CISA Information Systems Acquisition, Development and Implementation Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. A security administrator is troubleshooting why external users cannot reach the web server at 203.0.113.10 from the internet. Based on the configuration, what is the MOST likely issue?

Accepted Answer

The 'no-proxy-arp' option prevents the ASA from responding to ARP requests for the public IP. The 'no-proxy-arp' command disables proxy ARP on the ASA interface for the public IP address 203.0.113.10. Without proxy ARP, the ASA will not respond to ARP requests from upstream routers for that IP, so traffic destined to the web server is never delivered to the ASA for NAT processing. This is the most likely cause because the NAT rule exists but the ASA cannot intercept the traffic at Layer 2.

Answer

No NAT rule is configured for the web server

Answer

The source address is not translated

Answer

The access list denies incoming web traffic

Question 2

You are the IT audit manager for a multinational corporation. The company recently implemented a new enterprise resource planning (ERP) system using a phased rollout approach. The first phase (finance module) was deployed to three regional offices six months ago. During a post-implementation review, you discovered that the user acceptance testing (UAT) for the finance module was completed in only two days instead of the planned two weeks. The UAT was performed by a small group of power users selected by the project manager, and they reported no critical issues. However, after go-live, several finance staff in one region found that the system does not support a statutory reporting requirement specific to that country, which was not tested. The project manager argues that the requirement was never documented in the business requirements specification. The system has been live for six months, and the missing functionality requires a significant customization that will take three months and cost $200,000. Management is reluctant to fund the customization because the budget is exhausted. As the IT auditor, what is the BEST course of action?

Accepted Answer

Recommend that management implement a formal UAT process with representatives from all regions and include a checklist of statutory requirements for future rollouts. Option D is correct because the root cause is a deficient UAT process, not just a missing requirement. A formal UAT process with representatives from all regions and a statutory requirements checklist would have caught the country-specific reporting need before go-live. As an IT auditor, recommending process improvements for future rollouts addresses the systemic control weakness, which is more effective than blaming individuals or accepting risk without remediation.

Answer

Report the project manager to senior management for failing to include the requirement

Answer

Recommend that the organization accept the risk and proceed without the customization

Answer

Advise the project manager to retroactively document the requirement and request a change order for the customization

Question 3

During user acceptance testing (UAT) of a new financial system, users report that the system fails to enforce a segregation of duties rule where the same user should not be able to create a purchase order and approve it. The requirement was documented in the functional specifications. Which of the following is the MOST likely cause of this issue?

Accepted Answer

The system was not configured to enforce the control.. Option D is correct because the segregation of duties (SoD) rule is a functional control that must be explicitly configured in the system's authorization or workflow engine. Since the requirement was documented in the functional specifications, the most likely cause is that the system was not configured to enforce the control, meaning the access control list (ACL) or role-based access control (RBAC) settings did not prevent the same user from both creating and approving a purchase order.

Answer

Performance testing was prioritized over functional testing.

Answer

The functional requirements were incomplete.

Answer

The requirements were ambiguous and misinterpreted by developers.

Question 4

An IS auditor is reviewing the system development life cycle (SDLC) for a custom application. The project manager has decided to skip the design phase and proceed directly from requirements to coding. Which of the following risks are MOST likely to increase as a result? (Choose two.)

Accepted Answer

Inadequate security controls.. Skipping the design phase means that security requirements are never formally defined or integrated into the system architecture. Without a security design, controls such as authentication, authorization, encryption, and input validation are likely to be omitted or implemented ad hoc, leading to inadequate security controls. This directly increases the risk of vulnerabilities that could be exploited in production.

Answer

Delays in project schedule.

Answer

Increased cost due to rework.

Answer

Increased number of defects during unit testing.

Question 5

Order the steps for conducting an audit engagement from start to finish.

Question 6

Arrange the steps to implement a password policy in the correct order.

Question 7

Match each type of access control to its definition.

Question 8

Match each encryption key type to its usage.

Question 9

During the feasibility study for a new inventory system, the project team identifies that the expected benefits are significantly lower than the initial estimates. What is the MOST appropriate action for the IS auditor to recommend?

