CISA Practice Question: Information Systems Acquisition, Development, and Implementation

Which of the following is a key control in the deployment phase of the SDLC?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Rollback plan

A rollback plan ensures that if deployment fails, the system can be restored to a known good state.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Rollback plan
Why this is correct
A rollback plan provides a tested mechanism to revert to the prior stable state if deployment fails or introduces critical defects. This directly addresses the deployment phase's key risk — production disruption — by enabling rapid restoration of service, satisfying the stem's requirement for a key deployment control.
✗
Threat modeling
Why it's wrong here
Threat modeling identifies and mitigates design-level risks during requirements and design, well before deployment. Deployment controls address release approval, migration and segregation of duties. It tempts because it strengthens security, but it belongs to earlier SDLC phases, not the deployment phase.
✗
User acceptance testing
Why it's wrong here
User acceptance testing validates the system against business requirements before release, sitting at the end of testing rather than deployment. Deployment controls cover migration, approval and segregation of duties. It tempts because acceptance precedes go-live, but it is a testing-phase activity, not a deployment control.
✗
Code review
Why it's wrong here
Code review is a development-phase control, performed as code is written and before release. Deployment controls govern how tested code is moved into production, such as segregation of duties and release approval. It tempts because review improves quality, but it occurs earlier in the SDLC.

Go deeper