CISA Domain 3B Practice Test 001

This practice test covers Domain 3 (Information Systems Acquisition, Development & Implementation) Subdomain B (Information Systems Implementation) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA Practice Test — 3B (Information Systems Implementation)

10 questions • Single best answer

Question 1

During a go-live readiness review of a hospital's new electronic health record system, an IS auditor finds that several critical defects logged during user acceptance testing remain open, yet the implementation date has not been changed. Which of the following should be the auditor's MOST significant concern about the planned deployment?

A. The go-live date was scheduled before user acceptance testing had formally started. B. Unresolved critical defects suggest the system may not meet requirements and could disrupt patient care once live. C. End users, rather than the quality assurance team, executed the acceptance testing scripts. D. A consolidated test completion report has not yet been circulated to project management.

Question 2

A manufacturing company is converting master and transactional data from a legacy system into a new ERP platform. After the load, record counts match but users report incorrect supplier balances. Which of the following should the IS auditor recommend as the MOST effective control to prevent this type of conversion error?

A. Perform reconciliation of both record counts and control totals of key financial fields between source and target. B. Require the vendor to certify in writing that the conversion program executed successfully without any runtime errors or aborted job steps. C. Increase the frequency of full data backups taken before each conversion attempt. D. Restrict conversion program access to a single database administrator during the load window.

Question 3

Six months after a retailer implemented a new point-of-sale system, an IS auditor is conducting a post-implementation review. Management states the project was a success because it was delivered on time and within budget. Which of the following would provide the BEST evidence that the implementation actually delivered its intended value?

A. Signed minutes confirming the steering committee formally closed the project. B. The final project budget report showing that total costs stayed within the originally approved funding amount. C. Measured results showing the expected benefits in the business case were achieved. D. Confirmation that all planned system functions were deployed to stores.

Question 4

An IS auditor is reviewing release management for a bank's new loan origination application scheduled for production deployment. The auditor notes that developers can move their own code directly into the production environment. Which of the following is the auditor's MOST appropriate recommendation to strengthen this process?

A. Require developers to complete formal secure coding training before they are permitted to release any code into production. B. Implement segregation of duties so that migration to production is performed by an independent function. C. Mandate that all production releases occur only during scheduled overnight maintenance windows. D. Require developers to document each code change in the version control system before release.

Question 5

A government agency is preparing to migrate its tax processing system to new infrastructure over a weekend cutover. During the readiness review, the IS auditor observes that no documented fallback procedure exists if the migration fails. Which of the following should the auditor identify as the MOST significant risk of proceeding?

A. The migration is scheduled outside of normal business hours, reducing staff availability. B. Without a fallback procedure the agency may be unable to restore service if the migration fails. C. The infrastructure vendor has not yet provided any formal capacity benchmarks for the new production environment. D. Migration runbook steps have not been peer reviewed by a second engineer.

Question 6

During implementation testing of a new insurance claims platform, an IS auditor reviews the user acceptance testing sign-off. Business users approved the system despite a test log showing that 15 percent of test cases were not executed. Which of the following should the auditor do FIRST?

A. Recommend that the untested test cases be executed before the system is approved for production. B. Determine whether the unexecuted test cases cover critical business functions or high-risk requirements. C. Report the incomplete testing as a control deficiency in the final audit report to management. D. Conclude that user acceptance testing was inadequate and the sign-off should be rescinded.

Question 7

An organization used a parallel run to implement a new payroll system, operating the old and new systems simultaneously for two pay cycles. The IS auditor is evaluating the results. Which of the following provides the BEST assurance that the new payroll system is functioning correctly?

A. Both systems processed the payroll runs within the scheduled batch windows. B. Outputs from the new and legacy systems were compared and reconciled without material differences. C. The payroll team confirmed they are comfortable operating the new system. D. The new system successfully imported all active and terminated employee records from the legacy payroll database.

Question 8

A cloud migration review at a logistics firm finds that the new production environment was deployed using configuration settings copied from a developer's local environment rather than an approved baseline. Which of the following is the IS auditor's MOST significant concern regarding this deployment approach?

A. Production may contain insecure or unapproved settings that were never formally reviewed or authorized. B. The developer who created the configuration may not have documented each individual setting change. C. Copying configurations manually is slower than using an automated deployment pipeline tool. D. Development environments typically use different naming conventions than production systems.

Question 9

An IS auditor is performing a post-implementation review of a customer relationship management system deployed three months ago. The auditor wants to assess whether the application controls designed during the project are operating as intended. Which of the following audit procedures would be MOST appropriate for this objective?

A. Interview the project sponsor to confirm the system met the original delivery timeline. B. Review the detailed design specifications that were prepared for the application controls during the development phase. C. Test a sample of live transactions to verify the application controls are operating effectively. D. Inspect the change log to confirm no unauthorized changes were made after go-live.

Question 10

A financial institution deployed a new online banking release, but shortly after go-live customers reported failed transactions. Investigation showed the release was promoted to production without the tested database update script. Which of the following controls would MOST effectively prevent recurrence of this type of release failure?

A. Requiring an approved, complete release package with all components verified before production promotion. B. Increasing the number of testers assigned to the user acceptance testing phase of each release. C. Scheduling all future banking releases to occur only on weekends to limit customer impact. D. Requiring the operations team to monitor transaction volumes for one hour after each release.

Related Posts

Leave a Comment Cancel Reply