Pass the Isaca Isaca Certification CISA Questions and answers with CertsForce

The organization’s software inventory is not complete. This finding would be of greatest concern to an IS auditor assessing an organization’s patch management process because:

A software inventory is a list of all the software assets that an organization owns, uses, or manages. A software inventory is essential for effective patch management, as it helps identify the software that needs to be updated, the patches that are available, and the dependencies and compatibility issues that may arise. Without a complete software inventory, an organization may miss some critical patches, expose itself to security risks, and waste resources on unnecessary or redundant patches.

Applications frequently need to be rebooted for patches to take effect. This finding would be of moderate concern to an IS auditor assessing an organization’s patch management process because:

Rebooting applications for patches to take effect is a common and expected practice in some cases, especially for operating system or kernel patches. However, frequent reboots may indicate that the organization is not applying patches in a timely or efficient manner, or that the patches are not well-designed or tested. Frequent reboots may also cause disruption to the business operations and user experience, and increase the risk of data loss or corruption.

Software vendors are bundling patches. This finding would be of low concern to an IS auditor assessing an organization’s patch management process because:

Bundling patches is a practice where software vendors combine multiple patches into a single package or update. Bundling patches can have some advantages, such as reducing the number of downloads and installations, simplifying the patch management process, and ensuring consistency and compatibility among patches. However, bundling patches can also have some disadvantages, such as increasing the size and complexity of the updates, delaying the delivery of critical patches, and introducing new bugs or vulnerabilities.

Testing patches takes significant time. This finding would be of low concern to an IS auditor assessing an organization’s patch management process because:

Testing patches is a vital step in the patch management process, as it helps ensure that the patches are functional, secure, and compatible with the existing software and hardware environment. Testing patches can take significant time, depending on the scope, complexity, and frequency of the patches. However, testing patches is a necessary investment to avoid potential problems or failures that could result from applying untested or faulty patches.

IT disaster recovery time objectives (RTOs) are the maximum acceptable time that an IT system can be unavailable after a disaster before it causes unacceptable consequences for the business. IT RTOs should be based on the business-defined criticality of the systems, which reflects how important they are for supporting the business processes and functions. The maximum tolerable loss of data, the nature of the outage, and the maximum tolerable downtime (MTD) are also factors that affect the IT RTOs, but they are not the primary basis for determining them. 

 A preventive control is a control that aims to deter or prevent undesirable events from occurring. A fingerprint-based access control system for the building is an example of a preventive control for physical access, as it restricts unauthorized persons from entering the premises. Keeping log entries for all visitors to the building, installing CCTV cameras for all ingress and egress points, and implementing a centralized logging server to record instances of staff logging into workstations are examples of detective controls, which are controls that aim to discover or detect undesirable events that have already occurred.

The most effective method for positive authentication for physical access is a retina scan because it uses a biometric characteristic that is strongly tied to the individual and difficult to share, transfer, or replicate compared with cards, codes, or visual checks. ISACA materials discussing physical access and identity verification recognize biometrics such as retina scans as a high-assurance authentication mechanism.

Option B is correct because positive authentication means reliably confirming that the person presenting for access is truly the claimed individual. A retina scan verifies “something you are,” which is generally stronger than “something you have” or “something you know” for physical access authentication.

Option A is weaker because a proximity card is only possession-based authentication. It can be lost, borrowed, stolen, or shared, so it does not positively verify identity to the same degree as biometrics. This makes it less effective than a retina scan.

Option C is also weaker. A numeric keypad depends on a code that can be disclosed or observed, and a surveillance camera is more detective than authentication-focused. Together they do not provide the same strong identity binding as biometrics.

Option D improves assurance somewhat, but a smart card is still possession-based and a security guard’s judgment can be fallible. Human verification helps, but it does not usually match the direct individual-specific certainty of biometric authentication.

Therefore, B is the best answer because a retina scan most effectively provides positive authentication by directly verifying an individual’s unique biometric characteristic.

References (Official ISACA):

ISACA Journal, Against the Quantum Threat: Selective Compatibility — references retina and palm print scans being confirmed at each use to prevent identity theft.

ISACA News and Trends biometric authentication resources index.

