CISA System Development and Implementation 5

Question 1

An IS auditor is assessing a project that used prototyping as its development approach. The PRIMARY risk of this methodology is:

Accepted Answer

Insufficient technical documentation and scope creep

Answer

Prototyping can lead to inadequate formal documentation and uncontrolled scope expansion as stakeholders continually request enhancements to the prototype.

Question 2

Which of the following BEST describes the role of configuration management in system development?

Accepted Answer

Controlling and tracking changes to software components and their versions

Answer

Configuration management ensures that software components are versioned, tracked, and controlled so that any version can be reproduced and changes are auditable.

Question 3

An organization implements a new payroll system in parallel with the legacy system for two pay cycles. The PRIMARY purpose of parallel operations is to:

Accepted Answer

Validate that the new system produces correct results by comparing outputs

Answer

Parallel operations allow organizations to compare outputs from both systems, confirming the new system's accuracy before full cutover.

Question 4

During a CISA audit of the testing phase, an auditor discovers that developers performed their own integration testing with no independent review. This violates the principle of:

Accepted Answer

Segregation of duties

Answer

Segregation of duties requires that testing be performed or reviewed independently from development to ensure objectivity and catch biases.

Question 5

A key output of the feasibility study phase in SDLC is:

Accepted Answer

A business case assessing technical, economic, and operational viability

Answer

The feasibility study produces a business case that evaluates whether a proposed system is technically achievable, economically justified, and operationally suitable.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA System Development and Implementation 5