Certified Information Systems Auditor CISA (CISA) — Questions 826–900

Availability = MTBF / (MTBF + MTTR) = 720 / (720 + 4) = 720/724 ≈ 0.9945, or 99.45%.

The IT balanced scorecard typically includes four perspectives: financial, customer, internal process, and learning & growth. Financial and customer are two of these. Security and vendor management are not standard perspectives.

Walkthroughs and control testing are performed during fieldwork, where the auditor executes planned audit procedures.

During the audit planning phase, the primary objectives are to define the audit scope and objectives (Option E) and to identify and assess risks relevant to the audit (Option B). This sets the foundation for the entire audit engagement, ensuring resources are focused on high-risk areas and that the audit is aligned with organizational goals. Detailed procedures are developed later, and testing controls or issuing reports occur in subsequent phases.

The core issue is the lack of timely notification, not the number of retries or the dependency logic itself. The job scheduler correctly identified the dependency failure and attempted reruns, but the operations team remained unaware until the next morning. Implementing real-time alerts for job failures and dependency issues (Option B) ensures that the operations team can intervene immediately, rather than discovering the problem hours later during a manual check.

Availability is calculated as MTBF / (MTBF + MTTR). With MTBF = 500 hours and MTTR = 20 hours, availability = 500 / (500 + 20) = 500 / 520 ≈ 0.9615, or 96.15%. This formula measures the proportion of time the system is operational, directly reflecting its resilience and recoverability.

Analytical procedures involve evaluations of financial information through analysis of plausible relationships.

A clear escalation path (C) ensures incidents are reported to the right stakeholders for timely decision-making, while predefined communication templates (E) enable rapid and consistent notifications to internal and external parties. These are directly used during incident response. Post-incident reviews (A) are important but not a key element of the plan itself; software licenses (B) and hardware serial numbers (D) are asset management details, not incident response essentials.

A realistic project schedule with milestones (Option B) is the best method because it establishes a time-phased plan with measurable checkpoints, enabling early detection of delays and facilitating proactive corrective actions. Without a realistic baseline, even the best tracking tools or meetings cannot prevent schedule overruns, as the schedule itself is the foundation for monitoring and controlling project progress.

Data migration without reconciliation can cause undetected data corruption or loss, impacting financial reporting and operations.

Regular license compliance audits ensure proper licensing. Reconciliation of installed software with purchased licenses identifies gaps or over-licensing.

It uses TLS (the modern, secure successor to SSL) to encrypt data in transit, ensuring confidentiality and integrity during network communication, and AES-256, a strong symmetric encryption standard, to encrypt data at rest. This combination directly satisfies the mandate for encryption both in transit and at rest, as TLS protects against eavesdropping and tampering on the wire, while AES-256 protects stored PHI from unauthorized access if the device is lost or compromised.

Outsourcing software development often results in quality issues due to the client's limited visibility into the vendor's development processes, testing rigor, and adherence to coding standards. Without direct oversight, defects may go undetected until later stages, increasing rework costs and project delays.

Using a single key for all data increases the impact of key compromise. If the key is compromised, all data becomes accessible. Key management should include key rotation and different keys for different data sets.

The hot site must be compatible with the production environment to enable quick recovery.

Exception management allows controlled deviations from policy when required, while ensuring accountability and documentation.

A formal ITSM framework like ITIL explicitly focuses on aligning IT service delivery with business objectives through defined processes like service strategy and service design. This alignment ensures that IT investments and operations directly support business outcomes, such as improving customer satisfaction or enabling new revenue streams, rather than operating in a silo.

The gap between high training completion and poor phishing test results indicates that the training content is not effective in changing behavior. The auditor should recommend reviewing and improving the training to address weaknesses.

The primary benefit of a chargeback model is that it increases business unit accountability for IT spending. By directly allocating IT costs to the consuming departments based on actual usage (e.g., compute hours, storage GB, network bandwidth), business units are incentivized to optimize their consumption and make cost-conscious decisions. This aligns IT expenditure with business value and promotes transparency, rather than treating IT as a sunk cost.

Mandatory training for all employees ensures that every user understands their security responsibilities, recognizes threats like phishing, and follows organizational policies. This is a foundational element of an awareness program as defined by frameworks such as NIST SP 800-50, which emphasizes that awareness and training must be tailored to roles and delivered to all personnel. Without mandatory participation, coverage gaps leave the organization vulnerable to social engineering and policy violations.

