CISA Information Systems Acquisition, Development, and Implementation Practice Test 5 — 15 Questions

Question 1

During which phase of the SDLC should security requirements be formally documented and approved?

Accepted Answer

Requirements phase. Security requirements must be formally documented and approved during the Requirements phase of the SDLC because this is when functional and non-functional needs, including security controls, are defined before any design or coding begins. Integrating security at this stage ensures that confidentiality, integrity, and availability requirements are captured in the system specification, preventing costly rework later. The Requirements phase is the earliest point where stakeholders can review and approve security constraints, such as encryption standards or access control policies, aligning them with business objectives.

Answer

Design phase

Answer

Development phase

Answer

Testing phase

Question 2

An organization is implementing an ERP system and is concerned about segregation of duties conflicts. What is the most effective control to address this risk during implementation?

Accepted Answer

Implementing role-based access controls. Segregation of duties conflicts are best addressed by designing and implementing role-based access controls tailored to the organization's processes.

Answer

Performing a data migration risk assessment

Answer

Reviewing vendor SOC 2 reports

Answer

Conducting user acceptance testing

Question 3

An IS auditor is reviewing an agile software development project. Which of the following is the most important control to assess?

Accepted Answer

Sprint review. In agile, the sprint review provides an opportunity to demonstrate completed work and obtain stakeholder feedback, acting as a key control for quality and acceptance.

Answer

Daily standup meetings

Answer

Retrospective

Answer

Product backlog

Question 4

An organization is deciding between building a custom application and purchasing a commercial off-the-shelf (COTS) product. The primary factor favoring the build option is:

Accepted Answer

Greater control over features. Building a custom application allows for tailored functionality that meets unique business requirements, which is a key advantage over COTS.

Answer

Faster time to market

Answer

Lower initial cost

Answer

Reduced vendor dependency

Question 5

Which of the following is a key objective of a post-implementation review?

Accepted Answer

To determine if the system meets user requirements. A post-implementation review assesses whether the system meets its objectives and identifies lessons learned.

Answer

To conduct penetration testing

Answer

To approve the project budget

Answer

To select the vendor

Question 6

In the context of ITIL change management, which change type requires approval from the Change Advisory Board (CAB)?

Accepted Answer

Normal change. Normal changes require CAB approval because they have a higher risk and impact, unlike pre-approved standard changes or emergency fast-track changes.

Answer

Emergency change

Answer

Minor change

Answer

Standard change

Question 7

An IS auditor is evaluating the vendor selection process for a new system. Which of the following is the most important factor to include in the contract?

Accepted Answer

Audit rights. Audit rights are critical for the organization to verify the vendor's controls and compliance, especially for outsourced systems.

Answer

Timeframe for delivery

Answer

Fixed price

Answer

Warranty period

Question 8

During a spiral SDLC project, the IS auditor should focus on which aspect as the primary risk?

Accepted Answer

Incomplete risk assessment. The spiral model is risk-driven, so the primary risk is that risk assessment may be incomplete, leading to unaddressed issues.

Answer

Scope creep

Answer

Lack of documentation

Answer

Inadequate user involvement

Question 9

Which testing type is performed by end-users to verify that the system meets their needs?

Accepted Answer

User acceptance testing. User acceptance testing (UAT) is the final phase of the testing lifecycle where actual end-users validate that the system fulfills their business requirements and is ready for production deployment. Unlike technical testing types, UAT focuses on real-world workflows, data accuracy, and usability to confirm the system meets the agreed-upon acceptance criteria.

Answer

Security testing

Answer

Integration testing

Answer

Unit testing

Question 10

An organization is migrating data from a legacy system to a new ERP. What is the most critical data migration risk?

Accepted Answer

Data loss or corruption. Data integrity is the top risk during migration, as errors can lead to incorrect business operations and decisions.

Answer

Increased storage costs

Answer

Longer migration time

Answer

Incompatible hardware

Question 11

Which of the following is an example of a detective control in the SDLC testing phase?

Accepted Answer

Penetration testing. Dynamic application security testing (DAST) is a detective control that identifies vulnerabilities in a running application.

Answer

Security awareness training

Answer

Threat modeling

Answer

Code review

Question 12

An IS auditor is reviewing an emergency change that was implemented to fix a critical security vulnerability. What is the most important post-implementation step?

Accepted Answer

Document the change and obtain retrospective approval. After an emergency change, it is essential to document the change and obtain retrospective approval to maintain change management integrity.

Answer

Update the configuration management database

Answer

Notify all users

Answer

Conduct a risk assessment

Question 13

Which TWO of the following are key elements of a change request document?

Accepted Answer

Justification. A change request should include justification for the change and a rollback plan to mitigate risks.

Answer

Vendor contract

Answer

Project budget

Answer

User manual

Question 14

Which THREE of the following are typical controls in the design phase of the SDLC?

Accepted Answer

Designing security controls. Architecture review, threat modeling, and designing security controls are key design-phase controls to ensure security is built in.

Answer

Code review

Answer

User acceptance testing

Question 15

An IS auditor is reviewing an agile project. Which THREE of the following are controls the auditor should evaluate?

Accepted Answer

Sprint review. In agile, sprint reviews, product backlog prioritization, and retrospective actions are key controls to ensure quality and continuous improvement.

Answer

Burndown charts

Answer

Daily standup