Accepted Answer

Re-evaluate the feasibility study and update the business case.. When expected benefits fall significantly below initial estimates, the IS auditor should recommend re-evaluating the feasibility study and updating the business case. This ensures that the project's justification is based on current, accurate data before proceeding, which is a key control in the systems development lifecycle (SDLC) to prevent investment in a project that may no longer deliver adequate value.

Answer

Proceed with the project as planned, focusing on cost reduction.

Answer

Cancel the project immediately and document lessons learned.

Answer

Continue with the project but postpone the benefits realization.

Question 10

A company is implementing a new ERP system. The project team plans to use a parallel conversion strategy. What is the PRIMARY advantage of this approach?

Accepted Answer

Risk mitigation by allowing fallback to the old system.. The primary advantage of a parallel conversion strategy is risk mitigation. By running the new ERP system alongside the old system for a period, the organization can validate the new system's functionality and data integrity while retaining the ability to immediately fall back to the legacy system if critical failures occur. This approach ensures business continuity and reduces the impact of unforeseen issues during the transition.

Answer

Immediate realization of benefits from the new system.

Answer

Lower total cost due to reduced training requirements.

Answer

Faster implementation compared to phased approach.

Question 11

An organization is developing a custom application. The project manager reports that the development team has implemented 80% of the features but only 50% of the budget is used. What is the MOST significant risk from an IS audit perspective?

Accepted Answer

The project may exceed the total budget due to scope growth.. Option D is correct because the project has consumed only 50% of the budget while delivering 80% of the features, indicating a high probability of scope growth or feature creep. From an IS audit perspective, this imbalance suggests that additional features may be added without corresponding budget increases, leading to total budget overrun. The risk is that the remaining 20% of features will require more than the remaining 50% of the budget, especially if testing and deployment costs are underestimated.

Answer

The project may be completed ahead of schedule.

Answer

The application may not meet user requirements.

Answer

The remaining budget may be insufficient for testing and deployment.

Question 12

During a post-implementation review of a financial system, an IS auditor finds that several critical reports are not being generated correctly. Which of the following should the auditor recommend FIRST?

Accepted Answer

Review the system configuration and compare with user requirements.. Option A is correct because verifying the system configuration against user requirements is the logical first step. Option B may be needed later; C is premature; D is incorrect as acceptance testing should have been done earlier.

Answer

Conduct a new round of user acceptance testing.

Answer

Disable the incorrect reports and create manual workarounds.

Answer

Immediately patch the system to fix the report generation.

Question 13

An organization is considering outsourcing its IT infrastructure management. Which of the following is the MOST important factor to include in the service level agreement (SLA)?

Accepted Answer

Definition of key performance indicators (KPIs) and reporting frequency.. Option B is correct because clear metrics and reporting are essential to measure vendor performance. Option A is important but not the most critical; C and D are operational details that can be addressed separately.

Answer

List of hardware and software to be managed.

Answer

Staffing levels and qualifications of vendor personnel.

Answer

Price reduction clauses for non-compliance.

Question 14

During data conversion from a legacy system to a new ERP, the project team decides to clean data during extraction but not during loading. What is the PRIMARY risk associated with this approach?

Accepted Answer

Data integrity issues may remain undetected in the target system.. Cleaning data only during extraction and not during loading means that any data quality issues introduced during the extraction process or that become apparent only after mapping to the target schema will not be caught. This creates a primary risk that data integrity issues—such as referential integrity violations, duplicate keys, or format mismatches—will remain undetected in the new ERP system, potentially corrupting business operations and reporting.

Answer

The legacy system performance may degrade.

Answer

The project may exceed its budget due to rework.

Answer

The conversion process will be significantly slower.

Question 15

An IS auditor is reviewing the system development life cycle (SDLC) methodology. Which phase should include the development of detailed test plans?

Accepted Answer

System design.. Detailed test plans should be developed during the system design phase because this is when the system's architecture, interfaces, and data flows are fully specified. Creating test plans at this stage ensures that tests are aligned with the design specifications and can validate that the implemented system meets the intended technical requirements, rather than waiting until after coding.

Answer

Requirements definition.

Answer

Coding and unit testing.

Answer

User acceptance testing.

CISA Information Systems Acquisition, Development and Implementation Practice Test 3 — 15 Questions

Exhibit

CISA Information Systems Acquisition, Development and Implementation Practice Test 3 — 15 Questions

Exhibit