Certified Information Systems Auditor CISA (CISA) — Questions 226–300

Why this answer

How to eliminate wrong answers

Option A is wrong because integration testing focuses on verifying the interactions and data flow between integrated modules, not individual units. Option B is wrong because user acceptance testing is performed by end users to validate that the system meets business requirements, not by developers to test code units. Option D is wrong because system testing validates the complete, integrated system against functional and non-functional requirements, not individual program units.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a database firewall misconfiguration might allow or deny traffic at the network layer, but it does not typically enforce granular row- or column-level access based on user identity within a query; the log shows the query succeeded, indicating the firewall (if present) allowed it, but the core issue is that the user should not have been permitted to see the data at all. Option B is wrong because audit logging is clearly enabled—the log entry itself is evidence of logging; the failure is not the absence of logs but the absence of preventive controls. Option D is wrong because lack of encryption at rest protects data from physical theft or unauthorized file access, but it does not prevent an authenticated user from querying data through the application or database interface; encryption at rest would not have blocked this SELECT statement.

Why this answer

Why this answer

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because system uptime percentage measures availability, not utilization; a server can be up 99.999% of the time but idle, wasting resources. Option C is wrong because the number of help desk tickets resolved per day measures service desk productivity and incident handling efficiency, not the utilization of IT resources like servers or storage. Option D is wrong because the percentage of projects completed on time measures project management performance and schedule adherence, not the operational efficiency of IT resource usage.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because changing the backup schedule to daily full backups does not address the immediate data loss crisis; it is a long-term preventive measure, not an urgent response to the current RPO violation. Option C is wrong because determining the root cause of the failure should occur after recovery, not before; delaying recovery to investigate the cause would worsen the RTO breach and data loss. Option D is wrong because the RTO of 4 hours is a recovery speed target, and while it may be challenged, the primary and most immediate concern is the massive data loss (RPO violation), not the recovery time itself.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because adding manual controls and user double-checks is a detective, not corrective, control that does not address the root cause of incorrect data mapping; it increases operational burden and error risk without fixing the underlying data transformation logic. Option C is wrong because increasing the budget and hiring more consultants is a reactive, non-technical solution that does not guarantee the data mapping errors are identified and corrected; it may accelerate work but does not provide a validation mechanism. Option D is wrong because immediately reverting to the legacy system and restarting with a phased approach is overly disruptive, costly, and time-consuming; it ignores the possibility of a targeted fix and parallel testing, which is more efficient and preserves project momentum.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because encryption is a security control for data at rest or in transit, not a masking requirement; masked data is already obfuscated and does not need encryption to fulfill its purpose. Option C is wrong because irreversibility is a property of hashing or tokenization, not a mandatory requirement for data masking; masking can be reversible (e.g., using deterministic substitution) as long as the original data is not exposed. Option D is wrong because randomizing data across all columns would destroy referential integrity and consistency; masking often uses deterministic algorithms to maintain relationships and data distribution patterns.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B (Expected error rate) is wrong because it is an estimate of the actual deviation rate in the population, used to plan sample size but not the most important factor; it influences efficiency, not the fundamental precision requirement. Option C (Population size) is wrong because for large populations (typically >500), population size has a negligible effect on sample size in attribute sampling, as the sample size formula is driven by confidence level and tolerable error rate, not population size. Option D (Sampling method) is wrong because the method (e.g., random, systematic, or stratified) affects how the sample is selected and its representativeness, but does not determine the sample size; sample size is computed independently of the selection technique.

Why this answer

How to eliminate wrong answers

Option A is wrong because the CISO is a security advisor and enforcer, not the business owner; they lack the business context to determine data classification and usage rules. Option B is wrong because the system administrator is a custodian who implements technical controls (e.g., access control lists, encryption) but does not have ownership authority or business accountability for the data. Option D is wrong because legal counsel provides compliance guidance but does not own the data operationally; ownership must reside with the business unit that creates and uses the data.

Why this answer

How to eliminate wrong answers

Option B is wrong because it is an inflexible response that ignores the business value of the requested changes; outright rejection can lead to user dissatisfaction and a system that fails to meet critical business needs. Option C is wrong because delaying the go-live date is not feasible given the fixed deadline imposed by the legacy system's end-of-support, and it would likely cause significant operational risk. Option D is wrong because switching to an agile methodology mid-project is impractical; the project is already three months into a waterfall lifecycle with well-defined requirements, and a methodology shift would require retraining, rework, and disrupt the current integration and data migration work, likely causing further delays.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Implementation phase focuses on deploying the system into production, including installation, configuration, and user training; documenting business requirements at this stage would be too late, as the system has already been built based on earlier decisions. Option C is wrong because the Design phase translates documented requirements into technical specifications (e.g., data models, interface designs); it assumes requirements are already finalized and formalized. Option D is wrong because the Maintenance phase involves post-deployment support, patches, and enhancements; formal business requirements for the initial system must be captured long before this phase to avoid reactive changes that increase cost and risk.

