Domain 3: Information Systems Acquisition, Development and Implementation Flashcards
Which of the following is a characteristic of timebox management?
A.Not suitable for prototyping or rapid application development
B.Eliminates the need for a quality process
C.Prevents cost overruns and delivery delays
D.Separates system and user acceptance testing (UAT)
C. Timebox management, by its nature, sets specific time and cost boundaries. It is effective in controlling costs and delivery timelines by ensuring that each segment of the project is divided into small controllable time frames.
Which of the following is the MOST important factor in the design of a data warehouse?
A.Quality of the metadata
B.Speed of the transactions
C.Volatility of the data
D.Vulnerability of the system
A. Quality of the metadata is the most important element in the design of a data warehouse. A data warehouse is a copy of transaction data specifically structured for query and analysis. Metadata describes the data in the warehouse and aims to provide a table of contents to the stored information. Organizations that have built warehouses believe that metadata are the most important component of the warehouse.
An information systems (IS) auditor who is auditing the software acquisition process will ensure that the:
A. A.contract is reviewed and approved by the legal counsel before it is signed.
B. B.requirements cannot be met with the systems already in place.
C. C.requirements are found to be critical for the business.
D. D.user participation is adequate in the process.
A. Reviewing and approving the contract is one of the most important steps in the software acquisition process. An information systems (IS) auditor should verify that legal counsel reviewed and approved the contract before management signs the contract.
An organization sells books and music online on its secure website. Transactions are transferred to the accounting and delivery systems every hour to be processed. Which of the following controls BESTensures that sales processed on the secure website are transferred to both systems?
A.Transaction totals are recorded daily in the sales systems. Daily sales system totals are aggregated and totaled.
B.Transactions are automatically numerically sequenced. Sequences are checked and gaps in continuity are accounted for.
C.Processing systems check for duplicated transaction numbers. If a transaction number is duplicated (already present), it is rejected.
D.System time is synchronized hourly using a centralized time server. All transactions have a date/time stamp.
B. Automatic numerical sequencing is the only option that accounts for completeness of transactions because any missing transactions are identified by a gap.
An organization is implementing a new system to replace a legacy system. Which of the following conversion practices creates the GREATEST risk?
A.Pilot
B.Parallel
C.Direct cutover
D.Phased
C. Direct cutover implies switching to the new system immediately, usually without the ability to revert to the old system in the event of problems. This approach has the highest risk and may have a significant impact on the organization.
Ideally, stress testing should be carried out in a:
A.test environment using test data.
B.production environment using live workloads.
C.test environment using live workloads.
D.production environment using test data.
C. Stress testing is carried out to ensure that a system can cope with production workloads. Testing with production-level workloads is important to ensure that the system will operate effectively when moved into production.
The specific advantage of white box testing is that it:
A.verifies that a program can operate successfully with other parts of the system.
B.ensures a program’s functional operating effectiveness without regard to the internal program structure.
C.determines procedural accuracy or conditions of a program’s specific logic paths.
D.examines a program’s functionality by executing it in a tightly controlled or virtual environment with restricted access to the host system.
C. White box testing assesses the effectiveness of software program logic. Specifically, test data are used in determining procedural accuracy or conditions of a program’s logic paths.
An information systems (IS) auditor recommends that an initial validation control be programmed into a credit card transaction capture application. The initial validation process MOST likely:
A.checks to ensure that the type of transaction is valid for the card type.
B.verifies the format of the number entered, then locates it on the database.
C.ensures that the transaction entered is within the cardholder’s credit limit.
D.confirms that the card is not shown as lost or stolen on the master file.
B. The initial validation should confirm whether the card is valid. This validity is established through the card number and personal identification number entered by the user.
Change control for business application systems being developed using prototyping can be complicated by the:
A.iterative nature of prototyping.
B.rapid pace of modifications in requirements and design.
C.emphasis on reports and screens.
D.lack of integrated tools.
B. Changes in requirements and design happen so quickly that they are seldom documented or approved.
When a new system is to be implemented within a short time frame, it is MOST important to:
A.finish writing user manuals.
B.perform user acceptance testing (UAT).
C.add last-minute enhancements to functionalities.
D.ensure that the code has been documented and reviewed.
