CISA Practice Question: Information Systems Acquisition, Development, and Implementation
An IS auditor is reviewing a project that uses an iterative SDLC approach. Which THREE controls should the auditor expect to see in place during the development iterations? (Select THREE)
⚠ Common exam trap
CISA often tests the distinction between iterative and waterfall controls; candidates select waterfall-style gates (formal sign-off, UAT before each iteration) instead of the code-level, continuous controls that actually fit iterative development.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Code reviews
In an iterative SDLC, controls must fit each short development cycle, so the auditor should expect code reviews (B), because peer inspection of each increment catches defects and insecure coding early before they propagate into later iterations. Static application security testing (D) is also expected, since SAST tools scan source code or bytecode for vulnerabilities such as injection flaws during development, aligning with the shift-left security principle in iterative builds. Unit testing (E) is likewise a core iterative control, as developers verify individual functions or modules after each change, providing fast feedback and regression protection within the iteration. Formal sign-off on requirements before each iteration (A) is not typical because iterative methods embrace evolving requirements and continuous stakeholder feedback rather than frozen, pre-iteration approvals. User acceptance testing before each iteration (C) is also not expected, since UAT is normally performed at the end of a release or increment on a potentially shippable product, not before every development iteration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Formal sign-off on requirements before each iteration
Why it's wrong here
Iterative development expects requirements to evolve between iterations, so formal sign-off before every iteration is not a control auditors anticipate; baselined approval occurs at iteration planning instead. It tempts because sign-off is a valid waterfall control, but iterative projects rely on backlog refinement and change control rather than fixed pre-iteration approval.
- ✓
Code reviews
Why this is correct
Code reviews provide independent peer examination of each iteration's changes, catching defects and insecure coding before release. This satisfies the iterative SDLC's need for verification controls applied repeatedly within development iterations rather than only at final testing.
- ✗
User acceptance testing (UAT) before each iteration
Why it's wrong here
UAT is performed at the end of an iteration or release, not before each iteration begins, so it is not an expected per-iteration control. It tempts because UAT is a genuine SDLC control, but in iterative delivery the correct placement is after the increment is built and before release.
- ✓
Static application security testing (SAST)
Why this is correct
SAST scans source code for vulnerabilities such as injection flaws and insecure coding patterns during each iteration, catching defects before they propagate. This satisfies the iterative SDLC constraint by embedding automated security verification into every development cycle rather than deferring testing to a single pre-release phase.
- ✓
Unit testing
Why this is correct
Unit testing verifies individual code components against expected behaviour at the end of each iteration, confirming functionality before integration. Within an iterative SDLC, this provides the frequent, incremental validation the methodology demands, preventing defects from compounding across successive development cycles.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.