Isaca CISA Exam - Topic 2 Question 119 Discussion

Actual exam question for Isaca's CISA exam

Question #: 119
Topic #: 2

A web application is developed in-house by an organization. Which of the following would provide the BEST evidence to an IS auditor that the application is secure from external attack?

AWeb application firewall (WAF) implementation

BPenetration test results

CCode review by a third party

DDatabase application monitoring logs

Show Suggested Answer

Suggested Answer: B

by Frank at Jul 16, 2026, 12:44 PM

Limited Time Offer

25%

Off

Get Premium CISA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Margot

1 day ago

Definitely leaning towards penetration tests for solid evidence.

upvoted 0 times

...

Rebecka

6 days ago

Surprised that people overlook monitoring logs!

upvoted 0 times

...

Blondell

11 days ago

WAFs are good, but they can't catch everything.

upvoted 0 times

...

Leanna

17 days ago

I think a third-party code review is more reliable.

upvoted 0 times

...

Luis

22 days ago

Penetration test results are key for security!

upvoted 0 times

...

Crista

27 days ago

Database monitoring logs could show activity, but they wouldn’t necessarily prove the application is secure from attacks, right?

upvoted 0 times

...

Tequila

1 month ago

Code reviews by third parties seem important, but I wonder if they can miss some issues that a penetration test might catch.

upvoted 0 times

...

Carissa

1 month ago

I remember discussing how a WAF can help, but I feel like it’s more of a preventive measure than proof of security.

upvoted 0 times

...

Terrilyn

1 month ago

I think penetration test results would be the best evidence, but I’m not entirely sure if they cover all potential vulnerabilities.

upvoted 0 times

...