B. It is most important to complete the user acceptance testing to ensure that the system to be implemented is working correctly.
At the end of the testing phase of software development, an information systems (IS) auditor observes that an intermittent software error has not been corrected. No action has been taken to resolve the error. The IS auditor should:
A.report the error as a finding and leave further exploration to the auditee’s discretion.
B.attempt to resolve the error.
C.recommend that problem resolution be escalated.
D.ignore the error because it is not possible to get objective evidence for the software error.
C. When an IS auditor observes such conditions, it is best to fully apprise the auditee and suggest that further problem resolutions be attempted, including escalation if necessary.
Which of the following is MOST critical when creating data for testing the logic in a new or modified application system?
A.Enough data for each test case
B.Data representing expected conditions in actual processing
C.Completing the test on schedule
D.A random sample of actual data
B. Selecting the right kind of data is key in testing a computer system. The data should not only include valid and invalid data but also be representative of actual processing; quality is more important than quantity.
Which of the following is an advantage of the top-down approach to software testing?
A.Interface errors are identified early.
B.Testing can be started before all programs are complete.
C.It is more effective than other testing approaches.
D.Errors in critical modules are detected sooner.
A. The advantage of the top-down approach is that tests of major functions are conducted early, thus enabling the detection of interface errors sooner.
When reviewing input controls, an information systems (IS) auditor observes that, in accordance with corporate policy, procedures allow supervisory override of data validation edits. The IS auditor should:
A.not be concerned, because there may be other compensating controls to mitigate the risk.
B.ensure that overrides are automatically logged and subject to review.
C.verify whether all such overrides are referred to senior management for approval.
D.recommend that overrides not be permitted.
B. If input procedures allow overrides of data validation and editing, automatic logging should occur. A management individual who did not initiate the override should review this log.
Which of the following BEST helps to prioritize project activities and determine the timeline for a project?
A.Gantt chart
B.Earned value analysis
C.Program evaluation review technique (PERT)
D.Function point analysis
C. The PERT method works on the principle of obtaining project timelines based on project events for three likely scenarios—worst, best and normal. The timeline is calculated by a predefined formula and identifies the critical path, which identifies the key activities that must be prioritized.
Which of the following is of GREATEST concern to an information systems (IS) auditor when performing an audit of a client relationship management system migration project?
A.The technical migration is planned for a Friday preceding a long weekend, and the time window is too short for completing all tasks.
B.Employees pilot testing the system are concerned that the data representation in the new system is completely different from the old system.
C.A single implementation is planned, immediately decommissioning the legacy system.
D.Five weeks prior to the target date, there are still numerous defects in the printing functionality of the new system’s software.
C. Major system migrations should include a phase of parallel operation or a phased cutover to reduce implementation risk. Decommissioning or disposing of the old hardware would complicate any fallback strategy if the new system does not operate correctly.
Which of the following types of risk is MOST likely encountered in a software as a service (SaaS) environment?
A.Noncompliance with software license agreements
B.Performance issues due to Internet delivery method
C.Higher cost due to software licensing requirements
D.Higher cost due to the need to update to compatible hardware
B. The risk that can be most likely encountered in a SaaS environment is speed and availability issues because SaaS relies on the Internet for connectivity.
During a postimplementation review of an enterprise resource management system, an information systems (IS) auditor is MOST likely to:
A.review access control configuration.
B.evaluate interface testing.
C.review detailed design documentation.
D.evaluate system testing.
A. Reviewing access control configuration is the first task performed to determine whether security has been appropriately mapped in the system.
Many IT projects experience problems because the development time and/or resource requirements are underestimated. Which of the following techniques provides the GREATEST assistance in developing an estimate of project duration?
A.Function point analysis
B.Program evaluation review technique (PERT) chart
C.Rapid application development
D.Object-oriented system development
B. The program evaluation review technique (PERT) method works on the principle of obtaining project timelines based on project events for three likely scenarios—worst, best and normal. The timeline is calculated by a predefined formula and identifies the critical path, which identifies the key activities that must be prioritized. A PERT chart helps determine project duration after all the activities and the work involved with those activities are known.
Which of the following BEST helps an information systems (IS) auditor assess and measure the value of a newly implemented system?
