CCNA Cisa Systems Development Questions

Custom development carries risk of longer time-to-market and higher cost due to unforeseen complexities.

The post-implementation review should compare actual performance against projections. Significant performance degradation indicates the system is not meeting its intended performance objectives, which is a key project goal.

Normal changes are those that are not pre-approved or emergency. They require assessment and approval by the CAB to evaluate risks and impacts.

In agile, security requirements must be integrated into user stories, code reviews and static analysis are key for code quality, and sprint retrospectives help identify process improvements. Maintaining a detailed project plan is less relevant in agile, and formal change requests are not typical.

A rollback plan ensures that if deployment fails, the system can be restored to a known good state.

SoD conflicts are a high-risk issue. The auditor should recommend immediate implementation of compensating controls (e.g., enhanced monitoring, dual approval) to mitigate risk until the system is reconfigured.

The spiral model is risk-driven; each iteration includes a risk analysis to identify and mitigate project risks before proceeding to the next phase.

Data quality issues (incomplete/inaccurate data) and mapping errors are common risks that can lead to system failures.

Dynamic application security testing (DAST) is a detective control that identifies vulnerabilities in a running application.

The auditor must ensure the SOC 2 report is from a qualified auditor and covers the relevant period for the current evaluation.

Emergency changes bypass normal controls; without post-change review, unauthorized or flawed changes may persist unnoticed.

In agile development, security testing must be integrated into each sprint to ensure continuous validation. The 'definition of done' (DoD) is the team's checklist for completing a user story; if it explicitly includes security testing tasks (e.g., static analysis, dynamic scans, or penetration tests), then verifying the DoD proves that security testing was performed iteratively. Option D directly examines this artifact, providing objective evidence of iterative security testing.

Building a custom application allows for tailored functionality that meets unique business requirements, which is a key advantage over COTS.

Vendor dependency is a critical risk in COTS acquisitions. The organization may become reliant on the vendor for updates, support, and customizations, which can affect long-term flexibility and costs.

The deployment phase should include a rollback plan to revert to the previous state if the new system fails. This is a critical control to minimize downtime and data loss.

Data integrity is the top risk during migration, as errors can lead to incorrect business operations and decisions.

The review should identify lessons learned, address outstanding defects, and assess whether objectives were met beyond budget/schedule.

After an emergency change, it is essential to document the change and obtain retrospective approval to maintain change management integrity.

When the organization's processes are unique and provide a competitive advantage, custom development allows for exact fit and control.

Iterative approaches allow early feedback and adaptability to changing requirements, unlike waterfall's rigid sequential phases.

The post-implementation review aims to assess whether the system meets its intended objectives, including performance, user satisfaction, and business goals. Lessons learned are a secondary outcome.

Audit rights are critical for the organization to verify the vendor's controls and compliance, especially for outsourced systems.

Unauthorized overtime payments indicate a segregation of duties or control weakness that could lead to fraud. Inaccurate tax calculations could result in regulatory penalties and employee dissatisfaction. Both have significant financial and compliance impacts.

Segregation of duties conflicts in an ERP can lead to fraud or errors. The other findings are important but not as critical from a control perspective.

In agile, the sprint review provides an opportunity to demonstrate completed work and obtain stakeholder feedback, acting as a key control for quality and acceptance.

Data migration often involves mapping old data to new structures. Inaccurate mapping can lead to data corruption or loss, which is a critical risk.

For emergency changes, speed is critical, but a rollback plan is essential to ensure the change can be reversed if it causes issues. This minimizes the impact on operations.

ERP systems often combine roles that were separate in legacy systems, increasing risk of fraud.

The CAB is responsible for reviewing and approving changes, assessing risks, and ensuring proper planning and testing.

Architecture review, threat modeling, and designing security controls are key design-phase controls to ensure security is built in.

Configuring SoD rules within the ERP system helps enforce segregation and prevent conflicts during operations.

In waterfall, each phase ends with a formal sign-off; the requirements phase is critical to ensure business needs are documented and approved.

The sprint review is a key control in agile to demonstrate completed work to stakeholders and obtain feedback. It serves as a form of user acceptance testing and helps ensure the product meets stakeholder needs.

User acceptance testing (UAT) is the final phase of the testing lifecycle where actual end-users validate that the system fulfills their business requirements and is ready for production deployment. Unlike technical testing types, UAT focuses on real-world workflows, data accuracy, and usability to confirm the system meets the agreed-upon acceptance criteria.

UAT should be performed by actual end users using real data to validate business requirements.

A change request should include a test plan to verify the change works as intended and a rollback plan to revert if the change fails. These are critical for risk management and governance.

Emergency changes require a documented rationale and timely post-implementation review to ensure proper authorization and minimal risk.

In waterfall, requirements are defined upfront and changes are difficult. If a key stakeholder did not sign off, there is a risk that later phases will be based on incomplete or incorrect requirements.

