CISA - Certified Information Systems Auditor System Development and Implementation Questions and Answers

Question 1

An organization is preparing to migrate data from a legacy system to a new ERP platform.
Which of the following is the MOST critical control for an IS auditor to verify before the data conversion process begins?

Accepted Answer

The data conversion logic has been reviewed and approved by the data owners.

Answer

The new ERP system's user acceptance testing (UAT) has been successfully completed.

Answer

A complete data backup of the legacy system has been performed and validated.

Answer

End-user training on the new ERP system has been concluded.

Question 2

During a post-implementation review of a new CRM system, an IS auditor's PRIMARY objective is to determine whether:

Accepted Answer

the system has met the business objectives and delivers the expected benefits.

Answer

the project was completed within the allocated budget and timeframe.

Answer

all identified bugs and defects from the testing phase have been resolved.

Answer

end-users are satisfied with the new system's user interface and performance.

Question 3

A software development project is using a traditional Waterfall methodology. An IS auditor would be MOST concerned about the risk of:

Accepted Answer

requirements not being fully defined and understood until late in the lifecycle.

Answer

insufficient stakeholder involvement throughout the project.

Answer

the project scope expanding without formal control.

Answer

a lack of detailed documentation for each phase.

Question 4

Which of the following testing types is specifically designed to verify that different system components work together as a single, combined unit?

Accepted Answer

Integration testing

Answer

Unit testing

Answer

Stress testing

Answer

User Acceptance Testing (UAT)

Question 5

An IS auditor is reviewing the change management process for a critical financial application. It is noted that developers are able to promote their own code changes directly into the production environment. This practice represents a failure of which fundamental control principle?

Accepted Answer

Segregation of duties (SoD)

Answer

Principle of least privilege

Answer

Defense in depth

Answer

Security by design

Question 6

When an organization purchases a commercial off-the-shelf (COTS) software package instead of developing it in-house, the PRIMARY shift in risk for the organization is from:

Accepted Answer

development and testing risks to vendor management and dependency risks.

Answer

project management risks to data migration and conversion risks.

Answer

security configuration risks to user training and adoption risks.

Answer

business requirement definition risks to system integration risks.