A.Review of business requirements
B.System certification
C.Postimplementation review
D.System accreditation
C. One key objective of a postimplementation review is to evaluate the projected cost-benefits or the return-on-investment measurements.
The most common reason for the failure of information systems to meet the needs of users is that:
A.user needs are constantly changing.
B.the growth of system requirements was forecast inaccurately.
C.the hardware system limits the number of concurrent users.
D.user participation in defining the system’s requirements was inadequate.
D. Lack of adequate user involvement, especially in the system’s requirements phase, usually results in a system that does not fully or adequately address the needs of the user. Only users can define what their needs are and, therefore, what the system should accomplish.
Following good practices, formal plans for implementation of new information systems are developed during the:
A.development phase.
B.design phase.
C.testing phase.
D.deployment phase.
B. The method of implementation may affect the design of the system. Therefore, planning for implementation should begin well in advance of the actual implementation date. A formal implementation plan should be constructed in the design phase and revised as the development progresses.
An organization is migrating from a legacy system to an enterprise resource planning system. While reviewing the data migration activity, the MOST important concern for the information systems (IS) auditor is to determine that there is a:
A.correlation of semantic characteristics of the data migrated between the two systems.
B.correlation of arithmetic characteristics of the data migrated between the two systems.
C.correlation of functional characteristics of the processes between the two systems.
D.relative efficiency of the processes between the two systems.
A. Because the two systems can have a different data representation, including the database schema, the information systems (IS) auditor’s main concern should be to verify that the interpretation of the data (structure) is the same in the new system as it was in the old system.
An information systems (IS) auditor is reviewing a project that is using an agile software development approach. Which of the following should the IS auditor expect to find?
A.Use of a capability maturity model (CMM).
B.Regular monitoring of task-level progress against schedule.
C.Extensive use of software development tools to maximize team productivity.
D.Post-iteration reviews that identify lessons learned for future use in the project.
D. A key tenet of the agile approach to software project management is ongoing team learning to refine project management and software development processes as the project progresses. The team considers and documents what worked well and what could have worked better at the end of each iteration and identifies improvements to be implemented in subsequent iterations. Additionally, less importance is placed on formal paper-based deliverables, with the preference being effective informal communication within the team and with key outside contributors. Agile projects produce releasable software in short iterations, typically ranging from four-to-eight weeks, which instills considerable performance discipline within the team. These practices, combined with short daily meetings to agree on what the team is doing and the identification of any impediments, render task-level tracking against a schedule redundant.
An organization recently deployed a customer relationship management application that was developed in-house. Which of the following is the BEST option to ensure that the application operates as designed?
A.user acceptance testing (UAT)
B.Project risk assessment
C.Postimplementation review
D.Management approval of the system
C. The purpose of a postimplementation review is to evaluate how successfully the project results match original goals, objectives and deliverables. The postimplementation review also evaluates how effective the project management practices were in keeping the project on track.
Which of the following should an information systems (IS) auditor review to gain an understanding of the effectiveness of controls over the management of multiple projects?
A.Project information
B.Policy documents
C.Project portfolio information
D.Program organization
C. Project portfolio information is the basis for project portfolio management. It includes project data, such as owner, schedules, objectives, project type, status and cost. Project portfolio management requires specific project portfolio reports.
The MOST important point of consideration for an information systems (IS) auditor while reviewing an enterprise’s project portfolio is that it:
A.does not exceed the existing IT budget.
B.is aligned with the investment strategy.
C.has been approved by the IT steering committee.
D.is aligned with the business plan.
D. Portfolio management takes a holistic view of an enterprise’s overall IT strategy, which, in turn, should be aligned with the business strategy. A business plan provides the justification for each of the projects in the project portfolio, and that is the major consideration for an information systems (IS) auditor.
In an online transaction processing system, data integrity is maintained by ensuring that a transaction is either completed in its entirety or not at all. This principle of data integrity is known as:
A.isolation.
B.consistency.
C.atomicity.
D.durability.
C. The principle of atomicity requires that a transaction be completed in its entirety or not at all. If an error or interruption occurs, all changes made up to that point are backed out.
Which of the following types of risk can result from inadequate software project baselining?
