CISA Information Systems Acquisition, Development, and Implementation Practice Test 7 — 15 Questions

Question 1

During which phase of the waterfall SDLC should security requirements be formally documented and approved by the business owner?

Accepted Answer

Requirements phase. In the waterfall model, security requirements must be defined during the requirements phase to ensure they are integrated into the design. Formal sign-off by the business owner ensures accountability.

Answer

Development phase

Answer

Design phase

Answer

Testing phase

Question 2

An IS auditor is reviewing an agile project that uses Scrum. Which event provides the best opportunity for the auditor to assess whether completed user stories meet the defined acceptance criteria?

Accepted Answer

Sprint review. The sprint review is a formal meeting where the development team demonstrates completed work to stakeholders. The auditor can observe validation of acceptance criteria and gather evidence of user acceptance.

Answer

Daily standup

Answer

Retrospective

Answer

Sprint planning

Question 3

An organization is considering acquiring a commercial off-the-shelf (COTS) ERP system. Which of the following risks is most effectively mitigated by including a contractual clause for audit rights?

Accepted Answer

Inadequate vendor security controls. Audit rights allow the organization to verify that the vendor's controls are operating effectively. This directly addresses the risk of inadequate vendor security controls, which could expose the organization to data breaches or compliance violations.

Answer

Incompatibility with existing infrastructure

Answer

Vendor lock-in due to proprietary data formats

Answer

Cost overruns from customization

Question 4

An IS auditor is reviewing a post-implementation review report for a new financial system. Which finding would most indicate that the project did not meet its objectives?

Accepted Answer

The system processed transactions 20% slower than projected. The post-implementation review should compare actual performance against projections. Significant performance degradation indicates the system is not meeting its intended performance objectives, which is a key project goal.

Answer

Three minor change requests were submitted in the first month

Answer

Users required additional training after go-live

Answer

The project budget was exceeded by 5%

Question 5

Which type of change in ITIL requires approval from the Change Advisory Board (CAB) before implementation?

Accepted Answer

Normal change. Normal changes are those that are not pre-approved or emergency. They require assessment and approval by the CAB to evaluate risks and impacts.

Answer

Emergency change

Answer

Standard change

Answer

All changes

Question 6

An organization is implementing a new CRM system and has chosen a build (in-house development) approach over buying a COTS product. Which of the following is the most significant risk of this decision?

Accepted Answer

Higher likelihood of project delays and budget overruns. In-house development carries a higher risk of project delays and budget overruns due to unforeseen technical challenges, scope creep, and resource constraints. This is a well-known risk in custom development projects.

Answer

Inability to customize the system to meet user requirements

Answer

Reduced control over security and data privacy

Answer

Vendor lock-in due to proprietary technology

Question 7

During a spiral SDLC project, the project team has completed a risk analysis and created a prototype. What is the most likely next step in the spiral model?

Accepted Answer

Develop the next level of the product based on the risk analysis. In the spiral model, each iteration begins with identifying objectives, evaluating alternatives, and resolving risks through risk analysis. After completing risk analysis and building a prototype, the next step is to develop the next level of the product, incorporating the risk analysis findings to refine requirements and design. This ensures that high-risk areas are addressed incrementally before proceeding to subsequent phases.

Answer

Deploy the system to production

Answer

Obtain formal sign-off from the business owner on requirements

Answer

Conduct user acceptance testing (UAT)

Question 8

An IS auditor is reviewing the change management process for a critical financial application. Which of the following is the most important element to verify in an emergency change request?

Accepted Answer

A documented rollback plan. For emergency changes, speed is critical, but a rollback plan is essential to ensure the change can be reversed if it causes issues. This minimizes the impact on operations.

Answer

Approval from the Change Advisory Board (CAB)

Answer

Extensive user acceptance testing (UAT) results

Answer

A completed impact analysis

Question 9

Which of the following is a key control during the deployment phase of a system development life cycle?

Accepted Answer

Rollback plan. The deployment phase should include a rollback plan to revert to the previous state if the new system fails. This is a critical control to minimize downtime and data loss.

Answer

Code review

Answer

Threat modeling

Answer

User acceptance testing (UAT)

Question 10

An organization is evaluating two vendors for a critical cloud-based ERP system. Which TWO contractual clauses are most important to include to ensure the organization can monitor vendor performance and security? (Select TWO)

Accepted Answer

Audit rights. Service level agreements (SLAs) define performance metrics and remedies for breaches, ensuring accountability. Audit rights allow the organization to verify the vendor's controls, which is essential for security and compliance.

Answer

Data ownership clause

Answer

Indemnification clause

Answer

Non-disclosure agreement (NDA)

Question 11

An IS auditor is reviewing a project that uses an iterative SDLC approach. Which THREE controls should the auditor expect to see in place during the development iterations? (Select THREE)

Accepted Answer

Code reviews. Code reviews ensure code quality and security. Static application security testing (SAST) identifies vulnerabilities in source code. Unit testing validates individual components. These are key controls in iterative development.

Answer

Formal sign-off on requirements before each iteration

Answer

User acceptance testing (UAT) before each iteration

Question 12

During a post-implementation review of a new payroll system, the IS auditor identifies several outstanding issues. Which TWO issues should be considered most critical to address immediately? (Select TWO)

Accepted Answer

The system's tax calculation module produced incorrect results for a subset of employees. Unauthorized overtime payments indicate a segregation of duties or control weakness that could lead to fraud. Inaccurate tax calculations could result in regulatory penalties and employee dissatisfaction. Both have significant financial and compliance impacts.

Answer

The system is running 5% slower than expected

Answer

Some employees have not completed training

Answer

The user manual is not yet finalized

Question 13

An organization is implementing a large ERP system. The project manager is concerned about segregation of duties conflicts. Which THREE controls should the IS auditor recommend to mitigate segregation of duties risks during implementation? (Select THREE)

Accepted Answer

Use automated segregation of duties monitoring tools. Segregation of duties conflicts can be mitigated by enforcing access controls based on roles, using automated tools to detect conflicting access, and establishing compensating controls (e.g., dual approval) where segregation is not possible.

Answer

Delay deployment until all segregation conflicts are resolved

Answer

Conduct a single user acceptance test (UAT) at the end of the project

Question 14

An IS auditor is reviewing a change management process. Which TWO elements should be documented in a normal change request to ensure adequate governance? (Select TWO)

Accepted Answer

Test plan. A change request should include a test plan to verify the change works as intended and a rollback plan to revert if the change fails. These are critical for risk management and governance.

Answer

Vendor contact information

Answer

Change requester's name

Answer

Project budget remaining

Question 15

During the design phase of an SDLC, which TWO activities should be performed to ensure security is integrated into the system? (Select TWO)

Accepted Answer

Threat modeling. Architecture review ensures the system design meets security requirements, and threat modeling identifies potential threats and vulnerabilities early. Both are proactive security controls in the design phase.

Answer

User acceptance testing (UAT)

Answer

Code review

Answer

Penetration testing