CISA Practice Test

CISA IS Acquisition, Development & Implementation Practice Questions

IS Acquisition, Development & Implementation makes up 6 of every 50 questions on a Tigertest CISA practice test. Here are 10 of the 24 questions on it, each with the answer and the reason.

Updated 2026-11-10 by the Tigertest team. Based on ISACA's CISA job practice areas (effective August 2024). Original questions; 50 per test, weighted like the real exam. Not affiliated with ISACA.

1. 1. What is the main purpose of a feasibility study at the start of a system acquisition?

   • A.To test the system's response times
   • B.To judge if a solution is justified
   • C.To write the detailed program specifications
   • D.To train users on the new system

   Answer: B. A feasibility study weighs technical, economic and operational factors and the alternatives, such as build, buy or change nothing, so management can decide whether the project should go ahead.

2. 2. An IS auditor is invited to join a development project team. How should the auditor take part without losing independence?

   • A.Write the access control code
   • B.Sign off the user acceptance results
   • C.Approve the system for go-live
   • D.Advise on controls, not design them

   Answer: D. The auditor can review and recommend, but designing or approving controls would mean later auditing their own work.

3. 3. Midway through a project the expected benefits fall well below the cost to finish. What should happen?

   • A.Revisit the business case before going on
   • B.Hide the change from the sponsor
   • C.Finish the project as it was first planned
   • D.Cut testing to save the budget

   Answer: A. The business case should be checked at each stage gate. If it no longer holds, the sponsor and governance body decide whether to change course or stop.

4. 4. Who is accountable for the business case and benefits of an IT project?

   • A.The IS auditor
   • B.The test manager
   • C.The project sponsor
   • D.The lead software developer

   Answer: C. The sponsor, usually a senior business manager, owns the business case, provides funding and is answerable for the project delivering its benefits.

5. 5. Earned value analysis shows the earned value of completed work is lower than its actual cost. What does this mean?

   • A.The project is ahead of plan
   • B.The scope has been reduced
   • C.The project is over budget
   • D.The project is under budget

   Answer: C. A cost performance index below 1, earned value divided by actual cost, means the work done has cost more than planned for that work.

6. 6. Users keep adding features to a project after requirements were agreed. Which control addresses this?

   • A.Formal change control for scope
   • B.Longer working days for testers
   • C.Skipping the design review
   • D.More developers on the team

   Answer: A. Scope changes should go through an approval process that weighs cost, schedule and risk, so the project does not drift without a decision.

7. 7. A team uses agile sprints with little written documentation. What should an IS auditor check most closely?

   • A.The team uses the waterfall model
   • B.Every sprint has its own written charter
   • C.Developers fill in time sheets
   • D.Controls are in the definition of done

   Answer: D. Agile is fine if control requirements such as security and audit trails are part of what counts as complete. Otherwise they are dropped under time pressure.

8. 8. What is a key risk of building a system by prototyping?

   • A.The project always runs far behind schedule
   • B.Controls are left out of the final build
   • C.Users never see the system early
   • D.Requirements become too formal

   Answer: B. Prototypes focus on what users see. If a prototype is promoted to production, controls and documentation that were never built may be missing.

9. 9. Function point analysis is used to estimate what?

   • A.The cost of hardware
   • B.The size of a software system
   • C.The speed of the network links
   • D.The number of users

   Answer: B. Function points measure software size from the inputs, outputs, inquiries, files and interfaces it provides, which feeds effort and cost estimates.

10. 10. Who should perform user acceptance testing of a new application?

    • A.The auditor on live data
    • B.The vendor alone at its own test site
    • C.Developers in production
    • D.Business users in a test environment

    Answer: D. User acceptance testing confirms the system meets business needs, so the people who will use it test it against agreed criteria, away from production.