Certified Information Systems Auditor CISA (CISA) — Questions 226–300

GDPR mandates that PII must not be kept longer than necessary for the purpose for which it was collected. Defining retention periods based on legal and business requirements ensures compliance with the storage limitation principle (Article 5(1)(e)), and secure deletion (e.g., using cryptographic erasure or overwriting with tools like shred on Linux) prevents unauthorized recovery. This approach balances regulatory compliance with operational needs.

Formal approval from the data owner ensures that access is authorized based on business need, and periodic recertification ensures that access remains appropriate over time.

The user can authenticate and access the system (since they are in user acceptance testing with the given permission set), but cannot execute a fund transfer. This indicates that the user lacks the necessary Write permission for the transfer operation, which is required to modify the database record or initiate the transaction. Without Write access, the application can read data but cannot commit the transfer, causing the operation to fail.

Working papers document audit procedures, evidence, and conclusions to support the audit opinion.

A material weakness is a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement will not be prevented or detected.

Re-performance involves the auditor independently executing a control to verify its effectiveness. The auditor recalculating a control total is a direct re-performance.

User access recertifications confirm that current access rights are still appropriate for users' job functions and that no excessive privileges exist. This ensures the principle of least privilege.

A right-to-audit clause allows the customer or its auditor to review the provider's controls.

According to COBIT 2019, the industry and regulatory environment is a key design factor that significantly influences the governance system design, as it dictates compliance and risk management requirements. Options A, B, and C are factors but have a lesser impact compared to industry and regulatory considerations.

In agile, the sprint review provides an opportunity to demonstrate completed work and obtain stakeholder feedback, acting as a key control for quality and acceptance.

Continuous integration (CI) and automated testing enable frequent, reliable code integration and immediate feedback on defects, directly addressing the tension between rapid delivery and insufficient testing. Automated tests run on every commit, catching regressions early without manual overhead, which is essential for agile sprints where manual testing alone cannot scale to match delivery velocity.

A mature change management process requires that all changes be formally logged and subjected to automated approval workflows. This ensures traceability, segregation of duties, and auditability, which are critical for a financial trading system where unauthorized or untracked changes could lead to financial loss or regulatory non-compliance.

The auditor should identify that some vulnerabilities lack formal risk acceptance, that the SLA may need adjustment for legacy systems, and that scan reports may not accurately reflect the current status. While patch deployment is important, the immediate findings relate to documentation and SLA adequacy.

Mandatory vacation policies force the periodic removal of an employee's access, which allows detection of irregularities or fraudulent activities that require the employee's continued presence to conceal. Without enforcement, a malicious insider could perpetrate fraud (e.g., creating ghost vendors, altering payment records) and cover it up by maintaining daily control over transactions. This directly increases the risk that fraudulent actions will go undetected over extended periods.

Data migration often involves mapping old data to new structures. Inaccurate mapping can lead to data corruption or loss, which is a critical risk.

SMART stands for Specific, Measurable, Achievable, Relevant, Time-bound.

A mantrap is a small room with two interlocking doors that prevents tailgating because only one person can pass through at a time.

Correct answers: B, C, E. The board is responsible for approving the IT strategy (B), reviewing and approving IT policies (C), and ensuring that IT risks are managed within acceptable levels (E). Implementing IT security controls (A) is a management duty, and monitoring daily IT operations (D) is an operational responsibility.

The primary objective of an IAM program is to ensure that the right individuals have access to the appropriate resources at the right time for the right reasons. This is achieved through authentication, authorization, and access control mechanisms such as Role-Based Access Control (RBAC) or Attribute-Based Access Control (ABAC). Without this, the organization cannot enforce security policies or maintain audit trails.

For emergency changes, speed is critical, but a rollback plan is essential to ensure the change can be reversed if it causes issues. This minimizes the impact on operations.

The audit process phases include planning, fieldwork, reporting, and follow-up.

The principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions, based on their role and need-to-know. In a cloud-based IAM system, this is typically implemented through role-based access control (RBAC) or attribute-based access control (ABAC), ensuring minimal exposure to sensitive resources and reducing the attack surface.

Mature governance involves board-level review of IT strategy, linking IT metrics to business outcomes, and having a formal governance committee. Decisions in silos and historical budget allocation are signs of low maturity.

Tabletop exercises should focus on testing decision-making and communication, not just technical steps.

In agile development, iterative cycles and continuous feedback can lead to scope creep if changes are not managed through a disciplined backlog prioritization process. Unlike waterfall, where scope is fixed early, agile's flexibility requires robust controls (e.g., sprint boundaries, product owner authority) to prevent uncontrolled expansion. An IS auditor should highlight this risk because without proper governance, the project may exceed budget and timeline despite agile's adaptive nature.

The auditor should verify that the risk is formally accepted by management and that compensating controls are in place to protect the application until decommissioning.

