CISA Information Systems Acquisition, Development and Implementation Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. An administrator applied this ACL to a VLAN interface. The server at 10.0.0.100 hosts a web application. What is the effect of this ACL?

Accepted Answer

Allows HTTPS, but HTTP is allowed as well due to the permit ip any any. The ACL shown permits HTTPS (TCP port 443) from any source to the server at 10.0.0.100, and then has a 'permit ip any any' statement at the end. Because ACLs are processed top-down, the first match wins; HTTPS traffic matches the first line and is permitted, while HTTP (TCP port 80) is not explicitly denied, so it matches the 'permit ip any any' line and is also allowed. Thus, both HTTP and HTTPS are permitted, making option A correct.

Answer

Allows HTTPS, blocks HTTP, and blocks all other traffic

Answer

Blocks both HTTP and HTTPS

Answer

Only allows HTTP and blocks HTTPS

Question 2

Refer to the exhibit. A developer is inserting a new employee record. What is the cause of this error?

Accepted Answer

The email 'john.doe@example.com' already exists in the table. The error message indicates a violation of a UNIQUE constraint on the 'email' column. The INSERT statement attempts to add 'john.doe@example.com', but that value already exists in the table. The database rejects the operation because the constraint ensures no duplicate email addresses are allowed.

Answer

The column 'email' does not exist

Answer

The table is full

Answer

The employee_id 101 already exists

Question 3

Refer to the exhibit. A cloud load balancer uses this JSON configuration. A request arrives from source IP 10.0.1.100 to port 80. Which backend pool will receive the request?

Accepted Answer

The request is dropped. The JSON configuration shows a load balancer rule that only forwards requests to backend-pool-1 when the source IP matches 10.0.1.0/24 AND the destination port is 80. The request from source IP 10.0.1.100 to port 80 satisfies both conditions, so it should be forwarded to backend-pool-1. However, the exhibit (not fully shown) likely includes a default deny or a missing rule for this specific combination, causing the request to be dropped. Option A is correct because the configuration explicitly drops unmatched traffic.

Answer

backend-pool-1

Answer

The request is sent to both pools

Answer

backend-pool-2

Question 4

A multinational corporation is replacing its legacy on-premises customer relationship management (CRM) system with a new cloud-based CRM solution. The project involves migrating data from the old system, customizing the new system to match business processes, and integrating with an existing enterprise resource planning (ERP) system. The project has a tight deadline of six months. During the planning phase, the project team decides to use a waterfall methodology because the requirements are well-defined. However, three months into the project, the business users request significant changes to the customer data fields, which were not originally specified. The project manager is concerned that accommodating these changes will delay the project. The integration with the ERP system is also proving more complex than anticipated, with data mapping errors causing delays. The go-live date is fixed due to the end-of-support for the legacy system. What is the BEST course of action for the project manager?

Accepted Answer

Conduct a formal change impact assessment and prioritize the changes; implement only critical ones for go-live. Option A is correct because it follows the structured change management process required in a waterfall project with a fixed deadline. By conducting a formal change impact assessment, the project manager can objectively evaluate the cost, schedule, and resource implications of the requested changes. Prioritizing only critical changes for go-live ensures that the core CRM functionality is delivered on time, while non-critical enhancements can be deferred to a post-implementation phase. This approach balances the need to meet the legacy system's end-of-support deadline with accommodating essential business requirements.

Answer

Inform the business users that no changes can be made due to the fixed deadline

Answer

Delay the go-live date to accommodate all changes and integration issues

Answer

Switch to an agile methodology for the remaining three months

Question 5

A hospital is implementing a new electronic health records (EHR) system. The system will be used by doctors, nurses, and administrative staff. During the user acceptance testing (UAT) phase, the nursing staff reports that the interface for entering patient vitals is too slow and requires many clicks, which slows down their workflow. The project team has already completed system testing and is preparing for go-live in two weeks. The development team can make a quick fix to streamline the vital signs entry by adding a shortcut, but this change has not been tested. The IT director is concerned about patient safety and wants to ensure the system is usable. What is the BEST course of action?

