CISA Domain 3A Practice Test 001

This practice test covers Domain 3 (Information Systems Acquisition, Development & Implementation) Subdomain A (Information Systems Acquisition and Development) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA Practice Test — 3A (Information Systems Acquisition and Development)

10 questions • Single best answer

Question 1

An IS auditor is reviewing the governance of a new digital banking platform under development at a retail bank. The project has no steering committee, and scope decisions are made solely by the vendor's project manager. Which of the following is the auditor's MOST significant concern?

A. The vendor project manager may lack familiarity with the bank's internal secure coding standards and conventions. B. Business stakeholders lack a governance mechanism to approve scope changes and align the project with strategic objectives. C. Project status reports are not distributed to the full development team on a weekly basis. D. The project schedule was produced using a planning tool not formally licensed to the bank.

Question 2

During the initiation phase of an ERP replacement at a public utility, an IS auditor notes that the approved business case quantifies expected benefits but omits any analysis of alternative solutions or the option of not proceeding. Which conclusion is MOST appropriate regarding the business case?

A. The business case is incomplete because feasibility analysis should compare viable alternatives to justify the selected investment. B. The business case is adequate because the expected financial benefits have been fully quantified. C. The omission is acceptable because alternatives are normally evaluated later during system design. D. The business case cannot be assessed until post-implementation benefits are measured and compared.

Question 3

A post-design review of a claims-processing system at an insurance company finds that application controls were not identified until user acceptance testing began, well after requirements and design were finalized. Which of the following BEST describes the primary risk introduced by identifying controls this late?

A. Controls tested during user acceptance testing are inherently unreliable and cannot be depended upon. B. Late control identification automatically invalidates the system's transaction audit trail. C. Controls added late may be costlier and may fail to address risks that arose in the requirements stage. D. Application controls become unnecessary when the underlying database enforces integrity constraints.

Question 4

An IS auditor is evaluating an agile development project at a logistics firm where product requirements evolve during each sprint. Management is concerned that the iterative approach may weaken the control environment. Which recommendation is MOST appropriate to preserve control while retaining the flexibility of the agile method?

A. Freeze all project requirements before development starts so that no further change can occur. B. Replace the agile approach entirely with a traditional sequential waterfall development life cycle. C. Defer all control testing until the final production release has been fully deployed to users. D. Embed specific control requirements into the definition of done and review them at each sprint.

Question 5

During an audit of a government payroll system project, an IS auditor observes that the project is 40% over budget and several months behind schedule, yet the status reports submitted to the steering committee consistently show an overall green rating. What should the auditor do FIRST?

A. Determine why reported status does not reconcile with actual cost and schedule performance data. B. Recommend that the project be cancelled immediately because of the significant budget overrun observed. C. Report the project sponsor to the audit committee for deliberately misrepresenting project status. D. Recommend that additional funding be approved so the delayed project can be completed on time.

Question 6

An IS auditor is assessing whether user requirements were adequately defined during the early stages of a project to build a new hospital appointment scheduling system. Which of the following would provide the BEST evidence that the requirements were properly established and formally agreed by stakeholders?

A. Interviews with members of the development team describing the individual features they ultimately designed and delivered into the finished system. B. Signed-off requirements specifications traceable to documented business needs and formal user approvals. C. The absence of any change requests being raised during the system's coding phase. D. A live demonstration of the completed system delivered by the implementation vendor.

Question 7

During the design phase of a procurement system at a construction company, an IS auditor finds that the same automated workflow permits a requester to both raise and approve purchase orders that exceed the standard approval limit. Which of the following findings is MOST significant?

A. The automated workflow does not send email notifications to designated approvers when limits are exceeded. B. Approval authorization limits are documented in a separate procurement policy manual rather than the system. C. The design fails to enforce segregation of duties, allowing unauthorized transactions to be approved. D. The system stores approved purchase orders in a legacy relational database engine.

Question 8

A national retailer is acquiring a packaged point-of-sale solution from a vendor rather than building the system in-house. An IS auditor is reviewing the acquisition process. Which of the following activities provides the BEST assurance that the selected package will meet the organization's functional and control requirements?

A. Confirming that the vendor has a large installed base of customers in the retail sector. B. Verifying that the package received favorable ratings from independent industry analyst firms. C. Mapping the package's built-in controls against documented functional and control requirements before selection. D. Ensuring the vendor offers a meaningful discount in exchange for a multi-year licensing commitment.

Question 9

An IS auditor reviewing a multi-year core banking system replacement finds that no single party has been made accountable for realizing the project's expected business benefits once the system goes live and the project is formally closed. Which of the following recommendations is MOST appropriate to address this gap?

A. Close the project at go-live because the expected business benefits will accrue automatically. B. Assign benefits realization ownership to a business sponsor accountable through post-implementation review. C. Transfer all remaining accountability to the IT operations support team after final deployment. D. Delegate ongoing benefits tracking and measurement entirely to the external system development vendor named in the delivery contract.

Question 10

During an audit of a customer self-service portal built using rapid prototyping, an IS auditor notes that the approved prototype was promoted directly into the production environment without further development or testing work. Which of the following is the auditor's GREATEST concern regarding this approach to deployment?

A. Prototyping approaches always produce application code that performs more slowly than traditional code. B. End users were involved too heavily in defining the prototype's initial feature set and scope. C. The prototype was developed considerably faster than an equivalent waterfall solution would have been. D. Controls and documentation deferred during prototyping may never be formally implemented or tested.

Related Posts

Leave a Comment Cancel Reply