CISA Domain 3B-3 Practice Test 002

This practice test covers Domain 3 (Information Systems Acquisition, Development & Implementation) Subdomain B-3 (System Migration, Infrastructure Deployment, and Data Conversion) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 3B-3 System Migration, Infrastructure Deployment, and Data Conversion Practice Test 002

10 questions • Single best answer

Question 1

An external audit firm engaged by a credit union is reviewing the planned conversion of member loan records to a new lending platform. Conversion scripts have passed unit testing, but the project plan does not describe how record counts and loan balances will be reconciled between the legacy and target systems. Which recommendation is MOST appropriate before the conversion proceeds?

A. Increase the volume of test records processed during the final conversion rehearsal B. Obtain written vendor certification that the conversion scripts are free of defects C. Define control totals and reconciliation procedures with owner sign-off criteria D. Schedule a post-implementation review to compare loan balances after go-live

Question 2

During the conversion of claims history for a health insurer's new adjudication system, the error log shows that 2 percent of source records were rejected and written to a suspense file. The project manager plans to proceed with go-live next week and correct the rejected records afterward. What should the IS auditor do FIRST?

A. Determine the nature of the rejected records and their effect on processing B. Recommend that go-live be postponed until every rejected record has been corrected C. Report the rejection rate to the steering committee as a significant control failure D. Recommend that the conversion programs be rewritten and fully regression tested

Question 3

A government ministry deploys new virtual server infrastructure for its benefits portal using infrastructure-as-code templates that passed a security review. The IS auditor finds that engineers manually modified several production servers after deployment to resolve performance issues, and the templates were not updated. Which recommendation is MOST appropriate?

A. Require engineers to log all manual server changes in a shared tracking spreadsheet B. Perform a vulnerability scan of all production servers on a quarterly schedule C. Restrict engineer access to production servers to approved maintenance windows D. Route fixes through change management into the templates and redeploy servers

Question 4

A regional bank plans a single-weekend cutover of its core deposit system during a holiday. While reviewing the cutover plan, the IS auditor notes that the plan contains detailed conversion steps but no defined rollback criteria, go/no-go decision point, or procedures for reactivating the legacy system. Which risk is MOST significant?

A. Branch staff may be unfamiliar with the new system screens on the first business day B. The bank may be unable to restore customer services promptly if the cutover fails C. Conversion activities may run longer than the planned holiday weekend window D. Legacy system licensing and support costs may continue beyond the planned date

Question 5

A pharmaceutical distributor has migrated inventory and lot-tracking data from an on-premises warehouse system to a cloud platform. Regulators require complete traceability of product lots, and the IS auditor must conclude whether the migrated data is complete and accurate. Which of the following is the BEST evidence?

A. Reconciled record counts and hash totals between source and target, reviewed by data owners B. A project team sign-off memo stating that the migration was completed successfully C. Migration tool logs showing that every batch job ended with a zero return code D. User acceptance test results from a sample of lot lookups on the new platform

Question 6

A national retail chain is migrating customer loyalty data to a new marketing platform. The IT project team defined all field mapping and transformation rules and plans to approve the converted results itself before go-live, noting that business users are busy with seasonal sales. Which recommendation is MOST appropriate?

A. Assign the IT quality assurance team to approve the converted results independently B. Have the project manager approve the mapping rules once conversion testing is completed C. Require data owners to approve mapping rules and formally accept converted data D. Engage internal audit to review and sign off on the converted data before go-live

Question 7

An insurance company ran its legacy and new policy administration systems in parallel for one billing cycle. Premium calculations differed for several hundred policies, and to meet the go-live date the project team manually adjusted the new system's outputs to match the legacy results. What is the IS auditor's GREATEST concern?

A. The parallel run lasted for only one billing cycle rather than two B. Operations staff workload increased significantly during the parallel run C. The legacy system must remain available longer than originally budgeted D. Unresolved root causes of the differences may produce ongoing errors

Question 8

A state university hires a consulting firm to perform conversion rehearsals for its new financial aid system. The IS auditor finds that full copies of production data, including student identifiers and family income details, were loaded into the rehearsal environment, where all consultants have unrestricted access. Which recommendation is MOST appropriate?

A. Require consultants to sign confidentiality agreements before accessing the environment B. Mask sensitive fields and restrict rehearsal environment access to authorized staff C. Enable detailed logging of all queries executed within the rehearsal environment D. Delete the rehearsal environment immediately after each conversion rehearsal

Question 9

An audit manager at a securities firm is planning a review of an upcoming data center relocation that will move trading, settlement, and reporting systems to a new facility. Audit resources are limited to three weeks of fieldwork. Which area should receive the HIGHEST priority in the audit plan?

A. Contract terms and service level agreements with the relocation vendor B. Procedures for disposing of equipment left behind at the old facility C. Controls over the integrity and availability of critical data during transfer and cutover D. Accuracy and completeness of the updated asset inventory for equipment at the new facility

Question 10

A post-implementation review of a manufacturer's ERP migration finds that historical purchasing transactions were converted without their original created-by and approval timestamp fields because the mapping specification omitted them. Regulations require the company to retain this audit trail for seven years. Which recommendation is MOST appropriate?

A. Assess regulatory impact and restore the audit trail fields through a controlled supplementary conversion B. Document the omission as an accepted risk formally approved by the ERP project manager C. Configure the new ERP system to capture created-by and approval fields for future transactions D. Retain legacy system backup tapes so that audit trail data can be retrieved if regulators request it

Related Posts

Leave a Comment Cancel Reply