ISA 3.0 ICAI QUESTION BANK

Question explanation: C is the correct answer. Integrated test facility compares processing output with independently calculated data. Explanation: An integrated test facility is considered a useful audit tool because it uses the same programs to compare processing using independently calculated data. This involves setting up dummy entities on an application system and processing test or production data against the entity as a means
of verifying processing accuracy. Option A, B and D are not the dimensions of integrated test facility.

Question explanation: A is the correct answer. Processing controls ensure the completeness and accuracy of accumulated data, for example, editing and run-to-run totals. Option B data file control procedures ensure that only authorized processing occurs to stored data, for example, transaction logs. Option C output controls ensure that data delivered to users will be presented, formatted and delivered in a consistent and secure manner, for example, using report distribution. Option D "Application Controls" is a general term comprising all kinds of controls used in an application.

Question explanation: B is the correct answer. Access Security is not part of application domain. However options A, C and D are part of the Application Controls.

Question explanation: B is the correct answer. It checks the transposition of the digits. Option A is used for checking the integrity of the data. Option C is used for keeping input up to a certain limit and option D is used to check the integrity of all records.

Question explanation: B is the correct answer. It may check the validity and concurrency of the job code. Option A is used for checking the integrity of the data. Option C is used for keeping input up to a certain limit and option D is a figure calculated by the system, adding the values in one of the fields in a segment. This field is called the control totals key figure field.

Question explanation: B is the correct answer. Boundary Value Analysis is based on testing at the boundaries between partitions and checks the output with expected output. Option A White Box testing evaluates the code and the internal structure of a program. Option C also known as Grey Box testing is a process for debugging software applications by making an input through the front-end, and verifying the data on the back-end. Option D is not applicable.

Question explanation: B is the correct answer. Portability Testing shows the ease with which a computer software component or application can be moved from one environment to another, e.g. moving of any application from Windows XP to Windows 7. Option A Interoperability testing checks whether software can inter-operate with other software component, software or systems. Option C Usability Testing, is a non-functional testing technique that is a measure of how easily the system can be used by end users. Option D Performance Testing is the process of determining the speed, responsiveness and stability of a computer, network, software program or device under a workload.

Question explanation: B is the correct answer. Usability Testing is mostly done by users. They are not familiar with internal structure of the system and hence Black Box technique is correct answer. Option A White Box testing evaluates the code and the internal structure of a program. Option C Grey Box testing is a process for debugging software applications by making an input through the front-end, and verifying the data on the back-end. Option D does not exist.

Question explanation: C is the correct answer. Separately testable components are tested in Unit Testing or Component Testing. A Unit Testing tends to test a function, individual program or even a procedure. Option B Acceptance Testing (or User Acceptance Testing) determines whether the system is ready for release. Option A Integration Testing allows individuals to find interface defects between the modules/functions. Option D System Testing is the first level in which the complete application is tested as a whole.

Question explanation: C is the correct answer. System Testing is based on Functional Requirement Specification (FRS), which tells about general behavior of a system. Acceptance testing (or User Acceptance Testing) determines whether the system is ready for release. Component Testing, also known as Unit, Module or Program Testing, is defined as a software testing type, in which the testing is performed on each individual component
separately without integrating with other components. Integration testing allows individuals to find interface defects between the modules/functions.

Question explanation: D is the correct answer. Test levels can be combined or reorganized depending upon nature of a project or system architecture. Unit testing refers to test a function, individual program or even a procedure. Integration Testing allows individuals to find interface defects between the modules/functions. System Testing is the first level in which the complete application is tested as a whole. Acceptance Testing (or User Acceptance Testing) determines whether the system is ready for release.

Question explanation: B is the correct answer. Black Box testing focuses on the inputs and outputs without
knowing their internal code implementation. Option A White Box testing evaluates the code and the internal structure of a program. Option C Load Testing is performed to determine a system's behaviour under both normal and at peak conditions. Option D Regression Testing is defined as a type of software testing to confirm that a recent program or code change has not adversely affected existing features.

Question explanation: D is the correct answer. Sanitized data generally may not cover all paths the data can take and hence system cannot be tested for all possible cases. Option B leakage of production data is not a major concern since data is sanitized. Options A and C are not concerns.

Question explanation: C is the correct answer. Beta testing is making product available to users for feedback before launching. Option A Internal Audits seek to identify any shortcomings in a company's internal controls. Option B Alpha Testing is performed by the developers to identify bugs before releasing the product to real or intended users. Option D User Training helps successful system implementation.

Question explanation: B is the correct answer. UAT is mainly conducted to confirm from the users and application owners that application meets their requirements. Option C is a formality to be completed only if requirements are met. Training and implementation planning are different activities which are not dependent on UAT.

Question explanation: C is the correct answer. Since the application is for internal use and developed in house it has nothing to do with reduction in virus attacks. This can be benefit realization for anti-virus solution.

