CISA Information Systems Acquisition, Development and Implementation — Timed 30 Questions

Question 1

A company is replacing its legacy on-premises ERP system with a cloud-based SaaS solution. The project manager is concerned about data migration risks. Which of the following is the BEST approach to mitigate data integrity issues during migration?

Accepted Answer

Run parallel processing and compare outputs. Option D is correct because running parallel processing allows the legacy and new SaaS systems to operate simultaneously, enabling real-time comparison of outputs. This approach directly validates data integrity by detecting discrepancies during migration, not after, which is critical for ERP systems where transactional accuracy is paramount.

Answer

Perform data validation after migration

Answer

Use data transformation tools to convert formats

Answer

Implement data reconciliation reports post-migration

Question 2

An organization is developing a new customer portal. The development team wants to use an agile methodology. Which of the following is a key benefit of using agile for this project?

Accepted Answer

Continuous stakeholder feedback is incorporated. Agile methodologies emphasize iterative development with continuous stakeholder feedback, which is critical for a customer portal where user needs evolve. This ensures the final product aligns with actual requirements, reducing rework and increasing satisfaction. Option A directly captures this core benefit.

Answer

Detailed requirements are defined upfront

Answer

Documentation is minimized to save time

Answer

The entire system is delivered at once

Question 3

During the user acceptance testing (UAT) phase of a new financial application, the business users report that the system calculates interest incorrectly for certain loan types. The project manager wants to fix this quickly. Which of the following is the BEST course of action?

Accepted Answer

Log the defect and perform impact analysis before approving a fix. Option D is correct because in the UAT phase, any defect must be formally logged and subjected to impact analysis before a fix is approved. This ensures that the proposed change does not introduce new risks, break other functionality, or violate regulatory compliance—critical for a financial application handling interest calculations. Skipping this process could lead to cascading failures or audit findings.

Answer

Instruct the business to work around the issue until the next release

Answer

Authorize the development team to fix the bug immediately and re-deploy

Answer

Roll back to the previous version of the application

Question 4

An IT auditor is reviewing the system development life cycle (SDLC) process for a critical application. Which of the following findings would be of MOST concern?

Accepted Answer

Developers have production database access. Developers having direct production database access violates the principle of segregation of duties and poses a significant risk of unauthorized data modification, deletion, or exfiltration. In a well-controlled SDLC, production access should be restricted to operations or DBA teams, with changes promoted through automated deployment pipelines. This finding directly undermines data integrity and confidentiality controls.

Answer

Test data is refreshed from production monthly

Answer

Developers use local development environments

Answer

Code reviews are performed by senior developers

Question 5

When implementing a commercial off-the-shelf (COTS) software package, which of the following is the MOST important activity to ensure the software meets business requirements?

Accepted Answer

Performing a gap analysis between requirements and software features. Performing a gap analysis is the most important activity because it systematically maps each business requirement against the COTS software's delivered features, identifying any shortfalls that must be addressed through configuration, customization, or process adaptation. Without this structured comparison, the organization risks deploying software that fails to support critical business processes, leading to costly rework or project failure.

Answer

Conducting a vendor demonstration

Answer

Developing a project plan with milestones

Answer

Reviewing the software's technical architecture

Question 6

A company is implementing a new procurement system. The project team is considering using a rapid application development (RAD) methodology. Which of the following is a potential risk of using RAD?

Accepted Answer

Inadequate documentation. RAD prioritizes speed and iterative prototyping over formal documentation. Because the focus is on quickly delivering working software through user feedback and short development cycles, comprehensive documentation is often neglected or produced after the fact, leading to inadequate records for maintenance, auditing, and compliance.

Answer

Reduced stakeholder involvement

Answer

Longer development time

Answer

Difficulty in prototyping

Question 7

An organization is developing a mobile app that will handle personal health information (PHI). The security team mandates that data must be encrypted both in transit and at rest. Which of the following implementation strategies BEST ensures compliance?

Accepted Answer

Implement TLS for data in transit and AES-256 encryption for data at rest. Option D is correct because it uses TLS (the modern, secure successor to SSL) to encrypt data in transit, ensuring confidentiality and integrity during network communication, and AES-256, a strong symmetric encryption standard, to encrypt data at rest. This combination directly satisfies the mandate for encryption both in transit and at rest, as TLS protects against eavesdropping and tampering on the wire, while AES-256 protects stored PHI from unauthorized access if the device is lost or compromised.