A risk-based approach focuses on areas with higher inherent risk and weaker controls to maximize effectiveness.

Automated logging of all code changes (D) best supports auditability in a DevOps environment because it provides an immutable, timestamped record of every change made to the codebase, including who made the change, what was changed, and when. This aligns with the principle of continuous audit, where every deployment artifact is traceable through the CI/CD pipeline, enabling compliance with standards like SOC 2 or ISO 27001. Unlike manual processes, automated logging ensures no change goes unrecorded, which is critical for forensic analysis and regulatory audits.

In small organizations, segregation of duties may be limited, so the auditor should place greater reliance on detective and compensating controls.

COBIT 2019 uses the evaluate-direct-monitor (EDM) governance objective for governance of enterprise IT.

Internal auditors are employees of the organization, which may create independence concerns, while external auditors are independent third parties.

Availability = MTBF / (MTBF + MTTR) = 200 / 220 ≈ 0.9091, or 90.91%.

Strategic alignment of IT with business is a core component of an IT governance framework because it ensures that IT initiatives directly support and enable the organization's business objectives and strategies. This alignment is achieved through mechanisms like balanced scorecards and IT steering committees, which prioritize IT investments based on business value. Without this component, IT may operate in a silo, leading to wasted resources and missed opportunities.

Testing in a pre-production environment is essential to identify issues before deployment.

Observation and re-performance are both types of evidence; inquiry is also a type, but the question asks for TWO. The correct pair is observation and re-performance.

The DRP states an RTO of 4 hours for the transactional database, but the full backup transfer time over the 10 Mbps WAN link is approximately 12 hours. Since the backup must be restored before the database can be made available, the RTO cannot be met. This is the most critical finding because it directly invalidates a core recovery objective, regardless of whether the plan has been tested.

Audit rights allow the organization to review the vendor's controls and operations, which is essential for assurance.

SMART stands for Specific, Measurable, Achievable, Relevant, Time-bound. Vague and rigid are not desirable.

A change in vendor ownership can affect the contractual relationship and service delivery. The auditor should focus on whether the contract allows assignment (without consent) and whether the new owner's financial stability poses a risk.

An operational audit focuses on efficiency and effectiveness of operations.

Client-side encryption with customer managed keys ensures that data is encrypted before it leaves the client environment, and the cloud provider never has access to the plaintext data or the encryption keys. Even if the cloud provider's infrastructure is fully compromised, the attacker cannot decrypt the data because the keys are never stored or processed by the provider. This provides the strongest assurance of confidentiality because the data remains encrypted end-to-end, independent of the provider's security controls.

RAID 5 provides fault tolerance with parity, allowing recovery from a single disk failure.

The project is over budget (EV $500K vs AC $600K) and behind schedule (EV $500K vs PV $550K). Before taking corrective action, the project manager must first perform a root cause analysis to understand why costs are exceeding planned values. This aligns with the CISA’s emphasis on identifying the underlying cause of variances before implementing changes to scope, budget, or schedule.

System testing is a formal, structured process that validates the entire integrated system against its specified requirements. The primary goal is to confirm that the system behaves as defined in the functional and technical specifications, ensuring that all requirements are correctly implemented before user acceptance testing. While user satisfaction and defect removal are important, they are secondary to verifying requirement compliance, which is the core objective of system testing.

The classification level of a data asset is determined by its sensitivity and criticality to business operations because these factors directly drive the required confidentiality, integrity, and availability controls. For example, personally identifiable information (PII) or financial transaction records require higher classification due to regulatory mandates (e.g., GDPR, PCI DSS) and the potential for severe business impact if compromised. Cost, format, or location are secondary attributes that do not inherently define the risk profile or protection needs of the data.

Follow-up includes verifying that management has implemented corrective actions and assessing their effectiveness.

Iterative development requires continuous stakeholder involvement, version control, and risk assessment each iteration. These controls ensure the evolving system meets requirements and manages risks.

A primary objective of a BCP is to ensure that the organization can continue to meet legal and regulatory obligations during a disruption. This includes maintaining required data protection, reporting, and operational standards as mandated by regulations such as GDPR, HIPAA, or SOX, even when normal operations are impaired.

The best evidence because a user access review report signed by department managers provides documented confirmation that the assigned access rights have been explicitly verified and approved by the data owners. This is a detective control that directly validates the appropriateness of access assignments, whereas the other options are either preventive or detective controls that do not confirm the correctness of the rights themselves.