This is because the auditor’s primary objective is to evaluate the adequacy and performance of the business continuity plan (BCP) in ensuring the continuity and resilience of the organization’s critical functions and processesduring a disruption. The auditor should review the actual results and outcomes of the business response, such as the recovery time, recovery point, service level, customer satisfaction, and incident management, and compare them with the predefined objectives and criteria of the BCP. The auditor should also identify and analyze any gaps, issues, or lessons learned from the business response, and provide recommendations for improvement12.

Answer A. Confirm the BCP has been recently updated. is not the best answer, because it is not directly related to the auditor’s course of action. Confirming the BCP has been recently updated is a part of the audit planning and scoping process, not the audit execution or reporting process. The auditor should confirm the BCP has been recently updated before conducting the audit, not after revealing that a simulation test has not been performed. Moreover, confirming the BCP has been recently updated does not provide sufficient evidence of the effectiveness of the business response12.

Answer C. Raise an audit issue for the lack of simulated testing. is not the best answer, because it is not relevant to the auditor’s course of action. Raising an audit issue for the lack of simulated testing is a part of the audit reporting and follow-up process, not the audit execution or evaluation process. The auditor should raise an audit issue for the lack of simulated testing after reviewing the effectiveness of the business response, not before or instead of doing so. Furthermore, raising an audit issue for the lack of simulated testing does not address the root cause or impact of the problem, nor does it provide any constructive feedback or guidance for improvement12.

Answer D. Interview staff members to obtain commentary on the BCP’s effectiveness. is not the best answer, because it is not sufficient to guide the auditor’s course of action. Interviewing staff members to obtain commentary on the BCP’s effectiveness is a part of the audit evidence collection and analysis process, not the audit evaluation or conclusion process. The auditor should interview staff members to obtain commentary on the BCP’s effectiveness as one of the sources of information, not as the only or main source of information. Additionally, interviewing staff members to obtain commentary on the BCP’s effectiveness may be subjective, biased, or incomplete, and may not reflect the actual performance or outcomes of the business response12.

Shadow IT often arises when approved software does not meet user requirements (Option D), leading employees to seek alternative solutions.

ISACA CISA Reference: IT governance frameworks stress the need for user-centric IT policies to mitigate shadow IT risks.

Risk Implication: Shadow IT introduces security vulnerabilities, compliance risks, and potential data breaches.

The primary purpose of performing a parallel run of a new system is to validate the new system against its predecessor. A parallel run is a strategy for system changeover where a new system slowly assumes the roles of the older system while both systems operate simultaneously. This allows for comparison of the results and outputs of both systems to ensure that the new system is working correctly and reliably. A parallel run can also help identify and resolve any errors, discrepancies, or inconsistencies in the new system before the old system is discontinued.

The other options are not the primary purpose of performing a parallel run of a new system. A. To train the end users and supporting staff on the new system. Training is an important part of system implementation, but it is not the main reason for doing a parallel run. Training can be done before, during, or after the parallel run, depending on the needs and preferences of the organization. B. To verify the new system provides required business functionality. Verifying the business functionality of the new system is part of user acceptance testing (UAT), which is a formal and structured process of testing whether the new system meets the specifications and expectations of the users and stakeholders. UAT is usually done before the parallel run, as a prerequisite for system changeover. C. To reduce the need for additional testing. Reducing the need for additional testing is not the primary purpose of performing a parallel run, but rather a possible benefit or outcome of doing so. A parallel run can help ensure that the new system is thoroughly tested and validated in a real-worldenvironment, which may reduce the likelihood of encountering major issues or defects later on. However, additional testing may still be needed after the parallel run, depending on the feedback and evaluation of the users and stakeholders.

