Certified Information Systems Auditor CISA (CISA) — Questions 76–150

Shared accounts make it impossible to attribute actions to specific individuals, leading to loss of audit trail and non-repudiation. This is critical for forensic investigations and accountability.

An effective IR plan must include clear roles, communication procedures, and criteria for escalation and severity classification to ensure timely and coordinated response.

Dynamic application security testing (DAST) is a detective control that identifies vulnerabilities in a running application.

A tabletop exercise is a discussion-based test where participants walk through a scenario without executing procedures or activating systems.

The exhibit (not shown here, but implied by the context) likely depicts a deadlock graph or lock-wait chain, indicating that concurrent transactions are blocking each other. The most appropriate recommendation is to implement a locking strategy (e.g., row-level locking, lock ordering, or using snapshot isolation) to prevent resource contention and avoid deadlocks. This directly addresses the root cause of the observed performance or failure issues.

Standard changes are pre-approved and low risk; emergency changes require urgent approval. Normal changes require CAB approval.

Strategic alignment (B) is a key component of an IT governance framework because it ensures that IT strategies, investments, and operations are directly linked to business goals and objectives. This alignment is achieved through mechanisms such as balanced scorecards, IT steering committees, and portfolio management, which translate business strategy into IT priorities. Without strategic alignment, IT may operate in a silo, leading to wasted resources and missed opportunities for business value.

The change manager is typically Accountable for the change management process, ensuring it is effective and compliant.

The auditor must ensure the SOC 2 report is from a qualified auditor and covers the relevant period for the current evaluation.

The IT steering committee ensures that IT investments align with business strategy. They are responsible for strategic alignment and approving major projects based on business value.

D and E are correct. An IT strategy (D) and an IT steering committee (E) are key components of an IT governance framework. A (network topology diagram) is a technical document, B (help desk procedures) is operational, and C (hardware inventory) is operational, so they are not governance components.

Emergency changes bypass normal controls; without post-change review, unauthorized or flawed changes may persist unnoticed.

Mandatory vacation forces employees to take time off, during which irregularities may be discovered.

The 'R' in RACI stands for Responsible, which is the person who does the work.

The IT Audit Committee is the correct answer because it provides independent oversight of IT investments by operating outside of management's direct reporting structure. Unlike the CIO, PMO director, or CISO, who are all part of management and may have vested interests in project approvals or resource allocation, the IT Audit Committee reports to the board of directors and ensures that IT investments align with enterprise strategy, risk appetite, and regulatory requirements without bias.

The bucket policy grants public read access by setting `"Principal": "*"` and `"Effect": "Allow"` with `"Action": "s3:GetObject"`. This means any unauthenticated user on the internet can list and retrieve objects in the bucket, making it publicly readable. The policy does not require any authentication or authorization checks, which is a common misconfiguration leading to data exposure.

The BCP has not been tested in over two years is the greatest concern because testing is the only way to validate that the plan works under real-world conditions. Without recent testing, the organization cannot be confident that recovery time objectives (RTOs) and recovery point objectives (RPOs) are achievable, and any gaps or assumptions in the plan remain undiscovered. ISACA standards recommend testing at least annually, and a two-year gap significantly increases the risk of plan failure during an actual disaster.

A balanced scorecard translates strategic goals into performance metrics across financial, customer, internal process, and learning perspectives. Gantt charts, SWOT analysis, and Pareto charts are not designed for this purpose.

The most significant risk of implementing emergency changes without post-implementation review is that security vulnerabilities may be introduced and remain undetected (Option C). Without review, there is no assurance that the change did not compromise security controls, potentially exposing the application to threats. While other concerns such as lack of documentation (A), potential outages (B), or user notification (D) are important, they are not as critical as the undetected introduction of security vulnerabilities, which could have long-term impacts on data integrity and confidentiality.

Sample size is influenced by the expected error rate, tolerable error rate, and confidence level.

RAD prioritizes speed and iterative prototyping over formal documentation. Because the focus is on quickly delivering working software through user feedback and short development cycles, comprehensive documentation is often neglected or produced after the fact, leading to inadequate records for maintenance, auditing, and compliance.

Options A, B, and C are correct because COBIT 2019 defines governance system components as Organizational Structures, Information Items, and Processes. Option D (Service desk) is an operational process not a governance component. Option E (Project management office) is a management structure, not a governance component as defined in COBIT 2019.

Secure sanitization of storage media (Option C) is critical because decommissioned servers often contain sensitive data that must be irrecoverably erased to prevent unauthorized access. A formal disposal policy with authorization (Option D) ensures that decommissioning follows a documented, approved process, including verification of sanitization and chain of custody. Together, these controls address both the technical and procedural aspects of secure disposition.

In agile development, security testing must be integrated into each sprint to ensure continuous validation. The 'definition of done' (DoD) is the team's checklist for completing a user story; if it explicitly includes security testing tasks (e.g., static analysis, dynamic scans, or penetration tests), then verifying the DoD proves that security testing was performed iteratively. Option D directly examines this artifact, providing objective evidence of iterative security testing.

Symmetric keys are used for bulk encryption with a shared key, while public keys are distributed for encryption/verification. Asymmetric keys involve a key pair and are not optimized for bulk encryption; private keys must be kept secret for decryption/signing.

Observation (watching) and re-performance (doing) are both used to test control effectiveness.

A right-to-audit clause allows the organization to verify the provider's controls and compliance, which is critical for third-party risk management.

The CAB reviews and approves changes based on risk and impact. For a low-risk normal change, the CAB typically authorizes the change, possibly with standard procedures.

Consistently high utilization without planning risks performance degradation and outages. The organization may not be able to handle peak loads.

Building a custom application allows for tailored functionality that meets unique business requirements, which is a key advantage over COTS.

