CISA Information Systems Acquisition, Development and Implementation Practice Test 7 — 15 Questions

Question 1

A company is developing a mobile application that processes credit card payments. During the testing phase, which of the following types of testing is MOST critical to ensure security?

Accepted Answer

Penetration testing.. Penetration testing is the most critical testing type for a mobile application processing credit card payments because it simulates real-world attacks to identify exploitable vulnerabilities in the payment data flow, authentication mechanisms, and API endpoints. This directly addresses PCI DSS requirements for security testing of cardholder data environments, unlike other testing types that focus on functionality or user experience.

Answer

Interface testing.

Answer

Usability testing.

Answer

Regression testing.

Question 2

An IS auditor is evaluating a system development project that uses an outsourced team. The contract allows the vendor to reuse some of the developed code in other projects. What is the auditor's PRIMARY concern?

Accepted Answer

The organization may lose control of intellectual property.. The contract clause allowing the vendor to reuse developed code in other projects directly transfers ownership or licensing rights of the intellectual property (IP) to the vendor. This means the organization may lose exclusive control over the code, potentially allowing competitors to access proprietary logic or algorithms. The IS auditor's primary concern is safeguarding the organization's IP assets, as this loss can have long-term strategic and competitive implications.

Answer

The vendor might not deliver on time.

Answer

The vendor may not maintain the code after the project ends.

Answer

The vendor may use substandard development practices.

Question 3

Which TWO of the following are key controls that an IS auditor should expect to find in a well-managed system development life cycle (SDLC)?

Accepted Answer

Segregation of duties between development and testing.. Segregation of duties between development and testing is a key control because it ensures that code is independently verified before release, preventing developers from approving their own changes and reducing the risk of undetected defects or malicious code. In a well-managed SDLC, this separation enforces an independent testing phase, which is critical for maintaining code integrity and security.

Answer

Vendor due diligence reports.

Answer

Automated unit testing scripts.

Answer

Gantt chart for project scheduling.

Question 4

Which TWO of the following are indicators that a project is at risk of failure according to ISACA's project governance framework?

Accepted Answer

Lack of clear communication channels among team members.. Option B is correct because ISACA's project governance framework identifies lack of clear communication channels as a key risk indicator. Without defined communication paths, team members cannot effectively share status updates, escalate issues, or coordinate tasks, leading to misalignment and increased failure probability.

Answer

Regular status meetings with stakeholders.

Answer

Adoption of iterative development.

Answer

Use of a project management office (PMO).

Question 5

Which THREE of the following are typical phases in the system development life cycle (SDLC)?

Accepted Answer

Implementation.. Implementation is a standard phase in the SDLC where the designed system is built, coded, and deployed into the production environment. This phase follows design and precedes testing and maintenance, ensuring the solution is operational and meets the specified requirements.

Answer

Unit testing.

Answer

Patch management.

Question 6

An organization is implementing a new financial system. Which of the following is the MOST important control to ensure data integrity during the data migration phase?

Accepted Answer

Implementing reconciliation controls between source and target. Reconciliation controls between source and target systems are the most critical control for ensuring data integrity during migration because they provide a systematic method to verify that every record has been accurately transferred without loss, duplication, or corruption. This typically involves comparing record counts, hash totals, or checksums (e.g., using MD5 or SHA-256) between the legacy and new databases, and flagging any discrepancies for correction before the system goes live.

Answer

Conducting a post-implementation review

Answer

Encrypting data in transit

Answer

Performing user acceptance testing

Question 7

During system development, the project team discovers that the original requirements are incomplete. What is the BEST course of action?

Accepted Answer

Formally document the new requirements and follow the change management process. Option A is correct because formally documenting new requirements and following the change management process ensures that all changes are controlled, assessed for impact on scope, budget, and schedule, and approved by stakeholders. This aligns with the systems development lifecycle (SDLC) best practices and the ISACA standard for managing requirements changes, preventing scope creep and maintaining project integrity.

Answer

Inform the steering committee and continue as planned

Answer

Proceed with development and address changes during maintenance

Answer

Halt the project until all requirements are finalized

Question 8

An organization is adopting agile development methodology. Which control is MOST critical to ensure security is integrated?