Answer

Use HTTPS for all network communication and store data in plaintext

Answer

Use SSL and encrypt all data with a simple XOR cipher

Answer

Rely on platform-level encryption provided by the mobile OS

Question 8

In a traditional waterfall SDLC, when should the test plan be developed?

Accepted Answer

During the design phase. In a traditional waterfall SDLC, the test plan should be developed during the design phase because testing activities must be planned in parallel with system design to ensure that test cases, test data, and acceptance criteria are aligned with the design specifications. This allows for early identification of testability issues and ensures that the test plan is ready before coding begins, enabling a structured and efficient testing process.

Answer

During the implementation phase

Answer

During the coding phase

Answer

During the requirements phase

Question 9

An IT auditor is evaluating the change management process for a financial trading system. Which of the following is the BEST indicator of a mature change management process?

Accepted Answer

All changes are logged and require automated approval workflows. Option B is correct because a mature change management process requires that all changes be formally logged and subjected to automated approval workflows. This ensures traceability, segregation of duties, and auditability, which are critical for a financial trading system where unauthorized or untracked changes could lead to financial loss or regulatory non-compliance.

Answer

Changes are documented after deployment

Answer

Developers can deploy changes directly to production if urgent

Answer

Changes are approved verbally by the IT manager

Question 10

A company is integrating a third-party payment gateway into its e-commerce platform. Which of the following is the MOST important security control to implement?

Accepted Answer

Validate all input from the payment gateway. Option C is correct because input validation from the payment gateway is the most critical security control. The payment gateway returns data (e.g., transaction status, amount, token) that is consumed by the e-commerce platform. Without strict validation, an attacker could inject malicious payloads (e.g., SQL injection, XSS) via manipulated gateway responses, leading to data breaches or unauthorized transactions. This control directly prevents injection attacks at the integration boundary.

Answer

Implement role-based access control

Answer

Log all transactions

Answer

Encrypt all data with SSL

Question 11

During a post-implementation review of a new HR system, the auditor finds that the system's disaster recovery plan (DRP) was not tested before go-live. Which of the following is the BEST recommendation?

Accepted Answer

Conduct a DRP test immediately and document results. The DRP should be tested as part of the implementation. Option B is a temporary fix; Option C is not proactive; Option D is not sufficient.

Answer

Accept the risk because the system is new

Answer

Implement a backup procedure for the system

Answer

Schedule a DRP test within the next six months

Question 12

Which TWO of the following are key activities in the system design phase of the SDLC?

Accepted Answer

Defining system architecture. Defining system architecture is a key activity in the system design phase because it establishes the high-level structure of the system, including hardware, software, network components, and their interactions. This blueprint guides subsequent detailed design and implementation, ensuring alignment with functional and non-functional requirements. Without a defined architecture, the system risks integration failures and scalability issues.

Answer

Writing unit tests

Answer

Performing user acceptance testing

Answer

Gathering business requirements

Question 13

Which THREE of the following are common risks associated with outsourcing software development?

Accepted Answer

Quality issues due to lack of oversight. Option A is correct because outsourcing software development often results in quality issues due to the client's limited visibility into the vendor's development processes, testing rigor, and adherence to coding standards. Without direct oversight, defects may go undetected until later stages, increasing rework costs and project delays.

Answer

Faster time to market

Answer

Increased internal control

Question 14

Which TWO of the following are benefits of using a version control system in software development?

Accepted Answer

Rollback to previous versions. Option D is correct because version control systems (e.g., Git, SVN) allow developers to revert code to a previous commit or tag, enabling recovery from bugs or regressions. This rollback capability is a core feature that preserves the history of the codebase and supports safe experimentation.

Answer

Generate test cases

Answer

Eliminate all bugs

Answer

Automate deployment

Question 15

Which THREE of the following are key considerations when selecting a software development methodology for a project?

Accepted Answer

Regulatory compliance requirements. Regulatory compliance requirements (Option B) are a key consideration because the chosen methodology must support necessary audit trails, documentation, and control frameworks (e.g., SOX, HIPAA, PCI DSS). A methodology like Waterfall provides rigid phase-gate documentation, while Agile may require adaptation (e.g., SAFe) to satisfy compliance evidence demands. Failure to align methodology with regulatory needs can lead to non-compliance findings during a CISA audit.

Answer

Availability of project management software

Answer

Programming language preferences

Question 16

Refer to the exhibit. An administrator applied this ACL to a VLAN interface. The server at 10.0.0.100 hosts a web application. What is the effect of this ACL?