Why this answer

How to eliminate wrong answers

Option A is wrong because logging in from a known device is a low-risk factor that typically reduces the authentication burden, not triggers step-up. Option C is wrong because entering a correct password is the baseline authentication requirement and does not itself indicate elevated risk; step-up is triggered by anomalous context, not by successful password entry. Option D is wrong because logging in during business hours is a normal, expected behavior that aligns with low-risk profiles and would not prompt additional verification.

Why this answer

How to eliminate wrong answers

Option B is wrong because disabling automatic provisioning and requiring manual approval for all access would introduce operational inefficiency and delay for 5,000 users, and it does not address the root cause—the lack of periodic review of existing access rights. Option C is wrong because requiring documentation of approvals only fixes the symptom (undocumented approvals) but ignores the more critical risk that no one is periodically verifying whether current access is still appropriate. Option D is wrong because performing a risk assessment is a preliminary step, not a direct remediation; the auditor already identified the risk (no periodic reviews), so the best recommendation is to implement a control (automated recertification) rather than re-assess.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the data custodian (e.g., database administrator or system administrator) is responsible for implementing technical controls (access controls, encryption, backups) based on the classification assigned by the owner, not for assigning the labels themselves. Option C is wrong because the data user is an end-user who accesses data according to the policies and permissions set by the owner; they have no authority to assign classification labels. Option D is wrong because the data steward focuses on data quality, metadata management, and governance processes (e.g., data dictionary maintenance, data lineage) but does not have the business authority to determine the sensitivity or assign the classification label.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because out-of-band monitoring only allows the WAF to observe traffic and generate alerts without the ability to block malicious requests, failing the requirement to block traffic. Option C is wrong because transparent inline without failover introduces a single point of failure; if the WAF fails, traffic is dropped or bypassed, disrupting availability. Option D is wrong because reverse proxy with active-passive clustering still has a single point of failure if the active node fails and failover is not instantaneous or automatic, and it does not guarantee high availability as effectively as active-active clustering.

Why this answer

How to eliminate wrong answers

Option A is wrong because the implementation phase is when the system is actually built or coded, and developing the test plan at this late stage would delay testing and miss the opportunity to design tests in alignment with the design specifications. Option B is wrong because the coding phase focuses on writing the actual program code, and creating the test plan here would be reactive rather than proactive, increasing the risk of incomplete test coverage and rework. Option C is wrong because the requirements phase is too early for detailed test planning; while high-level test objectives may be identified, the specific test cases, test data, and test environment requirements cannot be finalized until the design is complete.

Why this answer

How to eliminate wrong answers

Option A is wrong because isolation is a containment step, not a preservation step; while it can help preserve volatile evidence by preventing remote tampering, the primary purpose is containment, and forensic preservation requires specific steps like creating a bit-for-bit image before any changes. Option B is wrong because patching offline is a remediation activity that occurs after containment; the immediate goal is to stop the attack, not to prepare the system for patching. Option C is wrong because compliance requirements may mandate containment, but the primary operational purpose is to prevent further damage, not to satisfy a regulation.

Why this answer

How to eliminate wrong answers

Option A is wrong because the unvalidated donation amount field is a symptom (a technical vulnerability), not the root cause in the development process; the IS auditor's primary finding should address the process gap that allowed the vulnerability to exist. Option B is wrong because the financial loss is an impact or consequence, not a process finding; the IS auditor evaluates controls and processes, not the monetary outcome. Option D is wrong because the payment gateway integration may be functional; the issue is the lack of input validation on the application side, not a misconfiguration or improper integration of the third-party gateway (e.g., incorrect API endpoint or missing signature verification).

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because tokenization with a reversible mapping is not anonymization; it is pseudonymization, as the original data can be recovered via the mapping table, which does not meet the irreversible anonymization required by privacy regulations. Option C is wrong because removing direct identifiers like names and SSNs alone leaves quasi-identifiers (e.g., ZIP code, age, gender) that can be combined with external data to re-identify individuals through linkage attacks, providing weak anonymization. Option D is wrong because data masking with static substitution (e.g., replacing values with fixed characters) is a form of obfuscation that does not preserve data utility for analytics (e.g., masked values lose statistical properties) and can often be reversed if the masking pattern is known or inferred.

Why this answer

How to eliminate wrong answers

Option B is wrong because a scheduled backup using a service account would involve backup-specific commands (e.g., wbadmin, robocopy, or backup software APIs) and would not include net user or net localgroup commands to create a new user. Option C is wrong because a brute-force attack would manifest as multiple failed login attempts (Event ID 4625) or repeated authentication failures, not a single successful command execution from an already-authenticated session. Option D is wrong because normal administrative activity would typically use a dedicated admin account, not a service account, and would follow change management procedures; creating a new user and adding it to the Administrators group is a high-risk action that is not routine.

