CISA Information Systems Acquisition, Development, and Implementation Practice Test 2 — 15 Questions

Question 1

During which phase of the SDLC should security requirements be formally documented and approved by the business owner?

Accepted Answer

Requirements phase. Security requirements must be identified and approved early to ensure proper controls are built into the system. The requirements phase is the appropriate stage for this.

Answer

Design phase

Answer

Testing phase

Answer

Development phase

Question 2

An IS auditor is reviewing an agile software development project. Which of the following practices would BEST help ensure that security controls are adequately addressed?

Accepted Answer

Including security acceptance criteria in user stories. In agile, security requirements should be included in user stories and tested during the sprint. Accepting a user story only after successful testing ensures security is validated.

Answer

Requiring sign-off from the project sponsor before each sprint review

Answer

Performing a single comprehensive security test after all sprints are complete

Answer

Conducting a formal design review at the end of each sprint

Question 3

An organization is implementing a large ERP system. The project team plans to migrate legacy data to the new system. Which of the following is the MOST significant risk associated with data migration?

Accepted Answer

Inaccurate data mapping between legacy and new systems. Data migration often involves mapping old data to new structures. Inaccurate mapping can lead to data corruption or loss, which is a critical risk.

Answer

Insufficient training of end users

Answer

Lack of executive sponsorship

Answer

Inadequate segregation of duties in the new system

Question 4

An IS auditor is evaluating the change management process. Which of the following is the BEST indicator that emergency changes are being properly controlled?

Accepted Answer

Emergency changes are documented with a justification and promptly reviewed after implementation. Emergency changes require a documented rationale and timely post-implementation review to ensure proper authorization and minimal risk.

Answer

Emergency changes are approved by the change manager within 24 hours

Answer

Emergency changes are tested in a production-like environment before implementation

Answer

Emergency changes require approval from the CAB before implementation

Question 5

In a waterfall SDLC, when should user acceptance testing (UAT) typically occur?

Accepted Answer

After system testing and before deployment. UAT is performed after system testing is complete and before deployment to ensure the system meets user requirements.

Answer

After deployment

Answer

After coding but before unit testing

Answer

During the requirements phase

Question 6

An organization is considering whether to build a custom application or purchase a commercial off-the-shelf (COTS) product. Which of the following factors is MOST important when deciding to build rather than buy?

Accepted Answer

Need for highly specialized functionality not available in the market. When an organization requires highly specialized functionality that is not available in any commercial off-the-shelf (COTS) product, building a custom application becomes the only viable option. COTS products are designed for broad market needs and often lack the unique features or compliance requirements that a custom solution can provide. This factor overrides cost, time, and maintenance considerations because no amount of configuration or customization of a COTS product can meet the specific functional gap.

Answer

Reduced need for ongoing maintenance

Answer

Faster time to market

Answer

Lower initial cost

Question 7

An IS auditor is reviewing a contract with a vendor for a new financial system. Which of the following clauses is MOST critical to ensure auditability?

Accepted Answer

Right to audit the vendor's operations and controls. Audit rights allow the organization to review the vendor's controls and operations, which is essential for assurance.

Answer

Penalties for non-performance

Answer

Service level agreements (SLAs) for system uptime

Answer

Data ownership and confidentiality provisions

Question 8

During a post-implementation review of a system, an IS auditor finds that the actual transaction processing time is 30% slower than projected. What should the auditor recommend FIRST?

Accepted Answer

Conduct a performance analysis to identify bottlenecks. The root cause should be identified before recommending specific actions. Performance testing or analysis will reveal the cause.

Answer

Upgrade the server hardware immediately

Answer

Reject the system and revert to the legacy system

Answer

Adjust user expectations to match actual performance

Question 9

Which of the following is a key control in the deployment phase of the SDLC?

Accepted Answer

Rollback plan. A rollback plan ensures that if deployment fails, the system can be restored to a known good state.

Answer

Threat modeling

Answer

User acceptance testing

Answer

Code review

Question 10

An IS auditor is assessing the controls in an agile development environment. What is the MOST effective way to verify that security testing is performed iteratively?

Accepted Answer

Reviewing the project's definition of done for each sprint. In agile development, security testing must be integrated into each sprint to ensure continuous validation. The 'definition of done' (DoD) is the team's checklist for completing a user story; if it explicitly includes security testing tasks (e.g., static analysis, dynamic scans, or penetration tests), then verifying the DoD proves that security testing was performed iteratively. Option D directly examines this artifact, providing objective evidence of iterative security testing.

Answer

Observing a daily standup meeting

Answer

Interviewing the product owner about security priorities

Answer

Examining the final security test report after release

Question 11

In a spiral model SDLC, risk analysis is performed at the beginning of each iteration. What is the PRIMARY benefit of this approach?

Accepted Answer

It allows for early detection and mitigation of project risks. By identifying and mitigating risks early in each cycle, the spiral model reduces the likelihood of major problems later.

Answer

It reduces the number of deliverables

Answer

It eliminates the need for user acceptance testing

Answer

It ensures all requirements are gathered upfront

Question 12

An organization is implementing a new ERP system and is concerned about segregation of duties (SoD) conflicts. What is the BEST approach to address this during the implementation?

Accepted Answer

Configure role-based access controls with SoD rules in the system. Configuring SoD rules within the ERP system helps enforce segregation and prevent conflicts during operations.

Answer

Assign all administrative rights to a single user for efficiency

Answer

Rely on manual compensating controls after go-live

Answer

Document SoD conflicts for future resolution

Question 13

An IS auditor is reviewing a vendor's SOC 2 report as part of a systems acquisition. Which TWO aspects should the auditor verify to ensure the report is reliable?

Accepted Answer

The report was issued within the last 12 months. The auditor must ensure the SOC 2 report is from a qualified auditor and covers the relevant period for the current evaluation.

Answer

The report includes a description of the vendor's business continuity plan

Answer

The report includes a list of the vendor's customers

Answer

The report contains the vendor's internal control objectives

Question 14

An organization is adopting a DevOps approach for system development. Which THREE controls should an IS auditor expect to see in place to maintain security and compliance?

Accepted Answer

Automated security scanning integrated into the CI/CD pipeline. In DevOps, automated security scanning, infrastructure as code with security review, and continuous monitoring are key controls to integrate security into the pipeline.

Answer

Annual penetration testing after the release

Answer

Manual code review for every change before deployment

Question 15

Which TWO of the following are characteristics of the iterative SDLC model?

Accepted Answer

User feedback is incorporated after each iteration. Iterative models develop systems through repeated cycles (iterations) that incorporate user feedback, unlike waterfall where requirements are fixed upfront.

Answer

The final product is delivered only at the end of the project

Answer

Requirements are defined in detail at the start of the project

Answer

Risk analysis is performed only at the beginning