CISA Information Systems Acquisition, Development and Implementation Practice Test 6 — 15 Questions

Question 1

An organization is acquiring a third-party SaaS application. Which of the following should be included in the contract to ensure data protection?

Accepted Answer

Right to audit the vendor's security practices. A right to audit the vendor's security practices is essential in a SaaS contract because it allows the organization to independently verify that the vendor's controls (e.g., access management, patch management, incident response) meet contractual and regulatory requirements. Without this clause, the organization must rely solely on the vendor's self-assessments or third-party reports like SOC 2, which may not cover all relevant risks or may be outdated. This right is a key mechanism for ensuring ongoing data protection in a shared responsibility model.

Answer

Service level agreement (SLA) for uptime

Answer

Data ownership and location specification

Answer

Data encryption clause for data at rest and in transit

Question 2

During a post-implementation review, an IS auditor identifies that the system's actual transaction processing time is significantly higher than the benchmark specified in the service level agreement (SLA). The vendor claims it is due to inadequate network bandwidth provided by the client. What should the auditor do first?

Accepted Answer

Review the SLA to determine responsibility for network performance. Option C is correct because the auditor should review the SLA terms to determine responsibility for network bandwidth and clarify performance expectations. Option A is incorrect because recommending bandwidth increase without analysis is premature. Option B is incorrect (but it's D in list? Actually options: A Review SLA, B Recommend bandwidth increase, C Escalate to management, D Perform independent tests. I set A as Review SLA, correct. So explanation: Option A is correct because the SLA defines responsibilities. Option B is incorrect because it assumes vendor claim is correct. Option C is incorrect but escalation is not first step. Option D is incorrect because independent testing may be unnecessary if SLA clarifies responsibility.

Answer

Recommend increasing network bandwidth

Answer

Escalate the issue to senior management

Answer

Perform independent performance testing

Question 3

An IS auditor is evaluating the controls over program changes. Which TWO of the following are essential controls?

Accepted Answer

Management authorization for the change. Options A and B are correct because documented change requests and management authorization are fundamental to ensure changes are controlled and approved. Option C is not essential as automation is a tool, not a control. Option D is a good practice but not essential for authorization. Option E is a testing control, not directly an authorization control.

Answer

Automated deployment scripts

Answer

Regression testing of all changes

Answer

Post-change review by independent party

Question 4

A company is developing a new financial application. Which THREE of the following are valid reasons to involve internal audit during the development phase?

Accepted Answer

To ensure compliance with regulatory requirements. Options A, C, and E are correct because internal audit can provide assurance on compliance, internal controls, and security. Option B is incorrect because designing architecture is not an audit function. Option D is incorrect because approving requirements is a management responsibility.

Answer

To design the application architecture

Answer

To approve all user requirements

Question 5

An IS auditor is reviewing a request for proposal (RFP) for a new system. Which TWO elements should be included in the RFP?

Accepted Answer

Vendor's financial stability information. In an RFP for a new system, including the vendor's financial stability information (B) is critical to assess the vendor's long-term viability and ability to support the system over its lifecycle. This helps mitigate the risk of vendor failure or bankruptcy, which could disrupt operations and leave the organization with an unsupported system.

Answer

Confidentiality agreement

Answer

Sample contract terms

Answer

Employee resumes for the proposed team

Question 6

An IS auditor is reviewing the configuration for a web application. Which of the following is the MOST significant security weakness?

Accepted Answer

The authentication method is Basic. Basic authentication transmits credentials in Base64-encoded plaintext over the network, which is trivially decoded and captured by any attacker with access to the traffic. Even when used over HTTPS, the credentials are exposed in the browser's cache and server logs, making this the most significant weakness among the options.

Answer

Session timeout is set to 600 seconds (10 minutes)

Answer

The base URL uses HTTPS

Answer

Encryption uses SSL instead of TLS

Question 7

An IS auditor reviews the change request. Which of the following is the most significant risk?

Accepted Answer

The impact assessment is incorrect. An incorrect impact assessment (Option C) is the most significant risk because it directly undermines the change management process. If the impact is misjudged, the change may introduce unanticipated failures, data corruption, or security vulnerabilities into the production environment. Unlike vague descriptions or pending approvals, an incorrect impact assessment can lead to catastrophic system outages or compliance violations that are difficult to reverse.

Answer

The description is too vague

Answer

The approval is still pending close to the scheduled date

Answer

The change affects a financial module

Question 8

An IS auditor is evaluating the security of the architecture. Which of the following is the MOST critical finding?

Accepted Answer

No encryption for SQL traffic between web and database servers. Option C is the most critical finding because unencrypted SQL traffic between the web and database servers exposes sensitive data to interception via man-in-the-middle attacks. Even if the traffic is confined to an internal network, an attacker who compromises the web server can sniff credentials or query results in plaintext. Encrypting SQL traffic with TLS or IPSec is a fundamental security control to protect data in transit.

