nerdexam
Isaca

CRISC · Question #206

Which of the following is the MOST effective way 10 identify an application backdoor prior to implementation'?

The correct answer is C. Source code review. The most effective way to identify an application backdoor before implementation is through a comprehensive source code review.

Submitted by jakub_pl· Apr 18, 2026IT Risk Assessment

Question

Which of the following is the MOST effective way 10 identify an application backdoor prior to implementation'?

Options

  • AUser acceptance testing (UAT)
  • BDatabase activity monitoring
  • CSource code review
  • DVulnerability analysis

How the community answered

(47 responses)
  • A
    11% (5)
  • B
    4% (2)
  • C
    79% (37)
  • D
    6% (3)

Why each option

The most effective way to identify an application backdoor before implementation is through a comprehensive source code review.

AUser acceptance testing (UAT)

User acceptance testing (UAT) focuses on validating functional requirements from an end-user perspective and is not designed to uncover hidden malicious code or backdoors within the system's underlying logic.

BDatabase activity monitoring

Database activity monitoring tracks and logs interactions with a database during runtime, meaning it would only detect a backdoor if it were actively used post-implementation, not prior to deployment.

CSource code reviewCorrect

A source code review involves a detailed, line-by-line examination of the application's underlying code, which allows security professionals to directly uncover hidden functionalities, intentional malicious code, or backdoors that might not be detectable through black-box testing. This method provides the deepest insight into the application's true behavior before it is deployed.

DVulnerability analysis

Vulnerability analysis typically involves scanning for known vulnerabilities, misconfigurations, or common exploits, which might not detect a custom-developed or uniquely embedded backdoor that doesn't trigger known signatures.

Concept tested: Proactive backdoor detection via code review

Source: https://learn.microsoft.com/en-us/azure/security/develop/security-code-review

Topics

#Application Security#Secure SDLC#Code Review#Backdoor Detection

Community Discussion

No community discussion yet for this question.

Full CRISC Practice