CISA Information Systems Acquisition, Development and Implementation Practice Test 5 — 15 Questions

Question 1

An organization is implementing a new identity management system. Which testing approach is MOST effective for verifying access controls?

Accepted Answer

User acceptance testing including role-based test cases. User acceptance testing (UAT) with role-based test cases is the most effective approach because it directly validates that the identity management system enforces the correct access controls for each user role in real-world scenarios. Unlike lower-level tests, UAT involves actual users executing role-specific transactions to confirm that permissions, segregation of duties, and policy rules are properly implemented. This ensures that the system behaves as intended from an end-user and auditor perspective, which is critical for compliance and security.

Answer

Regression testing

Answer

Unit testing

Answer

System integration testing

Question 2

A project uses a waterfall model. After design, the team discovers that the requirements have changed significantly. What is the BEST action?

Accepted Answer

Update the requirements and proceed with the design revision. Option B is correct because in a waterfall model, the most practical approach is to update the requirements and proceed to incorporate the changes, accepting some rework. Continuing with outdated requirements (A) leads to an irrelevant product; switching to agile mid-project (C) may cause process disruption; canceling (D) is drastic unless changes are infeasible.

Answer

Cancel the project and start over

Answer

Continue with original requirements as planned

Answer

Switch to an agile methodology for the remainder of the project

Question 3

Which TWO of the following are key controls for ensuring data privacy during system development?

Accepted Answer

Encrypting stored data. Encrypting stored data (Option B) is a key control for ensuring data privacy because it renders the data unreadable without the correct decryption key, protecting it from unauthorized access even if the storage medium is compromised. This aligns with data-at-rest protection requirements under regulations like GDPR and PCI DSS, and is a fundamental security control during system development to prevent exposure of sensitive information.

Answer

Using real customer data for testing

Answer

Disabling audit logs during development

Answer

Allowing developers unlimited access to production data

Question 4

Which TWO of the following are BEST indicators that a system development project is at risk of failure?

Accepted Answer

Frequent scope changes. Frequent scope changes (A) are a classic risk indicator because they disrupt the project's baseline requirements, leading to rework, budget overruns, and schedule delays. In system development, uncontrolled scope creep often results in 'analysis paralysis' and can cause the final product to deviate from original objectives, increasing the likelihood of failure.

Answer

Clear communication

Answer

Robust testing

Answer

High team morale

Question 5

Which THREE of the following are essential components of a change management process?

Accepted Answer

Impact analysis. Impact analysis (B) is essential because it evaluates the potential effects of a proposed change on system functionality, security, and performance before implementation. This ensures that risks are identified and mitigated, preventing unintended disruptions to production environments. Without impact analysis, changes could introduce vulnerabilities or cause system outages, violating IT governance principles.

Answer

Immediate implementation without review

Answer

Bypassing testing for urgent changes

Question 6

During a system deployment, the above error occurs. What is the MOST likely cause?

Accepted Answer

Firewall blocking the database port. The error message (not shown but implied from context) typically indicates a network-level connectivity failure, such as 'cannot connect to server' or 'connection timed out'. A firewall blocking the database port (e.g., TCP 1433 for SQL Server, 3306 for MySQL, 1521 for Oracle) is the most likely cause because it prevents the application from establishing a TCP handshake with the database server, even if the server name, password, and database service are all correct.

Answer

Incorrect server name in connection string

Answer

Invalid password

Answer

Database service not running on the server

Question 7

During user acceptance testing, a user with the above permission set cannot execute a fund transfer. What is the MOST likely reason?

Accepted Answer

Missing Write permission for transfers. The user can authenticate and access the system (since they are in user acceptance testing with the given permission set), but cannot execute a fund transfer. This indicates that the user lacks the necessary Write permission for the transfer operation, which is required to modify the database record or initiate the transaction. Without Write access, the application can read data but cannot commit the transfer, causing the operation to fail.

Answer

Incorrect username

Answer

Network connectivity issue

Answer

Database connection error

Question 8

A security review of the above Apache configuration identifies a critical vulnerability. Which of the following is the MOST significant issue?

Accepted Answer

Directory listing is enabled (Indexes option). The Indexes option in Apache enables directory listing, which exposes the entire contents of a directory when no index file (e.g., index.html) is present. This can reveal sensitive files, configuration backups, or source code, making it a critical information disclosure vulnerability. Unlike other options, Indexes directly leads to unauthorized data exposure without requiring any additional conditions.

