CISA Information Systems Acquisition, Development and Implementation — 10 Questions

Question 1

A company is replacing its legacy on-premises ERP system with a cloud-based SaaS solution. The project manager is concerned about data migration risks. Which of the following is the BEST approach to mitigate data integrity issues during migration?

Accepted Answer

Run parallel processing and compare outputs. Option D is correct because running parallel processing allows the legacy and new SaaS systems to operate simultaneously, enabling real-time comparison of outputs. This approach directly validates data integrity by detecting discrepancies during migration, not after, which is critical for ERP systems where transactional accuracy is paramount.

Answer

Perform data validation after migration

Answer

Use data transformation tools to convert formats

Answer

Implement data reconciliation reports post-migration

Question 2

An organization is developing a new customer portal. The development team wants to use an agile methodology. Which of the following is a key benefit of using agile for this project?

Accepted Answer

Continuous stakeholder feedback is incorporated. Agile methodologies emphasize iterative development with continuous stakeholder feedback, which is critical for a customer portal where user needs evolve. This ensures the final product aligns with actual requirements, reducing rework and increasing satisfaction. Option A directly captures this core benefit.

Answer

Detailed requirements are defined upfront

Answer

Documentation is minimized to save time

Answer

The entire system is delivered at once

Question 3

During the user acceptance testing (UAT) phase of a new financial application, the business users report that the system calculates interest incorrectly for certain loan types. The project manager wants to fix this quickly. Which of the following is the BEST course of action?

Accepted Answer

Log the defect and perform impact analysis before approving a fix. Option D is correct because in the UAT phase, any defect must be formally logged and subjected to impact analysis before a fix is approved. This ensures that the proposed change does not introduce new risks, break other functionality, or violate regulatory compliance—critical for a financial application handling interest calculations. Skipping this process could lead to cascading failures or audit findings.

Answer

Instruct the business to work around the issue until the next release

Answer

Authorize the development team to fix the bug immediately and re-deploy

Answer

Roll back to the previous version of the application

Question 4

An IT auditor is reviewing the system development life cycle (SDLC) process for a critical application. Which of the following findings would be of MOST concern?

Accepted Answer

Developers have production database access. Developers having direct production database access violates the principle of segregation of duties and poses a significant risk of unauthorized data modification, deletion, or exfiltration. In a well-controlled SDLC, production access should be restricted to operations or DBA teams, with changes promoted through automated deployment pipelines. This finding directly undermines data integrity and confidentiality controls.

Answer

Test data is refreshed from production monthly

Answer

Developers use local development environments

Answer

Code reviews are performed by senior developers

Question 5

When implementing a commercial off-the-shelf (COTS) software package, which of the following is the MOST important activity to ensure the software meets business requirements?

Accepted Answer

Performing a gap analysis between requirements and software features. Performing a gap analysis is the most important activity because it systematically maps each business requirement against the COTS software's delivered features, identifying any shortfalls that must be addressed through configuration, customization, or process adaptation. Without this structured comparison, the organization risks deploying software that fails to support critical business processes, leading to costly rework or project failure.

Answer

Conducting a vendor demonstration

Answer

Developing a project plan with milestones

Answer

Reviewing the software's technical architecture

Question 6

A company is implementing a new procurement system. The project team is considering using a rapid application development (RAD) methodology. Which of the following is a potential risk of using RAD?

Accepted Answer

Inadequate documentation. RAD prioritizes speed and iterative prototyping over formal documentation. Because the focus is on quickly delivering working software through user feedback and short development cycles, comprehensive documentation is often neglected or produced after the fact, leading to inadequate records for maintenance, auditing, and compliance.

Answer

Reduced stakeholder involvement

Answer

Longer development time

Answer

Difficulty in prototyping

Question 7

An organization is developing a mobile app that will handle personal health information (PHI). The security team mandates that data must be encrypted both in transit and at rest. Which of the following implementation strategies BEST ensures compliance?

Accepted Answer

Implement TLS for data in transit and AES-256 encryption for data at rest. Option D is correct because it uses TLS (the modern, secure successor to SSL) to encrypt data in transit, ensuring confidentiality and integrity during network communication, and AES-256, a strong symmetric encryption standard, to encrypt data at rest. This combination directly satisfies the mandate for encryption both in transit and at rest, as TLS protects against eavesdropping and tampering on the wire, while AES-256 protects stored PHI from unauthorized access if the device is lost or compromised.

Answer

Use HTTPS for all network communication and store data in plaintext

Answer

Use SSL and encrypt all data with a simple XOR cipher

Answer

Rely on platform-level encryption provided by the mobile OS

Question 8

In a traditional waterfall SDLC, when should the test plan be developed?

Accepted Answer

During the design phase. In a traditional waterfall SDLC, the test plan should be developed during the design phase because testing activities must be planned in parallel with system design to ensure that test cases, test data, and acceptance criteria are aligned with the design specifications. This allows for early identification of testability issues and ensures that the test plan is ready before coding begins, enabling a structured and efficient testing process.

Answer

During the implementation phase

Answer

During the coding phase

Answer

During the requirements phase

Question 9

An IT auditor is evaluating the change management process for a financial trading system. Which of the following is the BEST indicator of a mature change management process?

Accepted Answer

All changes are logged and require automated approval workflows. Option B is correct because a mature change management process requires that all changes be formally logged and subjected to automated approval workflows. This ensures traceability, segregation of duties, and auditability, which are critical for a financial trading system where unauthorized or untracked changes could lead to financial loss or regulatory non-compliance.

Answer

Changes are documented after deployment

Answer

Developers can deploy changes directly to production if urgent

Answer

Changes are approved verbally by the IT manager

Question 10

A company is integrating a third-party payment gateway into its e-commerce platform. Which of the following is the MOST important security control to implement?

Accepted Answer

Validate all input from the payment gateway. Option C is correct because input validation from the payment gateway is the most critical security control. The payment gateway returns data (e.g., transaction status, amount, token) that is consumed by the e-commerce platform. Without strict validation, an attacker could inject malicious payloads (e.g., SQL injection, XSS) via manipulated gateway responses, leading to data breaches or unauthorized transactions. This control directly prevents injection attacks at the integration boundary.

Answer

Implement role-based access control

Answer

Log all transactions

Answer

Encrypt all data with SSL