Certified Information Systems Auditor CISA (CISA) — Questions 901–975

Segregation of duties ensures that no single individual has control over conflicting tasks, reducing fraud risk.

C is correct because the IS auditor must first conduct a risk assessment of the ERP implementation to identify and prioritize the critical controls specific to the new system. This step ensures that the audit scope is aligned with the highest risks, such as segregation of duties conflicts, interface integrity, and configuration vulnerabilities, before any detailed planning occurs.

Impact analysis (B) is essential because it evaluates the potential effects of a proposed change on system functionality, security, and performance before implementation. This ensures that risks are identified and mitigated, preventing unintended disruptions to production environments. Without impact analysis, changes could introduce vulnerabilities or cause system outages, violating IT governance principles.

Recovery site types are categorized by readiness: hot sites have full replication, warm sites have partial, cold sites have only infrastructure. Common confusions include equating warm with hot or cold.

In DevOps, automated security scanning, infrastructure as code with security review, and continuous monitoring are key controls to integrate security into the pipeline.

In a COTS ERP system with significant customizations, allowing the system administrator to modify both configuration and production data violates the principle of segregation of duties (SoD). This creates a risk of unauthorized or undetected changes, as the same individual can alter system configurations and then manipulate production data to conceal the impact, bypassing audit trails and controls.

A centralized IT structure consolidates IT functions in a central unit, while a decentralized structure distributes IT across business units. A hybrid (federated) structure combines aspects of both, with some functions centralized and others decentralized.

Developers having direct production database access violates the principle of segregation of duties and poses a significant risk of unauthorized data modification, deletion, or exfiltration. In a well-controlled SDLC, production access should be restricted to operations or DBA teams, with changes promoted through automated deployment pipelines. This finding directly undermines data integrity and confidentiality controls.

Shared accounts make it impossible to attribute actions to specific individuals. Implementing individual accounts with privilege escalation (e.g., sudo) allows for accountability and detailed audit trails.

The core issue is that backup tapes contain sensitive data and are stored in an uncontrolled environment. Encrypting the tapes before transport ensures that even if the physical security of the offsite facility is compromised, the data remains confidential. This directly addresses the risk of unauthorized access to the data, which is the primary concern, and is a cost-effective, immediate control that does not disrupt operations.

Centralized IT allows for greater control, standardization, and economies of scale.

The plan is outdated (two years), the last test was only tabletop (not sufficient for a hot site), and the new ERP system is not reflected in the plan. These three issues directly impact the ability to recover effectively.

Regular restore verification tests confirm that backups can be successfully restored. This is a key control to ensure backup integrity.

A change request should include justification and an impact analysis to assess risks and benefits before approval.

Centralized endpoint management (e.g., Microsoft Intune, SCCM, or a third-party MDM) allows administrators to enforce full-disk encryption (such as BitLocker or FileVault) via policy, automatically encrypting non-compliant laptops and preventing users from disabling encryption. This is the most effective corrective action because it addresses the root cause—lack of enforcement—rather than relying on user action or manual processes.

The product backlog contains user stories, including security-related stories. Reviewing them shows whether security requirements are explicitly included.

Privilege creep occurs when an employee accumulates access rights over time, often due to role changes or lateral moves, without corresponding removal of previous permissions. In RBAC, overlapping role permissions can cause this condition when old role memberships are not revoked, leading to excessive entitlements that violate the principle of least privilege.

Sample size is influenced by desired confidence, tolerable error rate, and expected error rate.

The unique constraint violation on REF_NUM indicates that the batch job is attempting to insert a row with a REF_NUM value that already exists in the ACCT_TRANS table. This occurs when the job is not idempotent—meaning it does not check for or handle previously processed transactions—and re-processes the same data, leading to duplicate key errors.

In the spiral model, each cycle includes risk analysis; documented risk assessments in iteration artifacts demonstrate this.

Multi-factor authentication (MFA) mitigates the risk of password sharing because even if credentials are shared, an attacker cannot authenticate without the second factor (e.g., a one-time passcode from a hardware token or authenticator app). MFA decouples authentication from a single shared secret, making shared passwords insufficient for access. This directly addresses the root cause—reliance on passwords alone—rather than attempting to prevent sharing behavior.

Detection risk is the risk that audit procedures fail to detect material misstatements. With low control risk, the auditor may rely on controls and reduce substantive testing, affecting detection risk.

