easyMultiple ChoiceObjective-mapped
CISA Practice Question: A nonprofit organization develops a small online…
A nonprofit organization develops a small online donation platform using a third-party payment gateway. The project team skips formal security testing because of budget constraints. After launch, a security researcher discovers that the application fails to validate input on the donation amount field, allowing manipulation. The nonprofit loses several thousand dollars before the issue is patched. The IS auditor is asked to review the system development process. Which of the following is the PRIMARY finding?
⚠ Common exam trap
The trap here is that candidates focus on the immediate technical flaw (unvalidated input) or the financial loss, rather than recognizing that the IS auditor's role is to identify the systemic process failure (lack of security testing) that allowed the vulnerability to be introduced.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security testing was not performed during development.
The primary finding for an IS auditor reviewing the system development process is the absence of security testing during development. Skipping formal security testing (e.g., static application security testing, dynamic application security testing, or penetration testing) violates the secure development lifecycle (SDLC) best practices and directly led to the input validation vulnerability. The IS auditor's focus is on process deficiencies, not the specific exploit or financial loss.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The donation amount field was not validated.
Why it's wrong here
This is the vulnerability, not the root cause.
- ✗
The organization lost money due to the exploit.
Why it's wrong here
Impact, not process deficiency.
- ✓
Security testing was not performed during development.
Why this is correct
Testing would have identified the input validation issue.
- ✗
The payment gateway was not properly integrated.
Why it's wrong here
Integration was fine; the flaw was in the app.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.