Free CISA Domain 3 Practice Questions with Answers
These five CISA Domain 3 questions are drawn from Auditor Path's bank. Each follows ISACA's item-writing style: a scenario, four plausible options and one BEST answer. Read the explanation even when you get it right — it names the judgment the exam is testing.
Domain 3, Information Systems Acquisition, Development and Implementation, is 12% of the CISA exam.
Question 1: Control Identification and Design
An application allows users to override a credit limit check. Which control BEST manages this risk?
- A. Independent approval of each override, with every override logged for review
- B. Training users not to override limits
- C. Removing the credit limit check so that orders are no longer blocked
- D. Requiring users to record a business reason for each override
Answer: A. Overrides are sometimes needed, so the control is to authorize them independently and keep a reviewable record of each one.
Exam mindset: Overrides need authorization and an audit trail.
Question 2: Business Case and Feasibility Analysis
An IS auditor finds that the business case for a completed system was never revisited after approval. What is the GREATEST risk?
- A. The system documentation may no longer reflect the system as it was finally built
- B. Users may not have been trained on the features added after the design was approved
- C. The organization cannot tell whether the expected benefits were realized
- D. Project costs may not have been closed in the financial system
Answer: C. Without revisiting the business case, there is no comparison of actual benefits with those promised, so the organization cannot learn from or correct the investment.
Exam mindset: Benefits must be tracked, not assumed.
Question 3: System Readiness and Implementation Testing
What is the MAIN difference between white-box and black-box testing?
- A. White-box testing is done in production after go-live; black-box before release
- B. White-box tests internal logic and code paths; black-box tests functionality without knowing internals
- C. Black-box testing requires access to the source code and design documents
- D. White-box testing is done only by users
Answer: B. Using both approaches covers internal logic errors and functional failures.
Exam mindset: Know what each test perspective sees.
Question 4: Project Governance and Management
A project manager reports progress to the steering committee as the percentage of budget spent to date. What is the MOST significant concern for an IS auditor?
- A. The steering committee may find percentage figures hard to interpret and compare
- B. The finance department may report project spending in a different format from the project manager
- C. Spending does not measure work done, so progress may be overstated
- D. Budget figures may be rounded, making the progress reports slightly imprecise from month to month
Answer: C. Money spent shows effort consumed, not progress made. Status should be based on completed deliverables or earned value to give the committee a reliable view of progress.
Exam mindset: Spending is cost, not progress.
Question 5: System Development Methodologies
Users were so pleased with a prototype of a new application that management wants to put the prototype into production immediately. What is the MOST significant risk?
- A. Developers will be tied up supporting the prototype
- B. The prototype may not scale to the full number of production users
- C. Users may request further changes once the prototype is in production
- D. The prototype may lack production-grade controls, documentation and testing
Answer: D. Prototypes demonstrate functionality and often omit controls, error handling and security needed in production.
Exam mindset: A prototype is not a product.
Keep practising
The quiz below draws more questions from every CISA Domain 3 subtopic. Sign in to practise the full bank, take timed 150-question mocks and see your readiness by domain.