Certified Information Systems Auditor CISA (CISA) — Questions 976–995

The ACL has a 'permit any' statement at the end, which overrides the preceding 'deny' statements. In Cisco ACLs, packets are processed sequentially from top to bottom; once a match is found, no further rules are evaluated. Therefore, the 'deny' for the subnet is never reached, and all traffic (including from the blocked subnet) is permitted, defeating the intended restriction.

A change management process ensures that all changes are authorized, tested, and approved, directly addressing unauthorized changes. Asset management, CMDB, and incident response are supportive but not the primary control.

The 'aws:SourceAccount' condition key is designed for use in resource-based policies (like S3 bucket policies) to prevent cross-account confusion of resources. It does not restrict access within the same account; it only validates the source account when the request originates from a different account. Since the policy is an IAM identity-based policy (attached to a user/role), the 'aws:SourceAccount' condition is not evaluated for same-account requests, so any principal in account 123456789012 can still perform S3 actions without being restricted by this condition.

The high utilization indicates a need for immediate capacity expansion. The existing plan is too far in the future, risking performance degradation or outages. The auditor should recommend expediting the addition of resources.

A reciprocal agreement for a shared hot site does not guarantee exclusive access during a disaster. If both organizations declare a disaster simultaneously, the site may become oversubscribed, leading to resource contention and potential failure of the BCP. This directly undermines the recovery capability, making it the most critical finding.

Restricting access to the code repository to only company-managed IP addresses (e.g., via a VPN or a corporate NAT gateway) would have prevented the attacker from using the stolen session cookies from an external, non-corporate IP. Even though the attacker had valid session tokens, the repository's access control list (ACL) would have blocked the connection at the network layer, stopping the exfiltration before it could begin. This control addresses the root cause—unauthorized network origin—rather than relying on detection or session management alone.

The auditor should recommend a risk-based approach that allows expedited patching for critical vulnerabilities while maintaining testing for less critical ones. The process should be reviewed to balance security and stability.

A data classification policy is essential because it defines how information assets are categorized based on sensitivity and criticality (e.g., public, internal, confidential, restricted). This classification directly drives the selection and enforcement of appropriate security controls, such as encryption standards (e.g., AES-256 for confidential data) and access control mechanisms (e.g., role-based access control). Without it, security measures cannot be consistently applied across the organization, leading to gaps in protection.

Decentralized IT can lead to duplication of efforts and inconsistent standards across units, increasing complexity and cost.

Emergency changes bypass normal review, increasing the risk of unauthorized or poorly tested changes that could disrupt operations or introduce security vulnerabilities.

The best course of action is to avoid customization and re-engineer business processes to match the COTS application. This approach preserves the integrity of the vendor's standard codebase, ensuring that future upgrades and patches can be applied with minimal friction. Extensive customization creates a fork from the vendor's baseline, leading to costly regression testing, potential security gaps, and upgrade incompatibilities that undermine the long-term value of the COTS investment.

A DLP solution detects sensitive data by matching content against predefined patterns or rules. Without a data classification exercise, the organization cannot define what constitutes 'sensitive data' (e.g., PII, PCI, IP), making the DLP blind to what it should monitor. Classification provides the taxonomy and metadata (e.g., labels, tags) that the DLP engine uses to trigger alerts or blocks, ensuring detection is both accurate and aligned with policy.

The most concerning finding is that capacity planning is reactive, leading to performance degradation and potential outages before thresholds are raised. This indicates a lack of proactive management.

ITIL defines an Emergency change as one that must be implemented as soon as possible—often to resolve a major incident or security vulnerability. This change type bypasses the normal CAB approval cycle and uses a dedicated Emergency CAB (ECAB) process to authorize and implement the fix rapidly while still maintaining control.

Help desk first-call resolution rate is a common KPI measuring efficiency and effectiveness of support services.

Availability = MTBF / (MTBF + MTTR) = 720 / (720 + 4) = 720 / 724 ≈ 0.994475, or 99.45%.