CISA Information Systems Acquisition, Development and Implementation Practice Test 4 — 15 Questions

Question 1

A company is using an agile development methodology for a critical business application. The IS auditor is concerned about the lack of formal documentation. What is the BEST approach to mitigate this risk?

Accepted Answer

Ask the team to maintain a lightweight document of important decisions and changes.. Option D is the best approach because it balances agile principles with the need for auditability. In agile, lightweight documentation (e.g., architecture decision records, user story acceptance criteria) captures key decisions and changes without the overhead of full waterfall documentation. This mitigates the risk of knowledge loss while preserving the team's velocity.

Answer

Require the project to switch to a waterfall methodology.

Answer

Accept the lack of documentation because agile emphasizes working software.

Answer

Perform a detailed code review to compensate for missing documentation.

Question 2

A multinational corporation is implementing a global HR system. The project team decides to use a pilot implementation in one region before rolling out to others. What is the PRIMARY risk if the pilot region is not representative of the entire organization?

Accepted Answer

Issues relevant to other regions may remain undetected.. The primary risk of a non-representative pilot is that region-specific variations in regulatory, cultural, or technical infrastructure (e.g., data privacy laws like GDPR, local labor regulations, or network latency) will not be exercised. This means defects or integration failures that are unique to other regions remain hidden until full rollout, undermining the pilot's purpose as a risk-reduction mechanism. Option C directly captures this core risk of undetected issues.

Answer

The pilot team may become overly confident.

Answer

The pilot may run over budget due to unexpected challenges.

Answer

The implementation schedule will be delayed.

Question 3

Refer to the exhibit. The IS auditor reviews the router's version output during an audit. What is the MOST significant finding?

Accepted Answer

The IOS version is outdated and may contain security vulnerabilities.. The most significant finding is that the IOS version is outdated and may contain security vulnerabilities. An outdated IOS version can have known exploits that compromise the router's security, which is a critical risk for the organization. While other options describe operational states, they do not present the same level of immediate security threat as running unsupported or vulnerable firmware.

Answer

The router was returned to ROM by power-on.

Answer

The router has been running for over two years without a reboot.

Answer

The system image is stored in flash memory.

Question 4

Refer to the exhibit. An IS auditor finds this bucket policy attached to an S3 bucket storing sensitive customer data. What should the auditor recommend?

Accepted Answer

Restrict the principal to specific IAM roles or users.. The bucket policy grants access to any principal ("Principal": "*"), meaning any AWS user or anonymous user can perform the allowed actions on the bucket. For a bucket storing sensitive customer data, this is a critical security risk. Restricting the principal to specific IAM roles or users (Option D) ensures only authorized identities can access the bucket, aligning with the principle of least privilege.

Answer

Change the Resource to a different bucket.

Answer

Remove the Action "s3:GetObject and add "s3:PutObject".

Answer

Encrypt the bucket at rest.

Question 5

Refer to the exhibit. An IS auditor is reviewing the architecture. Which of the following is the MOST critical security weakness?

Accepted Answer

Application servers can initiate outbound internet connections.. Option C is correct because allowing application servers to initiate outbound connections to the internet is a common attack vector (e.g., for command and control). Option A is acceptable; B is not a weakness; D is not mentioned or required.

Answer

The use of TLS between tiers.

Answer

Centralized logging to a SIEM.

Answer

Lack of encryption on the database server.

Question 6

Which TWO of the following are essential components of a business case for a new system?

Accepted Answer

Alignment with business strategy.. A business case must justify the investment in a new system by demonstrating how it supports the organization's strategic goals and provides net financial benefit. Alignment with business strategy (C) ensures the system directly enables key objectives, while cost-benefit analysis (E) quantifies the expected return on investment, making both essential for approval.

Answer

Implementation schedule.

Answer

Detailed system architecture.

Answer

Risk assessment for all identified risks.

Question 7

Which THREE of the following are best practices for managing system testing in an IS development project?

Accepted Answer

Create test data that mirrors production data.. Creating test data that mirrors production data is a best practice because it ensures that the test environment closely reflects real-world data volumes, distributions, and edge cases. This approach helps uncover defects that might only appear under production-like data conditions, such as performance bottlenecks, data integrity issues, or boundary value errors. It also validates that the system handles the actual data formats and constraints it will encounter in production.

Answer

Perform testing in a environment identical to production.

Answer

Developers should test their own code thoroughly.

Question 8

Which TWO of the following are indicators of poor project governance that an IS auditor should identify?

