CISA Domain 3B-1 Practice Test 002

This practice test covers Domain 3 (Information Systems Acquisition, Development & Implementation) Subdomain B-1 (System Readiness and Implementation Testing) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 3B-1 System Readiness and Implementation Testing Practice Test 002

10 questions • Single best answer

Question 1

An audit manager at a pharmaceutical manufacturer is reviewing the readiness of a new laboratory information management system scheduled for go-live in two weeks. User acceptance testing is complete, but every sign-off form was signed by the IT project manager rather than by laboratory process owners. What should the audit manager recommend FIRST?

A. Proceed with go-live and obtain process owner sign-off during the hypercare period B. Require the IT project manager to attest that all test scripts passed as documented C. Have laboratory process owners review the UAT results and formally accept the system D. Commission an independent quality assurance team to rerun all user acceptance scripts

Question 2

During a pre-implementation review of a credit union's new online banking platform, an IS auditor finds that the test environment was loaded with a full copy of production member data, including account numbers and national identification numbers. Developers and contract testers have broad access to this environment. Which finding is MOST significant?

A. Confidential member data is exposed in a less-controlled environment without masking B. Test data may not reflect the transaction volumes expected after the platform goes live C. Contract testers have not yet signed updated nondisclosure agreements for this project D. Test results may be unreliable because production data changes while testing is underway

Question 3

A state transportation agency's new toll collection system passed functional and user acceptance testing. Two days before go-live, a late change to the fare calculation module was moved into the test environment and verified only by the developer who wrote it. What is the IS auditor's BEST course of action?

A. Accept the change because user acceptance testing was already formally approved B. Recommend a post-implementation review focused on fare calculation accuracy C. Request that the developer's supervisor review and approve the code change D. Recommend regression testing and user revalidation of the affected functions

Question 4

An IS auditor is evaluating go-live readiness for an airline's new crew scheduling system. The steering committee plans to make the implementation decision next week, but no documented go/no-go criteria exist, and the vendor has stated that the system is ready. Which recommendation is MOST appropriate?

A. Rely on the vendor's readiness statement supported by its internal test reports B. Define measurable acceptance criteria and assess test results against them C. Postpone implementation until the IS auditor completes independent system testing D. Require the vendor to extend the warranty period to cover post-go-live defects

Question 5

A hospital network is preparing to implement a new pharmacy dispensing system. The IS auditor reviews the test summary and notes 14 open defects, including two high-severity defects affecting dosage calculations. The project sponsor wants to proceed and resolve the defects after go-live. What should the IS auditor do FIRST?

A. Determine the impact of the high-severity defects and whether effective workarounds exist B. Recommend that go-live be canceled until every open defect has been fully resolved C. Record the open defects as a finding in the final audit report issued to the board D. Verify that the defect tracking tool accurately records the severity of each defect

Question 6

An online retailer plans to launch a redesigned checkout platform just before its peak holiday season. The IS auditor notes that functional, integration, and user acceptance testing were completed successfully, but all testing used transaction volumes typical of an average business day. Which additional testing is MOST important before go-live?

A. Regression testing of previously corrected defects B. Usability testing with a sample of real customers C. Load and stress testing at projected peak volumes D. Unit testing of the redesigned payment modules

Question 7

An IS auditor at a logistics provider reviews test documentation for a new freight billing system before its production release. All test scripts were executed and passed, but there is no traceability matrix linking approved business requirements to specific test cases. Which risk is of GREATEST concern to the IS auditor?

A. Test scripts may not have been executed by testers independent of development B. Some approved requirements may not have been tested before implementation C. Testing may have taken longer than the time allotted in the project schedule D. Defects found during testing may not have been prioritized by business impact

Question 8

A municipal government is replacing its property tax system and will run the legacy and new systems in parallel for two billing cycles. The IS auditor has been asked to evaluate the results of the parallel run. Which evidence provides the BEST assurance that the new system is ready for production?

A. Vendor sign-off confirming that both billing cycles completed without system errors B. Operator logs showing both systems processed every batch within scheduled windows C. Management representation that users are satisfied with the new system's performance D. Reconciled outputs of both systems, with all differences investigated and resolved

Question 9

A regional bank's IT department performed all system and user acceptance testing for a new wire transfer module, using test scripts written by the developers. Business users from the payments operations team did not participate in designing or executing the tests. Which conclusion is MOST appropriate based on this evidence?

A. Testing may not confirm that the module meets business needs and required controls B. Testing is adequate because IT staff have the technical expertise to design test cases C. Testing is adequate provided the scripts were approved by the IT development manager D. Testing may be incomplete because developers did not perform formal unit testing first

Question 10

During an implementation readiness review for a university's new student information system, an IS auditor learns that security testing will be performed after go-live to meet the semester start date. Role-based access profiles for faculty, staff, and students have been configured but not yet tested. Which recommendation is MOST appropriate?

A. Accept the schedule and plan a follow-up audit of access controls after the semester starts B. Test critical access profiles and segregation of duties before go-live, even if scope is limited C. Restrict all users to read-only access until security testing is completed after go-live D. Require management to formally accept the risk of all security testing deferred until later

Related Posts

Leave a Comment Cancel Reply