The correct action is to monitor SLA compliance and enforce penalties or require corrective action. This ensures the vendor meets contractual obligations.

IT governance policies require that BCPs remain current to reflect actual operational processes. An outdated BCP (three years stale) may contain obsolete recovery procedures, contact information, or dependencies, rendering it ineffective during a real incident. Updating the BCP and then testing it validates that the documented steps align with the current system architecture and can be executed successfully, which is a core requirement of the BCP lifecycle per ISACA guidelines.

Mantraps are specifically designed to prevent tailgating by allowing only one person at a time. Security awareness training educates employees on the risks of tailgating. Increasing camera coverage and PIN complexity do not directly prevent tailgating.

The primary concern is that the CAB approved a 'normal' change without adequately assessing its potential impact, leading to a major service outage. In ITIL-based change management, the CAB is responsible for evaluating the risk, impact, and resource requirements of a change before approval. A failure in this assessment indicates a breakdown in the change management process, which is the core issue an IS auditor must address.

ITIL 4 has seven guiding principles, including 'Focus on value' and 'Start where you are'.

Enterprise strategy determines the governance objectives and risk appetite, making it the most critical design factor. Options A, B, and C are all important but secondary; they influence the system but are driven by strategy.

When IT strategy is aligned with business strategy, every IT investment is directly tied to achieving specific business objectives, such as increasing revenue, improving customer experience, or enabling new business models. This alignment ensures that resources are allocated to projects that deliver measurable business value, rather than being spent on technology for its own sake. The primary benefit is therefore the increased value of IT investments to business objectives, as misalignment often leads to wasted expenditure on systems that do not support core business goals.

An operating system that has reached end-of-life (EOL) no longer receives security patches from the vendor. Without compensating controls, any newly discovered vulnerabilities remain unpatched, exposing the organization to exploitation, data breaches, and system compromise. This directly undermines the confidentiality, integrity, and availability of the IT assets, making unpatched security vulnerabilities the greatest risk.

Internal audits are performed by employees of the organization, which can create independence issues. External audits are conducted by third parties.

Firewall rule configuration begins with policy, then specifics, action, application, and testing.

An incident response policy is a documented set of procedures that defines roles, responsibilities, and steps to be taken when a security incident occurs. This is an administrative control as it governs human behavior and organizational processes, not technology. It aligns with the CISA domain of Protection of Information Assets by establishing a framework for detecting, responding to, and recovering from security events.

If the audit team lacks necessary expertise, the auditor should engage a specialist or subject matter expert to ensure audit quality.

A right to audit the vendor's controls (Option B) is essential for ensuring that the cloud-based HR system's security and operational controls are functioning as agreed. This contractual clause allows the organization to verify compliance with policies, regulations, and the vendor's own security assertions, such as SOC 2 Type II reports or ISO 27001 certifications, through direct examination or independent third-party assessments.

In an IaaS public cloud, the customer retains responsibility for securing the network layer, including virtual firewalls. Security groups (stateful) and ACLs (stateless) are the primary mechanisms to enforce least-privilege network access, which directly protects data from unauthorized exposure over the network. This aligns with the shared responsibility model where the provider secures the physical infrastructure, but the customer must control traffic to their instances.

SAST analyzes source code for vulnerabilities early in the SDLC, allowing remediation before deployment.

The project manager must follow the formal change control process to evaluate the impact of a scope change that lacks additional budget. Escalating to the steering committee is appropriate because they have the authority to approve or reject changes that affect project constraints, ensuring alignment with organizational governance and IT strategy.

Full backups every day consume large amounts of storage and time; incremental backups are more efficient.

Client-side encryption with a customer-managed key vault ensures data is encrypted before it leaves the client environment, so the cloud provider never has access to plaintext or the encryption keys. This satisfies both at-rest and in-transit encryption requirements while giving the organization full control over key management, unlike server-side options where the provider manages at least part of the key lifecycle.

Exceptions must be approved by appropriate management and documented with a defined expiration date to prevent permanent deviations.

Effective key management includes secure key storage (e.g., HSM) and regular key rotation to limit exposure. Key escrow is not a standard requirement, and distributing keys with data increases risk. Using a single key for all data violates best practices.

In agile, security requirements should be included in user stories and tested during the sprint. Accepting a user story only after successful testing ensures security is validated.