Which of the following situations would be of GREATEST concern?

Accepted Answer

An emergency change was implemented and not reviewed after resolution. Emergency changes bypass normal controls; without post-change review, unauthorized or flawed changes may persist unnoticed.

Answer

A standard change was implemented without CAB approval

Answer

The change request did not include an impact analysis

Answer

A normal change had a rollback plan that was not tested

Question 9

During a build vs. buy analysis, the IS auditor observes that the organization decided to build a custom application because no vendor solution met all requirements. Which of the following risks should the auditor emphasize?

Accepted Answer

Increased time-to-market and development costs. Custom development carries risk of longer time-to-market and higher cost due to unforeseen complexities.

Answer

Lack of customization

Answer

Dependence on external support

Answer

Vendor lock-in

Question 10

An organization is deploying a major system upgrade. The change request has been approved by CAB, but the deployment plan does not include a rollback procedure. As an IS auditor, what should you recommend?

Accepted Answer

Delay the deployment until a rollback plan is created and tested. Without a rollback plan, if the deployment fails, the system may be unavailable for an extended period, impacting business operations.

Answer

Perform the deployment during off-peak hours to minimize impact

Answer

Document the decision to skip rollback in the change record

Answer

Proceed with deployment as CAB approval is sufficient

Question 11

Which of the following is a key objective of the design phase in the SDLC?

Accepted Answer

To define system architecture and integrate security controls. The design phase defines the system architecture and ensures security controls are incorporated rather than added later.

Answer

To conduct user acceptance testing

Answer

To develop code

Answer

To gather business requirements

Question 12

An IS auditor is assessing an ERP implementation. Which of the following control concerns is MOST likely to arise from segregation of duties conflicts?

Accepted Answer

Unauthorized transactions or fraud. ERP systems often combine roles that were separate in legacy systems, increasing risk of fraud.

Answer

Data migration errors

Answer

Inadequate system performance

Answer

Integration complexity

Question 13

Which TWO of the following are typical controls in the testing phase of the SDLC? (Select two.)

Accepted Answer

Security testing (DAST/pen test). UAT ensures user acceptance, and security testing (e.g., DAST) identifies vulnerabilities before deployment.

Answer

Rollback plan testing

Answer

Code reviews

Answer

Threat modeling

Question 14

Which THREE of the following are essential elements of an emergency change request? (Select three.)

Accepted Answer

Test plan. Emergency changes require justification, a documented test plan (even if abbreviated), and a rollback plan to restore service if needed.

Answer

Impact analysis

Answer

Pre-approval from CAB

Question 15

Which TWO of the following are benefits of an iterative SDLC approach compared to waterfall? (Select two.)

Accepted Answer

Early and frequent feedback from stakeholders. Iterative approaches allow early feedback and adaptability to changing requirements, unlike waterfall's rigid sequential phases.

Answer

Simpler documentation requirements

Answer

Predictable project timeline

Answer

Reduced need for user involvement

Question 16

During which phase of the SDLC should security requirements be formally documented and approved by the business owner?

Accepted Answer

Requirements phase. Security requirements must be identified and approved early to ensure proper controls are built into the system. The requirements phase is the appropriate stage for this.

Answer

Design phase

Answer

Testing phase

Answer

Development phase

Question 17

An IS auditor is reviewing an agile software development project. Which of the following practices would BEST help ensure that security controls are adequately addressed?

Accepted Answer

Including security acceptance criteria in user stories. In agile, security requirements should be included in user stories and tested during the sprint. Accepting a user story only after successful testing ensures security is validated.

Answer

Requiring sign-off from the project sponsor before each sprint review

Answer

Performing a single comprehensive security test after all sprints are complete

Answer

Conducting a formal design review at the end of each sprint

Question 18

An organization is implementing a large ERP system. The project team plans to migrate legacy data to the new system. Which of the following is the MOST significant risk associated with data migration?

Accepted Answer

Inaccurate data mapping between legacy and new systems. Data migration often involves mapping old data to new structures. Inaccurate mapping can lead to data corruption or loss, which is a critical risk.

Answer

Insufficient training of end users

Answer

Lack of executive sponsorship

Answer

Inadequate segregation of duties in the new system

Question 19

An IS auditor is evaluating the change management process. Which of the following is the BEST indicator that emergency changes are being properly controlled?

Accepted Answer

Emergency changes are documented with a justification and promptly reviewed after implementation. Emergency changes require a documented rationale and timely post-implementation review to ensure proper authorization and minimal risk.

Answer

Emergency changes are approved by the change manager within 24 hours

Answer

Emergency changes are tested in a production-like environment before implementation

Answer

Emergency changes require approval from the CAB before implementation

Question 20

In a waterfall SDLC, when should user acceptance testing (UAT) typically occur?

Accepted Answer

After system testing and before deployment. UAT is performed after system testing is complete and before deployment to ensure the system meets user requirements.

Answer

After deployment

Answer

After coding but before unit testing

Answer

During the requirements phase