The primary concern for an IS auditor is that the vendor selection process lacked due diligence, as this directly violates the principle of proper acquisition governance. By selecting a vendor based solely on lowest price without evaluating financial stability and support history, the company exposed itself to significant operational risk, which materialized when the vendor declared bankruptcy. This oversight is a root cause failure in the information systems acquisition and implementation process, making it the most critical audit finding.

The IT steering committee is a senior-level governance body responsible for aligning IT strategy with business objectives. Monitoring IT performance and value delivery (A) is a key responsibility because the committee must ensure that IT investments generate the expected business benefits and that service levels meet agreed targets. Prioritizing IT projects and allocating resources (D) is also a core duty, as the committee decides which initiatives receive funding and staffing based on strategic importance and risk, rather than operational urgency.

Tokenization replaces sensitive data (e.g., credit card numbers) with a non-sensitive placeholder (token) that has no exploitable value. This technique is commonly used in cloud environments to reduce the scope of compliance (e.g., PCI DSS) because the token can be stored and processed without exposing the original sensitive value, even if the cloud storage is compromised.

Developing forensic procedures ensures proper evidence collection, and regular tabletop exercises improve team readiness. While backup restoration and malware analysis are important, the highest priority is to address the identified gaps in forensics and preparedness.

P1 incidents are critical and require immediate response to restore service. The service desk should assign the incident to the appropriate support team without delay.

The right-to-audit clause in the contract gives the organization legal authority to examine all relevant records, including those from subcontractors. Escalating to the vendor management team is the correct first step because they can enforce the contractual obligation without prematurely escalating to termination. This preserves the business relationship while asserting the organization's audit rights over the entire outsourced environment, including subcontracted network security operations.

Follow-up ensures that management has taken corrective actions to address the findings and that the risks have been mitigated.

In agile, including security requirements in the product backlog ensures they are prioritized and addressed in each sprint.

Immediate revocation of access rights upon termination is the most critical control to prevent unauthorized access.

Human error is significantly higher under stress, which can cause delays and mistakes. Other options are not primary risks.

A is correct because a risk assessment report must identify critical assets and their vulnerabilities to establish the scope and basis for risk analysis. Without this, the report cannot prioritize which systems require immediate attention or justify subsequent control recommendations.

Without a known error database (KEDB), incident resolution relies on ad-hoc troubleshooting rather than leveraging documented root causes and workarounds. This directly increases the mean time to resolve (MTTR) incidents because support teams cannot quickly identify and apply previously identified fixes, leading to longer outages and reduced operational efficiency.

COBIT 2019 defines seven components of a governance system: Processes, Organizational Structures, Principles, Policies and Frameworks, Culture, Ethics and Behavior, Information, Services, Infrastructure and Applications, and People, Skills and Competencies. Options A, C, and D are all valid components. Option B (Service level agreements) is not a component.

Storing backup media in the same building as the primary system creates a single point of failure. A disaster that destroys the primary site would also destroy the backups, making recovery impossible and violating both the RTO and RPO. In contrast, options B, C, and D represent operational gaps that can be addressed through process improvements, but none pose as fundamental a threat to the recoverability of the application as the lack of off-site storage.

In-house development carries a higher risk of project delays and budget overruns due to unforeseen technical challenges, scope creep, and resource constraints. This is a well-known risk in custom development projects.

The best indicator because it directly measures the program's outcome: a reduction in security incidents caused by human error. While training completion, policy acknowledgment, and quiz scores measure activity or knowledge, they do not confirm that employees have changed their behavior. A downward trend in human-error-related incidents provides empirical evidence that the awareness program is effectively influencing employee actions in real-world scenarios.

Normal changes require CAB approval because they have a higher risk and impact, unlike pre-approved standard changes or emergency fast-track changes.

Regulatory compliance requirements (Option B) are a key consideration because the chosen methodology must support necessary audit trails, documentation, and control frameworks (e.g., SOX, HIPAA, PCI DSS). A methodology like Waterfall provides rigid phase-gate documentation, while Agile may require adaptation (e.g., SAFe) to satisfy compliance evidence demands. Failure to align methodology with regulatory needs can lead to non-compliance findings during a CISA audit.

Establishing a Project Management Office (PMO) provides standardized project management practices, oversight, and governance, addressing delays and overruns. Agile methodology alone may not provide governance; increasing staff or outsourcing may not solve underlying issues.

UAT ensures user acceptance, and security testing (e.g., DAST) identifies vulnerabilities before deployment.

The amount of data lost (actual vs. RPO) directly measures whether the recovery process met the Recovery Point Objective. This metric validates the effectiveness of backup frequency and replication lag, which is critical for determining if the DR plan preserved data integrity within acceptable loss limits.

