CISA Domain 3A-3 Practice Test 001

This practice test covers Domain 3 (Information Systems Acquisition, Development & Implementation) Subdomain A-3 (System Development Methodologies) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 3A-3 System Development Methodologies Practice Test 001

10 questions • Single best answer

Question 1

During a review of an insurance company's software development function, the IS auditor finds the team recently adopted Agile and delivers working software every two weeks. Requirements are captured only as brief user stories, and design and control decisions are rarely documented anywhere. Which of the following should concern the IS auditor MOST?

A. Agile enables the team to deliver working software to business users every two weeks. B. Business users, rather than the developers, are responsible for writing the user stories. C. Sparse documentation weakens requirements traceability and undermines the auditability of controls. D. Two-week iterations may not leave sufficient time to complete regression testing each cycle.

Question 2

A financial institution is planning a multi-year core-banking replacement where regulatory requirements are fixed, well understood, and unlikely to change. Management asks the IS auditor which development approach would best support strong documentation and formal control checkpoints. Which methodology should the auditor identify as MOST appropriate under these conditions?

A. A sequential waterfall model with formal, documented sign-offs at each defined phase gate. B. An Agile model built around frequent iterations and continuous requirement change. C. Rapid prototyping used to iteratively discover and refine unclear requirements. D. A continuous DevOps pipeline that deploys changes automatically into production.

Question 3

An IS auditor reviews a project where developers built a working prototype to help users clarify requirements for a new claims system. Users were impressed and now expect the prototype to be deployed directly into production without further work. What is the auditor's GREATEST concern with this situation?

A. Prototyping increased user involvement during the requirements definition process. B. Prototyping can take longer to complete than a traditional waterfall approach would. C. Developers may require specialized tools in order to build the working prototype. D. The prototype likely lacks the security, controls, and quality assurance needed for production.

Question 4

A national retailer's development teams use Agile with two-week sprints and release features to production continuously throughout the year. The IS auditor wants to provide ongoing assurance over application controls without slowing the pace of delivery the business depends on. Which approach would BEST allow the auditor to gain that assurance in this environment?

A. Wait until the entire product is fully complete before performing a single comprehensive audit. B. Embed control requirements into the definition of done and review each sprint's deliverables. C. Require the development teams to abandon Agile and adopt a waterfall methodology. D. Review only the quarterly release notes to confirm that features were delivered.

Question 5

During an audit of a technology company's DevOps environment, the IS auditor notes that the same engineers write the code, approve their own changes, and then deploy directly to production through fully automated pipelines with no independent review gate in place. Which of the following is the auditor's MOST significant concern?

A. Inadequate segregation of duties may let unauthorized or unreviewed code reach production. B. Automated deployment pipelines now release code far more quickly than the previous manual change-approval processes ever did. C. Engineers are expected to develop both software development and operations skill sets. D. Continuous deployment tends to produce frequent releases that contain small code changes.

Question 6

An IS auditor is evaluating the requirements definition phase of a new HR system that was developed using an iterative methodology over several releases. The auditor wants reasonable assurance that the delivered functionality genuinely reflects agreed business needs. Which of the following provides the BEST evidence that requirements were appropriately defined?

A. The total number of user stories completed during each development iteration. B. Informal positive feedback from developers regarding the clarity of the requirements. C. User requirements that are documented and formally approved by the business owners. D. A project schedule confirming that requirements gathering finished on the planned date.

Question 7

While auditing a system development project at a utility company, the IS auditor finds the organization has a defined SDLC methodology, but the project team bypassed several mandatory phase-gate approvals in order to meet an aggressive delivery deadline set by management. Which of the following findings is MOST significant?

A. Bypassing mandatory phase gates removed key control checkpoints and management oversight. B. The project may now be completed somewhat earlier than its originally scheduled and communicated delivery date. C. The methodology documentation had recently been reviewed and updated by governance. D. Several project team members were unfamiliar with parts of the defined methodology.

Question 8

A post-implementation review of a newly launched system reveals that the system, built with an incremental methodology, met its scheduled deadlines, but several security controls identified and agreed during the early increments were never actually implemented. Considering the resulting risk exposure, what should the IS auditor recommend FIRST?

A. Recommend that the organization immediately halt all use of the newly deployed system. B. Perform a risk assessment of the missing controls to determine remediation priority. C. Recommend rebuilding the entire system using a sequential waterfall methodology. D. Recommend that management take disciplinary action against the development team.

Question 9

A manufacturing firm is undertaking a highly innovative, high-risk system project where technical feasibility is uncertain and risks must be re-evaluated repeatedly as work progresses. The IS auditor is asked which methodology best incorporates continuous risk assessment throughout development. Which approach should the auditor identify?

A. The spiral model, which repeats formal risk analysis within each development cycle. B. The waterfall model, which completes each phase a single time in strict sequence. C. Rapid application development, which prioritizes delivery speed over risk analysis. D. A single risk assessment performed only during the project initiation phase.

Question 10

An IS auditor evaluates whether an organization's chosen system development methodology adequately supports its control objectives across a large and diverse portfolio of projects ranging widely in scope. Which factor is MOST important for the auditor to consider when assessing whether the methodology is appropriate for a given project?

A. Whether the methodology is currently the newest one available within the industry. B. Whether the organization's own developers personally prefer working with the methodology. C. Whether the methodology matches the one used by the organization's main competitors. D. Whether the methodology fits each project's risk, size, and requirement stability.

Related Posts

Leave a Comment Cancel Reply