The service desk acts as a single point of contact for IT support.

Patch compliance percentage directly measures how well the organization applies patches, indicating process effectiveness.

The permanent file contains information that is relevant for multiple audits, such as organizational charts and key contracts. Current year's audit program is part of the current file.

A decreasing number of recurring incidents indicates that root causes are being identified and resolved, which is a key measure of incident management effectiveness. Option A focuses on resolution speed, which is not the best indicator of effectiveness; Option B may indicate better detection, not effectiveness; Option C is about logging timeliness, which is a process compliance metric, not effectiveness.

Protection of intellectual property and data is the primary concern for an IS auditor when outsourcing software development because it represents the highest risk to the organization. While vendor methodology, financial stability, and SLA compliance are important, they are secondary to ensuring that sensitive data and proprietary information are safeguarded against unauthorized access or disclosure.

Continuous auditing enables real-time or near-real-time monitoring of transactions, allowing the IS auditor to detect anomalies and potential fraud as they occur. This is the primary benefit because it shifts the audit function from retrospective review to proactive identification, which is critical for timely risk mitigation.

The IAM policy grants broad permissions (e.g., `"Effect": "Allow", "Action": "*", "Resource": "*"`) without scoping to specific actions or resources, violating the principle of least privilege. This over-privileged access allows any authenticated principal to perform any operation (including destructive actions like `iam:DeleteRole` or `s3:DeleteBucket`) across all resources, creating a severe security risk. The primary weakness is the lack of fine-grained access control, not the absence of encryption, MFA, or logging.

Key performance indicators (KPIs) and reporting frequency are essential to define measurable performance standards and enable ongoing monitoring of vendor compliance. Without clear KPIs and regular reporting, the organization cannot effectively assess whether the vendor is meeting service levels. While B (list of hardware/software) is a necessary operational detail, C (staffing) and D (penalty clauses) are secondary; the SLA must first establish how performance will be measured and reported.

Containerization (also known as dual-persona or sandboxing) creates a separate, encrypted container on the device for corporate apps and data. This allows the MDM to issue a selective wipe command that destroys only the container and its contents, leaving the user's personal apps, photos, and settings untouched. Without containerization, a remote wipe would typically erase the entire device, including all personal data.

Strategic alignment ensures IT supports business goals; performance measurement tracks achievement. Network firewall rules, user training, and vendor lock-in are operational or tactical, not core governance components.

Restoring from offline backups taken before the attack ensures that the recovered data is clean and free from encryption, as the ransomware cannot modify backups that are not connected to the network. This strategy minimizes data loss by reverting to the most recent known-good state without relying on potentially compromised or incomplete system restore points.

Re-performance is when the auditor independently executes a control to confirm it operates as designed.

Defining and enforcing data retention schedules directly addresses the requirement to not retain data longer than necessary by specifying precise timeframes for data deletion or archival. This control ensures compliance with legal, regulatory, and business needs by automating the lifecycle management of data, such as through expiration policies in object storage (e.g., S3 Lifecycle rules) or database TTL (time-to-live) settings. Without such schedules, data may persist indefinitely, increasing storage costs and regulatory risk.

Unsupported software no longer receives security patches, making the systems vulnerable to exploitation.

Surprise walkthroughs provide a realistic view of daily compliance, unlike scheduled inspections.

Keeping a rule after the business need has ended violates the principle of least privilege. The best recommendation is to remove the rule immediately, as retaining it increases risk without justification.

Including right-to-audit clauses in contracts is a key control for managing third-party risk because it grants the IS auditor or the organization the contractual authority to independently verify the vendor's security controls, data handling practices, and compliance with policies. This clause ensures ongoing oversight beyond initial due diligence, allowing for on-site inspections or reviews of the vendor's systems and processes, which is critical for detecting control failures or unauthorized changes that could impact the organization's data.

The project lacks formal sign-off on business requirements, has unresolved critical data integrity issues, and has been making uncontrolled code changes without version control. Going live under these conditions would violate ISACA's IS acquisition and implementation standards, which require that all critical defects be resolved and UAT be successfully completed before production deployment. The regulatory deadline does not justify bypassing these fundamental controls, as post-implementation fixes cannot guarantee data integrity and could lead to regulatory penalties.

A decrease in successful phishing attacks demonstrates behavioral change.

Verbal approval of scope changes bypasses formal change control processes, leading to undocumented scope creep, loss of audit trail, and increased risk of project failure. An IS auditor should identify this as a governance weakness because it violates the principle of documented authorization and traceability required for effective project oversight.

Vendor concentration risk is the risk of over-reliance on a single vendor. An exit strategy clause ensures the ability to transition away, and a subcontracting controls clause (fourth-party risk) addresses the CSP's use of other vendors that could increase concentration. SLA monitoring is important but not directly for concentration; right-to-audit is a general control; data encryption is about security.