Accepted Answer

Including security stories in the product backlog. In agile development, security must be continuously integrated into each iteration. Including security stories in the product backlog ensures that security tasks are prioritized, estimated, and addressed during each sprint, making security an inherent part of the development lifecycle rather than an afterthought. This aligns with the principle of 'shifting left' on security, where controls are applied as early as possible.

Answer

Penetration testing before release

Answer

Code reviews after each sprint

Answer

Security requirements defined at project initiation

Question 9

Which testing phase is MOST effective for validating that the system meets business needs?

Accepted Answer

User acceptance testing. User acceptance testing (UAT) is the final phase of testing where actual end-users validate the system against real-world business requirements and workflows. It confirms that the system meets the agreed-upon business needs, functional specifications, and operational criteria before production deployment. Unlike technical testing phases, UAT focuses on business process alignment and user satisfaction.

Answer

Regression testing

Answer

Unit testing

Answer

Integration testing

Question 10

A company is outsourcing software development. What is the IS auditor's PRIMARY concern?

Accepted Answer

Protection of intellectual property and data. Option D is correct because protection of intellectual property and data is a critical risk when outsourcing. Financial stability, methodology, and SLA compliance are important but secondary to data protection.

Answer

The vendor's development methodology

Answer

The vendor's financial stability

Answer

Compliance with service level agreements

Question 11

In a DevOps environment, which practice BEST supports auditability?

Accepted Answer

Automated logging of all code changes. Automated logging of all code changes (D) best supports auditability in a DevOps environment because it provides an immutable, timestamped record of every change made to the codebase, including who made the change, what was changed, and when. This aligns with the principle of continuous audit, where every deployment artifact is traceable through the CI/CD pipeline, enabling compliance with standards like SOC 2 or ISO 27001. Unlike manual processes, automated logging ensures no change goes unrecorded, which is critical for forensic analysis and regulatory audits.

Answer

Use of configuration management tools

Answer

Manual approval gates

Answer

Separate development and production environments

Question 12

When implementing a commercial off-the-shelf (COTS) system, what is the MOST important factor?

Accepted Answer

Alignment with business processes with minimal modification. When implementing a commercial off-the-shelf (COTS) system, the most important factor is alignment with business processes with minimal modification. COTS systems are designed to provide standardized functionality; extensive customization undermines the core benefits of reduced cost, faster deployment, and easier vendor support. Modifying the COTS codebase creates a 'forked' version that complicates patch management, increases testing overhead, and risks incompatibility with future vendor updates, directly contradicting the acquisition rationale.

Answer

Customization to fit all requirements

Answer

Lowest total cost

Answer

Vendor reputation

Question 13

Which of the following is the BEST method to ensure that a system development project is completed on time?

Accepted Answer

A realistic project schedule with milestones. A realistic project schedule with milestones (Option B) is the best method because it establishes a time-phased plan with measurable checkpoints, enabling early detection of delays and facilitating proactive corrective actions. Without a realistic baseline, even the best tracking tools or meetings cannot prevent schedule overruns, as the schedule itself is the foundation for monitoring and controlling project progress.

Answer

Regular status meetings

Answer

Frequent scope changes

Answer

Use of a project management software

Question 14

During a systems audit, the auditor finds that the project did not follow the organization's systems development methodology. What should the auditor do FIRST?

Accepted Answer

Report the deviation and assess the impact on controls. The auditor's first responsibility upon discovering a deviation from the organization's systems development methodology is to report the finding and assess the impact on internal controls. This aligns with ISACA's audit standards, which require auditors to evaluate whether the deviation introduces risks to data integrity, security, or project governance. Without this assessment, the auditor cannot determine the severity of the non-compliance or recommend appropriate corrective actions.

Answer

Accept if the project is on schedule

Answer

Recommend that the project be stopped

Answer

Interview the project team to understand why

Question 15

Which TWO of the following are key controls in the system development life cycle?

Accepted Answer

Post-implementation review. Options A and E are correct. Segregation of duties between development and operations is a key control to prevent unauthorized changes. A post-implementation review ensures the system meets objectives and provides lessons learned. Agile methodology (B) is a framework, not a control. Automated deployment (D) is a practice, not a control. Formal approval of business requirements (C) is a control, but in this question we need exactly two – A and E are broader key controls.

Answer

Use of agile methodology

Answer

Formal approval of business requirements

Answer

Automated deployment tools