External audits are conducted by third-party auditors to provide independent assurance, often required by regulations or standards.

A right-to-audit clause allows the organization or its auditor to review the provider's controls.

Vendor dependency is a critical risk in COTS acquisitions. The organization may become reliant on the vendor for updates, support, and customizations, which can affect long-term flexibility and costs.

A warm site is partially configured with some hardware, software, and data synchronization, offering a balance between cost and recovery time. For a medium-sized organization, it provides faster recovery than a cold site while being significantly less expensive than a hot site, making it suitable for a region prone to earthquakes where the DR site must be geographically distant.

The deployment phase should include a rollback plan to revert to the previous state if the new system fails. This is a critical control to minimize downtime and data loss.

A risk assessment identifies high-risk areas to prioritize audit efforts and allocate resources effectively.

Inconsistent application of data classification labels is most commonly caused by insufficient training and awareness programs. Without proper education, users do not understand how to correctly classify data according to the policy, leading to inconsistent labeling across the organization.

Insufficient storage on the standby server delays data restoration, directly impacting RTO. Other options are good practices that would not cause failure.

A firewall rule review should compare documented rules with actual configured rules and verify business justifications for each rule.

The file 'sensitive.txt' has world-writable permissions, meaning any user on the system can modify or delete it. The most direct and appropriate remediation is to remove the world-writable permission using `chmod 644`, which sets the file to owner read-write, group read, and others read. This eliminates the security risk while preserving necessary access for the owner and group.

IT strategy alignment requires that IT investments directly support business goals, such as enabling new business capabilities.

MTD defines the maximum time a process can be unavailable without causing severe business impact. It sets the recovery time objective (RTO) target.

Data integrity is the top risk during migration, as errors can lead to incorrect business operations and decisions.

The planning phase includes defining scope, risk assessment, and developing the audit programme.

The exhibit shows backup tapes stored in an unsecured cabinet without any indication of encryption. Since backup media often contains sensitive data, the lack of encryption exposes the organization to data breaches if the media is lost or stolen. This is a direct violation of data protection requirements and requires immediate remediation.

The review should identify lessons learned, address outstanding defects, and assess whether objectives were met beyond budget/schedule.

Resource Optimization has a Red status, indicating critical risk or non-compliance, requiring immediate attention. Green and Yellow components are less urgent.

Audit risk consists of inherent risk, control risk, and detection risk. The question asks for TWO; inherent and detection are correct.

Excessive I/O wait time directly indicates that the storage subsystem is the bottleneck, not the database server's CPU or memory. Inadequate disk spindles or a SAN bottleneck (e.g., insufficient HBA queue depth, oversubscribed SAN links, or slow RAID rebuilds) cause the storage layer to become saturated, forcing the OS to wait for I/O completions. This is the most likely root cause because the symptom is specifically I/O wait, not CPU or memory pressure.

Correct answers are A, B, and D: redundant hardware, regular data backups, and insurance policies. C and E are not resilience techniques; C is a risk analysis step, E is training which is supportive but not a core resilience technique.

Compliance audits specifically assess adherence to laws, regulations, and policies. Efficiency and effectiveness are the focus of operational audits.

Dependency management is the correct control because it ensures that job scheduling logic explicitly defines and enforces the order of execution based on predecessor/successor relationships. By configuring dependencies (e.g., using job control language (JCL) with COND parameters or scheduling tools like CA Workload Automation ESP), the system will automatically hold a job until all prerequisite jobs have completed successfully, preventing the failure scenario described.

COBIT and ISO/IEC 38500 are IT governance frameworks. ITIL and PMBOK are management frameworks.

Overly permissive rules should be tightened to reduce risk; the auditor should recommend implementing more specific rules based on actual needs.

COBIT 5 has five process domains: EDM (governance), APO (planning), BAI (acquisition/implementation), DSS (delivery/support), and MEA (monitoring). Correct matches are as above; common confusions involve swapping APO/MEA or DSS/APO.

The bucket policy grants access to any principal ("Principal": "*"), meaning any AWS user or anonymous user can perform the allowed actions on the bucket. For a bucket storing sensitive customer data, this is a critical security risk. Restricting the principal to specific IAM roles or users (Option D) ensures only authorized identities can access the bucket, aligning with the principle of least privilege.

The pattern of denied SSH attempts followed by successful HTTPS connections suggests the internal host is probing for an open SSH service and, when blocked, switches to an allowed protocol (HTTPS) to communicate with a different server. This behavior indicates an attempt to bypass security controls by leveraging a permitted protocol after initial reconnaissance or direct access attempts fail. The firewall logs show the host adapts its method, which is a classic indicator of protocol hopping or tunneling attempts.

A comprehensive BCP includes procedures for people, alternate facilities, and communications.

The IS auditor's primary role is to assess risk, not to enforce policy blindly. Quarterly reviews may still be acceptable if compensating controls (e.g., automated provisioning/deprovisioning, real-time monitoring, or role-based access controls) effectively reduce the risk of unauthorized access between reviews. Determining the presence and effectiveness of such controls is the best initial action before deciding whether to report noncompliance.

After an emergency change, it is essential to document the change and obtain retrospective approval to maintain change management integrity.

The internal process perspective focuses on operational efficiency and effectiveness, such as system availability.

Waterfall is the most appropriate methodology for projects with well-defined requirements and low uncertainty because it follows a linear, sequential approach where each phase (requirements, design, implementation, verification, maintenance) must be completed before the next begins. This structure minimizes risk when requirements are stable and unlikely to change, ensuring thorough documentation and predictable outcomes. In contrast, iterative or adaptive methods would introduce unnecessary complexity and overhead for such a deterministic project.

Without ongoing training, employees are less likely to stay informed about evolving threats, increasing the risk of security incidents due to human error.