A project team is developing a new customer support system. They have identified a risk that customer data could be exposed through a misconfigured database. Which control would be most directly mapped to this risk?

Implementing a database activity monitoring system

Implementing database encryption at rest

Conducting regular backups of the database

Providing training to database administrators on security best practices

An organization is adopting Agile methodology for a new customer relationship management (CRM) system. The project manager wants to ensure that security controls are integrated throughout the development lifecycle. Which approach best aligns with Agile principles while ensuring control integration?

Incorporate security requirements and control testing into each sprint's definition of done

Document all controls in a requirements document and rely on the QA team to test them

Perform a comprehensive security review only at the end of the project before go-live

Create a separate security workstream that runs in parallel and reports to the project board

Why is it important to integrate controls into project management processes?

To reduce the project timeline by eliminating control activities

To ensure that controls are only implemented after the project is completed

To transfer all control responsibilities to the project manager

To ensure that control activities are planned, resourced, and monitored like other project tasks

During the requirements definition phase of a new financial system, the project team identifies a risk that unauthorized users might access sensitive data. Which activity best exemplifies the IS auditor's role in control identification at this stage?

Documenting the access control requirements as a control relevant to the system acquisition

Approving the project budget for the acquisition

Designing the database schema to enforce referential integrity

Performing a penetration test on the system after implementation

Which of the following is an example of a detective control in a system development project?

Performing a code review to identify security vulnerabilities

Implementing a firewall to block unauthorized access

Requiring dual authorization for code changes

Restoring data from a backup after a system failure

Certified Information Systems Auditor

Domain 3Objective 4

Control Identification and Design CISA Practice Questions (Page 3)

Part of the Information Systems Acquisition, Development and Implementation domain, which accounts for 12% of the CISA exam.

28questions here

6free pages

5concepts

12%of the exam

Questions 11–15

11application · medium
A project team is developing a new customer support system. They have identified a risk that customer data could be exposed through a misconfigured database. Which control would be most directly mapped to this risk?
Select an answer first
12application · medium
An organization is adopting Agile methodology for a new customer relationship management (CRM) system. The project manager wants to ensure that security controls are integrated throughout the development lifecycle. Which approach best aligns with Agile principles while ensuring control integration?
Select an answer first
13foundation · easy
Why is it important to integrate controls into project management processes?
Select an answer first
14foundation · easy
During the requirements definition phase of a new financial system, the project team identifies a risk that unauthorized users might access sensitive data. Which activity best exemplifies the IS auditor's role in control identification at this stage?
Select an answer first
15foundation · easy
Which of the following is an example of a detective control in a system development project?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISA” is a trademark of its owner, used for identification only.