CISA Information Systems Acquisition, Development, and Implementation Practice Test 6 — 15 Questions

Question 1

An IS auditor is reviewing a waterfall SDLC project that has completed the requirements phase. Which of the following is the greatest risk to the project?

Accepted Answer

A key business stakeholder did not sign off on the requirements.. In waterfall, requirements are defined upfront and changes are difficult. If a key stakeholder did not sign off, there is a risk that later phases will be based on incomplete or incorrect requirements.

Answer

The project manager left the company.

Answer

The development team is unfamiliar with the technology.

Answer

The design phase is behind schedule.

Question 2

During an agile software development project, which of the following events provides the best opportunity for the IS auditor to assess the effectiveness of controls implemented in the current sprint?

Accepted Answer

Sprint review. The sprint review is a demonstration of working software where controls can be observed. The retrospective is about process improvement, not control assessment.

Answer

Sprint planning meeting

Answer

Daily standup meeting

Answer

Sprint retrospective

Question 3

An organization is considering whether to build a custom application or purchase a commercial off-the-shelf (COTS) product. Which of the following factors would most strongly support a build decision?

Accepted Answer

The required functionality is unique to the organization's competitive advantage.. When the organization's processes are unique and provide a competitive advantage, custom development allows for exact fit and control.

Answer

Short time to market is critical.

Answer

The vendor offers a robust service-level agreement (SLA).

Answer

The organization has limited in-house development resources.

Question 4

An IS auditor is reviewing a post-implementation review report for a new ERP system. Which of the following findings would be of greatest concern to the auditor?

Accepted Answer

Several segregation of duties conflicts were identified and not resolved.. Segregation of duties conflicts in an ERP can lead to fraud or errors. The other findings are important but not as critical from a control perspective.

Answer

The implementation took three months longer than planned.

Answer

The project exceeded the budget by 15%.

Answer

User acceptance testing (UAT) was completed with only 80% test coverage.

Question 5

During a change management audit, the IS auditor notes that an emergency change was implemented to fix a critical security vulnerability. Which of the following should the auditor expect to find in the change documentation?

Accepted Answer

A rollback plan. Emergency changes require a rollback plan to ensure the system can be restored if the change fails. A full test plan may be abbreviated.

Answer

A post-implementation review scheduled six months later

Answer

A formal change request approved by the Change Advisory Board (CAB) before implementation

Answer

A complete test plan executed before deployment

Question 6

Which of the following is the primary purpose of conducting a static application security test (SAST) during the development phase of the SDLC?

Accepted Answer

To identify security vulnerabilities in the source code. SAST analyzes source code for vulnerabilities early in development, allowing fixes before deployment.

Answer

To ensure the application is free of runtime errors

Answer

To validate that the application meets business requirements

Answer

To test the application's performance under load

Question 7

An organization is acquiring a new financial system. The contract includes a clause that allows the organization to audit the vendor's controls. Which type of report would most efficiently provide assurance over the vendor's internal controls?

Accepted Answer

SOC 2 report. A SOC 2 report is specifically designed to provide assurance over a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy, which directly addresses the need to audit the vendor's internal controls for a financial system. It is more efficient than other options because it is a standardized, independent assessment that covers the control environment relevant to financial data processing.

Answer

Financial audit report

Answer

Penetration test report

Answer

ISO 27001 certificate

Question 8

During an ERP implementation, data migration is a critical activity. Which of the following controls would be most effective in ensuring the accuracy and completeness of migrated data?

Accepted Answer

Performing a trial migration and reconciling the results. Reconciliation reports compare source and target data, providing evidence of completeness and accuracy. Other options are less direct.

Answer

Using automated data extraction tools

Answer

Assigning a data owner for each data field

Answer

Running parallel processing for one month

Question 9

An IS auditor is reviewing the system design phase of a project. Which of the following activities is most important to ensure that security is adequately addressed?

Accepted Answer

Conducting a threat modeling exercise. Threat modeling identifies potential security threats and informs the design of controls, ensuring security is built in.

Answer

Creating a data flow diagram

Answer

Developing a detailed project schedule

Answer

Reviewing the budget for security tools

Question 10

Which of the following is a key advantage of using an iterative SDLC model over a waterfall model?

Accepted Answer

Provides more flexibility to adapt to changing requirements. Iterative models allow for adjustments based on feedback and changing requirements, which is a key advantage.

Answer

Reduces the need for user involvement

Answer

Better suited for projects with stable requirements

Answer

Easier to manage project costs

Question 11

An IS auditor is evaluating the change management process for a critical financial application. The auditor finds that all standard changes are approved by the Change Advisory Board (CAB). However, emergency changes are approved by the IT manager and later ratified by the CAB. Which of the following is the greatest risk associated with this process?

Accepted Answer

There is no clear definition of what constitutes an emergency change.. Without a well-defined definition of what constitutes an emergency, changes could be misclassified to bypass CAB scrutiny, weakening controls.

Answer

The IT manager may not have sufficient technical expertise to approve emergency changes.

Answer

Emergency changes may be delayed while waiting for CAB ratification.

Answer

The CAB may not have enough time to review emergency changes properly.

Question 12

An organization is implementing a new CRM system using an agile methodology. The IS auditor wants to assess whether security requirements are being addressed. What is the best evidence for the auditor to review?

Accepted Answer

The product backlog. The product backlog contains user stories, including security-related stories. Reviewing them shows whether security requirements are explicitly included.

Answer

The security policy

Answer

The sprint retrospective minutes

Answer

The system architecture document

Question 13

An IS auditor is reviewing a post-implementation review of a new payroll system. Which TWO findings should most concern the auditor? (Select two.)

Accepted Answer

User acceptance testing did not include all payroll scenarios.. Inaccurate pay calculations and unresolved segregation of duties issues directly impact control objectives and financial accuracy.

Answer

The project was completed 10% over budget.

Answer

The vendor's implementation team was helpful.

Answer

The system's response time is slower than expected.

Question 14

An organization is planning to purchase a cloud-based HR system. Which THREE of the following should be included in the vendor contract to ensure adequate control and oversight? (Select three.)

Accepted Answer

Right to audit the vendor's controls. A right to audit the vendor's controls (Option B) is essential for ensuring that the cloud-based HR system's security and operational controls are functioning as agreed. This contractual clause allows the organization to verify compliance with policies, regulations, and the vendor's own security assertions, such as SOC 2 Type II reports or ISO 27001 certifications, through direct examination or independent third-party assessments.

Answer

A list of all subprocessors

Answer

A fixed-price payment schedule

Question 15

During a change management audit, which TWO of the following are essential elements of a normal change request? (Select two.)

Accepted Answer

Justification for the change. A change request should include justification and an impact analysis to assess risks and benefits before approval.

Answer

The name of the developer who will implement the change

Answer

The project manager's approval

Answer

A list of all users affected