 The advantage of using agile software development methodology over the waterfall methodology is that it allows for quicker deliverables. Agile software development is an iterative and incremental approach that emphasizes customer feedback, collaboration, and adaptation. Agile software development delivers working software in short cycles, called sprints, that typically last from two to four weeks. This enables the development team to respond to changing requirements, deliver value faster, and improve quality. Waterfall software development is a linear and sequential approach that follows a predefined set of phases, such as planning, analysis, design, implementation, testing, and maintenance. Waterfall software development requires a clear and stable definition of the project scope, deliverables, and expectations before starting the development process. Waterfall software development can be slow, rigid, and costly, especially if changes occur during the later stages of the project. References: CISA Review Manual (Digital Version), Chapter 3: Information Systems Acquisition, Development and Implementation, Section 3.1: Project Management Practices

 The type of control that is in place when an organization has established hiring policies and procedures designed specifically to ensure network administrators are well qualified is directive. Directive controls are those that guide or direct the actions of individuals or groups to achieve a desired outcome. Directive controls can also help to prevent or reduce the occurrence of undesirable events. Hiring policies and procedures are examples of directive controls that aim to ensure that only qualified and competent personnel are employed to perform IT-related tasks. References:

CISA Review Manual (Digital Version), Chapter 4, Section 4.11

CISA Online Review Course, Domain 1, Module 2, Lesson 12

The most effective way to identify exfiltration of sensitive data by a malicious insider is to establish behavioral analytics monitoring. Behavioral analytics is the process of analyzing the patterns and anomalies in user behavior to detect and prevent insider threats. Behavioral analytics can help identify unusual or suspicious activities, such as accessing sensitive data at odd hours, transferring large amounts of data to external devices or locations, or using unauthorized applications or protocols. Behavioral analytics can also help correlate data from multiple sources, such as network logs, user profiles, and access rights, to provide a holistic view of user activity and risk.

Data loss prevention (DLP) software is a tool that can help prevent exfiltration of sensitive data by a malicious insider, but it is not the most effective way to identify it. DLP software can block or alert on unauthorized data transfers based on predefined rules and policies, but it may not be able to detect sophisticated or stealthy exfiltration techniques, such as encryption, steganography, or data obfuscation.

Reviewing perimeter firewall logs is a way to identify exfiltration of sensitive data by a malicious insider, but it is not the most effective way. Perimeter firewall logs can show the traffic volume and destination of data transfers, but they may not be able to show the content or context of the data. Perimeter firewall logs may also be overwhelmed by the amount of normal traffic and miss the signals of malicious exfiltration.

Providing ongoing information security awareness training is a way to reduce the risk of exfiltration of sensitive data by a malicious insider, but it is not a way to identify it. Information security awareness training can help educate users on the importance of protecting sensitive data and the consequences of violating policies and regulations, but it may not deter or detect those who are intentionally or maliciously exfiltrating data.

Maintaining an onboarding and annual security awareness program is the best way to prevent social engineering incidents because it can educate the users about the common techniques and tactics used by social engineers and how to avoid falling victim to them. Ensuring user workstations are running the most recent version of antivirus software, including security responsibilities in job descriptions and requiring signed acknowledgment, and enforcing strict email security gateway controls are all good security practices, but they do not directly address the human factor that is exploited by social engineering. References:

ISACA, CISA Review Manual, 27th Edition, 2020, p. 3671

ISACA, CISA Review Questions, Answers and Explanations Database - 12 Month Subscription2

 The best way to ensure that a proper cutoff has been established to reinstate transactions and records to their condition just prior to a computer system failure is to use a database management system (DBMS) to dynamically back-out partially processed transactions. A DBMS is a software system that manages the creation, manipulation, retrieval, and security of data stored in a database. A DBMS can provide features such as transaction management, concurrency control, recovery management, and integrity management. A DBMS can dynamically back-out partially processed transactions by using mechanisms such as rollback segments, undo logs, or write-ahead logs. These mechanisms allow the DBMS to restore the database to a consistent state before the failure occurred. References:

CISA Review Manual (Digital Version)

CISA Questions, Answers and Explanations Database

 Data analytics can be used to compare data from different sources and identify any discrepancies or anomalies. In this case, comparing a population of loans input in the origination system to loans booked on the servicing system can help detect any errors or frauds in the loan origination process. The other options are not examples of data analytics, but rather controls for data integrity, reconciliation, and error handling. References: CISA Review Manual (Digital Version), Chapter 3, Section 3.3.2

 Scope creep is the uncontrolled expansion of a project’s scope, which can result in delays, cost overruns, and quality issues. To mitigate the risk of scope creep, an IS auditor should look for projectchange management controls, which are processes and procedures for managing changes to the project’s scope, schedule, budget, and quality. Project change management controls ensure that changes are properly requested, approved, documented, communicated, and implemented. Source code version control, existence of an architecture review board, and configuration management are also important for software development, but they do not directly address the risk of scope creep. References: ISACA Frameworks: Blueprints for Success, Project Management Institute: A Guide to the Project Management Body of Knowledge

