An IS auditor performed tests to evaluate the readiness of developed software for implementation. Which of the following test results BEST indicates that the software meets security requirements?

The correct answer is C. Users can only perform tasks and functions assigned to their roles.. The ability of users to perform only tasks assigned to their roles demonstrates that role-based access control (RBAC) and the principle of least privilege are correctly implemented - a fundamental security requirement. Processing only required data types (A) relates more to funct

Submitted by andreas_gr· Apr 18, 2026Information Systems Acquisition, Development, and Implementation

Question

Options

AThe software processes only required data types.
BThe passwords meet both complexity and aging criteria.
CUsers can only perform tasks and functions assigned to their roles.
DUsers are required to utilize encrypted connections.

How the community answered

(33 responses)

A
9% (3)
B
3% (1)
C
82% (27)
D
6% (2)

Explanation

The ability of users to perform only tasks assigned to their roles demonstrates that role-based access control (RBAC) and the principle of least privilege are correctly implemented - a fundamental security requirement. Processing only required data types (A) relates more to functional correctness. Password complexity (B) is an authentication control, not a comprehensive security indicator. Encrypted connections (D) address transport security but not authorization, which is the broader and more critical security requirement in access governance.

Topics

#Software security#Role-Based Access Control#Authorization#Application security

Community Discussion

No community discussion yet for this question.

Full CISA Practice