CISA Information Systems Acquisition, Development, and Implementation Practice Test 4 — 15 Questions

Question 1

An organization is implementing a new financial system using the waterfall SDLC model. Which of the following is the MOST critical control to ensure that business requirements are met?

Accepted Answer

Formal user acceptance testing (UAT) sign-off. In the waterfall model, requirements are defined upfront and formal sign-off at each phase is critical. Formal user acceptance testing (UAT) is the key control to ensure the system meets business needs before deployment.

Answer

Automated unit testing results

Answer

Code reviews by the development team

Answer

Detailed technical design documents

Question 2

During an agile software development project, a sprint review meeting is conducted. What is the PRIMARY purpose of this meeting from an IS audit perspective?

Accepted Answer

To demonstrate the working product increment to stakeholders and gather feedback. The sprint review is a key control in agile to demonstrate completed work to stakeholders and obtain feedback. It serves as a form of user acceptance testing and helps ensure the product meets stakeholder needs.

Answer

To identify and document lessons learned for process improvement

Answer

To assign tasks to team members for the current sprint

Answer

To plan the tasks for the next sprint

Question 3

An IS auditor is reviewing a systems acquisition project that involves purchasing an ERP system. Which of the following is the MOST significant risk related to data migration during implementation?

Accepted Answer

Incomplete or inaccurate data conversion from legacy systems. Data migration is a critical risk in ERP implementations. Poor data quality from legacy systems can lead to errors, inconsistencies, and business disruption. Ensuring data integrity is paramount.

Answer

Inadequate security controls in the new system

Answer

Insufficient training of end users on the new system

Answer

Lack of integration testing between modules

Question 4

An organization is deciding between developing a custom application and purchasing a commercial off-the-shelf (COTS) product. The project manager favors a COTS solution because it offers faster deployment. Which of the following is the MOST important consideration for the IS auditor to evaluate in this build vs. buy decision?

Accepted Answer

The degree of vendor dependency and ability to customize. Vendor dependency is a critical risk in COTS acquisitions. The organization may become reliant on the vendor for updates, support, and customizations, which can affect long-term flexibility and costs.

Answer

Availability of skilled developers to maintain the custom solution

Answer

User training requirements for the new system

Answer

Total cost of ownership including maintenance and licensing

Question 5

During an SDLC audit, the IS auditor finds that security requirements were not formally documented during the requirements phase. Which of the following is the BEST recommendation to mitigate the associated risk?

Accepted Answer

Include security requirements in the design phase and obtain sign-off. Security requirements should be defined early to ensure controls are designed in, not bolted on. The best practice is to include security requirements in the requirements phase and have them reviewed by security experts.

Answer

Perform a penetration test after go-live

Answer

Conduct a vulnerability scan after deployment to identify security gaps

Answer

Implement a firewall and intrusion detection system

Question 6

An IS auditor is reviewing an emergency change that was implemented to fix a critical security vulnerability. Which of the following post-implementation controls is MOST important to ensure the change was properly managed?

Accepted Answer

A post-implementation review was performed by the Change Advisory Board (CAB). Emergency changes bypass normal CAB approval, so it is critical to document the change and have it retrospectively reviewed by the CAB to ensure proper governance.

Answer

The change request included a rollback plan

Answer

The change was tested in a production-like environment before deployment

Answer

The change was documented and approved by the change manager after implementation

Question 7

Which of the following is the PRIMARY objective of a post-implementation review of an information system?

Accepted Answer

To evaluate whether the system achieved its planned objectives and benefits. The post-implementation review aims to assess whether the system meets its intended objectives, including performance, user satisfaction, and business goals. Lessons learned are a secondary outcome.

Answer

To assess the performance of the project team

Answer

To document the technical architecture for future reference

Answer

To identify new requirements for future enhancements

Question 8

An IS auditor is reviewing a contract for a new software solution. Which of the following contract types poses the HIGHEST risk to the buyer if requirements are not well-defined?

