ExpertMedium1 markMultiple Choice
CPA · Question 76 · Area I: Information Systems
An auditor is reviewing the 'System Development Life Cycle' (SDLC). Which phase should include the definition of security requirements?
An auditor is reviewing the 'System Development Life Cycle' (SDLC). Which phase should include the definition of security requirements?
Answer options:
A.
Testing
B.
Deployment
C.
Requirements Analysis / Planning
D.
Maintenance
How to approach this question
Apply 'Shift Left' or 'Security by Design'.
Full Answer
C.Requirements Analysis / Planning✓ Correct
Requirements Analysis / Planning
Defining security requirements early prevents costly rework and vulnerabilities.
Common mistakes
Thinking security happens during testing.
Practice the full CPA ISC Practice Exam 2
82 questions · hints · full answers · grading
More questions from this exam
Q01A service organization provides a cloud-based payroll platform where clients access the software ...MediumQ02An auditor is reviewing the backup strategy for a financial institution that requires a Recovery ...HardQ03During a walkthrough of the change management process, an auditor observes that developers have w...MediumQ04An auditor is reviewing a SQL query used to generate a list of active customers for a marketing c...HardQ05Which of the following entities is considered a 'Covered Entity' under the HIPAA Privacy Rule?Medium