Information Systems Acquisition, Development, and Implementation →mediumMultiple SelectObjective-mapped
CISA Practice Question: Information Systems Acquisition, Development, and Implementation
An IS auditor is evaluating an organization's SDLC controls for a new system. Which TWO of the following are key controls that should be in place during the design phase? (Select TWO.)
⚠ Common exam trap
Many candidates confuse security testing techniques like SAST with design-phase controls, or they mistakenly think UAT or regression testing occur early in the SDLC, when in fact they belong to later phases.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Architecture review by a senior architect
Architecture review by a senior architect is a key control during the design phase because it ensures the system's high-level structure aligns with security, scalability, and business requirements before development begins. This review catches design flaws early, reducing costly rework and preventing architectural weaknesses that could be exploited later. It is a formal gate in the SDLC that validates the design against established patterns and standards.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Architecture review by a senior architect
Why this is correct
Architecture review validates the design against requirements and best practices.
- ✗
Static application security testing (SAST)
Why it's wrong here
SAST is a development phase control (code scanning).
- ✗
User acceptance testing (UAT)
Why it's wrong here
UAT occurs during the testing phase, not design.
- ✗
Regression testing
Why it's wrong here
Regression testing is part of the testing phase.
- ✓
Threat modeling to identify security threats
Why this is correct
Threat modeling is a key security control in design to build security in.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.