Certified Information Systems Auditor CISA (CISA) — Questions 151–225

Deploying an ERP system with unresolved critical bugs in core financial processing violates the fundamental principle of system integrity and accuracy. UAT must be successfully completed to validate that the system meets business requirements and processes financial transactions correctly; going live with known critical defects introduces unacceptable risk of financial misstatement, regulatory non-compliance, and data corruption. Delaying go-live ensures that all critical bugs are resolved and retested, preserving the reliability of financial data and audit trails.

The error message (not shown but implied from context) typically indicates a network-level connectivity failure, such as 'cannot connect to server' or 'connection timed out'. A firewall blocking the database port (e.g., TCP 1433 for SQL Server, 3306 for MySQL, 1521 for Oracle) is the most likely cause because it prevents the application from establishing a TCP handshake with the database server, even if the server name, password, and database service are all correct.

Start where you are means assessing current services and processes to identify what can be reused or improved.

The primary purpose of a DRP is to restore IT systems and operations after a disaster. The plan must include step-by-step recovery procedures for critical systems, applications, and data to ensure business continuity. Without these steps, the DRP cannot guide the recovery team through the technical restoration process.

A hot standby site provides near-real-time failover, which supports a 2-hour RTO. Synchronous data replication ensures data loss is minimal, supporting a 30-minute RPO.

A hybrid (or federated) structure combines centralized and decentralized elements, where some functions are centralized and others are distributed.

Parallel testing is the correct answer because it involves processing live transactions at the alternate site while the primary site remains fully operational. This allows validation of the disaster recovery (DR) systems without risking a service outage, as both sites run concurrently and results are compared for consistency. Unlike a full interruption test, the primary site is not shut down, ensuring business continuity during the test.

ISO/IEC 38500's acquisition principle requires that IT acquisitions are made for valid reasons, based on appropriate analysis, and with clear accountability.

Risk acceptance should be formally documented with compensating controls and management sign-off.

Contextual analysis (Option C) is the best approach because it reduces false positives by considering user roles, data classification, and behavioral patterns, ensuring that only genuinely risky data transfers are flagged. Unlike static methods, this dynamic analysis adapts to the organization's data governance policies, allowing legitimate business communications to proceed while still protecting sensitive information.

When the organization's processes are unique and provide a competitive advantage, custom development allows for exact fit and control.

For emergency access, a break-glass procedure with post-event review ensures that urgent access is granted quickly but is later reviewed for appropriateness and accountability.

To ensure accountability, individual user authentication must be implemented before granting privileged access.

If the IS auditor cannot obtain sufficient appropriate audit evidence, the audit approach must be adjusted—for example, by expanding sample sizes, using alternative procedures, or re-evaluating the reliance on controls. This directly impacts the ability to form an audit opinion and is a key fieldwork trigger per ISACA audit standards.

Inspection of training records provides documentary evidence of completion, which is more reliable than inquiry or observation for verifying compliance.

CMMI Level 2 (Managed) indicates that the vendor has established basic project management processes to plan, execute, monitor, and control projects. This means projects are managed according to documented plans, with defined requirements, project planning, and configuration management, but processes are not yet standardized across the organization. Option D correctly captures this foundational level of process maturity.

In agile development, security must be continuously integrated into each iteration. Including security stories in the product backlog ensures that security tasks are prioritized, estimated, and addressed during each sprint, making security an inherent part of the development lifecycle rather than an afterthought. This aligns with the principle of 'shifting left' on security, where controls are applied as early as possible.

A requirements traceability matrix (RTM) links each requirement to corresponding design, development, and testing artifacts. By mapping the encryption-at-rest requirement to specific code modules, configuration settings, and test cases, the RTM ensures that the control is implemented and verified at every stage of the lifecycle, not just at the end. This makes it the best proactive control for continuous compliance throughout development.

A reduced number of successful phishing attacks indicates that employees are applying the training to recognize and avoid threats. The other metrics are useful but less direct indicators of behavioral change.

Audit risk = inherent risk × control risk × detection risk; all three combine to determine overall risk.

The change advisory board (CAB) is the primary control for authorizing system changes because it provides a formal, documented approval process before any change is implemented. This ensures that changes are reviewed by stakeholders with appropriate authority, reducing the risk of unauthorized or poorly planned modifications. Without CAB approval, there is no definitive authorization step, making it the best control for ensuring authorization.

Periodic access recertification ensures that users' access rights are reviewed and confirmed by managers, reducing the risk of excessive or inappropriate access.

If CRLs are stale, revoked certificates may still be trusted, allowing unauthorized parties to impersonate legitimate entities or access encrypted data.

The internal process perspective focuses on operational efficiency and project delivery metrics.

