CISA Domain 3B-2 Practice Test 002

This practice test covers Domain 3 (Information Systems Acquisition, Development & Implementation) Subdomain B-2 (Implementation Configuration and Release Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 3B-2 Implementation Configuration and Release Management Practice Test 002

10 questions • Single best answer

Question 1

The internal audit team at a regional electric utility is reviewing a recent release of its outage management system. The change advisory board approved the release, but the deployment package promoted to production contained three code modules not listed in the approved release manifest. What should the IS auditor do FIRST?

A. Recommend that the release be rolled back until all modules are retested B. Report the discrepancy to the change advisory board as a significant deficiency C. Determine whether the extra modules were authorized, tested, and linked to approved changes D. Recommend configuring the deployment tool to automatically block packages that differ from approved manifests

Question 2

An IS auditor at a state revenue department is testing whether production releases match the versions that were tested and approved. Developers state that the build server enforces version integrity, and the release team provides a spreadsheet summarizing last quarter's deployments. Which of the following provides the BEST evidence that released code matched tested code?

A. Comparison of production executable hash values with those recorded for the tested build B. The release team's spreadsheet reconciled against change tickets approved by the board C. Written representations from the development manager confirming version integrity controls D. Screenshots of build server settings showing that version control enforcement is enabled

Question 3

A retail e-commerce company allows senior developers to promote code to production during weekend releases because the operations team has limited staff on weekends. Management states that this arrangement has been in place for two years and that every promotion is recorded in the deployment tool's activity log. Which recommendation is MOST appropriate?

A. Hire additional operations staff so that all weekend promotions are performed by operations B. Require developers to sign an annual acknowledgment of the change and release management policy C. Increase the level of detail captured by the deployment tool for developer sessions D. Have an independent party review deployment logs against approved changes after each release

Question 4

During an audit of a hospital's clinical systems, the IS auditor notes that 40 percent of last year's production releases were processed as emergency changes. Each emergency release was approved retroactively by the change advisory board within five business days. Which of the following is the MOST significant concern?

A. Approvals for emergency releases are documented after deployment rather than before it B. The emergency process is being used to bypass normal release planning and testing controls C. The five-day retroactive review window exceeds what is typical in the healthcare industry D. The volume of emergency releases increases the board's workload and delays routine approvals

Question 5

A cloud migration review at an insurance broker finds that production server configurations were hardened to an approved baseline at go-live. Six months later, automated scanning shows that 30 percent of servers deviate from the baseline, and there are no related change tickets. Which control weakness does this MOST likely indicate?

A. Configuration changes are being made outside the formal change and release process B. The approved hardening baseline was not adequately defined and documented before implementation C. The automated scanning tool is generating false positives against the baseline D. The configuration management database is not updated after approved changes

Question 6

An IS auditor is reviewing the release plan for a university's new student information system, with cutover scheduled for next weekend. The plan includes detailed deployment steps, communication schedules, and stakeholder sign-offs, but no documented procedure for restoring the prior version if deployment fails. What is the auditor's BEST course of action?

A. Recommend postponing the release until a full parallel run of both systems is completed B. Note the gap in the final audit report for management follow-up after go-live occurs C. Recommend that the vendor provide on-site technical support during the cutover weekend D. Advise management that a tested back-out plan should be in place before deployment

Question 7

During an audit of a payment processor's release management process, the IS auditor wants to determine whether any code reached production without an approved change request. Release requests are maintained in a ticketing system, and all deployment events are logged by the orchestration tool. Which testing approach is MOST effective?

A. Select a sample of approved change tickets and trace each to deployment log entries B. Interview release managers about how unapproved deployments are prevented and detected C. Select a sample of production deployment events and trace each to an approved ticket D. Review the release management policy for a requirement that all changes be approved

Question 8

A telecommunications provider's release manager has authority to approve, schedule, and deploy releases, while business owners are informed only after deployment. During a quarterly review, an IS auditor notes that several recent releases altered customer billing calculations without any business review. Which recommendation BEST addresses the root cause?

A. Implement automated regression testing of all billing calculation modules before each release B. Require business owner acceptance and sign-off before releases are approved for deployment C. Transfer deployment authority from the release manager to the IT operations team instead D. Notify business owners of scheduled releases at least one week before each deployment

Question 9

A fintech company deploys code through an automated CI/CD pipeline that requires peer-reviewed merges and passing automated tests before any production release. The IS auditor discovers that all developers have write access to the pipeline configuration files that define these release gates. Which of the following is the MOST significant risk?

A. Pipeline configuration files may not be backed up along with the source code repository B. Automated tests may not cover all business-critical functions within the application C. Peer reviewers may lack the expertise needed to identify defective or insecure code D. Developers could disable review and testing gates to deploy unapproved code changes

Question 10

An IS auditor's prior report recommended that a government agency implement a formal release calendar with freeze periods around fiscal year-end. During follow-up, management states that the calendar is now published on the intranet, but two releases were deployed during the most recent freeze period. What should the auditor do NEXT?

A. Determine whether the freeze-period releases were authorized under a documented exception process B. Close the finding because the release calendar with freeze periods has been implemented as recommended C. Reissue the original finding as unresolved in the follow-up report issued to senior management and the audit committee D. Recommend that the agency replace its change advisory board with an independent board

Related Posts

Leave a Comment Cancel Reply