Emergency changes bypassing CAB approval pose high risk as they may not undergo proper testing and review.

A change request should include justification for the change and a rollback plan to mitigate risks.

Low UAT pass rate indicates unresolved defects or unmet user requirements, leading to user dissatisfaction and potential workarounds that compromise controls.

Security requirements must be identified and approved early to ensure proper controls are built into the system. The requirements phase is the appropriate stage for this.

Emergency changes bypass normal CAB approval, so it is critical to document the change and have it retrospectively reviewed by the CAB to ensure proper governance.

A SOC 2 report is specifically designed to provide assurance over a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy, which directly addresses the need to audit the vendor's internal controls for a financial system. It is more efficient than other options because it is a standardized, independent assessment that covers the control environment relevant to financial data processing.

Fixed-price contracts are risky when requirements are unclear because the vendor may understate effort or charge high change orders. Time-and-materials contracts are safer for undefined requirements.

The spiral model is risk-driven; failure to identify critical risks undermines the methodology and could lead to project failure.

Data migration is a critical risk in ERP implementations. Poor data quality from legacy systems can lead to errors, inconsistencies, and business disruption. Ensuring data integrity is paramount.

By identifying and mitigating risks early in each cycle, the spiral model reduces the likelihood of major problems later.

The sprint review is a formal meeting where the development team demonstrates completed work to stakeholders. The auditor can observe validation of acceptance criteria and gather evidence of user acceptance.

Emergency changes require justification, a documented test plan (even if abbreviated), and a rollback plan to restore service if needed.

Segregation of duties conflicts can be mitigated by enforcing access controls based on roles, using automated tools to detect conflicting access, and establishing compensating controls (e.g., dual approval) where segregation is not possible.

In agile, the sprint review is a ceremony where stakeholders inspect the increment and provide feedback, serving as a control for user acceptance.

The spiral model is risk-driven, so the primary risk is that risk assessment may be incomplete, leading to unaddressed issues.

Iterative models allow for adjustments based on feedback and changing requirements, which is a key advantage.

In agile projects, sprint retrospectives help identify improvements, and sprint reviews demonstrate working functionality to stakeholders, serving as a control point. Pair programming is a development practice but not a universal agile control. Detailed requirements documentation and formal phase-gate approvals are characteristic of waterfall, not agile.

Code reviews should be performed before unit testing to catch defects early. Delaying reviews until after testing may lead to rework if issues are found, increasing costs and time.

Audit rights allow the organization to verify that the vendor's controls are operating effectively. This directly addresses the risk of inadequate vendor security controls, which could expose the organization to data breaches or compliance violations.

The auditor should first verify actual performance against the criteria defined in the business case to determine if objectives were met.

Iterative models develop systems through repeated cycles (iterations) that incorporate user feedback, unlike waterfall where requirements are fixed upfront.

Low user satisfaction may stem from inadequate training, unmet requirements, or data migration issues affecting business processes. While budget and timeline were met, these operational aspects often drive satisfaction. Integration testing completeness is important but more technical; vendor SLA compliance is contractual and less directly tied to user satisfaction.

The sprint review is a demonstration of working software where controls can be observed. The retrospective is about process improvement, not control assessment.

An adverse SOC 2 opinion indicates material weaknesses in controls; the organization should seek compensating controls or consider alternative vendors.

When an organization requires highly specialized functionality that is not available in any commercial off-the-shelf (COTS) product, building a custom application becomes the only viable option. COTS products are designed for broad market needs and often lack the unique features or compliance requirements that a custom solution can provide. This factor overrides cost, time, and maintenance considerations because no amount of configuration or customization of a COTS product can meet the specific functional gap.

In agile, the product backlog is the primary control for requirements, and sprint reviews provide stakeholder validation.

In agile, sprint reviews, product backlog prioritization, and retrospective actions are key controls to ensure quality and continuous improvement.

Security requirements should be defined early to ensure controls are designed in, not bolted on. The best practice is to include security requirements in the requirements phase and have them reviewed by security experts.

Fixed-price contracts provide cost certainty for the buyer, as the vendor bears the risk of cost overruns.

The root cause should be identified before recommending specific actions. Performance testing or analysis will reveal the cause.

In the waterfall model, requirements are defined upfront and formal sign-off at each phase is critical. Formal user acceptance testing (UAT) is the key control to ensure the system meets business needs before deployment.

Threat modeling proactively identifies potential security threats and vulnerabilities in the system architecture to design appropriate controls.

Without a rollback plan, if the deployment fails, the system may be unavailable for an extended period, impacting business operations.

UAT is performed after system testing is complete and before deployment to ensure the system meets user requirements.

The design phase defines the system architecture and ensures security controls are incorporated rather than added later.

Emergency changes require a rollback plan to ensure the system can be restored if the change fails. A full test plan may be abbreviated.