MENU
A web application is developed in-house by an organization. Which of the following would provide the BEST evidence to an IS auditor that the application is secure from external attack?
Suggested Answer: B
Get Premium CISA Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
12 comments · newest first
ER
Erasmo
1 month ago
But C is important too. A third-party review can catch issues we miss.
DE
Delisa
1 month ago
I agree, B is solid. It simulates actual attacks.
RO
Rodney
1 month ago
I think B is the best choice. Penetration tests show real vulnerabilities.
MA
Margot
2 months ago
Definitely leaning towards penetration tests for solid evidence.
RE
Rebecka
2 months ago
Surprised that people overlook monitoring logs!
BL
Blondell
2 months ago
WAFs are good, but they can't catch everything.
LE
Leanna
2 months ago
I think a third-party code review is more reliable.
LU
Luis
2 months ago
Penetration test results are key for security!
CR
Crista
2 months ago
Database monitoring logs could show activity, but they wouldn’t necessarily prove the application is secure from attacks, right?
TE
Tequila
3 months ago
Code reviews by third parties seem important, but I wonder if they can miss some issues that a penetration test might catch.
CA
Carissa
3 months ago
I remember discussing how a WAF can help, but I feel like it’s more of a preventive measure than proof of security.
TE
Terrilyn
3 months ago
I think penetration test results would be the best evidence, but I’m not entirely sure if they cover all potential vulnerabilities.