nerdexam
Isaca

CISA · Question #55

Which of the following would BEST help to ensure that potential security issues are considered by the development team as part of incremental changes to agile-developed software?

The correct answer is D. Include a mandatory step to analyze the security impact when making changes.. Integrating a mandatory security impact analysis step directly into the agile development process ensures potential security issues are consistently addressed with each incremental change.

Submitted by omar99· Apr 18, 2026Information Systems Acquisition, Development, and Implementation

Question

Which of the following would BEST help to ensure that potential security issues are considered by the development team as part of incremental changes to agile-developed software?

Options

  • ADeploy changes in a controlled environment and observe for security defects.
  • BMandate that the change analyses are documented in a standard format.
  • CAssign the security risk analysis to a specially trained member of the project management office.
  • DInclude a mandatory step to analyze the security impact when making changes.

How the community answered

(60 responses)
  • A
    28% (17)
  • B
    10% (6)
  • C
    7% (4)
  • D
    55% (33)

Why each option

Integrating a mandatory security impact analysis step directly into the agile development process ensures potential security issues are consistently addressed with each incremental change.

ADeploy changes in a controlled environment and observe for security defects.

Deploying and observing for defects is a reactive testing step; it doesn't ensure that security issues are proactively *considered* and designed out during development.

BMandate that the change analyses are documented in a standard format.

Documenting change analyses in a standard format is good for record-keeping but doesn't guarantee that security is a part of the analysis itself.

CAssign the security risk analysis to a specially trained member of the project management office.

Assigning risk analysis to an external PMO member can create a bottleneck and disconnect from the development team's immediate context and velocity, which is contrary to agile principles of integrated teams.

DInclude a mandatory step to analyze the security impact when making changes.Correct

Including a mandatory step to analyze the security impact when making changes embeds security considerations directly into the development workflow for each incremental change, ensuring that security is a continuous focus rather than an afterthought. This proactive approach identifies and addresses potential vulnerabilities early in the agile development lifecycle.

Concept tested: Integrating security in agile development

Source: https://learn.microsoft.com/en-us/azure/devops/boards/backlogs/security-and-compliance-integration?view=azure-devops

Topics

#Agile Security#Secure Development Lifecycle#Security Impact Analysis#Change Management

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CISA Practice