CISA System Development and Implementation 4 — Questions and Answers
Question 1: Which of the following is the PRIMARY objective of a structured walkthrough during system development?
- Assigning blame for coding errors to individual developers
- Peer review of code or design to identify defects early (Correct answer)
- Documenting project budget expenditures
- Training end users on the new system
Correct answer: Peer review of code or design to identify defects early
Structured walkthroughs are formal peer review sessions designed to detect errors in design, code, or documentation before they propagate to later phases.
Question 2: An IS auditor reviewing system documentation finds that no operations manual exists for a newly implemented system. The PRIMARY concern is:
- End users may not enjoy the interface
- Operations staff may be unable to maintain or recover the system properly (Correct answer)
- Development costs may increase in the next phase
- The system may not integrate with social media platforms
Correct answer: Operations staff may be unable to maintain or recover the system properly
Without an operations manual, staff lack the guidance needed for routine operations, troubleshooting, and disaster recovery, increasing operational risk.
Question 3: During application testing, what is the MAIN purpose of boundary value analysis?
- Verifying system performance under peak load conditions
- Testing input values at the edges of valid ranges where defects are most likely (Correct answer)
- Confirming user interface color schemes meet accessibility standards
- Measuring database query response times
Correct answer: Testing input values at the edges of valid ranges where defects are most likely
Boundary value analysis tests values at, just below, and just above defined input limits, where programming errors are most commonly found.
Question 4: A company outsources its application development to a third-party vendor. Which control is MOST important for the IS auditor to verify?
- The vendor uses the same programming language as internal staff
- Contractual rights to audit the vendor and review deliverables (Correct answer)
- The vendor's office is in the same time zone
- Development staff turnover is below industry average
Correct answer: Contractual rights to audit the vendor and review deliverables
Contractual audit rights ensure the organization retains oversight of vendor activities, code quality, and security practices throughout the engagement.
Question 5: The MOST effective control to prevent SQL injection vulnerabilities in a newly developed web application is:
- Implementing strong password policies for database administrators
- Using parameterized queries and input validation in application code (Correct answer)
- Encrypting all data stored in the database
- Restricting physical access to the database server
Correct answer: Using parameterized queries and input validation in application code
Parameterized queries separate SQL logic from user-supplied data, preventing malicious input from being interpreted as SQL commands.
Question 6: When reviewing an Agile development project, an IS auditor should be MOST concerned if:
- Sprints are two weeks long instead of four weeks
- Security and compliance requirements are consistently deferred to later sprints (Correct answer)
- The product backlog is maintained in a digital tool rather than on paper
- Daily standups are held remotely via video conference
Correct answer: Security and compliance requirements are consistently deferred to later sprints
Continuously deferring security and compliance work creates technical debt and may result in a system that fails regulatory requirements at launch.
Question 7: An IS auditor evaluating a software quality assurance program should expect to find metrics that track:
- Developer coffee consumption and office hours
- Defect density, test coverage, and open defect aging (Correct answer)
- Number of lines of code written per sprint
- Manager approval time for change requests
Correct answer: Defect density, test coverage, and open defect aging
Defect density, test coverage, and defect aging are key quality indicators that reflect the reliability and completeness of testing efforts.
CISA System Development and Implementation 4
Which of the following is the PRIMARY objective of a structured walkthrough during system development?