A.Sign-off delays
B.Software integrity violations
C.Scope creep
D.Inadequate controls
C. A software baseline is the cutoff point in the design and development of a system. Beyond this point, additional requirements or modifications to the scope must go through formal, strict procedures for approval based on a business cost-benefit analysis. Failure to adequately manage a system through baselining can result in uncontrolled changes in a project’s scope and may incur time and budget overruns.
A project manager for a project that is scheduled to take 18 months to complete announces that the project is in a healthy financial position because, after six months, only one-sixth of the budget has been spent. The information systems (IS) auditor should FIRST determine:
A.the amount of progress achieved compared to the project schedule.
B.if the project budget can be reduced.
C.if the project can be completed ahead of schedule.
D.if the budget savings can be applied to increase the project scope.
A. Cost performance of a project cannot be properly assessed in isolation of schedule performance. Cost cannot be assessed simply in terms of elapsed time on a project.
Which of the following system and data conversion strategies provides the GREATEST redundancy?
A.Direct cutover
B.Pilot study
C.Phased approach
D.Parallel run
D. Parallel runs are the safest—although the most expensive—approach because both the old and new systems are run, thus incurring what might appear to be double costs.
Normally, it is essential to involve which of the following stakeholders in the initiation stage of a project?
A.System owners
B.System users
C.System designers
D.System builders
A. System owners are the information systems (project) sponsors or chief advocates. They normally are responsible for initiating and funding projects to develop, operate and maintain information systems.
An information systems (IS) auditor reviewing a series of completed projects finds that the implemented functionality often exceeded requirements and most of the projects ran significantly over budget. Which of these areas of the organization’s project management process is the MOSTlikely cause of this issue?
A.Project scope management
B.Project time management
C.Project risk management
D.Project procurement management
A. Because the implemented functionality is greater than what was required, the most likely cause of the budget issue is failure to effectively manage project scope. Project scope management is defined as the processes required to ensure that the project includes all of the required work, and only the required work, to complete the project.
A project development team is considering using production data for its test deck. The team removed sensitive data elements before loading it into the test environment. Which of the following additional concerns should an information systems (IS) auditor have with this practice?
A.Not all functionality will be tested.
B.Production data are introduced into the test environment.
C.Specialized training is required.
D.The project may run over budget.
A. A primary risk of using production data in a test deck is that not all transactions or functionality may be tested if there are no data that meet the requirement.
Which of the following controls helps prevent duplication of vouchers during data entry?
A.Range check
B.Transposition and substitution
C.Sequence check
D.Cyclic redundancy check
C. A sequence check involves increasing the order of numbering and validates whether the vouchers are in sequence, and, thus, prevents duplicate vouchers.
An advantage of using sanitized live transactions for test data is that:
A.all transaction types are included.
B.every error condition is likely to be tested.
C.no special routines are required to assess the results.
D.test transactions are representative of live processing.
D. Test data is representative of live processing; however, it is important that all sensitive information in the live transaction file is sanitized to prevent improper data disclosure.
During the audit of an acquired software package, an information systems (IS) auditor finds that the software purchase was based on information obtained through the Internet, rather than from responses to a request for proposal. The IS auditor should FIRST:
A.test the software for compatibility with existing hardware.
B.perform a gap analysis.
C.review the licensing policy.
D.ensure that the procedure had been approved.
D. In the case of a deviation from the predefined procedures, an IS auditor should first ensure that the procedure followed for acquiring the software is consistent with the business objectives and has been approved by the appropriate authorities.
During the requirements definition stage of a proposed enterprise resource planning system, the project sponsor requests that the procurement and accounts payable modules be linked. Which of the following test methods is the BEST to perform?
A.Unit testing
B.Integration testing
C.Sociability testing
D.Quality assurance (QA) testing
B. Integration testing is a hardware or software test that evaluates the connection of two or more components that pass information from one area to another. The objective is to take unit-tested modules and build an integrated structure dictated by design.
Regression testing is undertaken PRIMARILY to ensure that:
A.system functionality meets customer requirements.
B.a new system can operate in the target environment.
C.applicable development standards have been maintained.
D.applied changes have not introduced new errors.
D. Regression testing is used to test for the introduction of new errors in the system after changes have been applied.
During which of the following phases in system development are user acceptance testing (UAT) plans normally prepared?