Question explanation: B is the correct answer. In order to ensure the acceptability by users, beta version of solution is made available to users. Based on feedback changes are made so that the solution can be socialized. Option A addresses technical feasibility, Option C addresses economic feasibility. Option D addresses IT policy that has nothing to do with SDLC.

Question explanation: A is correct answer. Non availability of skilled resources required for application development is primary reason for outsourcing the SDLC project. Other reasons can be addressed. i.e. (B) budget can be made available; (C) security processes can be established. (D) Infrastructure can be acquired, depending upon design of new application and hence it is not a reason.

Question explanation: B is the correct answer. Business case is a document that narrates all aspect including benefit realization, cost and effort estimates, outcome of feasibility study, available budget. That helps management in decision on the need of the SDLC project. Rest are secondary aspects.

Question explanation: D is correct answer. When a competitor launches new IT based efficient service, it becomes necessary for management to consider the impact in market place and in order to remain in competition organization should provide similar or better services. Option A and C may not require SDLC since it can be adopted with change management process. B may help in deciding for D, but is not the reason for initiating SDLC project.

Question explanation: D is the correct answer. Active role of IS Auditor in design and development of controls affects the independence. Hence, IS Auditor cannot perform review or audit of the application system. However, developing integrated test facility within the application is not a control, but a facility to be used by auditors in future. Hence, this does not impact independence of IS auditor. Options A, B and C affect independence of an IS Auditor.

Question explanation: A is the correct answer. Security requirements must be considered during requirement definition. Option B is a phase in which technical, economical and social feasibilities are considered. Option C is the phase during which, the nature of controls to be implemented for security must be considered first. This will ensure that necessary security controls are built while developing application.

Question explanation: B is the correct answer. Make or buy decision is the outcome of feasibility study where technical, economical and social feasibilities are considered. Option A is a statement that indicates what a system needs to do in order to provide a capability. Options C and D are the phases of developing a software.

Question explanation: C is correct answer. Adopting coding standards helps organization in ensuring quality of coding and in minimizing the errors. It also helps in reducing obvious errors which may lead to vulnerabilities in application. A is not true since it is required for all languages; B is partially true but is not main reason. D is not main reason.

Question explanation: A is correct answer. SDLC primarily focuses on identifying IT based solution to improve business processes delivering services to customers. Other activities may be part of SDLC however, these are IT projects not SDLC projects.

Question explanation: A is the correct answer. A Project Manager must have experience in working on projects in various roles including the role of a Project Manager. Options B, C and D are secondary aspect.

Question explanation: A is the correct answer. The Project Manager is responsible for collective project success. The Project Manager integrates a project as a whole. He/she unifies various aspects and processes of initiating, planning, executing, monitoring, control and closure. Options B, C and D is not the role of the Project Manager.

Question explanation: C is the correct answer. A Project Manager is responsible to ensure high quality in a way that the final product meets the specifications and quality benchmarks. Options A, B and C are not the main responsibility of a Project Manager.

Question explanation: A is the correct answer. Auditor should primarily focus on risk management that will provide inputs on events that has impact on all aspects of project. Options B, C and D help in confirming the findings from review of Risk Management process.

Question explanation: C is the correct answer. Automated tools help team in improving productivity as these tools help in managing mundane and structure activities and developers can focus on core activities. Developers’ workbench provides various functions that help in improving productivity. Option A: Use of standards help in following uniform methods and reducing rework. Option B: Software Sizing is the main input parameter to cost estimation models. Option D: HR policies may help in motivating team but it is secondary.

Question explanation: A is the correct answer. Quality is most important aspect for SDLC project, since it minimizes errors that can impact operations. Options B, C and D are of prior to monitoring phase.

Question explanation: B is the correct answer. A program is concerned with the benefits received, from implementing it, whereas project deals with specific deliverables. The scope of the program is wider in comparison to the project. The project works on a single functional unit, while the program works on various functional units. A portfolio contains both projects and programs and is managed by a portfolio manager. Option D: Feasibility study either has been completed or shall be initiated as part of program.

Question explanation: D is the correct answer. Scope Creep of continued changes in requirements during SDLC project is most common risk. If not properly handled the project may be delayed and benefit realization from the project shall be affected. The Project Manager therefore, must freeze the scope by base-lining requirements. Any change after baselining shall follow. Option A: Change Management process without base-lining may not
help. Project Manager may or may not. Option B: is used for freezing the requirements. Option D: revised effort estimate is applicable after change is approved.

Question explanation: A is the correct answer. Project Sponsor is a stake holder having maximum interest / stake in the success of project and his primary responsibility is to coordinate with various stakeholders for success of project. Option B: Project Manager is responsible for executing the project activities. Option C: Steering Committee monitors project progress but is not ongoing activity. Option D: Board of Directors provides direction.