Accepted Answer

Allows HTTPS, but HTTP is allowed as well due to the permit ip any any. The ACL shown permits HTTPS (TCP port 443) from any source to the server at 10.0.0.100, and then has a 'permit ip any any' statement at the end. Because ACLs are processed top-down, the first match wins; HTTPS traffic matches the first line and is permitted, while HTTP (TCP port 80) is not explicitly denied, so it matches the 'permit ip any any' line and is also allowed. Thus, both HTTP and HTTPS are permitted, making option A correct.

Answer

Allows HTTPS, blocks HTTP, and blocks all other traffic

Answer

Blocks both HTTP and HTTPS

Answer

Only allows HTTP and blocks HTTPS

Question 17

Refer to the exhibit. A developer is inserting a new employee record. What is the cause of this error?

Accepted Answer

The email 'john.doe@example.com' already exists in the table. The error message indicates a violation of a UNIQUE constraint on the 'email' column. The INSERT statement attempts to add 'john.doe@example.com', but that value already exists in the table. The database rejects the operation because the constraint ensures no duplicate email addresses are allowed.

Answer

The column 'email' does not exist

Answer

The table is full

Answer

The employee_id 101 already exists

Question 18

Refer to the exhibit. A cloud load balancer uses this JSON configuration. A request arrives from source IP 10.0.1.100 to port 80. Which backend pool will receive the request?

Accepted Answer

The request is dropped. The JSON configuration shows a load balancer rule that only forwards requests to backend-pool-1 when the source IP matches 10.0.1.0/24 AND the destination port is 80. The request from source IP 10.0.1.100 to port 80 satisfies both conditions, so it should be forwarded to backend-pool-1. However, the exhibit (not fully shown) likely includes a default deny or a missing rule for this specific combination, causing the request to be dropped. Option A is correct because the configuration explicitly drops unmatched traffic.

Answer

backend-pool-1

Answer

The request is sent to both pools

Answer

backend-pool-2

Question 19

A multinational corporation is replacing its legacy on-premises customer relationship management (CRM) system with a new cloud-based CRM solution. The project involves migrating data from the old system, customizing the new system to match business processes, and integrating with an existing enterprise resource planning (ERP) system. The project has a tight deadline of six months. During the planning phase, the project team decides to use a waterfall methodology because the requirements are well-defined. However, three months into the project, the business users request significant changes to the customer data fields, which were not originally specified. The project manager is concerned that accommodating these changes will delay the project. The integration with the ERP system is also proving more complex than anticipated, with data mapping errors causing delays. The go-live date is fixed due to the end-of-support for the legacy system. What is the BEST course of action for the project manager?

Accepted Answer

Conduct a formal change impact assessment and prioritize the changes; implement only critical ones for go-live. Option A is correct because it follows the structured change management process required in a waterfall project with a fixed deadline. By conducting a formal change impact assessment, the project manager can objectively evaluate the cost, schedule, and resource implications of the requested changes. Prioritizing only critical changes for go-live ensures that the core CRM functionality is delivered on time, while non-critical enhancements can be deferred to a post-implementation phase. This approach balances the need to meet the legacy system's end-of-support deadline with accommodating essential business requirements.

Answer

Inform the business users that no changes can be made due to the fixed deadline

Answer

Delay the go-live date to accommodate all changes and integration issues

Answer

Switch to an agile methodology for the remaining three months

Question 20

A hospital is implementing a new electronic health records (EHR) system. The system will be used by doctors, nurses, and administrative staff. During the user acceptance testing (UAT) phase, the nursing staff reports that the interface for entering patient vitals is too slow and requires many clicks, which slows down their workflow. The project team has already completed system testing and is preparing for go-live in two weeks. The development team can make a quick fix to streamline the vital signs entry by adding a shortcut, but this change has not been tested. The IT director is concerned about patient safety and wants to ensure the system is usable. What is the BEST course of action?

Accepted Answer

Assess the risk, develop the fix, fast-track testing, and if successful, include it in the go-live. Option C is correct because it balances patient safety with project timelines by formally assessing the risk of the untested fix, developing it, and then fast-tracking a targeted regression test. This approach ensures the usability issue is resolved without bypassing necessary quality controls, which is critical for a clinical system where data entry errors could directly impact patient care. The IT director's concern about patient safety is addressed by the risk assessment and focused testing, while the go-live date is preserved if the fix passes.

Answer

Implement the quick fix immediately and go live as scheduled

Answer

Proceed with go-live as planned and address usability issues in a future release

Answer

Delay go-live by one month to fully test the fix