Allowing only corporate IM solutions is the best control to mitigate the malware risk associated with an IM system, because it can prevent unauthorized or malicious IM applications from accessing the network and infecting the system with malware. Corporate IM solutions can also enforce security policies and standards, such as encryption, authentication, and logging, to protect the IM system from malware attacks. Blocking attachments in IM, blocking external IMtraffic, and encrypting IM traffic are also possible controls to mitigate the malware risk, but they are not as effective as allowing only corporate IM solutions. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.4.4

Controls related to authorized modifications to production programs are best tested by tracing modifications from the original request for change forward to the executable program, as this ensures that the change management process was followed and that the modifications were approved, documented, tested, and implemented correctly. Tracing modifications from the executable program back to the original request for change may not reveal any unauthorized or undocumented changes that occurred during the process. Testing only the authorizations to implement the new program or reviewing only the actual lines of source code changed in the program are not sufficient to test the controls related to authorized modifications, as they do not cover the entire change management process. References: CISA Review Manual (Digital Version), Chapter 4: Information Systems Operations, Maintenance and Service Management, Section 4.2: Change Management

 To confirm integrity for a hashed message, the receiver should use the same hashing algorithm as the sender’s to create a binary image of the file. A hashing algorithm is a mathematical function that transforms an input data into a fixed-length output value, called a hash or a digest. A hashing algorithm has two main properties: it is one-way, meaning that it is easy to compute the hash from the input, but hard to recover the input from the hash; and it is collision-resistant, meaning that it is very unlikely to find two different inputs that produce the same hash. These properties make hashing algorithms useful for verifying the integrity of data, as any change in the input data will result in a different hash value. Therefore, to confirm integrity for a hashed message, the receiver should use the same hashing algorithm as the sender’s to create a binary image of the file, which is a representation of the file in bits (0s and 1s). The receiver should then compare this binary image with the hash value sent by the sender. If they match, then the message has not been altered in transit. If they do not match, then the message has been corrupted or tampered with.

 The first step that an IS auditor should take when finding that a business impact analysis (BIA) has not been performed is to evaluate the impact on current disaster recovery capability. A BIA is a process that identifies and analyzes the potential effects of disruptions to critical business functions and processes. A BIA helps determine the recovery priorities, objectives, and strategies for the organization. Without a BIA, the disaster recovery plan may not be aligned with the business needs and expectations, and may not provide adequate protection and recovery for the most critical assets and activities. Therefore, an IS auditor should assess how the lack of a BIA affects the current disaster recovery capability and identify any gaps or risks that need to be addressed.

Performing a BIA, issuing an intermediate report to management, and conducting additional compliance testing are not the first steps that an IS auditor should take when finding that a BIA has not been performed. These steps may be done later in the audit process, after evaluating the impact on current disaster recovery capability. Performing a BIA is not the responsibility of the IS auditor, but of the business owners and managers. Issuing an intermediate report to management may be premature without sufficient evidence and analysis. Conducting additional compliance testing may not be relevant ornecessary without a clear understanding of the disaster recovery requirements and objectives.

The best guard against the risk of attack by hackers is encryption. Encryption is the process of transforming data into an unreadable format using a secret key or algorithm. Encryption can protect data in transit and at rest from unauthorized access, modification, or disclosure by hackers. Encryption can also ensure the authenticity and integrity of data by using digital signatures or hashes.

Tunneling, message validation, and firewalls are not the best guards against the risk of attack by hackers. Tunneling is a technique that encapsulates one network protocol within another to create a secure connection between two endpoints. Message validation is a process that verifies the format, content, and origin of a message before accepting it. Firewalls are devices or software that filter network traffic based on predefined rules. These controls may help reduce the exposure or impact of hacker attacks, but they do not provide the same level of protection as encryption.

Comprehensive and Detailed Explanation:

The primary audit concern is data integrity—ensuring that the data uploaded via the custom interface is accurately and completely transferred to the financial system.

Option A directly addresses data accuracy and integrity.

Option B (timing) is secondary compared to correctness.

Option C (malware checks) is important but handled by security controls, not the primary audit concern here.

Option D (duplex communication) is irrelevant to ensuring accurate financial records.

???? ISACA Reference: CISA Review Manual 27th Edition, Domain 3, section on interface controls and audit considerations.

 Leveraging an IT governance framework is the best way to enable alignment of IT with business objectives, as it provides a set of principles, standards, processes, and practices that guide the effective delivery of IT services that support the organization’s strategy and goals. Benchmarking against peer organizations, developing key performance indicators (KPIs), and completing an IT risk assessment are useful activities that can help measure and improve the performance and value of IT, but they are not sufficient to ensure alignment without a governance framework. References: CISA Review Manual (Digital Version), Chapter 1: Information Systems Auditing Process, Section 1.2: IT Governance

Segregation of duties (SoD) is a key internal control that aims to prevent fraud and errors by ensuring that no single individual can perform incompatible or conflicting tasks within a business process. SoD reduces the risk of unauthorized or improper transactions, manipulation of data, or misappropriation of assets.

In the accounts payable department, SoD involves separating the following functions: invoice processing, payment authorization, payment execution, and reconciliation. For example, the person who approves an invoice should not be the same person who issues the payment or reconciles the bank statement.

One of the best ways to ensure appropriate SoD within the accounts payable department is to restrict program functionality according to user security profiles. This means that each user of the accounts payable system should have a unique login and password, and should only have access to the functions that are relevant to their role and responsibilities. For instance, an invoice processor should not be able to approve payments or modify vendor records. This way, the system can enforce SoD and prevent unauthorized or fraudulent activities.

The other options are not as effective as restricting program functionality according to user security profiles. Restricting access to update programs to accounts payable staff only is a general access control measure, but it does not address the SoD issue within the accounts payable department. Including the creator’s user ID as a field in every transaction record created is a useful audit trail feature, but it does not prevent users from performing incompatible functions. Ensuring that audit trails exist for transactions is a detective control that can help identify and investigate any irregularities, but it does not prevent them from occurring in the first place.

The best course of action for a security administrator who is called in the middle of the night by the on-call programmer who needs access to the live system is to give the programmer an emergency ID for temporary access and review the activity. This is because:

Requiring that a change request be completed and approved may delay the resolution of the problem and cause further damage or disruption to the system or business operations. A change request is a formal document that describes the proposed change, its rationale, impact, benefits, risks, costs, and approval process. A change request is usually required for planned or scheduled changes, not for emergency or urgent changes.

Giving the programmer read-only access to investigate the problem may not be sufficient or effective, as the programmer may need to perform actions or tests that require write or execute permissions. Read-only access means that the user can only view or copy data or files, but cannot modify or delete them.

Reviewing activity logs the following day and investigating any suspicious activity may not prevent or detect any unauthorized or malicious actions by the programmer in real time. Activity logs are records of events and actions that occur within a system or network. Activity logs can provide evidence and accountability for system activities, but they are not proactive or preventive controls.

Therefore, giving the programmer an emergency ID for temporary access and reviewing the activity is the best course of action, as it allows the programmer to access the live system and resolve the problem quickly, while also ensuring that the security administrator can monitor and verify the programmer’s activity and revoke the access when it is no longer needed. An emergency ID is a temporary account that grants a user elevated privileges or access to a system or resource for a specific purpose and duration. An emergency ID should be:

Created and authorized by a security administrator or manager

Assigned to a specific user and purpose

Limited in scope and time

Logged and audited

Revoked and deleted after use

Some of the best practices for emergency access to live systems are12:

Establish clear policies and procedures for requesting, approving, granting, monitoring, reviewing, and revoking emergency access

Define criteria and scenarios for emergency access, such as severity, impact, urgency, and risk

Implement controls to prevent unauthorized or unnecessary use of emergency access, such as multifactor authentication, approval workflows, alerts, notifications, and time restrictions

Implement controls to track and audit emergency access activities, such as logging, reporting, analysis, and investigation

Implement controls to ensure accountability and responsibility for emergency access users, such as attestation, justification, documentation, and feedback

The auditor’s next action after finding that there is an informal unwritten set of standards in the IS department is to document and test compliance with the informal standards. This is because the auditor’s role is to evaluate the adequacy and effectiveness of the existing controls, regardless of whether they are formal or informal, written or unwritten. The auditor should also assess the risks and implications of having informal standards, such as lack of consistency, accountability, or traceability. The auditor should not make recommendations, postpone the audit, or finalize the audit without performing the audit procedures. References:

CISA Review Manual (Digital Version), Chapter 2, Section 2.21

CISA Online Review Course, Domain 1, Module 1, Lesson 12

A privacy protection policy is primarily intended to make personnel aware of the organization’s responsibilities and rules for handling personal information in accordance with applicable laws, regulations, and contractual obligations. ISACA privacy guidance consistently frames privacy as a compliance-driven and accountability-driven discipline, centered on the proper collection, use, storage, sharing, and protection of personal data under applicable legal requirements.

Option C is therefore the best answer because a privacy policy’s core purpose is not just technical protection, but ensuring that employees understand the legal and regulatory requirements governing personal information. ISACA notes that modern privacy programs are strongly shaped by regulations such as GDPR and similar laws, which impose explicit obligations on organizations that collect and process personal data. A privacy protection policy helps communicate those obligations internally.

Option A is incorrect because cybercrime awareness belongs more to a general information security awareness program than to the primary purpose of a privacy protection policy. Privacy and cybersecurity overlap, but privacy policy is specifically about lawful and proper handling of personal information, not general awareness of network-targeting crimes.

Option B is incorrect because encryption is only one possible control for protecting personal data. A privacy policy may mention encryption, but its primary purpose is broader: defining privacy obligations, rights, responsibilities, and compliance expectations. Technical controls support the policy; they are not the policy’s central awareness objective.

Option D is also incorrect because system configuration procedures belong to technical standards, baselines, or operating procedures. A privacy protection policy is a governance-level document that sets expectations regarding personal information protection and legal compliance, rather than detailing system configuration steps.

For CISA-style reasoning, when a question asks for the primary objective of a privacy policy, the best answer is the one that addresses the organization’s obligation to protect personal data in accordance with legal requirements. That makes C the strongest and most defensible answer.

References (Official ISACA):

ISACA Privacy Resource Center — privacy guidance focused on compliance and privacy program obligations.

ISACA, The Evolving World of Data Privacy: Trends and Strategies — discusses legal obligations such as GDPR requirements for personal data protection.

ISACA Privacy Notice — reflects the role of applicable law in handling personal data.

ISACA Journal, Creating a Compliant and Accountable Data Culture — emphasizes accountability and compliance in data privacy.

 The greatest benefit of adopting an international IT governance framework rather than establishing a new framework based on the actual situation of a specific organization is wide acceptance by different business and support units with IT governance objectives. An international IT governance framework, such as COBIT, provides a common language and understanding for IT governance among various stakeholders, such as management, users, auditors and regulators. This facilitates alignment, communication and collaboration among them. Readily available resources, comprehensive coverage and fewer resources expended are also benefits of adopting an international IT governance framework, but they are not the greatest benefit. References: CISA Review Manual (Digital Version) , Chapter 1, Section 1.3.1.

The best recommendation to mitigate the risk of data leakage from lost or stolen devices that contain confidential data is to configure them to auto-wipe after multiple failed access attempts, as this would prevent unauthorized access and erase sensitive information from the device. Requiring employees to attend security awareness training, password protecting critical data files, or enabling device auto-lockfunction are also good practices, but they may not be sufficient oreffective in preventing data leakage from lost or stolen devices. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.3

A web-based CRM system that is directly accessed by customers via the Internet should be hosted in a secure and isolated environment to protect it from external threats and unauthorized access. A web-based CRM system should also be reliable, trusted, and backedup regularly1.

Hosting the system on an external third-party service provider’s servers (A) or a hybrid-cloud platform managed by a service provider (B) may not be a concern for the auditor if the service provider has adequate security measures and service level agreements in place. The auditor should verify the security controls and contractual terms of the service provider before trusting them with the CRM data23.

Hosting the system within a demilitarized zone (DMZ) of a corporate network © is a common practice to provide an extra layer of security to the CRM system from untrusted networks, such as the Internet. A DMZ is a perimeter network that isolates the CRM system from the internal network and filters the incoming traffic from the external network using a security gateway4567.

Hosting the system within an internal segment of a corporate network (D) is a concern for the auditor because it exposes the CRM system and the internal network to potential attacks from the Internet. The CRM system should not be directly accessible from the Internet without a DMZ or a firewall to protect it. This could compromise the confidentiality, integrity, and availability of the CRM data and the internal network78.

 The only thing that can be provided by asymmetric encryption is nonrepudiation. Nonrepudiation is the ability to prove that a message or transaction was originated or authorized by a specific party. Asymmetric encryption uses a pair of keys: a public key and a private key. The public key can be shared with anyone, while the private key is kept secret by the owner. If a message is encrypted with the sender’s private key, only the sender’s public key can decrypt it. This proves that the message was sent by the sender and not by anyone else. This is called digital signature and it provides nonrepudiation. Asymmetric encryption can also provide information privacy by encrypting a message with the receiver’s public key, so that only the receiver’s private key can decrypt it. However, information privacy can also be provided by symmetric encryption, which uses a single key to encrypt and decrypt messages. References:

CISA Review Manual (Digital Version), Chapter 5, Section 5.21

CISA Online Review Course, Domain 3, Module 2, Lesson 12

This is the most effective way for the organization to improve its data classification processes and procedures, because data owners are the ones who are responsible for assigning the appropriate level of classification to the data they create, collect, or manage. Data owners should be aware of the data classification policy, the criteria for each level of classification, and the implications of misclassification. IT security staff can provide tailored training for data owners based on their roles, functions, and types of data they handle.

The other options are not as effective as having IT security staff conduct targeted training for data owners:

Use automatic document classification based on content. This is a possible option, but it may not be feasible or accurate for a small organization. Automatic document classification is a process that uses artificial intelligence or machine learning to analyze the content of a document and assign a class label based on predefined rules or models. However, this process may require a lot of resources, expertise, and maintenance, and it may not capture all the nuances and context of the data. The IS auditor should also verify the reliability and validity of the automatic document classification system.

Publish the data classification policy on the corporate web portal. This is a good practice, but it is not enough to improve the data classification situation. Publishing the data classification policy on the corporate web portal can increase the visibility and accessibility of the policy, but it does not ensure that data owners will read, understand, and follow it. The IS auditor should also monitor and enforce the compliance with the policy.

Conduct awareness presentations and seminars for information classification policies. This is a useful measure, but it is not the most effective one. Conducting awareness presentations and seminars can raise the general awareness and knowledge of information classification policies among all employees, but it may not address the specific needs and challenges of data owners. The IS auditor should also provide more in-depth and practical training for data owners.

 Write access to production program libraries presents the greatest risk when granted to a new member of the system development staff. Production program libraries contain executable code that runs on live systems and supports critical business functions. Write access allows a user to modify or delete existing programs, or add new programs to the library. If a user were to make unauthorized or erroneous changes to production programs, it could cause serious disruptions, errors, or security breaches in the organization’s operations. Therefore, writeaccess to production program libraries should be restricted to authorized personnel only, and subject to strict change management controls. 

The best recommendation to help prevent the situation where IT support staff were put in a position to make decisions beyond their level of authority during the review of a system disruption incident is to introduce escalation protocols. Escalation protocols are policies and procedures that define who should be notified, involved, or consulted when an incident occurs, how the communication and handover should take place, and what criteria or triggers should be used to escalate the incident to a higher level of authority or expertise2. Escalation protocols help to ensure that:

Incidents are handled by the appropriate staff with the required skills, knowledge, and experience

Incidents are resolved in a timely and effective manner

Incidents are escalated to senior management or specialized teams when necessary

Incidents are documented and reported accurately and transparently

Incidents are analyzed and learned from to prevent recurrence or mitigate impact

Therefore, by introducing escalation protocols, an organization can improve its incident management process and avoid putting IT support staff in a position to make decisions beyond their level of authority.