Answer

The web server has a public IP address

Answer

SQL traffic from the web server to the database server is allowed

Answer

The database server is not placed in the DMZ

Question 9

A company is developing a custom application. During the requirements phase, the project manager documents that the system must encrypt all sensitive data at rest. Which of the following is the BEST control to ensure this requirement is met throughout the development lifecycle?

Accepted Answer

Create a requirements traceability matrix (RTM).. A requirements traceability matrix (RTM) links each requirement to corresponding design, development, and testing artifacts. By mapping the encryption-at-rest requirement to specific code modules, configuration settings, and test cases, the RTM ensures that the control is implemented and verified at every stage of the lifecycle, not just at the end. This makes it the best proactive control for continuous compliance throughout development.

Answer

Perform static code analysis on the final code.

Answer

Conduct a post-implementation security review.

Answer

Deploy a database activity monitoring tool.

Question 10

An organization is transitioning from a waterfall to an agile development methodology. Which of the following is a key risk that the IS auditor should highlight?

Accepted Answer

Scope creep may increase without proper controls.. In agile development, iterative cycles and continuous feedback can lead to scope creep if changes are not managed through a disciplined backlog prioritization process. Unlike waterfall, where scope is fixed early, agile's flexibility requires robust controls (e.g., sprint boundaries, product owner authority) to prevent uncontrolled expansion. An IS auditor should highlight this risk because without proper governance, the project may exceed budget and timeline despite agile's adaptive nature.

Answer

User requirements may be incomplete at the start.

Answer

Testing is deferred until the end of the project.

Answer

Stakeholder involvement may decrease.

Question 11

During a third-party software vendor audit, the IS auditor discovers that the vendor uses a common shared database for multiple clients and relies on application-level access controls. Which of the following is the GREATEST concern?

Accepted Answer

Data from different clients may be commingled and accessible.. Option D is correct because application-level controls can be bypassed if there are vulnerabilities, leading to data exposure. Option A is less critical as segregation of duties can be managed. Option B is not a direct control issue. Option C is not the primary concern.

Answer

The database does not encrypt data at rest.

Answer

The vendor does not perform regular penetration testing.

Answer

The vendor lacks segregation of duties among administrators.

Question 12

An organization is replacing its legacy customer relationship management (CRM) system. Which of the following is the MOST important control to ensure data integrity during the data conversion process?

Accepted Answer

Perform reconciliation of total record counts and key field sums before and after conversion.. Option A is correct because reconciliation and validation ensures all records are accurately transferred. Option B focuses on completeness but not accuracy. Option C is security, not integrity. Option D is about functionality, not conversion accuracy.

Answer

Implement encryption for data in transit during migration.

Answer

Conduct user acceptance testing on the new system.

Answer

Ensure data mapping documents are approved by business owners.

Question 13

A project team is using a prototyping approach for a new system. Which of the following is the BEST control to ensure the prototype accurately reflects user needs?

Accepted Answer

Involve users in each iteration and obtain formal sign-off.. Option C is correct because iterative feedback and formal sign-offs ensure the prototype evolves to meet true requirements. Option A is after the fact. Option B does not involve users directly. Option D occurs too late.

Answer

Conduct a post-implementation review.

Answer

Require the project sponsor to approve the final design.

Answer

Perform regression testing after each prototype iteration.

Question 14

An IS auditor is reviewing the change management process for a financial institution. The auditor finds that emergency changes bypass normal approval but are documented and reviewed within 48 hours. Which of the following is the BEST recommendation?

Accepted Answer

Implement a risk classification for changes and apply controls accordingly.. Option B is correct because implementing a risk classification for changes allows the organization to apply appropriate controls based on the change's impact and urgency. Emergency changes inherently require speed, but a risk-based approach ensures that high-risk emergency changes receive more stringent controls (e.g., mandatory peer review) while low-risk changes can proceed with lighter oversight. This balances security with operational agility, which is critical in a financial institution where system availability and data integrity are paramount.

Answer

Require a second administrator to approve during the emergency.

Answer

Increase the frequency of post-implementation reviews to every 24 hours.

Answer

Require all emergency changes to be approved by the change advisory board (CAB) before implementation.

Question 15

An organization is selecting a vendor for a new enterprise resource planning (ERP) system. Which of the following is the MOST critical factor in the vendor selection process?

Accepted Answer

Clearly define business requirements before issuing the request for proposal (RFP).. Clearly defining business requirements before issuing the RFP is the most critical factor because it ensures that the ERP system will align with the organization's operational needs, processes, and data flows. Without a precise requirements definition, the RFP will lack the necessary evaluation criteria, leading to mismatched vendor proposals, scope creep, and potential project failure. This step directly impacts the success of the acquisition, as it forms the foundation for all subsequent vendor evaluation and contract negotiations.

Answer

Negotiate service level agreements (SLAs) in the contract.

Answer

Check vendor references for similar projects.

Answer

Evaluate vendor financial stability.