CISA · topic practice

Information Systems Acquisition, Development, and Implementation practice questions

Q: How should I use these Information Systems Acquisition, Development, and Implementation practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Q: Can I practise just Information Systems Acquisition, Development, and Implementation questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Information Systems Acquisition, Development, and Implementation domain.

Practise Certified Information Systems Auditor CISA Information Systems Acquisition, Development, and Implementation practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Information Systems Acquisition, Development, and Implementation

Practice 10 questions Browse domain →

What the exam tests

What to know about Information Systems Acquisition, Development, and Implementation

Information Systems Acquisition, Development, and Implementation questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Information Systems Acquisition, Development, and Implementation exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Information Systems Acquisition, Development, and Implementation questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Information Systems Acquisition, Development, and Implementation explanation →

During a post-implementation review of a new financial system, the IS auditor finds that user acceptance testing (UAT) was completed with only 60% of test cases passed. Which of the following is the MOST significant risk?

Trap 1: The system deployment was delayed

Delay is a project timeline issue, not a direct consequence of low UAT success.

Trap 2: The system performance is below expectations

Performance is tested separately; UAT focuses on functionality and user acceptance.

Trap 3: The project was not completed within the planned budget

Budget overruns are a project management concern, not a direct risk from low UAT pass rate.

Study all Information Systems Acquisition, Development, and Implementation common traps →

A
The system deployment was delayed
Why wrong: Delay is a project timeline issue, not a direct consequence of low UAT success.
B
The system performance is below expectations
Why wrong: Performance is tested separately; UAT focuses on functionality and user acceptance.
C
The project was not completed within the planned budget
Why wrong: Budget overruns are a project management concern, not a direct risk from low UAT pass rate.
D
The system may not fully meet business requirements, leading to user workarounds
Unpassed test cases mean functionality gaps that users may bypass, increasing error and fraud risk.

Information Systems Acquisition, Development, and Implementation practice questions

What to know about Information Systems Acquisition, Development, and Implementation

Common Information Systems Acquisition, Development, and Implementation exam traps

Information Systems Acquisition, Development, and Implementation questions

During a post-implementation review of a new financial system, the IS auditor finds that user acceptance testing (UAT) was completed with only 60% of test cases passed. Which of the following is the MOST significant risk?

An organization is implementing an enterprise resource planning (ERP) system. The project team plans to migrate legacy data without performing a full reconciliation between source and target systems. As an IS auditor, which of the following should be your PRIMARY concern?

In a waterfall SDLC, which phase requires formal sign-off from the business owner before proceeding to the next phase?

An IS auditor is reviewing an agile software development project. Which of the following would be the BEST evidence that adequate controls are in place for user acceptance?

During a vendor evaluation for a critical system, the IS auditor notes that the vendor's SOC 2 report includes an adverse opinion. What should be the auditor's PRIMARY recommendation?

An organization is using a spiral model for a high-risk project. The IS auditor wants to ensure that risk assessment is performed at each iteration. Which of the following is the BEST evidence that this control is effective?

Which of the following is a primary advantage of fixed-price contracts in systems acquisition?

An IS auditor is reviewing change management procedures. Which of the following situations would be of GREATEST concern?

During a build vs. buy analysis, the IS auditor observes that the organization decided to build a custom application because no vendor solution met all requirements. Which of the following risks should the auditor emphasize?

An organization is deploying a major system upgrade. The change request has been approved by CAB, but the deployment plan does not include a rollback procedure. As an IS auditor, what should you recommend?

Which of the following is a key objective of the design phase in the SDLC?

An IS auditor is assessing an ERP implementation. Which of the following control concerns is MOST likely to arise from segregation of duties conflicts?

Which TWO of the following are typical controls in the testing phase of the SDLC? (Select two.)

Which THREE of the following are essential elements of an emergency change request? (Select three.)

Which TWO of the following are benefits of an iterative SDLC approach compared to waterfall? (Select two.)

During which phase of the SDLC should security requirements be formally documented and approved by the business owner?

An IS auditor is reviewing an agile software development project. Which of the following practices would BEST help ensure that security controls are adequately addressed?

An organization is implementing a large ERP system. The project team plans to migrate legacy data to the new system. Which of the following is the MOST significant risk associated with data migration?

An IS auditor is evaluating the change management process. Which of the following is the BEST indicator that emergency changes are being properly controlled?

In a waterfall SDLC, when should user acceptance testing (UAT) typically occur?

Track your progress over time

Start a Information Systems Acquisition, Development, and Implementation only practice session

Related CISA topic practice pages

Governance and Management of IT practice questions

Information Systems Acquisition, Development and Implementation practice questions

Information Systems Operations and Business Resilience practice questions

Information System Auditing Process practice questions

Information Systems Acquisition, Development, and Implementation practice questions

Protection of Information Assets practice questions

CISA fundamentals practice questions

CISA scenario practice questions

CISA troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid