Certified Information Systems Auditor CISA (CISA) — Questions 751–825

Continuous monitoring provides timely detection of control deficiencies, enabling faster remediation.

Inaccurate pay calculations (E) directly impact financial accuracy and employee trust, posing a high risk. User acceptance testing that did not cover all payroll scenarios (B) indicates that the system may have undiscovered defects, leading to potential operational failures and control weaknesses.

Data exfiltration often involves bypassing security controls by using unauthorized encryption or tunneling protocols (e.g., SSH over port 443, IPsec over UDP, or custom VPNs) to hide malicious traffic within legitimate-looking flows. Such protocols can encapsulate stolen data and evade deep packet inspection (DPI) or data loss prevention (DLP) systems, making them a strong indicator of exfiltration attempts.

External auditors are third-party and not employees, reducing bias and enhancing independence.

A work instruction is the most detailed document in the policy hierarchy, providing step-by-step guidance.

Role-based access control (RBAC) restricts data access to authorized users based on their roles, directly preventing unauthorized viewing or modification of data at rest. Transparent data encryption (TDE) encrypts the database files at the storage level, ensuring that even if the physical media is stolen, the data remains unreadable without the encryption keys. Both controls address the core requirement of protecting data while it is stored on the database server.

The right-to-audit clause allows the organization to audit the vendor's processes and performance, ensuring SLA compliance.

Re-performance provides direct evidence that a control is operating effectively.

Building a custom ETL script is a common and acceptable approach when legacy data formats are incompatible with a new ERP system. The key is that the script must undergo thorough testing and validation to ensure data integrity, completeness, and accuracy before migration. This balances the need for timely implementation with the risk of data corruption, which can be mitigated through rigorous quality assurance processes.

The incident revealed failures in DNS failover scripts (causing RTO breach) and database consistency checks (causing RPO breach). A full-scale test that includes DNS failover and database consistency validation is the only option that directly addresses both root causes, ensuring the DR plan meets the stated RTO of 2 hours and RPO of 15 minutes. Without such a test, the organization cannot verify that the failover process and data integrity mechanisms work as intended under realistic conditions.

Analytical procedures identify anomalies; the auditor should investigate the cause before concluding.

A mantrap, or dual-door interlocking system, is the most effective physical security control against tailgating because it physically isolates individuals in a small vestibule where both doors cannot be opened simultaneously. This forces authentication and verification for each person before the second door unlocks, preventing an unauthorized person from following an authorized individual through a single entry point.

The audit risk model consists of inherent risk, control risk, detection risk, and overall audit risk. Inherent risk is the risk of misstatement without controls, control risk is the risk controls fail, detection risk is the risk audit procedures miss misstatements, and audit risk is the risk of issuing an inappropriate opinion. Common confusions include swapping the definitions of inherent and control risks or misattributing detection risk to inherent risk.

The bucket policy explicitly grants `s3:GetObject` to `Principal: "*"` with `Effect: "Allow"`, which means any unauthenticated user on the internet can read objects in the bucket. This is a classic misconfiguration that leads to public read access, exposing sensitive data. While encryption and versioning are important security controls, the immediate and most severe risk is unauthorized data disclosure via public read.

COBIT defines enablers as factors that influence the effectiveness of governance. Processes, organizational structures, and culture/ethics/behavior are key enablers. Network infrastructure and application software are resources, not enablers in the COBIT framework.

Re-performance involves the auditor independently performing a control to verify its effectiveness. For access controls, independently adding a test user and verifying access rights is a re-performance.

In ITIL-based problem management, when a root cause is known but a permanent fix is unavailable, the known error should be documented in the Known Error Database (KEDB) and a workaround should be implemented to reduce incident impact and restore service. This aligns with the problem management process of controlling the error until a permanent solution (e.g., a patch or change) is deployed, ensuring operational continuity and minimizing recurrence of incidents.

Statistical sampling (attribute sampling) is appropriate when the auditor wants to draw a conclusion about the population's error rate with a specified confidence level.

A differential backup copies all data that has changed since the last full backup, regardless of any incremental backups taken in between. This approach reduces restore time because only the last full backup and the most recent differential backup are needed, unlike incremental backups which require the full backup plus every subsequent incremental in sequence.

Analyzing historical utilization trends allows IT to predict future capacity needs and plan upgrades before issues occur.

Without a well-defined definition of what constitutes an emergency, changes could be misclassified to bypass CAB scrutiny, weakening controls.

Statistical random sampling gives every item an equal probability of selection.

COBIT 2019 defines the governance objective as Evaluate, Direct, and Monitor (EDM), which is the board's responsibility.

Planning ensures the audit is focused on high-risk areas and resources are allocated appropriately.

Information classification is a foundational security process that assigns sensitivity labels (e.g., public, internal, confidential, restricted) to data assets. Its primary objectives are to determine the appropriate access controls and protection requirements for each classification level (Option B) and to ensure compliance with legal and regulatory requirements such as GDPR, HIPAA, or PCI DSS (Option D). These objectives directly drive the implementation of security controls like encryption, access control lists (ACLs), and data loss prevention (DLP) policies.

Basic authentication transmits credentials in Base64-encoded plaintext over the network, which is trivially decoded and captured by any attacker with access to the traffic. Even when used over HTTPS, the credentials are exposed in the browser's cache and server logs, making this the most significant weakness among the options.

Full-disk encryption (FDE) on the NAS would render the data unreadable without the decryption key, even if the physical device is stolen. Since the backup drive was also unencrypted and stored in the same location, both were equally vulnerable. FDE protects data at rest, which is the primary risk in a theft scenario where physical access is obtained.

End-of-life (EOL) operating systems no longer receive security patches from the vendor, leaving known vulnerabilities unmitigated. This directly increases the risk of security breaches because attackers can exploit these unpatched flaws. Additionally, many regulatory frameworks (e.g., PCI DSS, SOX) require timely patching of critical systems, so running EOL software constitutes non-compliance with those requirements.

Service level agreements (SLAs) define performance metrics and remedies for breaches, ensuring accountability. Audit rights allow the organization to verify the vendor's controls, which is essential for security and compliance.

The exhibit shows that multiple users are sharing a single privileged account (e.g., 'root' or 'admin') to perform administrative actions. Without unique user IDs for each administrator, it is impossible to map specific actions (e.g., a 'sudo' command or a configuration change) back to an individual. This lack of individual accountability is the core control weakness, as it violates the audit principle of non-repudiation and prevents effective forensic investigation.

APO focuses on strategic planning and alignment of IT with business objectives.

Job scheduling should include dependency management and failure alerts. The lack of an alert means the issue went unnoticed, potentially causing delays.

The segregation of duties (SoD) rule is a functional control that must be explicitly configured in the system's authorization or workflow engine. Since the requirement was documented in the functional specifications, the most likely cause is that the system was not configured to enforce the control, meaning the access control list (ACL) or role-based access control (RBAC) settings did not prevent the same user from both creating and approving a purchase order.

Limited scenarios mean the IR team may not be prepared for other types of incidents, such as data breaches or insider threats, which require different response procedures.

The root cause of the average reporting time exceeding the policy is likely a lack of awareness or skill in identifying and escalating incidents. Providing additional training directly addresses the human factor, improving staff ability to recognize security events and follow the one-hour reporting procedure, which is the most effective corrective action for a process gap.

ISO/IEC 38500 outlines six principles: responsibility, strategy, acquisition, performance, conformance, and human behavior.

A walkthrough involves tracing a transaction from initiation to completion, often combining inquiry, observation, and inspection.

Cleaning data only during extraction and not during loading means that any data quality issues introduced during the extraction process or that become apparent only after mapping to the target schema will not be caught. This creates a primary risk that data integrity issues—such as referential integrity violations, duplicate keys, or format mismatches—will remain undetected in the new ERP system, potentially corrupting business operations and reporting.

Segregation of duties conflicts are best addressed by designing and implementing role-based access controls tailored to the organization's processes.

The contract clause allowing the vendor to reuse developed code in other projects directly transfers ownership or licensing rights of the intellectual property (IP) to the vendor. This means the organization may lose exclusive control over the code, potentially allowing competitors to access proprietary logic or algorithms. The IS auditor's primary concern is safeguarding the organization's IP assets, as this loss can have long-term strategic and competitive implications.

When implementing a commercial off-the-shelf (COTS) system, the most important factor is alignment with business processes with minimal modification. COTS systems are designed to provide standardized functionality; extensive customization undermines the core benefits of reduced cost, faster deployment, and easier vendor support. Modifying the COTS codebase creates a 'forked' version that complicates patch management, increases testing overhead, and risks incompatibility with future vendor updates, directly contradicting the acquisition rationale.

The primary security concern is that traffic between the application and database servers is not encrypted. In a typical three-tier web architecture, sensitive data such as authentication credentials, SQL queries, and result sets are transmitted in cleartext if TLS/SSL is not enforced between the application layer and the database layer. This exposes the data to eavesdropping or man-in-the-middle attacks on the internal network, which is a direct violation of the principle of defense in depth and common compliance requirements like PCI DSS or HIPAA.

Creating test data that mirrors production data is a best practice because it ensures that the test environment closely reflects real-world data volumes, distributions, and edge cases. This approach helps uncover defects that might only appear under production-like data conditions, such as performance bottlenecks, data integrity issues, or boundary value errors. It also validates that the system handles the actual data formats and constraints it will encounter in production.

Assessing the effectiveness of compensating controls is appropriate to determine if the control deficiency is mitigated.

Version control systems (e.g., Git, SVN) allow developers to revert code to a previous commit or tag, enabling recovery from bugs or regressions. This rollback capability is a core feature that preserves the history of the codebase and supports safe experimentation.

Service level management ensures that the outsourcer's performance is monitored against agreed-upon metrics.

Service organization control (SOC) reports are independent audits of control effectiveness, highly regarded by regulators. Internal audit reports are valuable but may lack independence; risk register and balanced scorecard are not direct evidence of control effectiveness.

A post-implementation review assesses whether the system meets its objectives and identifies lessons learned.

The most suspicious because it indicates a remote interactive logon (Logon Type 10) from IP 192.168.10.50 using NTLM authentication. Remote interactive logons from unfamiliar IP addresses, especially when using older protocols like NTLM, may indicate an unauthorized remote desktop (RDP) attempt. Option A (Negotiate package) is standard for domain authentication; Option B (logoff) is a normal event; Option D shows a logon from a known workstation (WS-FINANCE) on a different subnet, which is less suspicious than an unknown remote IP.

Implementation is a standard phase in the SDLC where the designed system is built, coded, and deployed into the production environment. This phase follows design and precedes testing and maintenance, ensuring the solution is operational and meets the specified requirements.

GDPR mandates that personal data of EU citizens must not be transferred to countries without adequate protection unless specific safeguards are in place. Implementing data residency controls ensures that EU personal data is stored and processed only within the EU, preventing inadvertent replication to non-EU jurisdictions via AD replication. This directly addresses the DPO's concern by enforcing geographic boundaries on data storage and processing.

Management authorization (A) is essential because it ensures that only approved changes are implemented, preventing unauthorized modifications that could introduce security vulnerabilities or operational disruptions. A documented change request (B) provides an audit trail and formal record of what was changed, why, and by whom, which is critical for accountability and traceability in the change management process.

Unsupported software no longer receives security patches, increasing vulnerability risk. It also may cause compatibility issues with other systems. Additionally, it may lead to non-compliance with regulations that require supported software.

Architecture review ensures the system design meets security requirements, and threat modeling identifies potential threats and vulnerabilities early. Both are proactive security controls in the design phase.

P1 incidents are critical and require immediate response, typically within minutes, not hours.

The root cause is a deficient UAT process, not just a missing requirement. A formal UAT process with representatives from all regions and a statutory requirements checklist would have caught the country-specific reporting need before go-live. As an IT auditor, recommending process improvements for future rollouts addresses the systemic control weakness, which is more effective than blaming individuals or accepting risk without remediation.

The primary risk is that test transactions may be processed as real transactions if the CAAT does not properly isolate them from the production environment. This could result in unintended data corruption, financial misstatements, or operational disruptions. The auditor must ensure that test data is clearly flagged or run in a separate test environment to avoid integration with live processing.

When expected benefits fall significantly below initial estimates, the IS auditor should recommend re-evaluating the feasibility study and updating the business case. This ensures that the project's justification is based on current, accurate data before proceeding, which is a key control in the systems development lifecycle (SDLC) to prevent investment in a project that may no longer deliver adequate value.

A risk-based approach prioritizes areas with highest risk, efficient for limited resources.

The Human Behaviour principle requires that IT policies respect human behavior and include training and awareness to ensure compliance.