Accepted Answer

Assess the risk, develop the fix, fast-track testing, and if successful, include it in the go-live. Option C is correct because it balances patient safety with project timelines by formally assessing the risk of the untested fix, developing it, and then fast-tracking a targeted regression test. This approach ensures the usability issue is resolved without bypassing necessary quality controls, which is critical for a clinical system where data entry errors could directly impact patient care. The IT director's concern about patient safety is addressed by the risk assessment and focused testing, while the go-live date is preserved if the fix passes.

Answer

Implement the quick fix immediately and go live as scheduled

Answer

Proceed with go-live as planned and address usability issues in a future release

Answer

Delay go-live by one month to fully test the fix

Question 6

An organization is implementing a new financial system and has completed user acceptance testing (UAT). The project manager reports that all critical defects have been fixed and retested, but several low-severity issues remain unresolved. What is the BEST course of action?

Accepted Answer

Document the unresolved defects as known issues in a risk acceptance form with a remediation plan, then proceed with go-live. Option A is correct because in a financial system implementation, low-severity issues that do not impair core financial processing or controls can be accepted as known risks. Documenting them with a remediation plan and proceeding with go-live aligns with ISACA’s guidance that UAT sign-off does not require zero defects, only that critical and high-severity defects are resolved. This approach balances business needs with risk management, avoiding unnecessary delays while ensuring accountability through formal risk acceptance.

Answer

Re-run all UAT test cases to ensure no regression occurs

Answer

Delay go-live until all defects are resolved

Answer

Obtain sign-off from business stakeholders acknowledging the risks and proceed with go-live

Question 7

During a nightly batch job, the above error appears in the application logs. The transaction table ACCT_TRANS has a unique constraint on the REF_NUM column. Which of the following is the MOST likely root cause?

Accepted Answer

The batch job is not idempotent and is re-processing previously successful transactions. The unique constraint violation on REF_NUM indicates that the batch job is attempting to insert a row with a REF_NUM value that already exists in the ACCT_TRANS table. This occurs when the job is not idempotent—meaning it does not check for or handle previously processed transactions—and re-processes the same data, leading to duplicate key errors.

Answer

The batch job lacks sufficient privileges to insert into the ACCT_TRANS table

Answer

There is a mismatch between the number of columns in the INSERT statement and the table definition

Answer

The batch job is missing an index on the REF_NUM column

Question 8

A company is implementing a new customer relationship management (CRM) system. The project team is currently defining user roles and permissions. Which of the following is the PRIMARY reason to enforce segregation of duties (SoD) within the CRM?

Accepted Answer

To reduce the risk of fraud and errors. Segregation of duties (SoD) in a CRM system is primarily enforced to prevent a single user from having conflicting capabilities, such as creating a customer record and also approving credit limits or processing refunds. Without SoD, an employee could both initiate and approve a fraudulent transaction, directly increasing the risk of fraud and undetected errors. While SoD can indirectly support data accuracy and compliance, the primary control objective is risk reduction through separation of conflicting functions.

Answer

To ensure data accuracy and completeness

Answer

To comply with regulatory requirements

Answer

To improve system performance and efficiency

Question 9

An organization is developing a web application using an Agile methodology. The security team wants to integrate security testing early in the development lifecycle. Which of the following is the BEST approach to achieve this?

Accepted Answer

Implement static application security testing (SAST) in the continuous integration pipeline. Integrating SAST into the CI pipeline allows automated scanning of source code for vulnerabilities (e.g., SQL injection, XSS) as code is committed, aligning with Agile's iterative development. This shift-left approach catches flaws early, reducing remediation cost and effort compared to later stages.

Answer

Conduct a penetration test after each sprint

Answer

Schedule an annual vulnerability scan of the production environment

Answer

Perform dynamic application security testing (DAST) on deployed builds

Question 10

During a system development project, the project manager notices that the actual cost is significantly higher than the planned cost at the 50% completion point. The earned value (EV) is $500,000, the actual cost (AC) is $600,000, and the planned value (PV) is $550,000. Which of the following is the MOST appropriate action?

