CISA Information Systems Acquisition, Development, and Implementation Practice Test 3 — 15 Questions

Question 1

An organization is considering replacing its legacy financial system with a new ERP solution. Which of the following is the PRIMARY advantage of purchasing a commercial off-the-shelf (COTS) ERP package over building a custom system?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Faster implementation. COTS packages typically have a faster implementation timeline because the core functionality already exists, reducing development time.

Answer

Greater control over customization

Answer

Lower total cost of ownership

Answer

Complete alignment with business processes

Question 2

During a post-implementation review of a new customer relationship management (CRM) system, the IS auditor finds that the system is processing transactions slower than anticipated. What is the BEST initial course of action for the auditor?

Accepted Answer

Compare actual performance to the performance criteria in the business case. The auditor should first verify actual performance against the criteria defined in the business case to determine if objectives were met.

Answer

Recommend immediate performance tuning to resolve the issue

Answer

Report the issue to senior management immediately

Answer

Conduct a load test to identify bottlenecks

Question 3

An organization is implementing an agile methodology for a new software project. Which of the following is the MOST effective control to ensure that security requirements are addressed?

Accepted Answer

Including security requirements in the product backlog. In agile, including security requirements in the product backlog ensures they are prioritized and addressed in each sprint.

Answer

Conducting a single security requirements review at the start of the project

Answer

Requiring a separate security sprint after development

Answer

Performing a security audit only at the end of the project

Question 4

Which of the following is the PRIMARY purpose of a change advisory board (CAB) in the change management process?

Accepted Answer

To assess, prioritize, and authorize changes. The CAB is responsible for reviewing and approving changes, assessing risks, and ensuring proper planning and testing.

Answer

To approve all standard changes without review

Answer

To authorize emergency changes immediately

Answer

To develop technical solutions for change requests

Question 5

An IS auditor is reviewing a software development project that follows the waterfall model. Which of the following is the MAIN advantage of this methodology?

Accepted Answer

Clear milestones and documentation at each phase. Waterfall's sequential phases and formal sign-offs provide clear milestones and documentation.

Answer

Reduced risk of requirements misinterpretation

Answer

Early delivery of working software increments

Answer

Ability to accommodate changing requirements easily

Question 6

During an ERP implementation, the project team decides to customize the software to align with existing business processes. Which of the following risks is MOST likely to increase as a result of extensive customization?

Accepted Answer

Higher costs for future upgrades. Extensive customization of an ERP system typically involves modifying the core code or configuration beyond standard parameters. This creates a custom code base that diverges from the vendor's standard release, making future upgrades significantly more complex and costly because each upgrade requires re-applying and testing all customizations against the new version, often requiring specialized skills and extensive regression testing.

Answer

Increased vendor lock-in

Answer

Simpler data migration

Answer

Reduced user acceptance

Question 7

An IS auditor is reviewing the change management process for a critical financial application. Which of the following findings would be of GREATEST concern?

Accepted Answer

Emergency changes are implemented without subsequent CAB approval. Emergency changes bypassing CAB approval pose high risk as they may not undergo proper testing and review.

Answer

Standard changes are documented but not tracked individually

Answer

Change requests are logged in a spreadsheet instead of a dedicated system

Answer

The CAB meets only once per month

Question 8

Which of the following is the BEST control to ensure that user acceptance testing (UAT) is effective?

Accepted Answer

UAT testers are from the business and use realistic data. UAT should be performed by actual end users using real data to validate business requirements.

Answer

UAT scripts are written by developers

Answer

UAT is performed after deployment

Answer

UAT is conducted by the quality assurance team

Question 9

What is the PRIMARY purpose of conducting a static application security testing (SAST) during the development phase?

Accepted Answer

To identify security vulnerabilities in the source code. SAST analyzes source code for vulnerabilities early in the SDLC, allowing remediation before deployment.

Answer

To ensure the application is free of logic errors

Answer

To test the application's functionality

Answer

To validate that security requirements are met

Question 10

An organization is selecting a vendor for a new procurement system. Which of the following is the MOST important factor to include in the contract?

Accepted Answer

Right to audit the vendor's security controls. Audit rights ensure the organization can verify vendor controls and compliance, which is critical for outsourcing.

Answer

A clause limiting vendor liability

Answer

Fixed price for the entire contract term

Answer

Detailed service level agreements (SLAs)

Question 11

During a spiral model SDLC project, an IS auditor is reviewing risk assessment documentation. Which of the following would be the GREATEST concern?

Accepted Answer

Key risks identified in the first iteration are not reassessed in later iterations. The spiral model is risk-driven; failure to identify critical risks undermines the methodology and could lead to project failure.

Answer

Risk mitigation plans are not documented

Answer

The project uses a combination of waterfall and prototyping

Answer

Risk analysis is performed by the project manager alone

Question 12

Which of the following BEST describes the role of threat modeling in the design phase of the SDLC?

Accepted Answer

To analyze the system architecture for potential security threats. Threat modeling proactively identifies potential security threats and vulnerabilities in the system architecture to design appropriate controls.

Answer

To define functional requirements for the system

Answer

To test the application's resilience to attacks

Answer

To identify and mitigate security vulnerabilities in the code

Question 13

An organization is implementing a new payroll system using an agile methodology. Which TWO of the following are the MOST important controls for the IS auditor to assess?

Accepted Answer

The product backlog is prioritized and includes security requirements. In agile, the product backlog is the primary control for requirements, and sprint reviews provide stakeholder validation.

Answer

Comprehensive documentation of all design decisions

Answer

A formal change control board to approve all changes

Answer

A detailed project plan with all tasks upfront

Question 14

During a post-implementation review of a new accounting system, the IS auditor notes the following: the project was completed on time and within budget, but user satisfaction is low and there are several outstanding defect reports. Which THREE of the following are the MOST appropriate recommendations?

Accepted Answer

Compare actual benefits achieved against the business case. The review should identify lessons learned, address outstanding defects, and assess whether objectives were met beyond budget/schedule.

Answer

Request additional budget to fix the defects

Answer

Immediately escalate the defect reports to the project sponsor

Question 15

An organization is migrating from a legacy system to a new ERP. Which TWO of the following are the HIGHEST risks during data migration?

Accepted Answer

Incorrect data mapping between old and new systems. Data quality issues (incomplete/inaccurate data) and mapping errors are common risks that can lead to system failures.

Answer

Insufficient network bandwidth during cutover

Answer

Lack of user training on the new system

Answer

Lack of segregation of duties in the new system