A.Feasibility study
B.Requirements definition
C.Implementation planning
D.Postimplementation review
B. During requirements definition, the project team works with the users to define their precise objectives and functional needs. The users should be working with the team to consider and document how the system functionality can be tested to ensure that it meets their stated needs. An information systems (IS) auditor should know at what point user testing should be planned to ensure that it is most effective and efficient.
When auditing the proposed acquisition of a new computer system, an information systems (IS) auditor should FIRST ensure that:
A.a clear business case has been approved by management.
B.corporate security standards will be met.
C.users will be involved in the implementation plan.
D.the new system will meet all required user functionality.
A. The first concern of an information systems (IS) auditor is to ensure that the proposal meets the needs of the business. This should be established by a clear business case.
Which of the following has the MOST significant impact on the success of an application system implementation?
A.Prototyping application development methodology
B.Compliance with applicable external requirements
C.Overall organizational environment
D.Software reengineering technique
C. The overall organizational environment has the most significant impact on the success of application systems implemented. This includes the alignment between IT and the business, the maturity of the development processes and the use of change control and other project management tools.
A small company cannot segregate duties between its development processes and its change control function. What is the BEST way to ensure that the tested code is the code that is moved into production?
A.Release management software
B.Manual code comparison
C.Regression testing in preproduction
D.Management approval of changes
A. Automated release management software can prevent unauthorized changes by moving code into production without any manual intervention.
An information systems (IS) auditor is involved in the reengineering process that aims to optimize IT infrastructure. Which of the following will BEST identify the issues to be resolved?
A.Self-assessment
B.Reverse engineering
C.Prototyping
D.Gap analysis
D. Gap analysis is the best method to identify issues that need to be addressed in the reengineering process. Gap analysis indicates which parts of current processes conform to good practices (desired state) and which parts do not.
Which of the following considerations is the MOST important while evaluating a business case for the acquisition of a new accounting application?
A.Total cost of ownership of the application
B.The resources required for implementation
C.Return on investment (ROI) for the enterprise
D.The cost and complexity of security requirements
C. The proposed ROI benefits, and targets or metrics that can be measured, are the most important aspects of a business case. While reviewing the business case, it should be verified that the proposed ROI is achievable, does not make unreasonable assumptions and can be measured for success. (Benefits realization should look beyond project cycles to longer-term cycles that consider the total benefits and total costs throughout the life of the new system.)
An information systems (IS) auditor who is invited to a project development meeting notes that no project risk has been documented. When the IS auditor raises this issue, the project manager responds that it is too early to identify risk and that, if risk starts impacting the project, a risk manager will be hired. The appropriate response of the IS auditor is to:
A.stress the importance of spending time at this point in the project to consider and document risk and to develop contingency plans.
B.accept the project manager’s position because the project manager is accountable for the outcome of the project.
C.offer to work with the risk manager when one is appointed.
D.inform the project manager that the IS auditor will conduct a review of the risk at the completion of the requirements definition phase of the project.
A. The majority of project risk can be identified before a project begins, allowing mitigation/avoidance plans to be put in place to deal with this risk. A project should have a clear link back to corporate strategy, enterprise risk management and tactical plans to support this strategy. The process of setting corporate strategy, setting objectives and developing tactical plans should include the consideration of risk.
During the review of a web-based software development project, an information systems (IS) auditor realizes that coding standards are not enforced and code reviews are rarely carried out. These issues will MOST likely increase the likelihood of a successful:
A.buffer overflow.
B.brute force attack.
C.distributed denial of service (DDoS) attack.
D.war dialing attack.
A. Poorly written code, especially in web-based applications, is often exploited by hackers using buffer overflow techniques.
Which of the following data validation edits is effective in detecting transposition and transcription errors?
A.Range check
B.Check digit
C.Validity check
D.Duplicate check
B. A check digit is a numeric value that is calculated mathematically and is appended to data to ensure that the original data have not been altered (e.g., an incorrect, but valid, value substituted for the original). This control is effective in detecting transposition and transcription errors.
Which of the following is the PRIMARY purpose for conducting parallel testing?