Using a hardware security module (HSM) provides tamper-resistant storage and management of keys, which is the most important control for key security. Other controls are important but secondary.

Vendor concentration risk arises if the subcontractor is a single point of failure. Fourth-party risk means the organization has no direct control. Exit strategy concerns include difficulty in transitioning if the subcontractor fails.

A material weakness is a deficiency or combination of deficiencies that results in a reasonable possibility that a material misstatement will not be prevented or detected.

The root cause was a deliberate bypass of the existing change management policy, not a flaw in the policy itself. Enforcing stricter controls and disciplinary measures directly addresses the human factor by reinforcing accountability and deterring unauthorized changes, which is the most effective way to prevent recurrence when a well-documented process is already in place but ignored.

The HSM must enforce split knowledge and dual control at the technical level, not rely on procedural compliance. By configuring the HSM to require two administrators to be physically present for key exports, the organization ensures that no single individual can export keys, directly addressing the policy violation and the log evidence of a solo export. This technical control is the most effective corrective action because it prevents the bypass of dual control even if administrators attempt to circumvent procedures.

A known error database (KEDB) is a key output of effective problem management because it records known errors and their workarounds, enabling faster incident resolution and preventing recurrence. The KEDB is populated from root cause analysis findings and is used to link incidents to known problems, supporting ITIL-based problem management processes.

The RTO must be less than or equal to the MTD. Here, RTO (2 hours) is less than MTD (4 hours), so the recovery target is acceptable.

Delays in CRL updates increase the window during which a revoked certificate may be accepted, potentially allowing unauthorized access.

Iterative approaches allow early feedback and adaptability to changing requirements, unlike waterfall's rigid sequential phases.

Column-level encryption and tokenization allow sensitive fields (e.g., SSNs, credit card numbers) to be protected while leaving non-sensitive columns unencrypted, preserving query performance on indexed and frequently queried data. Tokenization replaces sensitive values with non-sensitive placeholders, enabling joins and lookups without decryption overhead, and column-level encryption limits decryption to only the required fields per query.

User behavior analytics (UBA) is the most cost-effective control because it directly addresses the core issue: unauthorized access by insiders. UBA applies machine learning to EHR access logs to establish baselines of normal user behavior and detect anomalous patterns (e.g., accessing records outside work hours or from unusual locations) without requiring manual log review. This provides automated, real-time detection of the specific unauthorized access incidents that are occurring, which the current logging system alone cannot provide.

Storing recovery keys on the local drive defeats the purpose of full disk encryption (FDE). If an attacker gains physical access to the laptop, they can simply boot an alternate OS or mount the drive and read the recovery key file, then use it to unlock the encrypted volume. This bypasses the encryption entirely, making the data vulnerable to unauthorized access despite encryption being enabled.

Without regular testing, the hot site may not function as expected. Options A, B, and C are important but secondary: A is part of planning, B is operational, C is compliance but not the most critical for effectiveness.

A material weakness is a deficiency that could result in a material misstatement.

The post-implementation review aims to assess whether the system meets its intended objectives, including performance, user satisfaction, and business goals. Lessons learned are a secondary outcome.

External auditors are not employees, reducing organizational pressures and biases.

A data inventory should identify where PII is stored and the business purpose for processing, as these are critical for managing privacy risks.

VPN setup: server configuration, user provisioning, client installation, connection testing, and monitoring.

Audit documentation must be sufficient to enable an experienced auditor, with no prior connection to the audit, to understand the work performed and conclusions reached.

Maximum Tolerable Downtime (MTD) defines the maximum acceptable downtime before severe impact.

Audit rights are critical for the organization to verify the vendor's controls and compliance, especially for outsourced systems.

Data classification is the foundational step for effective DLP rules because it defines which data is sensitive and how it should be handled. Without classification, DLP policies cannot accurately identify or enforce rules on sensitive content, leading to false positives or missed detections. Classification enables the DLP system to apply context-aware rules (e.g., regex patterns for PII, keywords for confidential documents) that align with the organization's data governance requirements.

The scope should be based on a risk assessment to ensure that the audit addresses areas with the highest risk to the organization.

Walkthroughs and inspection of documentation are common procedures to evaluate design and implementation.

The primary recommendation is to include a right-to-audit clause for all subcontractors in the contract. This ensures the organization retains direct oversight and contractual leverage over fourth-party risks, as relying solely on the vendor's assurance without audit rights creates a blind spot in the supply chain. Without such a clause, the organization cannot independently verify the fourth party's compliance with security controls, which is critical for maintaining business resilience.

The IT steering committee ensures that IT investments align with business strategy and provide value, balancing stakeholder needs.

