CISA Domain 3A-3 Practice Test 002

This practice test covers Domain 3 (Information Systems Acquisition, Development & Implementation) Subdomain A-3 (System Development Methodologies) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 3A-3 System Development Methodologies Practice Test 002

10 questions • Single best answer

Question 1

A state government agency's internal audit team is reviewing the Agile project that is rebuilding its unemployment benefits eligibility system. Sprint records show the IT project manager serves as product owner, writes all user stories, and accepts completed increments without participation from benefits program staff. Which finding is MOST significant?

A. Sprint velocity has varied significantly across the last six sprints of the project. B. User stories are recorded in the backlog tool rather than in a formal requirements specification document. C. Business stakeholders have no role in prioritizing or accepting the delivered functionality. D. Daily stand-up meetings are frequently shortened or skipped by the development team.

Question 2

A hospital network is replacing its pharmacy management system using a traditional waterfall methodology. During a mid-project review, the IS auditor learns that the design phase began three weeks ago, although clinical users have not yet signed off on the functional requirements. What is the MOST significant risk to the project?

A. The system design may not reflect validated user needs, causing costly rework in later phases. B. The schedule may slip because design and requirements staff are now working on overlapping phases at once. C. Test scripts may be developed before the design documents have been formally baselined. D. The vendor may invoice for design deliverables before the contract milestone is reached.

Question 3

An IS auditor at a logistics company reviews a new route-optimization application that was built by rapidly iterating on a prototype with dispatch supervisors. Management now proposes deploying the final prototype directly into production to meet an upcoming peak-season deadline. Which concern is MOST significant?

A. Dispatch supervisors may resist the system because they were not trained on its final version. B. The prototype's user interface may differ from the organization's approved design standards. C. Development costs may exceed budget because the iterations were never formally estimated. D. The prototype may lack adequate controls, error handling, and documentation for production use.

Question 4

During an audit of a fintech company's DevOps practices, the IS auditor observes that developers commit code that is automatically built, tested, and deployed to production through a CI/CD pipeline. Management states that separating development and deployment duties would eliminate the benefits of the methodology. Which control provides the BEST assurance in this environment?

A. Quarterly management review of a sample of production deployments against change tickets. B. Pipeline-enforced peer review and approval of every code merge by someone other than the author. C. Restricting direct production server logins so only designated operations engineers hold admin accounts. D. Requiring developers to sign an annual attestation acknowledging the change management policy.

Question 5

An audit manager at an insurance carrier is evaluating whether security and control requirements are addressed in a claims portal developed through two-week Agile sprints. The team keeps documentation minimal, consistent with its methodology. Which of the following is the BEST evidence that controls are being built into each increment?

A. A definition of done that includes control criteria, supported by sprint review acceptance records. B. A signed project charter stating that security will be considered throughout development. C. Interview statements from developers describing how they typically address security requirements. D. The final penetration test report scheduled to be completed before the portal's public launch.

Question 6

A telecommunications provider used rapid application development to deliver a customer self-service app within a fixed 90-day timebox. A post-implementation review finds the app launched on schedule, but several reporting features were dropped mid-project and business owners were not informed until go-live. Which conclusion is MOST appropriate based on the evidence?

A. The timebox was too short, and RAD should not be used for customer-facing applications. B. The development team lacked the technical skills required to complete all planned features. C. Scope reductions made to meet the timebox were not governed through stakeholder approval. D. Reporting features should have been prioritized ahead of the core self-service functions.

Question 7

A mid-sized manufacturer's IT department allows each development team to choose its own methodology, and teams currently use waterfall, Scrum, and informal ad hoc approaches. The IS auditor finds that control checkpoints such as requirements approval and security review vary widely across projects. Which recommendation is MOST appropriate?

A. Require all development teams to adopt Scrum so that practices become consistent across projects. B. Have the internal audit function approve each project's methodology before development begins. C. Replace ad hoc projects with commercial off-the-shelf software wherever a suitable product exists. D. Establish an SDLC framework defining mandatory control checkpoints that apply to any methodology.

Question 8

A regional bank plans to reverse engineer a legacy loan-servicing application, purchased from a vendor that no longer supports it, to document the program logic before redevelopment. The project team has already obtained a decompiler and assigned two developers to the effort. What should the IS auditor do FIRST?

A. Verify that the decompiled source code will be stored in a secured version control repository. B. Determine whether the software license agreement permits reverse engineering of the application. C. Recommend that the bank select a replacement package instead of redeveloping the application. D. Review the developers' qualifications to confirm they can interpret the decompiled program logic.

Question 9

A chief audit executive at a university is planning assurance coverage for an enterprise student information system being delivered in monthly Agile releases over two years. Prior audits of similar projects were performed only after full implementation, when remediation proved costly. Which audit approach is MOST appropriate?

A. Perform a single comprehensive review after the final release, once all functionality is complete. B. Assign an auditor to the Scrum team to help design and approve its control requirements. C. Conduct periodic reviews at key release points, assessing control acceptance criteria and backlog governance. D. Rely on the project management office's status reports and review them at the end of each year.

Question 10

An IS auditor reviewing the backlog for a government contractor's Agile procurement system notes that user stories for audit logging and role-based access have been deprioritized in each of the last seven sprints. The product owner states that business features deliver more visible value. Which recommendation is MOST appropriate?

A. Require formal risk acceptance for deferred control stories and include them in release criteria. B. Have developers implement the control stories informally outside the sprint process when time allows. C. Suspend all business feature development until every outstanding control story has been completed. D. Transfer the product owner role to the information security manager for the rest of the project.

Related Posts

Leave a Comment Cancel Reply