CISA Practice Question: Information Systems Acquisition, Development, and Implementation
During the design phase of an SDLC, which TWO activities should be performed to ensure security is integrated into the system? (Select TWO)
⚠ Common exam trap
CISA often tests the phase-appropriateness of security activities; candidates incorrectly select testing-phase activities (UAT, code review, pen testing) for a design-phase question because they conflate 'security assurance' with 'security integration.'
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Threat modeling
Threat modeling (C) is correct because it is a design-phase activity that systematically identifies potential threats, attack vectors, and mitigations against the proposed architecture and data flows before code is written. Architecture review (D) is correct because it evaluates the proposed system design against security requirements, standards, and best practices (e.g., segmentation, least privilege, trust boundaries) to catch structural weaknesses early. User acceptance testing (A) is wrong because UAT validates business functionality and user requirements during testing, not design. Code review (B) is wrong because it examines implemented source code, which occurs after design. Penetration testing (E) is wrong because it is an active exploitation test performed on a built system, typically in later testing or deployment phases.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
User acceptance testing (UAT)
Why it's wrong here
UAT validates that the built system meets business requirements and occurs after coding, so it cannot shape design-phase security decisions. It is tempting because testing is a recognised SDLC security activity, and UAT would be correct when the requirement is confirming functional acceptance before go-live.
- ✗
Code review
Why it's wrong here
Code review examines implemented source, which does not yet exist during design, so it cannot embed security at that stage. It is tempting because review is a genuine security control, and it would be the right choice once code has been written, during development or before release.
- ✓
Threat modeling
Why this is correct
Threat modeling systematically identifies potential threats, attack vectors and required mitigations against the proposed design. Conducted during the design phase, it satisfies the requirement to integrate security before coding begins, when architectural changes remain inexpensive compared with remediation after implementation.
- ✓
Architecture review
Why this is correct
Architecture review evaluates the proposed system design against security standards, identifying weaknesses in trust boundaries, data flows and component placement. Performed during design, it satisfies the requirement to embed security controls before development, when structural corrections cost far less than post-implementation remediation.
- ✗
Penetration testing
Why it's wrong here
Penetration testing attacks a running system, so it cannot influence design-phase security requirements or architecture. It is tempting because it is a recognised security assurance activity, and it would be correct after deployment, when validating that implemented controls resist real exploitation.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.