Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Systems Auditor · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Secure code review is preventive, the word "periodic" is what is getting to me. Does periodic make it let frequent and is also making it more so detective then preventive?
Periodic secure code reviews are conducted to identify security flaws or vulnerabilities in source code before the software is deployed or put into production. This proactive approach helps ensure that insecure code does not make it into the final application, thereby preventing potential security issues. Therefore, this type of control is classified as a preventive control, because it aims to avoid incidents before they occur. Why not the others? A. Compensating ➤ A control that serves as a substitute for a missing primary control. Secure code reviews are not substitutes; they are standard practice. B. Detective ➤ Detective controls identify issues after they have occurred, such as logs or alerts. Code reviews are performed before deployment. D. Corrective ➤ Corrective controls are used after an incident to fix the problem. Secure code reviews aim to prevent issues in the first place.
These reviews help uncover issues that could lead to security breaches or functional failures, enabling the organization to address them before deployment. While secure coding practices (e.g., training and guidelines) are preventive, the act of reviewing code is detective because it identifies problems after the fact.