Rule 30 is the correct answer because it allows SSH access from any source (0.0.0.0/0) without restriction. In a security audit, an ACL entry that permits SSH from any IP address poses the greatest risk as it exposes the management interface to potential brute-force attacks and unauthorized access, violating the principle of least privilege.

Options A, C, and E are correct because internal audit can provide assurance on compliance, internal controls, and security. Option B is incorrect because designing architecture is not an audit function. Option D is incorrect because approving requirements is a management responsibility.

Involving internal audit early in the SDLC allows control requirements to be identified and designed into the system from the start, avoiding costly retrofits. Implementing controls during the design phase is significantly cheaper than adding them after development or deployment, as changes to code, architecture, or configuration are less disruptive and require less rework.

A robust certificate policy (CP) and certification practice statement (CPS) define the rules and procedures for certificate management, ensuring consistency and security. Other controls are important but are defined within the CP/CPS.

Emergency changes bypass normal controls, so post-implementation review is critical to ensure the change was effective and did not introduce risks. Without it, undocumented or unauthorized changes may persist.

Online backup with transaction log backups (Option C) is correct because it allows the database to remain fully operational (24/7 availability) while capturing every committed transaction in the transaction log. In the event of a failure, you can restore the most recent full backup and then apply all subsequent transaction log backups to recover to the exact point of failure, minimizing data loss to only uncommitted transactions.

Unauthorized overtime payments indicate a segregation of duties or control weakness that could lead to fraud. Inaccurate tax calculations could result in regulatory penalties and employee dissatisfaction. Both have significant financial and compliance impacts.

A vulnerability management program ensures systematic identification and remediation of missing patches, addressing the root cause. Immediate patching and isolation are tactical; renewing the contract is necessary but not a process improvement.

Separation of duties prevents fraud by ensuring no single person has control over all aspects of a transaction. Mandatory vacation allows detection of fraud when employees are away. Background checks are preventive but not as directly effective as separation of duties and mandatory vacation for ongoing fraud prevention.

RTO defines the maximum acceptable downtime; it is the foundational metric for recovery planning. RPO, MTTR, and SLA are defined later or are contractual.

Immutable backup storage ensures backups cannot be altered or deleted, preventing corruption from ransomware. Encryption protects confidentiality, not integrity; logging detects but does not prevent; restoration testing detects corruption after the fact.

Defining system architecture is a key activity in the system design phase because it establishes the high-level structure of the system, including hardware, software, network components, and their interactions. This blueprint guides subsequent detailed design and implementation, ensuring alignment with functional and non-functional requirements. Without a defined architecture, the system risks integration failures and scalability issues.

Segregation of duties conflicts in an ERP can lead to fraud or errors. The other findings are important but not as critical from a control perspective.

The auditor should ensure that the rerun procedure specifies the correct restart point to avoid data corruption or reprocessing errors.

The least privilege principle dictates that users should be granted only the minimum permissions necessary to perform their job functions. In this scenario, finance department users have unnecessary access to HR payroll data, directly violating this principle by providing more access than required.

Service level agreements (SLAs) are the most critical control because they define measurable performance targets (e.g., uptime, response time, throughput) for the outsourced customer portal. Without enforceable SLAs, the company has no contractual mechanism to ensure the portal meets availability and responsiveness requirements, directly impacting customer experience and business operations.

Running parallel processing allows the legacy and new SaaS systems to operate simultaneously, enabling real-time comparison of outputs. This approach directly validates data integrity by detecting discrepancies during migration, not after, which is critical for ERP systems where transactional accuracy is paramount.

Regular disaster recovery testing that includes a full failover is the only control that directly validates that the DR site's SAN zoning is correctly configured to accept replicated data. Without such testing, misconfigurations like incorrect zone sets or missing WWPN (World Wide Port Name) mappings in the SAN fabric remain undetected until an actual failover is attempted. This aligns with the CISA emphasis on testing recovery procedures to ensure business continuity.

The SAML response shows the assertion is sent in plaintext (no xenc:EncryptedData element), meaning the authentication assertion is not encrypted. This allows an attacker who intercepts the SAML response to extract the assertion and reuse it in a replay or impersonation attack, violating the confidentiality requirement for sensitive authentication tokens.

Encrypting stored data (Option B) is a key control for ensuring data privacy because it renders the data unreadable without the correct decryption key, protecting it from unauthorized access even if the storage medium is compromised. This aligns with data-at-rest protection requirements under regulations like GDPR and PCI DSS, and is a fundamental security control during system development to prevent exposure of sensitive information.

Secure key storage, such as using a hardware security module (HSM) or key vault, is critical to prevent unauthorized access to keys. Without secure storage, other controls are less effective.