Accepted Answer

Conduct a root cause analysis to identify the reasons for cost overrun. Option C is correct because the project is over budget (EV $500K vs AC $600K) and behind schedule (EV $500K vs PV $550K). Before taking corrective action, the project manager must first perform a root cause analysis to understand why costs are exceeding planned values. This aligns with the CISA’s emphasis on identifying the underlying cause of variances before implementing changes to scope, budget, or schedule.

Answer

Request additional budget from senior management

Answer

Reduce the project scope to align with the budget

Answer

Crash the project schedule to make up for lost time

Question 11

An organization is planning to replace its legacy accounting system with a commercial off-the-shelf (COTS) software package. Which of the following is the PRIMARY risk of using a COTS solution?

Accepted Answer

The software may not fully align with the organization's business processes. The primary risk of a COTS solution is that it is designed for a broad market and may not fully align with the organization's specific business processes. This misalignment can force the organization to change its workflows or perform costly customizations, which can negate the benefits of a packaged solution and introduce project delays or failures.

Answer

The total cost of ownership is likely to be higher than custom development

Answer

The software may have inherent security vulnerabilities

Answer

Vendor support may be discontinued after a few years

Question 12

A company is migrating its on-premises data center to a public cloud provider. Which of the following is the MOST important control to implement before migration to ensure data security?

Accepted Answer

Implement data encryption at rest and in transit. Data encryption at rest and in transit is the most important control before migration because it protects sensitive data from exposure during the transfer process and after it is stored in the cloud. Without encryption, data could be intercepted over the network or accessed by unauthorized parties in the cloud provider's infrastructure. This control directly addresses the core risk of data leakage during and after migration, which is a fundamental security requirement.

Answer

Enable multi-factor authentication (MFA) for all cloud accounts

Answer

Deploy a cloud access security broker (CASB)

Answer

Establish a virtual private network (VPN) between on-premises and cloud

Question 13

Which TWO of the following are key benefits of using a system development life cycle (SDLC) methodology? (Select exactly two.)

Accepted Answer

It provides a structured approach to system development. Options A and C are correct. A: SDLC provides structure and phases. C: SDLC includes user involvement. B is wrong because SDLC does not guarantee reduced cost; it may increase upfront cost. D is wrong because SDLC is not primarily for security testing. E is wrong because SDLC may not eliminate scope creep, but helps manage it.

Answer

It prevents any scope changes during development

Answer

It eliminates the need for security testing

Answer

It reduces the overall cost of development

Question 14

Which THREE of the following are common challenges when integrating a software package with existing legacy systems? (Select exactly three.)

Accepted Answer

Lack of documented application programming interfaces (APIs). Legacy systems often lack well-documented or standardized APIs, making it difficult to establish reliable interfaces for integration. Without clear API documentation, developers must reverse-engineer communication protocols or rely on outdated methods like screen scraping, which increases integration risk and effort.

Answer

Availability of modern integration middleware

Answer

Need for custom development to bridge the gap

Question 15

Refer to the exhibit. An application log shows an error. What is the MOST likely cause of this error?

Accepted Answer

A duplicate username was inserted into the USERS table. The error message 'Duplicate entry 'admin' for key 'PRIMARY'' indicates a violation of the PRIMARY KEY constraint on the USERS table. Since the username field is the primary key, inserting a second row with the same username (e.g., 'admin') causes MySQL to reject the INSERT operation with error code 1062. This is a unique constraint violation, not a connectivity or privilege issue.

Answer

The database server is offline

Answer

The user does not have insert privileges

Answer

The data type of the username field is incorrect

CISA Information Systems Acquisition, Development and Implementation Practice Test 2 — 15 Questions

Exhibit

CISA Information Systems Acquisition, Development and Implementation Practice Test 2 — 15 Questions

Exhibit