Answer

Default DocumentRoot path is used

Answer

AllowOverride All allows .htaccess overrides

Answer

Require all granted permits all access

Question 9

A project manager is selecting a development methodology for a project with well-defined requirements and low uncertainty. Which methodology is most appropriate?

Accepted Answer

Waterfall. Waterfall is the most appropriate methodology for projects with well-defined requirements and low uncertainty because it follows a linear, sequential approach where each phase (requirements, design, implementation, verification, maintenance) must be completed before the next begins. This structure minimizes risk when requirements are stable and unlikely to change, ensuring thorough documentation and predictable outcomes. In contrast, iterative or adaptive methods would introduce unnecessary complexity and overhead for such a deterministic project.

Answer

Agile

Answer

Rapid Application Development (RAD)

Answer

Spiral

Question 10

An IS auditor is reviewing a system development project and notices that user acceptance testing (UAT) is being conducted in the production environment due to lack of a separate test environment. What is the primary risk?

Accepted Answer

Security breaches due to unauthorized access. Conducting UAT in production exposes sensitive production data and live systems to test scripts and users who may not have proper authorization, creating a direct path for security breaches. Production environments typically have broader access controls and audit trails that are not designed to isolate test activities, increasing the risk of unauthorized data exposure or modification. This violates the principle of segregation of duties and can lead to compliance issues with standards like PCI DSS or HIPAA.

Answer

System availability issues

Answer

Performance degradation

Answer

Data integrity violations

Question 11

An organization is implementing a COTS application. The project team plans to heavily customize the application to meet unique business processes. Which of the following is the most significant risk?

Accepted Answer

Difficulties in applying future vendor upgrades. Option B is correct because heavy customization makes it difficult to apply vendor upgrades, potentially leading to unsupported software. Option A is incorrect while vendor lock-in is a risk, upgrade difficulties are more direct. Option C is incorrect because incompatibility is a symptom of upgrade difficulties. Option D is incorrect because high cost is a secondary concern.

Answer

Vendor lock-in

Answer

Incompatibility with future releases

Answer

High implementation cost

Question 12

Which of the following is the BEST control to ensure that system changes are authorized?

Accepted Answer

Change advisory board approval. The change advisory board (CAB) is the primary control for authorizing system changes because it provides a formal, documented approval process before any change is implemented. This ensures that changes are reviewed by stakeholders with appropriate authority, reducing the risk of unauthorized or poorly planned modifications. Without CAB approval, there is no definitive authorization step, making it the best control for ensuring authorization.

Answer

Audit trail of all changes

Answer

Segregation of duties between developers and operators

Answer

Version control system

Question 13

An IS auditor finds that a project failed to meet its objectives because key stakeholders were not involved in the requirements definition phase. Which phase of the SDLC was most neglected?

Accepted Answer

Requirements analysis. The requirements analysis phase is where stakeholder needs are formally captured and documented. Without key stakeholder involvement, the project lacks a validated baseline of what must be built, leading to misaligned objectives and scope creep. The IS auditor’s finding directly points to a failure in this phase, as it is the only SDLC phase that defines the project’s success criteria from the user’s perspective.

Answer

Development

Answer

Design

Answer

Testing

Question 14

In an agile development environment, an IS auditor reviews the backlog and finds that security requirements are not explicitly included. What is the best recommendation?

Accepted Answer

Include security stories in the product backlog. In agile development, security should be integrated continuously rather than treated as an afterthought. Including security stories in the product backlog ensures that security requirements are prioritized, estimated, and implemented incrementally within each sprint, aligning with the agile principle of delivering value early and often. This approach embeds security into the development lifecycle from the start, reducing technical debt and vulnerabilities.

Answer

Engage external security auditors to define requirements

Answer

Allocate a separate sprint dedicated solely to security

Answer

Perform comprehensive security testing during the final sprint

Question 15

Which of the following is the MOST important objective of system testing?

Accepted Answer

Verify that the system meets specified requirements. System testing is a formal, structured process that validates the entire integrated system against its specified requirements. The primary goal is to confirm that the system behaves as defined in the functional and technical specifications, ensuring that all requirements are correctly implemented before user acceptance testing. While user satisfaction and defect removal are important, they are secondary to verifying requirement compliance, which is the core objective of system testing.

Answer

Confirm that end users are satisfied

Answer

Ensure the code is free of defects

Answer

Validate system performance under load