Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Badly written question, as others have stated already...not enough information to choose between B or C. Anyway, I think this question is meant to test you on the SDLC so in that case, you integrate security into it as early as possible (in this case, development phase, although it should be even earlier, in the design phase). So I vote C.
The reason it would be C is that it is considered best practice in DevSecOps for building secure applications. B also makes sense but I would prefer C.
I'm not sure they give enough context (yet again). If you're about to develop something then C makes the most sense as people have stated. Though software development is taught briefly on the CISM course I've done, it's not an ISM's job. If the question is talking about something being integrated then the answer is B. Implementing things into security systems (and managing the risk that comes with it) is far more in line with an ISM's work