CISA Domain 3B-2 Practice Test 001

This practice test covers Domain 3 (Information Systems Acquisition, Development & Implementation) Subdomain B-2 (Implementation Configuration and Release Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 3B-2 Implementation Configuration and Release Management Practice Test 001

10 questions • Single best answer

Question 1

A commercial bank is deploying a major release of its online banking application through an automated deployment pipeline. During the review, the IS auditor observes that the same engineers who write and compile the application code also execute the deployment into the live production environment without any independent oversight. Which finding is MOST significant?

A. Automated regression testing is not consistently executed within the deployment pipeline before each scheduled release into the production environment. B. The same staff both develop and deploy the code, so segregation of duties over release to production is inadequate. C. Release notes describing the changes are not distributed to affected end users before go-live. D. The production environment was not capacity-tested against projected peak transaction volumes.

Question 2

During an audit of a government agency's implementation controls, the IS auditor finds that production deployments are built manually from individual developers' local workstations rather than from a controlled, version-managed source repository. As a result, the agency cannot readily confirm which specific build is currently running in production. What is the auditor's GREATEST concern?

A. Developers may find the manual build process time-consuming and prone to occasional human error during deployment. B. The manual build procedure has not been fully documented within the agency's release runbook. C. The organization cannot reliably verify or reproduce which code version is running in production. D. Compilation warnings could be overlooked during the manual build process on a workstation.

Question 3

A healthcare provider promotes application releases into its production environment based only on informal verbal approval from the development lead, and no record of the authorization is retained afterward. The IS auditor has been engaged to evaluate the organization's release management controls. Which recommendation is MOST appropriate?

A. Require documented release authorization from a designated approver before any production deployment. B. Increase the frequency of regression testing performed prior to each release. C. Require developers to peer-review all source code before it is promoted. D. Implement a separate quality assurance environment for release testing.

Question 4

An IS auditor is reviewing the release plan for a large enterprise resource planning system before its scheduled go-live. The plan contains detailed step-by-step deployment instructions but includes no documented procedure for reverting to the prior version if the deployment fails partway through. Which control weakness is MOST significant?

A. The detailed deployment steps have not been independently peer-reviewed by a second engineer. B. The release schedule was not communicated to affected business users sufficiently in advance. C. A post-implementation review of the release has not yet been scheduled by management. D. The lack of a tested rollback procedure increases the risk of a prolonged production outage if the release fails and cannot be reversed.

Question 5

A manufacturer uses a configuration management database to track all production configuration items across its server estate. During a release audit, the IS auditor identifies several servers whose live running configurations do not match the configurations recorded in the approved baseline. What should the auditor do FIRST?

A. Determine whether the discrepancies resulted from unauthorized changes that bypassed release controls. B. Recommend that the configuration management database baseline be updated to reflect the current server configurations found in production. C. Conclude that the release and configuration management process is operating effectively overall. D. Request that the affected servers be re-imaged to the recorded baseline configuration immediately.

Question 6

A technology firm deploys application code to production through a fully automated continuous integration and continuous delivery pipeline. The IS auditor wants reasonable assurance that only properly approved and tested code is able to reach the live production environment. Which of the following controls provides the BEST assurance?

A. Developers receive automated email notifications whenever a production deployment has completed successfully. B. The pipeline enforces mandatory approval gates and blocks deployment of any unreviewed or failed build. C. The pipeline logs the timestamp and duration of each production deployment for later review. D. A rollback capability is available to restore the previous release version when it is needed.

Question 7

During an audit of the release management process, the IS auditor wants to verify that all application changes moved into the production environment during the last quarter were properly authorized before deployment. Which of the following would be the BEST source of audit evidence to support this objective?

A. Interviews with the release manager describing the organization's standard deployment procedure. B. Vendor documentation describing the deployment tool's release automation capabilities. C. Approved release records reconciled against the deployments recorded in the production change log. D. A current copy of the organization's approved release management policy document.

Question 8

A financial services company frequently relies on an emergency release process to deploy urgent fixes into production outside of its normal, scheduled release cycle. The IS auditor has been asked to evaluate the adequacy of controls over this emergency release process. Which of the following findings would be MOST significant?

A. Emergency releases are deployed without any retroactive review or documented after-the-fact approval. B. Emergency releases tend to occur more frequently during month-end financial processing periods. C. Emergency releases are not always reflected in the quarterly release calendar distributed to teams. D. Emergency release procedures differ slightly from the wording used in the standard release runbook.

Question 9

An IS auditor reviewing a logistics company's release process finds that configuration settings validated in the test environment are manually re-entered into the production environment by staff during each deployment, rather than being promoted automatically. Which risk is the auditor MOST likely to raise regarding this practice?

A. Manual re-entry makes each production deployment take considerably longer to complete than a comparable fully automated configuration promotion approach would require. B. Test-environment configuration settings might inadvertently expose sensitive production data to developers. C. The release calendar may not adequately account for the additional manual effort required each time. D. Manual re-entry may introduce differences between environments, so the tested settings may not match what actually runs in production.

Question 10

After reviewing an insurer's release management controls in detail, the IS auditor confirms that releases are version-controlled, independently approved before deployment, promoted through segregated pipelines, and subsequently reconciled to authorized change records. Based on this evidence, which conclusion is MOST appropriate for the auditor to reach regarding release management?

A. Release management controls are ineffective and require immediate remediation before the next release. B. Release management controls provide reasonable assurance that only authorized, tested code reaches production. C. No further audit evidence is required for any other area of the overall engagement scope. D. Automated deployment through the pipeline eliminates the need for any subsequent post-implementation review of the release.

Related Posts

Leave a Comment Cancel Reply