CISA Domain 3 Questions With Correct
Answers!!
Capability Maturity Models - ANSWERLevel 1 - Initial - processes are poorly
controlled
Level 2 - Managed - process is characterized for projects.
Level 3 - Defined - documented process characterized for the organization and is
proactive
Level 4 - Quantitatively Managed - Process is measured and controlled. Quantitative
quality goals can be reached.
Level 5 - Optimizing - Focus is on process improvement
Computer Aided Software Engineering (CASE) - ANSWERThe use of automated
tools to aid in the software development process. Their use may include the
application of software tools for software requirements capture and analysis,
software design, code production, testing, document generation and other software
development activities.
Upper CASE - Products used to describe and document business and application
requirements
Middle CASE - Products used for developing the detailed designs.
Lower CASE - Products involved with the generation of program code and database
definitions.
Benefits Realization - ANSWERObjective is to ensure that IT and the business fulfill
their value management responsibilities, particularly that:
IT-enabled business investments achieve the promised benefits and deliver
measurable business value.
Required capabilities are delivered on time, both with respect to schedule and time-
sensitive market. Within budget.
IT services and other IT assets continue to contribute to business value.
Programs - ANSWERLike projects, they have a limited time frame and organizational
boundaries. Differentiator is that programs are more complex, usually have a longer
duration, a higher budget and higher risk associated with them.
Examples of Programs - ANSWERLarge scale enterprise resource planning (ERP)
system, organizational realignment, business process reengineering (BPR) and
optimization, training and development.
Objective of Program Management - ANSWERSuccessful execution of programs
including: management of program scope, financials, schedules, objectives and
deliverables. Program context and environment. Program communication and
culture. Program organization.
Program MGMT vs Project MGMT methodology - ANSWERVery similar
methodology and processes and run in parallel to each other. They must not be
combined and have to be handled and carried out separately
,Starting a program - ANSWERSome form of written assignment from the program
sponsor(owner) to the program manager and the program team is required.
Programs most often emerge from projects, such an assignment is important to set
the program context and boundaries as well as formal management authority.
Project Portfolio - ANSWERDefined as all the projects being carried out in an
organization at a given point in time(snapshot). Projects of a program belong to the
company's project portfolio as do projects that are not associated with a program.
Objectives of project portfolio management - ANSWEROptimization of the results of
the project portfolio (not individual projects)
Prioritizing and scheduling projects
Resource coordination (internal and external)
Knowledge transfer throughout the projects
Project Portfolio Database - ANSWERMandatory for project portfolio management. It
must include project data such as owner, schedules, objectives, project type, status,
cost, etc.
Project Portfolio Reports - ANSWERAre a project portfolio bar chart, a profit versus
risk matrix, a project portfolio progress graph, etc.
Enterprise Resource Planning - ERP - ANSWERA packaged business software
system that allows an organization to automate and integrate the majority of its
business processes, share common data and practices across the entire
organization and produce and access information in a real time environment.
Business Process Reengineering - BPR - ANSWERThe thorough analysis and
significant redesign of business processes and management systems to establish a
better performing structure, more responsive to the customer base and market
conditions, while yielding material cost savings.
Business Case - ANSWERAn important consideration in any IT project. Provides the
information required for an organization to decide whether a project should proceed.
Either the first step in a project or a precursor to the commencement of a project. If
at any stage of the project the business case is thought to be no longer valid,
through increased costs or reduction in the anticipated benefits, the project sponsor
or IT steering committee should consider whether to continue. In a well planned
project, there will be stage gates or kill points at which the business case is formally
reviewed. If the business case is changed during the course of a project, the project
should be reapproved through the departmental planning and approval process.
Feasibility Study - ANSWERIs used to derive an initial business case.
Includes:
The project scope defines the business problem and/or opportunity to be addressed.
The current analysis defines and establishes an understanding of a system, a
software product, etc. At this point in the process, the strengths and weaknesses of
the current system or software product are identified.
Requirements are defined based upon stakeholder needs and constraints.
, The approach is the recommended system and/or software solution to satisfy the
requirements.