A.To determine whether the system is cost-effective
B.To enable comprehensive unit and system testing
C.To highlight errors in the program interfaces with files
D.To ensure the new system meets user requirements
D. The purpose of parallel testing is to ensure that the implementation of a new system will meet user requirements by comparing the results of the old system with the new system to ensure correct processing.
What is the PRIMARY goal of natural language processing in the field of artificial intelligence?
A.To create algorithms that mimic human cognitive processes and decision making
B.To build intelligent systems capable of autonomously learning from data
C.To develop machines capable of understanding and generating human language
D.To design robots and physical agents that can interact with the environment
C. The primary goal of NLP is to enable machines to understand, interpret and generate human language in a way that is similar to how humans process language. NLP involves tasks such as language translation, sentiment analysis, text summarization and speech recognition.
An information systems (IS) auditor is reviewing system development for a health care organization with two application environments—production and test. During an interview, the auditor notes that production data are used in the test environment to test program changes. What is the MOSTsignificant potential risk from this situation?
A.The test environment may not have adequate controls to ensure data accuracy.
B.The test environment may produce inaccurate results due to use of production data.
C.Hardware in the test environment may not be identical to the production environment.
D.The test environment may not have adequate access controls implemented to ensure data confidentiality.
D. In many cases, the test environment is not configured with the same access controls that are enabled in the production environment. For example, programmers may have privileged access to the test environment (for testing purposes), but not to the production environment. If the test environment does not have adequate access control, the production data are subject to risk of unauthorized access and/or data disclosure. This is the most significant risk of the choices listed and is especially important in a health care organization where patient data confidentiality is critical and privacy laws in many countries impose strict penalties on misuse of these data.
Which of the following BEST describes the concept of overfitting in machine learning (ML)?
A.Overfitting happens when a model fails to capture the underlying patterns and relationships in the training data.
B.Overfitting occurs when advanced algorithms are underused in machine learning (ML).
C.Overfitting occurs when the training data are insufficient to train a ML model effectively.
D.Overfitting occurs when a model performs well on the training data but fails to generalize to new, unseen data.
D. Overfitting happens when a model becomes overly complex and starts fitting the noise or random fluctuations in the training data, which leads to poor performance on new, unseen data.
The BEST time for an information systems (IS) auditor to assess the control specifications of a new application software package that is being considered for acquisition is during:
A.the internal lab testing phase.
B.testing and prior to user acceptance.
C.the requirements gathering phase.
D.the implementation phase.
C. The best time for the involvement of an IS auditor is at the beginning of the requirements definition of the development or acquisition of applications software, providing maximum opportunity for review of the vendors and their products. Early engagement of an IS auditor also minimizes the potential of a business commitment to a given solution that might be inadequate and more difficult to overcome as the process continues.
An organization is implementing an enterprise resource planning (ERP) application. Of the following, who is PRIMARILY responsible for overseeing the project to ensure that it is progressing in accordance with the project plan and that it will deliver the expected results?
A.Project sponsor
B.System development project team
C.Project steering committee
D.User project team
C. A project steering committee that provides an overall direction for the enterprise resource planning (ERP) implementation project is responsible for reviewing the project’s progress to ensure that it will deliver the expected results.
The PRIMARY objective of conducting a postimplementation review for a business process automation project is to:
A.ensure that the project meets the intended business requirements.
B.evaluate the adequacy of controls.
C.confirm compliance with technological standards.
D.confirm compliance with regulatory requirements.
A. Ensuring that the project meets the intended business requirements is the primary objective of a postimplementation review.
During the system testing phase of an application development project, the information systems (IS) auditor should review the:
A.conceptual design specifications.
B.vendor contract.
C.error reports.
D.program change requests.
C. Testing is crucial in determining that user requirements have been validated. The information systems (IS) auditor should be involved in this phase, review error reports for their precision in recognizing erroneous data and review the procedures for resolving errors.
Which of the following types of testing determines whether a new or modified system can operate in its target environment without adversely impacting other existing systems?
A.Parallel testing
B.Pilot testing
C.Interface/integration testing
D.Sociability testing
D. The purpose of sociability testing is to confirm that a new or modified system can operate in its target environment without adversely impacting existing systems. This should cover the platform that will perform primary application processing and interfaces with other systems, and changes to the desktop in a client-server or web development.
