CRISC Information Technology and Security Practice Question
A risk practitioner is assessing the security of the organization's software development lifecycle (SDLC). The organization wants to integrate security controls to reduce the risk of introducing vulnerabilities into production. Which TWO of the following are the MOST effective preventive controls to implement during the development phase? (Choose two.)
⚠ Common exam trap
It's easy for candidates to confuse detective controls like DAST or penetration testing with preventive controls that belong earlier in the development lifecycle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct static application security testing (SAST) on source code before code is merged into the main branch.
The most effective preventive controls during development are those that stop vulnerabilities from being introduced in the first place. Static application security testing (SAST) analyzes code before it is merged, catching flaws early. Secure coding training and standards give developers the skills to write safer code. Both are proactive measures integrated into the development phase, unlike DAST, WAF, or penetration testing, which are detective or perimeter controls applied later.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conduct static application security testing (SAST) on source code before code is merged into the main branch.
Why this is correct
SAST analyzes source code for security flaws without executing the program, allowing developers to identify and fix vulnerabilities early in the development phase. Integrating SAST into the CI/CD pipeline before merge ensures that insecure code does not progress to later stages. This is a preventive control that reduces the cost and effort of remediation compared to finding issues in production.
- ✓
Require developers to complete secure coding training and adhere to a secure coding standard.
Why this is correct
Secure coding training and standards equip developers with the knowledge to avoid common vulnerabilities, such as injection flaws and insecure deserialization. This preventive control addresses the root cause by improving the quality of code as it is written. It is most effective when reinforced with regular updates and integrated into the development culture, reducing the likelihood of introducing security defects.
- ✗
Implement a web application firewall (WAF) in front of the production application to block malicious traffic.
Why it's wrong here
A WAF is a preventive control at the network perimeter, but it does not prevent vulnerabilities from being coded into the application. It can mitigate some exploitation attempts, but it is not a development-phase control and may be bypassed. The question focuses on reducing risk during development, so WAF is not the best choice compared to controls that improve code quality.
- ✗
Perform dynamic application security testing (DAST) on applications in the production environment after deployment.
Why it's wrong here
DAST is typically a detective control performed on running applications, often in a staging or production environment. While valuable, it occurs after code is deployed, so it does not prevent vulnerabilities from being introduced. The question asks for preventive controls during the development phase, making DAST less appropriate than early-stage code analysis or secure coding practices.
- ✗
Conduct a penetration test on the application after it is deployed to production.
Why it's wrong here
Penetration testing is a detective control that simulates attacks to identify exploitable vulnerabilities. It is typically performed after development, often in a staging environment, and does not prevent flaws from being introduced. While it provides valuable assurance, it is not a preventive measure during the development phase and is less effective than integrating security earlier in the lifecycle.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.