CISA System Development and Implementation 5

Question 1

An IS auditor is assessing a project that used prototyping as its development approach. The PRIMARY risk of this methodology is:

Accepted Answer

Insufficient technical documentation and scope creep

Answer

Too much time spent on requirements gathering

Answer

Excessive unit testing of prototype modules

Answer

Vendor lock-in to prototyping tools

Question 2

Which of the following BEST describes the role of configuration management in system development?

Accepted Answer

Controlling and tracking changes to software components and their versions

Answer

Managing employee workstation hardware inventories

Answer

Scheduling project team meetings and sprint reviews

Answer

Approving capital expenditure for IT infrastructure

Question 3

An organization implements a new payroll system in parallel with the legacy system for two pay cycles. The PRIMARY purpose of parallel operations is to:

Accepted Answer

Validate that the new system produces correct results by comparing outputs

Answer

Train payroll staff on both systems simultaneously

Answer

Reduce hardware costs by sharing processing load

Answer

Accelerate the decommissioning of the old system

Question 4

During a CISA audit of the testing phase, an auditor discovers that developers performed their own integration testing with no independent review. This violates the principle of:

Accepted Answer

Segregation of duties

Answer

Least privilege access

Answer

Defense in depth

Answer

Need to know

Question 5

A key output of the feasibility study phase in SDLC is:

Accepted Answer

A business case assessing technical, economic, and operational viability

Answer

Fully coded application modules ready for testing

Answer

Completed user training materials

Answer

Approved production deployment scripts

Question 6

An IS auditor reviewing system retirement (decommissioning) should PRIMARILY confirm that:

Accepted Answer

Data retention requirements are met and data is migrated or archived per policy

Answer

The retired system's source code is deleted from all media

Answer

The project manager has signed the project closure document

Answer

New system licenses have been purchased to replace the old ones

Question 7

When auditing a DevOps environment, which control is MOST critical to verify regarding the deployment pipeline?

Accepted Answer

That automated security scans and approval gates are embedded in the CI/CD pipeline

Answer

That deployments occur only on Fridays to maximize monitoring time

Answer

That developers attend weekly code review meetings

Answer

That all deployments are performed manually by a senior engineer