mediumMultiple SelectObjective-mapped
CISA Practice Question: Which TWO of the following are key controls that…
Which TWO of the following are key controls that an IS auditor should expect to find in a well-managed system development life cycle (SDLC)?
⚠ Common exam trap
Many exam-takers confuse project management artifacts (like Gantt charts) or development tools (like unit test scripts) with actual controls, but the CISA exam focuses on controls that enforce separation of duties and formal change management, not on the tools or schedules used to manage the project.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Segregation of duties between development and testing.
Segregation of duties between development and testing is a key control because it ensures that code is independently verified before release, preventing developers from approving their own changes and reducing the risk of undetected defects or malicious code. In a well-managed SDLC, this separation enforces an independent testing phase, which is critical for maintaining code integrity and security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Segregation of duties between development and testing.
Why this is correct
Ensures independent verification and reduces risk of errors.
- ✗
Vendor due diligence reports.
Why it's wrong here
Relevant for third-party software acquisition, not general SDLC.
- ✓
Formal change control process for code changes.
Why this is correct
Prevents unauthorized modifications and ensures traceability.
- ✗
Automated unit testing scripts.
Why it's wrong here
Unit testing is a development practice, not a control.
- ✗
Gantt chart for project scheduling.
Why it's wrong here
Gantt charts aid planning but are not a control.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.