Accepted Answer

Scope changes are frequently requested and approved verbally.. Option A is correct because verbal approval of scope changes bypasses formal change control processes, leading to undocumented scope creep, loss of audit trail, and increased risk of project failure. An IS auditor should identify this as a governance weakness because it violates the principle of documented authorization and traceability required for effective project oversight.

Answer

Project team uses an agile methodology.

Answer

Project status meetings are held weekly.

Answer

The project budget is reallocated across phases.

Question 9

During the requirements gathering phase for a new financial system, stakeholders disagree on the priority of security controls versus user convenience. Which of the following is the BEST approach?

Accepted Answer

Conduct a risk assessment to balance security and usability. Option C is correct because a risk assessment provides a structured, evidence-based framework for balancing security controls against user convenience during requirements gathering. By evaluating the likelihood and impact of threats specific to financial systems (e.g., transaction fraud, data breaches) against usability needs, the organization can prioritize controls that mitigate high-risk exposures without unnecessarily impeding legitimate business processes. This aligns with the COBIT 5 principle of balancing benefits, risk, and resource optimization.

Answer

Postpone security decisions to later phases

Answer

Let the project team decide based on development ease

Answer

Implement all security controls regardless of convenience

Question 10

A company is migrating from a legacy system to a cloud-based ERP. Which of the following is the MOST important control to ensure data integrity during data conversion?

Accepted Answer

Reconciliation of control totals. Reconciliation of control totals is the most important control because it directly verifies that the sum of key fields (e.g., total account balances, record counts) in the source system matches the target cloud-based ERP after conversion. This ensures no data is lost, duplicated, or corrupted during the extraction, transformation, and loading (ETL) process, which is critical for maintaining data integrity in a migration from a legacy system.

Answer

Automated backup

Answer

User acceptance testing

Answer

Parallel running

Question 11

An organization is developing a critical application using an agile methodology. The project sponsor demands frequent deliveries but the development team is concerned about insufficient testing. Which of the following BEST mitigates this risk?

Accepted Answer

Implement continuous integration and automated testing. Option D is correct because continuous integration (CI) and automated testing enable frequent, reliable code integration and immediate feedback on defects, directly addressing the tension between rapid delivery and insufficient testing. Automated tests run on every commit, catching regressions early without manual overhead, which is essential for agile sprints where manual testing alone cannot scale to match delivery velocity.

Answer

Deploy with known defects and fix them in the next sprint

Answer

Increase manual testing effort at the end of each sprint

Answer

Extend the release cycle to allow more time for testing

Question 12

Which of the following is the PRIMARY benefit of using a prototype during system development?

Accepted Answer

Clarifying user requirements. Option B is correct because prototyping helps clarify and validate user requirements early, reducing the risk of misinterpretation. Reducing development cost (A) is not a primary benefit; prototyping can actually increase cost initially. Accelerating coding (C) and minimizing documentation (D) are not primary objectives.

Answer

Accelerating coding

Answer

Minimizing documentation

Answer

Reducing development cost

Question 13

A company decides to outsource the development of a customer portal. Which of the following is the MOST critical control to include in the contract?

Accepted Answer

Service level agreements. Service level agreements (SLAs) are the most critical control because they define measurable performance targets (e.g., uptime, response time, throughput) for the outsourced customer portal. Without enforceable SLAs, the company has no contractual mechanism to ensure the portal meets availability and responsiveness requirements, directly impacting customer experience and business operations.

Answer

Fixed price clause

Answer

Non-disclosure agreement

Answer

Termination for convenience clause

Question 14

During system implementation, a critical defect is found in the production environment. The project manager wants to apply an emergency patch without full testing. Which of the following is the BEST course of action?

Accepted Answer

Conduct a risk assessment and obtain approval from the change control board. Option A is correct because a risk assessment should be performed to evaluate the potential impact of the patch versus the risk of not applying it, and then obtain proper change approval. Applying the patch without testing (D) bypasses controls; reverting (B) may not address the defect; delaying (C) may not be feasible for critical defects.

Answer

Apply the patch immediately without testing

Answer

Delay deployment until full testing can be completed

Answer

Revert to the previous version of the system

Question 15

What is the PRIMARY purpose of a post-implementation review?

Accepted Answer

To assess whether expected benefits were achieved. The primary purpose of a post-implementation review (PIR) is to determine whether the system or project has delivered the expected business benefits, such as improved efficiency, cost savings, or enhanced functionality. This aligns with the IS auditor's focus on value realization and governance, ensuring that the investment achieved its intended objectives before the project is formally closed.

Answer

To close the project budget and finalize costs

Answer

To evaluate the performance of the project team

Answer

To document lessons learned for future projects