IS Acquisition & Development: Exam Day Guide
Time Management for Domain 3 Questions
Domain 3 carries a 12% weight, meaning approximately 18 questions on the exam. This is the smallest domain by question count, so efficient time management here can free up valuable minutes for the larger domains. Most SDLC and project management questions are direct if you understand the phases and their deliverables. Allocate about 90 seconds per question and aim to complete this domain section quickly to bank time for Domains 4 and 5.
Approaching SDLC Scenario Questions
SDLC scenarios will typically place you at a specific phase of a development project and ask what should happen next or what was missed. Identify the current phase first (feasibility, requirements, design, development, testing, implementation, post-implementation) before evaluating the answers. ISACA expects auditors to verify that proper approvals, documentation, and controls exist at each phase transition. Questions about Agile methodologies are becoming more common; understand how iterative development differs from waterfall in terms of documentation and change control.
Key Patterns to Recognize
Testing questions follow a predictable hierarchy: unit testing, integration testing, system testing, user acceptance testing (UAT), and regression testing. Each level has a specific owner and purpose that ISACA expects you to know. Change management questions will test whether you can identify proper authorization, impact assessment, and rollback procedures. Look for the pattern of "segregation of duties in development," which means developers should not have access to production environments and should not perform their own testing.
Common Trap Answers
A frequent trap is selecting an answer that skips a required phase or approval in the SDLC. For example, moving from development directly to production without system testing and UAT is always incorrect. Another trap involves confusing who is responsible for UAT; it is always the business users or data owners, never the development team. Watch for answers that suggest implementing a system without a post-implementation review, as ISACA considers this step essential for verifying that project objectives were met.
What ISACA Expects as the Best Answer
ISACA favors answers that emphasize proper project governance, stakeholder involvement, and documented processes throughout the acquisition and development lifecycle. The best answer will always include appropriate controls such as sign-offs, baseline configurations, and version control. When a question asks about buying versus building software, ISACA expects a cost-benefit analysis that considers total cost of ownership, organizational fit, and long-term maintainability. Risk assessment before, during, and after implementation is always expected.
Change Management and Configuration Control
Change management is one of the most heavily tested topics within this domain. Every change to production systems should follow a formal process: request, impact assessment, approval, testing, implementation, and review. Emergency changes are permitted but must be documented and formally approved after the fact. Configuration management ensures that only authorized and tested versions of software are deployed to production. Questions may test whether you understand the difference between change management (process) and configuration management (technical control).
Post-Implementation and Project Closure
Post-implementation review (PIR) questions test whether you understand that this review should assess whether the project delivered the expected business benefits, not just whether it was completed on time and within budget. The PIR should be conducted after the system has been operational long enough for meaningful performance data to be available. Project closure includes archiving project documentation, releasing resources, and documenting lessons learned. ISACA expects auditors to verify that all of these closure activities are completed.
Practical Exam Day Logistics
For Domain 3 questions, keep a mental checklist of SDLC phases and their key deliverables. If a question describes a scenario you are unfamiliar with, fall back on the fundamental principle that every phase requires input, a transformation process, output, and a control or review mechanism. Do not overthink project management methodology questions; ISACA tests concepts rather than specific methodology implementations. Use your notepad to sketch quick phase diagrams if a complex scenario question requires you to track multiple activities.