Information Systems Acquisition, Development, and Implementation →mediumMultiple ChoiceObjective-mapped
CISA Practice Question: Information Systems Acquisition, Development, and Implementation
During an SDLC audit, the IS auditor finds that security requirements were not formally documented during the requirements phase. Which of the following is the BEST recommendation to mitigate the associated risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Include security requirements in the design phase and obtain sign-off
Security requirements should be defined early to ensure controls are designed in, not bolted on. The best practice is to include security requirements in the requirements phase and have them reviewed by security experts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform a penetration test after go-live
Why it's wrong here
Penetration testing is a point-in-time assessment and cannot fix requirements gaps.
- ✗
Conduct a vulnerability scan after deployment to identify security gaps
Why it's wrong here
Vulnerability scanning is reactive and may not address design flaws that stem from missing requirements.
- ✗
Implement a firewall and intrusion detection system
Why it's wrong here
Network controls are important but do not compensate for lack of security requirements in the system design.
- ✓
Include security requirements in the design phase and obtain sign-off
Why this is correct
Adding security requirements during design is better than later, but ideally they should be in requirements. However, this is the best option given the context.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.