Reviewing the performance against service level agreements (SLAs) would best determine whether the service provider continues to meet the organization’s objectives, as SLAs define the expected level of service, quality, availability, and responsibilities of both parties. Assessment of the personnel training processes of the provider, adequacy of the service provider’s insurance, and periodic audits of controls by an independent auditor are important aspects of outsourcing, but they do not directly measure the performance of the service provider against the organization’s objectives. References: CISA Review Manual (Digital Version), Chapter 3, Section 3.5.2

 Antivirus software has been implemented on the guest operating system only is the observation that an IS auditor would consider the greatest risk when conducting an audit of a virtual server farm for potential software vulnerabilities. A virtual server farm is a collection of servers that run multiple virtual machines (VMs) on a single physical host using a software layer called a hypervisor. A guest operating system is the operating system installed on each VM. Antivirus software is a software program that detects and removes malicious software from a computer system. If antivirus software has been implemented on the guest operating system only, it means that the hypervisor and the host operating system are not protected from malware attacks, which could compromise the security and availability of all VMs running on the same host. Therefore, antivirus software should be implemented on both the guest and host operating systems as well as on the hypervisor. References: CISA Review Manual, 27th Edition, page 378

Reviewing and evaluating application test cases is the most effective use of an IS auditor’s time during the evaluation of controls over a major application development project. Application test cases are designed to verify that the application meets the functional and non-functional requirements and specifications. They also help to identify and correct any errors, defects, or vulnerabilities in the application before it is deployed. By reviewing and evaluating the test cases, the IS auditor can assess the quality, reliability, security, and performance of the application and provide recommendations for improvement. 

 The finding that should be of greatest concern to an IS auditor assessing the effectiveness of an organization’s vulnerability scanning program is that results are not reported to individuals with authority to ensure resolution. This indicates a lack of accountability and communication for vulnerability management, which may result in unresolved or delayed remediation of identified vulnerabilities. This may expose the organization to increased risk of cyberattacks or breaches. The other findings are also concerning, but not as much as this one, because they may affect the completeness, accuracy or timeliness of the vulnerability scanning process, but not necessarily its effectiveness. References:

ISACA, CISA Review Manual, 27th Edition, chapter 4, section 4.41

ISACA, COBIT 2019 Framework: Introduction and Methodology, section 3.2

Data analytics is the process of collecting, transforming, analyzing, and visualizing data to gain insights and support decision making1. Data analytics can be used to facilitate the testing of a new account creation process by applying various techniques and methods to evaluate the quality, functionality, performance, and security of the process. One of the approaches that would utilize data analytics to test the new account creation process is to review new account applications submitted in the past month for invalid dates of birth. This approach would involve the following steps:

Extract the data of new account applications from the source system, such as a database or a web service, using appropriate tools and methods.

Transform and clean the data to ensure its accuracy, completeness, consistency, and validity, using techniques such as data profiling, data cleansing, data mapping, and data validation2.

Analyze the data to identify any anomalies, errors, or outliers in the date of birth field, using methods such as descriptive statistics, exploratory data analysis, hypothesis testing, or anomaly detection3.

Visualize the data to present the findings and insights in a clear and understandable way, using tools and techniques such as charts, graphs, dashboards, or reports.

By reviewing new account applications submitted in the past month for invalid dates of birth, the tester can use data analytics to:

Verify if the new account creation process is working as expected and meets the business requirements and specifications for the date of birth field.

Detect any defects or issues in the new account creation process that may cause invalid dates of birth to be accepted or rejected incorrectly.

Measure and monitor the performance and reliability of the new account creation process in terms of data quality, accuracy, and completeness.

Evaluate and improve the test coverage and effectiveness of the new account creation process by identifying any gaps or risks in the test cases or scenarios.

Therefore, option C is the correct answer.

Option A is not correct because attempting to submit new account applications with invalid dates of birth is not a data analytics approach, but a functional testing approach that involves executing test cases or scenarios manually or automatically to validate the behavior and functionality of the new account creation process. Option B is not correct because reviewing the business requirements document for date of birth field requirements is not a data analytics approach, but a requirements analysis approach that involves examining and understanding the needs and expectations of the stakeholders for the new account creation process. Option D is not correct because evaluating configuration settings for date of birth field requirements is not a data analytics approach, but a configuration testing approach that involves verifying if the settings and parameters of the new account creation process are correct and consistent with the requirements.