mediumMultiple ChoiceObjective-mapped
CISA Practice Question: Integrating a third-party payment gateway into…
A company is integrating a third-party payment gateway into its e-commerce platform. Which of the following is the MOST important security control to implement?
⚠ Common exam trap
Candidates often choose encryption (SSL/TLS) as the most important control because it is a well-known security measure, but they overlook that encryption does not validate the trustworthiness of the decrypted data, which is the primary risk when integrating with an external system.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Validate all input from the payment gateway
Input validation from the payment gateway is the most critical security control. The payment gateway returns data (e.g., transaction status, amount, token) that is consumed by the e-commerce platform. Without strict validation, an attacker could inject malicious payloads (e.g., SQL injection, XSS) via manipulated gateway responses, leading to data breaches or unauthorized transactions. This control directly prevents injection attacks at the integration boundary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement role-based access control
Why it's wrong here
Important but addresses internal access.
- ✗
Log all transactions
Why it's wrong here
Detective control, not preventive.
- ✓
Validate all input from the payment gateway
Why this is correct
Prevents injection and data corruption.
- ✗
Encrypt all data with SSL
Why it's wrong here
Important but not the most important for integration.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.