The PRIMARY objective of performing a postincident review is that it presents an opportunity to:
A.improve the internal control process.
B.harden the network to industry good practices.
C.highlight the importance of incident response management to management.
D.improve employee awareness of the incident response process.
A postincident review examines the cause and response to an incident. The lessons learned from the review can be used to improve internal controls. Understanding the purpose and structure of postincident reviews and follow-up procedures enables the information security manager to continuously improve the security program. Improving the incident response plan based on the incident review is an internal (corrective) control.
A large industrial organization is replacing an obsolete legacy system and evaluating whether to buy a custom solution or develop a system in-house. Which of the following will MOST likely influence the decision?
A.Technical skills and knowledge within the organization related to sourcing and software development
B.Privacy requirements applied to the data processed by the application
C.Whether the legacy system being replaced was developed in-house
D.The users not devoting reasonable time to defining the functionalities of the solution
A. Critical core competencies will most likely be carefully considered before outsourcing the planning phase of the application.
A failure discovered in which of the following testing stages would have the GREATEST impact on the implementation of new application software?
A.System testing
B.Acceptance testing
C.Integration testing
D.Unit testing
B. Acceptance testing is the final stage before the software is installed and available for use. Software failure at the acceptance testing level has the greatest impact on implementation because this can result in delays and cost overruns.
Which of the following is an advantage of prototyping?
A.The finished system normally has strong internal controls.
B.Prototype systems can provide significant time and cost savings.
C.Change control is often less complicated with prototype systems.
D.Prototyping ensures that functions or extras are not added to the intended system.
B. Prototype systems can provide significant time and cost savings through better user interaction and the ability to rapidly adapt to changing requirements; however, they also have several disadvantages, including loss of overall security focus, project oversight and implementation of a prototype that is not yet ready for production.
An advantage of using a bottom-up versus a top-down approach to software testing is that:
A.interface errors are detected earlier.
B.confidence in the system is achieved earlier.
C.errors in critical modules are detected earlier.
D.major functions and processing are tested earlier.
C. The bottom-up approach to software testing begins with the testing of atomic units, such as programs and modules, and works upward until complete system testing has taken place. The advantage of using a bottom-up approach to software testing is that errors in critical modules are found earlier.
Documentation of a business case used in an IT development project should be retained until:
A.the end of the system’s life cycle.
B.the project is approved.
C.user acceptance of the system.
D.the system is in production.
A. A business case should be used throughout the life cycle of the product. It serves as an anchor for new management personnel, helps to maintain focus and provides valuable information on estimates versus actuals. Questions, such as “Why do we do that?”, “What was the original intent?” and “How did we perform against the plan?”, can be answered, and lessons for developing future business cases can be learned.
Which testing approach is MOST appropriate to ensure that internal application interface errors are identified as soon as possible?
A.Bottom-up testing
B.Sociability testing
C.Top-down testing
D.System testing
C. The top-down approach to testing ensures that interface errors are detected early and that testing of major functions is conducted early.
The use of object-oriented design and development techniques MOST likely:
A.facilitates the ability to reuse modules.
B.improves system performance.
C.enhances control effectiveness.
D.speeds up the system development life cycle (SDLC).
A. One of the major benefits of object-oriented design and development is the ability to reuse modules.
A legacy payroll application was migrated to a new application. Which of the following stakeholders should be PRIMARILY responsible for reviewing and signing off on the accuracy and completeness of the data before going live?
A.Information systems (IS) auditor
B.Database administrator (DBA)
C.Project manager
D.Data owner
D. During the data conversion stage of a project, the data owner is primarily responsible for reviewing and signing off that the data are migrated completely and accurately and are valid.
The reason for establishing a stop or freezing point on the design of a new system is to:
A.prevent further changes to a project in process.
B.indicate the point at which the design is to be completed.
C.require that changes after that point be evaluated for cost-effectiveness.
D.provide the project management team with more control over the project design.
C. Projects often tend to expand, especially during the requirements definition phase. This expansion often grows to a point where the originally anticipated cost benefits are diminished because the cost of the project has increased. When this occurs, it is recommended that the project be stopped or frozen to allow a review of all the cost benefits and the payback period.