Accepted Answer

Fixed-price contract. Fixed-price contracts are risky when requirements are unclear because the vendor may understate effort or charge high change orders. Time-and-materials contracts are safer for undefined requirements.

Answer

Time-and-materials contract

Answer

Cost-plus contract

Answer

Outcome-based contract

Question 9

In a spiral SDLC model, what is the primary purpose of risk analysis in each iteration?

Accepted Answer

To identify and resolve potential project risks early. The spiral model is risk-driven; each iteration includes a risk analysis to identify and mitigate project risks before proceeding to the next phase.

Answer

To assess user satisfaction with the prototype

Answer

To plan the next iteration's tasks

Answer

To define detailed functional requirements

Question 10

During an ERP implementation, the project team decides to disable segregation of duties (SoD) controls in the system to accelerate go-live. After go-live, the IS auditor identifies that a single user can perform incompatible functions. What is the BEST course of action?

Accepted Answer

Implement compensating controls such as enhanced monitoring and audit logs. SoD conflicts are a high-risk issue. The auditor should recommend immediate implementation of compensating controls (e.g., enhanced monitoring, dual approval) to mitigate risk until the system is reconfigured.

Answer

Require reconfiguration of SoD controls before the next audit

Answer

Document the issue and accept the risk

Answer

Advise management to terminate the project manager

Question 11

An IS auditor is reviewing change management procedures and finds that standard changes are approved by the change manager without CAB review. What is the auditor's BEST conclusion?

Accepted Answer

This is acceptable provided that standard changes are clearly defined and low-risk. Standard changes are pre-approved, low-risk changes that do not require CAB review. This is acceptable if the criteria for standard changes are properly defined.

Answer

The change manager should be a member of the CAB

Answer

The auditor should recommend that all changes go through CAB

Answer

This is a control weakness because all changes should be reviewed by the CAB

Question 12

During a system development project, the IS auditor notes that code reviews are performed only after the code is unit tested. Which of the following is the MOST significant risk associated with this practice?

Accepted Answer

Defects may be discovered later in the development lifecycle, increasing rework costs. Code reviews should be performed before unit testing to catch defects early. Delaying reviews until after testing may lead to rework if issues are found, increasing costs and time.

Answer

Code reviews may be less effective because developers are reluctant to critique tested code

Answer

Unit tests may mask code quality issues

Answer

The code review process may overlook security vulnerabilities

Question 13

An IS auditor is evaluating an organization's SDLC controls for a new system. Which TWO of the following are key controls that should be in place during the design phase? (Select TWO.)

Accepted Answer

Architecture review by a senior architect. Architecture review by a senior architect is a key control during the design phase because it ensures the system's high-level structure aligns with security, scalability, and business requirements before development begins. This review catches design flaws early, reducing costly rework and preventing architectural weaknesses that could be exploited later. It is a formal gate in the SDLC that validates the design against established patterns and standards.

Answer

Static application security testing (SAST)

Answer

User acceptance testing (UAT)

Answer

Regression testing

Question 14

An organization is implementing a new CRM system using an iterative development methodology. The IS auditor wants to verify that appropriate controls are in place. Which THREE of the following are essential controls for iterative development? (Select THREE.)

Accepted Answer

Risk assessment at the start of each iteration. Iterative development requires continuous stakeholder involvement, version control, and risk assessment each iteration. These controls ensure the evolving system meets requirements and manages risks.

Answer

Formal sign-off on a complete requirements document before development begins

Answer

A mandatory change control board for every change

Question 15

An IS auditor is reviewing vendor management practices for a cloud-based SaaS solution. Which TWO of the following are critical elements to include in the contract's service level agreement (SLA)? (Select TWO.)

Accepted Answer

Guaranteed uptime percentage with penalties for non-compliance. The SLA should define performance metrics (uptime) and data ownership/portability to ensure business continuity and data control. Audit rights are also important but are often in a separate clause.

Answer

The vendor's marketing plan for the solution

Answer

The vendor's employee training program details

Answer

The vendor's disaster recovery testing schedule