Explanation/Reference:
Explanation:
An updated and flawless access list is a significant challenge and, therefore, has the greatest chance for errors at the time of the initial installation. Passwords do not apply to firewalls, a modem bypasses a firewall and a virus attack is not an element in implementing a firewall.

The effect of installing the patch should be immediately evaluated and installation should occur based on the results of the evaluation. To install the patch without knowing what it might affect could easily cause problems. New software versions withall fixes included are not always available and a full installation could be time consuming. Declining to deal with vendors does not take care of the flaw.

Section: Information System Acquisition, Development and Implementation
Explanation/Reference:
Project sponsor provides funding for the project and works closely with the project manager to define
critical success factor(CSFs) and metrics for measuring the success of the project. It is crucial that success
is translated to measurable and quantifiable terms. Data and application ownership are assigned to a
project sponsor. A project sponsor is typically the senior manager in charge of the primary business unit
that the application will support.
For the CISA exam you should know the information below about roles and responsibilities of groups/
individuals that may be involved in the development process are summarized below:
Senior Management - Demonstrate commitment to the project and approves the necessary resources to
complete the project. This commitment from senior management helps ensure involvement by those
needed to complete the project.
User Management -Assumes ownership of the project and resulting system, allocates qualified
representatives to the team, and actively participates in business process redesign, system requirement
definitions, test case development, acceptance testing and user training. User management is concerned
primarily with the following questions:
Are the required functions available in the software?
How reliable is the software?
How effective is the software?
Is the software easy to use?
How easy is to transfer or adapt old data from preexisting software to this environment?
Is it possible to add new functions?
Does it meet regulatory requirement?
Project Steering Committee -Provides overall directions and ensures appropriate representation of the
major stakeholders in the project's outcome. The project steering committee is ultimately responsible for all
deliverables, project costs and schedules. This committee should be compromised of senior representative
from each business area that will be significantly impacted by the proposed new system or system
modifications.
System Development Management -Provides technical support for hardware and software environment by
developing, installing and operating the requested system.
Project Manager -Provides day-to-day management and leadership of the project, ensures that project
activities remain in line with the overall directions, ensures appropriate representation of the affected
departments, ensures that the project adheres local standards, ensures that deliverable meet the quality
expectation of key stakeholder, resolve interdepartmental conflict, and monitors and controls cost of the
project timetables.
Project Sponsor - Project sponsor provides funding for the project and works closely with the project
manager to define critical success factor(CSFs) and metrics for measuring the success of the project. It is
crucial that success is translated to measurable and quantifiable terms. Data and application ownership are
assigned to a project sponsor. A project sponsor is typically the senior manager in charge of the primary
business unit that the application will support.
System Development Project Team -Completes assigned tasks, communicates effectively with user by
actively involving them in the development process, works according to local standards, and advise the
project manager of necessary plan deviations.
User Project Team -Completes assigned tasks, communicate effectively with the system developers by
actively involving themselves in the development process as Subject Matter Expert (SME) and works
according to local standards, and advise the project manager of expected and actual project deviations.
Security Officer - Ensures that system controls and supporting processes provides an effective level of
protection, based on the data classification set in accordance with corporate security policies and
procedures: consult throughout the life cycle on appropriate security measures that should be incorporated
into the system.
Quality Assurance - Personnel who review result and deliverables within each phase and at the end of
each phase, and confirm compliance with requirements. Their objective is to ensure that the quality of the
project by measuring adherence of the project staff to the organization's software development life cycle
(SDLC), advise on the deviation and propose recommendation for process improvement or greater control
points when deviation occur.
The following were incorrect answers:
Security Officer - Ensures that system controls and supporting processes provides an effective level of
protection, based on the data classification set in accordance with corporate security policies and
procedures: consult throughout the life cycle on appropriate security measures that should be incorporated
into the system.
User Management -Assumes ownership of the project and resulting system, allocates qualified
representatives to the team, and actively participates in business process redesign, system requirement
definitions, test case development, acceptance testing and user training.
Senior Management - Demonstrate commitment to the project and approves the necessary resources to
complete the project. This commitment from senior management helps ensure involvement by those
needed to complete the project.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 150