Evaluation is based upon the previously completed elements within the feasibility
study. The final report addresses the cost-effectiveness of the approach selected.
A formal review of the feasibility study report is conducted with all stakeholders.
The feasibility study determines the strategic benefits of the project. Therefore, the
result of the feasibility study determines the organizational impact—a comparison
report of costs, benefits, risk, etc.
Benefits realization - ANSWERIs a continuous process that must be managed like
any other business process and the business case should be a key element of
benefits realization processes. Often includes a postimplementation review 6-18
months after the implementation of systems. Must be part of the governance and
management of projects. COBIT 5 is often used as a framework for this.
Postimplementation Review - ANSWERThe objective is to reveal whether the
implementation of a system has achieved planned objectives (i.e., meets business
objectives and risk acceptance criteria).
Asses the adequacy of the system does it meet user requirements and business
objectives?
Evaluate the projected cost benefits or ROI
Develop recommendations that address the systems inadequacies and deficiencies.
Develop a plan for implementing the recommendations
Assess the development project process. Were the chosen methodologies,
standards and techniques followed?
Project Management Approaches - ANSWERPMBOK Project Management Body of
Knowledge
PRINCE2 Projects in a controlled environment
Are dependent on the size of the organization and complexity of
business/operations. Role of the IS auditor is to ensure that rules of system
development, as they relate to segregation of duties and responsibilities, are not
compromised.
Influence Project Organization - ANSWERThe PM has only a staff function without
the formal management authority. The PM is only allowed to advise peers and team
members as to which activities should be completed
Pure Project Organization - ANSWERThe PM has formal authority over those taking
part in the project. Often, this is bolstered by providing a special working area for the
project team that is separated from their normal office space
Matrix Project Organization - ANSWERManagement authority is shared between the
project manager and the department heads
IT steering committee - ANSWERRequests for major projects should be submitted to
and prioritized by the IT steering committee. The IT steering committee should
identify and appoint a PM. The PM should be given complete operational control
over the project and be allocated the appropriate resources including staff. IS
auditors can participate in the project in an advisory role and they may become
Answers!!
Capability Maturity Models - ANSWERLevel 1 - Initial - processes are poorly
controlled
Level 2 - Managed - process is characterized for projects.
Level 3 - Defined - documented process characterized for the organization and is
proactive
Level 4 - Quantitatively Managed - Process is measured and controlled. Quantitative
quality goals can be reached.
Level 5 - Optimizing - Focus is on process improvement
Computer Aided Software Engineering (CASE) - ANSWERThe use of automated
tools to aid in the software development process. Their use may include the
application of software tools for software requirements capture and analysis,
software design, code production, testing, document generation and other software
development activities.
Upper CASE - Products used to describe and document business and application
requirements
Middle CASE - Products used for developing the detailed designs.
Lower CASE - Products involved with the generation of program code and database
definitions.
Benefits Realization - ANSWERObjective is to ensure that IT and the business fulfill
their value management responsibilities, particularly that:
IT-enabled business investments achieve the promised benefits and deliver
measurable business value.
Required capabilities are delivered on time, both with respect to schedule and time-
sensitive market. Within budget.
IT services and other IT assets continue to contribute to business value.
Programs - ANSWERLike projects, they have a limited time frame and organizational
boundaries. Differentiator is that programs are more complex, usually have a longer
duration, a higher budget and higher risk associated with them.
Examples of Programs - ANSWERLarge scale enterprise resource planning (ERP)
system, organizational realignment, business process reengineering (BPR) and
optimization, training and development.
Objective of Program Management - ANSWERSuccessful execution of programs
including: management of program scope, financials, schedules, objectives and
deliverables. Program context and environment. Program communication and
culture. Program organization.
Program MGMT vs Project MGMT methodology - ANSWERVery similar
methodology and processes and run in parallel to each other. They must not be
combined and have to be handled and carried out separately
,Starting a program - ANSWERSome form of written assignment from the program
sponsor(owner) to the program manager and the program team is required.
Programs most often emerge from projects, such an assignment is important to set
the program context and boundaries as well as formal management authority.