The auditor's first responsibility upon discovering a deviation from the organization's systems development methodology is to report the finding and assess the impact on internal controls. This aligns with ISACA's audit standards, which require auditors to evaluate whether the deviation introduces risks to data integrity, security, or project governance. Without this assessment, the auditor cannot determine the severity of the non-compliance or recommend appropriate corrective actions.

Clearly defining business requirements before issuing the RFP is the most critical factor because it ensures that the ERP system will align with the organization's operational needs, processes, and data flows. Without a precise requirements definition, the RFP will lack the necessary evaluation criteria, leading to mismatched vendor proposals, scope creep, and potential project failure. This step directly impacts the success of the acquisition, as it forms the foundation for all subsequent vendor evaluation and contract negotiations.

Firewalls are preventive controls that block unauthorized access, IDS are detective controls that monitor and alert, and data backups are corrective controls that restore data after loss. The distractors swap these definitions.

In a waterfall methodology, changes after the coding phase require a formal change control process to assess impact on cost, schedule, and scope. The correct answer is A because submitting a change request to the change control board (CCB) ensures that the 200-hour effort, two-month delay, and budget overrun are evaluated against business priorities, maintaining project governance and auditability. This aligns with ISACA’s guidance on managing scope creep in systems development.

Continuing the rollout while a data integrity issue exists could affect more users. Best practice is to halt the rollout until the issue is resolved and patched, to prevent further impact and ensure the fix is effective.

Synchronous replication with write-back caching provides near-zero data loss while managing performance impact. Asynchronous replication may have higher latency, daily backups exceed RPO, and hourly snapshots are insufficient.

The SLA should define performance metrics (uptime) and data ownership/portability to ensure business continuity and data control. Audit rights are also important but are often in a separate clause.

HSRP requires that both routers participating in the same virtual IP address use the same group number to form a single HSRP group. If the group numbers on the two interfaces do not match, each router will form its own separate HSRP group, and neither will recognize the other as a peer. Consequently, when the primary router fails, the DR router does not assume the active role because it is not part of the same HSRP group.

Architecture review by a senior architect is a key control during the design phase because it ensures the system's high-level structure aligns with security, scalability, and business requirements before development begins. This review catches design flaws early, reducing costly rework and preventing architectural weaknesses that could be exploited later. It is a formal gate in the SDLC that validates the design against established patterns and standards.

Risk assessment begins with asset identification, then threat/vulnerability identification, followed by risk analysis, prioritization, and documentation of treatment.

Audit rights ensure the organization can verify vendor controls and compliance, which is critical for outsourcing.

An information security policy sets the high-level direction and principles for the security program, outlining management's commitment and expectations.

Device control software (e.g., endpoint DLP or USB whitelisting tools) operates at the OS kernel or driver level to enforce a hardware ID or vendor ID allowlist, blocking any USB device not explicitly approved. This is the only option that provides a preventive, automated, and continuous control against unauthorized USB connections, regardless of user behavior or physical access.

Alternate facilities and data backup and recovery are essential components of BC strategy.

Regular restore tests (e.g., quarterly) are the only way to validate that backup data can actually be recovered and that the recovery procedures work as intended, which directly ensures recoverability. Option E is correct because storing backups offsite protects against site-level disasters (fire, flood, physical theft) that could destroy both primary data and on-site backups, ensuring data can be recovered from a separate location.

Observation of processes being performed (Option B) is an acceptable audit evidence-gathering technique because the auditor directly witnesses the execution of controls or procedures, providing firsthand evidence of their operation. This method is particularly valuable for assessing the effectiveness of manual controls or physical security measures, as it allows the auditor to verify that the process is performed as documented and to identify any deviations in real-time.

Re-performance and observation provide direct evidence; re-performance shows the control works, and observation provides witness of execution.

Analytical procedures involve comparisons of data to expectations, such as comparing current-year data to prior-year data to identify unusual fluctuations.

The standard audit process phases are planning, fieldwork, reporting, and follow-up. Risk assessment is part of planning, and testing is part of fieldwork.

Comparing user access rights directly against job descriptions and responsibilities is the most effective method to verify that access is appropriate based on the principle of least privilege. This approach ensures that each user's permissions align with their actual job functions, which is the core objective of a logical access control review. Interviewing or reviewing lists alone does not validate the appropriateness of access against business roles.

The final audit report should include findings, recommendations, and management's action plans to provide a complete picture and enable follow-up.