ISACA IT Acquisition, Development, and Implementation 3

Question 1

When evaluating vendor proposals during system acquisition, what should an IS auditor verify is included in the RFP (Request for Proposal)?

Accepted Answer

Security, compliance, and audit requirements

Answer

Vendor stock prices and financial forecasts

Answer

Only technical specifications and pricing

Answer

The vendor's internal marketing strategy

Question 2

What does 'parallel operation' mean in the context of a system cutover strategy?

Accepted Answer

Both the old and new systems run concurrently for a validation period

Answer

Two development teams work on the same module simultaneously

Answer

Two separate databases are maintained permanently going forward

Answer

Testing is performed in parallel with active development

Question 3

A change advisory board (CAB) is PRIMARILY responsible for which activity?

Accepted Answer

Reviewing and authorizing change requests prior to implementation

Answer

Writing and coding the changes requested by the business

Answer

Testing all system changes after they have been implemented

Answer

Training users on new system features and updates

Question 4

Which rollback procedure consideration is MOST critical before executing a production system upgrade?

Accepted Answer

Whether the rollback procedure has been tested and a documented fallback plan exists

Answer

Whether the rollback process takes more than one hour

Answer

Whether all end users have been notified about the potential rollback

Answer

Whether the rollback preserves developer configuration preferences

Question 5

In IT governance and change management, the RACI model is used to define which of the following?

Accepted Answer

Responsible, Accountable, Consulted, and Informed roles

Answer

Risk, Accountability, Control, and Integration responsibilities

Answer

Review, Authorize, Check, and Implement steps

Answer

Request, Approval, Change, and Incident tracking

Question 6

Formal change management for infrastructure changes exists PRIMARILY to achieve which outcome?

Accepted Answer

Prevent unauthorized changes and minimize the risk of unplanned outages

Answer

Ensure infrastructure changes are implemented as rapidly as possible

Answer

Reduce the total number of people authorized to make changes

Answer

Eliminate the requirement for pre-deployment testing

Question 7

An IS auditor finds that emergency changes are implemented without any post-implementation review. This finding represents:

Accepted Answer

A control weakness that requires remediation

Answer

An acceptable exception given the time-critical nature of emergencies

Answer

A best practice for expediting high-priority changes

Answer

A standard procedure consistent with ITIL emergency change guidance