Information Systems Acquisition, Development, and Implementation →mediumMultiple ChoiceObjective-mapped
CISA Practice Question: Information Systems Acquisition, Development, and Implementation
An IS auditor is assessing the controls in an agile development environment. What is the MOST effective way to verify that security testing is performed iteratively?
⚠ Common exam trap
Watch out — candidates often confuse 'planning for security' (e.g., standups or product owner interviews) with 'evidence of security execution' (the DoD), or they mistakenly think a final report proves iterative testing when it only shows a single snapshot.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reviewing the project's definition of done for each sprint
In agile development, security testing must be integrated into each sprint to ensure continuous validation. The 'definition of done' (DoD) is the team's checklist for completing a user story; if it explicitly includes security testing tasks (e.g., static analysis, dynamic scans, or penetration tests), then verifying the DoD proves that security testing was performed iteratively. Option D directly examines this artifact, providing objective evidence of iterative security testing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Observing a daily standup meeting
Why it's wrong here
Standups do not typically cover testing details.
- ✗
Interviewing the product owner about security priorities
Why it's wrong here
Subjective and may not reflect actual practice.
- ✗
Examining the final security test report after release
Why it's wrong here
This does not confirm iterative testing.
- ✓
Reviewing the project's definition of done for each sprint
Why this is correct
The Definition of Done should include security testing criteria.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.