Implementing an IT governance framework, such as COBIT or ISO/IEC 38500, establishes structured policies, procedures, and controls that directly improve risk management and mitigation. By defining clear roles, accountability, and risk appetite, the framework ensures that risks are systematically identified, assessed, and treated, rather than being managed ad hoc. This aligns IT strategy with business objectives and embeds risk management into daily operations.

An allow rule from any to any (any-any) is overly permissive and poses a significant security risk. The other options are also problems but are less severe than a wide-open rule.

The scenario describes a file that is digitally signed by a trusted vendor yet exhibits malicious behavior. This is the classic definition of signed malware, where the digital certificate used to sign the file has likely been stolen, misused, or issued fraudulently. The trusted signature bypasses reputation-based and allowlist controls, making the threat particularly dangerous because the file appears legitimate to security tools that trust the vendor's certificate.

The error message 'Duplicate entry 'admin' for key 'PRIMARY'' indicates a violation of the PRIMARY KEY constraint on the USERS table. Since the username field is the primary key, inserting a second row with the same username (e.g., 'admin') causes MySQL to reject the INSERT operation with error code 1062. This is a unique constraint violation, not a connectivity or privilege issue.

ERP systems often combine roles that were separate in legacy systems, increasing risk of fraud.

RBAC mandates that access rights are strictly tied to job functions. When an employee changes departments, their previous role permissions are no longer applicable and must be immediately revoked to prevent unauthorized access, while new role permissions are granted to align with their new responsibilities. This follows the principle of least privilege and ensures that access rights are always current with the employee's role.

Penetration testing is the most critical testing type for a mobile application processing credit card payments because it simulates real-world attacks to identify exploitable vulnerabilities in the payment data flow, authentication mechanisms, and API endpoints. This directly addresses PCI DSS requirements for security testing of cardholder data environments, unlike other testing types that focus on functionality or user experience.

Audit risk = inherent risk × control risk × detection risk. With high control risk and low detection risk, audit risk is moderate to high.

Phishing simulation exercises are a key component of an effective information security awareness program because they provide hands-on, practical experience in identifying and responding to real-world phishing attempts. By simulating attacks, organizations can measure employee susceptibility, reinforce training, and reduce the risk of successful social engineering attacks. This proactive approach helps build a security-conscious culture and directly addresses the human factor in cybersecurity.

A P1 (Priority 1) incident is the highest severity, typically involving a critical system outage that affects all users or major business operations.

Resource tagging helps allocate costs and track usage. Detecting orphaned resources (e.g., unused instances) prevents unnecessary charges. These are key cloud cost management controls.

Regular key rotation limits the amount of data compromised if a key is exposed.

Aligning IT strategy with business strategy ensures that IT investments support business objectives, delivering value and reducing waste. Reducing costs, improving morale, or simplifying architecture are secondary benefits.

COBIT 2019 explicitly requires a governance framework that covers all IT-related activities and stakeholder needs to ensure alignment with business goals. This framework integrates enterprise governance principles, such as the Governance System and Governance Framework components, to bridge IT and business strategy through policies, structures, and processes.

A release plan should include a rollback plan (to revert if issues arise) and a testing strategy (to validate the release). Deployment automation is beneficial but not always essential; communication plan is important but secondary to technical components; post-implementation review is after the release.

Audit risk is defined as the risk that the auditor will issue an incorrect opinion (option C). Option B represents the audit risk model (Inherent risk × Control risk × Detection risk), which is a formula for assessing audit risk, not the definition itself. Therefore, C is the best description.

The intermittent synchronization errors indicate a potential data integrity or consistency issue that must be fully understood before expanding the system's footprint. Proceeding without root cause analysis risks propagating the defect to the European phase, which could lead to widespread data corruption, increased remediation costs, and regulatory non-compliance. A thorough root cause analysis (e.g., examining network latency, transaction log replication, or database conflict resolution) is essential to ensure the ERP's distributed architecture is reliable.

The requirement that all employees undergo annual security awareness training is a mandatory directive. In the policy hierarchy, a policy is a high-level statement, while standards translate policies into specific mandatory requirements. This requirement is not a step-by-step procedure but a compulsory condition, making it a standard.

Encryption is the only control that directly protects the confidentiality and integrity of data both at rest (e.g., AES-256 for database files) and in transit (e.g., TLS 1.3 for HTTPS). It renders data unreadable without the proper decryption key, ensuring that even if storage media or network traffic is intercepted, the customer data remains secure.

A clean desk policy requires employees to secure documents at end of day, and a security awareness program reminds them of the policy and consequences.

In the UAT phase, any defect must be formally logged and subjected to impact analysis before a fix is approved. This ensures that the proposed change does not introduce new risks, break other functionality, or violate regulatory compliance—critical for a financial application handling interest calculations. Skipping this process could lead to cascading failures or audit findings.