Project Portfolio - ANSWERDefined as all the projects being carried out in an
organization at a given point in time(snapshot). Projects of a program belong to the
company's project portfolio as do projects that are not associated with a program.
Objectives of project portfolio management - ANSWEROptimization of the results of
the project portfolio (not individual projects)
Prioritizing and scheduling projects
Resource coordination (internal and external)
Knowledge transfer throughout the projects
Project Portfolio Database - ANSWERMandatory for project portfolio management. It
must include project data such as owner, schedules, objectives, project type, status,
cost, etc.
Project Portfolio Reports - ANSWERAre a project portfolio bar chart, a profit versus
risk matrix, a project portfolio progress graph, etc.
Enterprise Resource Planning - ERP - ANSWERA packaged business software
system that allows an organization to automate and integrate the majority of its
business processes, share common data and practices across the entire
organization and produce and access information in a real time environment.
Business Process Reengineering - BPR - ANSWERThe thorough analysis and
significant redesign of business processes and management systems to establish a
better performing structure, more responsive to the customer base and market
conditions, while yielding material cost savings.
Business Case - ANSWERAn important consideration in any IT project. Provides the
information required for an organization to decide whether a project should proceed.
Either the first step in a project or a precursor to the commencement of a project. If
at any stage of the project the business case is thought to be no longer valid,
through increased costs or reduction in the anticipated benefits, the project sponsor
or IT steering committee should consider whether to continue. In a well planned
project, there will be stage gates or kill points at which the business case is formally
reviewed. If the business case is changed during the course of a project, the project
should be reapproved through the departmental planning and approval process.
Feasibility Study - ANSWERIs used to derive an initial business case.
Includes:
The project scope defines the business problem and/or opportunity to be addressed.
The current analysis defines and establishes an understanding of a system, a
software product, etc. At this point in the process, the strengths and weaknesses of
the current system or software product are identified.
Requirements are defined based upon stakeholder needs and constraints.
, The approach is the recommended system and/or software solution to satisfy the
requirements.
Evaluation is based upon the previously completed elements within the feasibility
study. The final report addresses the cost-effectiveness of the approach selected.
A formal review of the feasibility study report is conducted with all stakeholders.
The feasibility study determines the strategic benefits of the project. Therefore, the
result of the feasibility study determines the organizational impact—a comparison
report of costs, benefits, risk, etc.
Benefits realization - ANSWERIs a continuous process that must be managed like
any other business process and the business case should be a key element of
benefits realization processes. Often includes a postimplementation review 6-18
months after the implementation of systems. Must be part of the governance and
management of projects. COBIT 5 is often used as a framework for this.
Postimplementation Review - ANSWERThe objective is to reveal whether the
implementation of a system has achieved planned objectives (i.e., meets business
objectives and risk acceptance criteria).
Asses the adequacy of the system does it meet user requirements and business
objectives?
Evaluate the projected cost benefits or ROI
Develop recommendations that address the systems inadequacies and deficiencies.
Develop a plan for implementing the recommendations
Assess the development project process. Were the chosen methodologies,
standards and techniques followed?
Project Management Approaches - ANSWERPMBOK Project Management Body of
Knowledge
PRINCE2 Projects in a controlled environment
Are dependent on the size of the organization and complexity of
business/operations. Role of the IS auditor is to ensure that rules of system
development, as they relate to segregation of duties and responsibilities, are not
compromised.
Influence Project Organization - ANSWERThe PM has only a staff function without
the formal management authority. The PM is only allowed to advise peers and team
members as to which activities should be completed
Pure Project Organization - ANSWERThe PM has formal authority over those taking
part in the project. Often, this is bolstered by providing a special working area for the
project team that is separated from their normal office space
Matrix Project Organization - ANSWERManagement authority is shared between the
project manager and the department heads
IT steering committee - ANSWERRequests for major projects should be submitted to
and prioritized by the IT steering committee. The IT steering committee should
identify and appoint a PM. The PM should be given complete operational control
over the project and be allocated the appropriate resources including staff. IS
auditors can participate in the project in an advisory role and they may become