Why this answer

How to eliminate wrong answers

Option A is wrong because the ACL permits TCP traffic to port 443 (HTTPS), as evidenced by users successfully browsing HTTPS websites. Option C is wrong because if the DNS server at 10.2.2.10 were unreachable, users would not be able to resolve names at all, but the issue is that users are configured to query a different DNS server, not 10.2.2.10. Option D is wrong because the security-level configuration on the OUTSIDE interface affects traffic direction and stateful inspection, not DNS resolution; the problem is specifically an ACL filtering issue.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because applying the latest security patches to the SSH service addresses vulnerabilities in the SSH protocol or implementation, but does not prevent brute-force attacks that exploit weak or guessed credentials. Option C is wrong because disabling direct root login via SSH reduces the attack surface by requiring a non-root account first, but it does not prevent brute-force attacks against any user account; the attacker can still target other usernames. Option D is wrong because enforcing strong password complexity makes passwords harder to guess, but it does not stop an attacker from making unlimited attempts; a brute-force attack can still succeed over time if no lockout mechanism is in place.

Why this answer

How to eliminate wrong answers

Option A is wrong because least privilege restricts user permissions to the minimum necessary for their job function, but it does not inherently prevent a single user from approving a transaction if that approval is within their role. Option C is wrong because mandatory access control (MAC) enforces system-wide policies based on labels and clearances, not the division of task responsibilities among multiple users. Option D is wrong because need to know limits access to information required for a specific task, but it does not address the requirement that no single person can approve a transaction, which is a process control, not an information access restriction.

Why this answer

How to eliminate wrong answers

Option A is wrong because the attacker is not testing already compromised credentials; they are attempting to guess the password, and forcing a password reset for only that user does not address the systematic guessing technique. Option B is wrong because pre-authentication enumeration would allow an attacker to determine valid usernames, but here the attacker already knows the specific user account and is targeting it with password guesses; disabling account lockout would remove the only protection against brute force. Option D is wrong because integration issues with AD would typically cause consistent failures for all users or show error patterns (e.g., timeouts, sync errors), not precise bursts of 4 attempts from varied IPs targeting a single executive account.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because proceeding without assessing privacy risks violates the auditor's duty to ensure compliance with health data privacy regulations (e.g., HIPAA), and a rushed custom interface may introduce vulnerabilities like unencrypted PHI in transit. Option C is wrong because rejecting the custom interface outright is overly rigid; a properly assessed and controlled custom interface can be compliant, and delaying the project unnecessarily ignores a viable solution. Option D is wrong because replacing the entire legacy system is disproportionate, costly, and introduces far greater project risk and disruption than addressing the format mismatch with a controlled interface.

Why this order

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because agile deliberately avoids defining detailed requirements upfront; instead, it embraces changing requirements through the project lifecycle. Option C is wrong because while agile values working software over comprehensive documentation, it does not minimize documentation to save time—it produces just enough documentation for the team and stakeholders. Option D is wrong because agile delivers the system incrementally in small, functional releases, not all at once, enabling early value delivery and feedback.

Why this answer

Why these pairings

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because engaging external security auditors to define requirements creates a dependency on outside parties and delays security integration, contradicting agile's self-organizing team model and continuous feedback loops. Option B is wrong because allocating a separate sprint dedicated solely to security violates agile's iterative delivery principle and can lead to security being treated as a separate phase, increasing risk of integration issues and rework. Option C is wrong because performing comprehensive security testing only during the final sprint is a waterfall-like approach that misses the opportunity to detect and fix vulnerabilities early, often resulting in costly late-stage remediation and potential release delays.

Why this answer

How to eliminate wrong answers

Option A is wrong because real-time threats are typically detected by monitoring and alerting mechanisms (e.g., SIEM, anomaly detection), not by reviewing recorded sessions after the fact; the question states sessions are recorded but not reviewed, which does not preclude real-time detection tools. Option B is wrong because increased administrative overhead is a potential operational impact, not the primary risk; the core concern is security and forensic capability, not resource usage. Option C is wrong because non-compliance with licensing agreements is unrelated to session recording and review; licensing compliance concerns software usage rights, not security monitoring.

Why this answer

How to eliminate wrong answers

Option A is wrong because using the default DocumentRoot path (e.g., /var/www/html) is a common configuration and not inherently a vulnerability; it only becomes a risk if combined with other misconfigurations. Option C is wrong because AllowOverride All allows .htaccess overrides, which can be a security concern if not properly managed, but it is not as immediately exploitable as directory listing and can be mitigated with proper .htaccess controls. Option D is wrong because 'Require all granted' permits all access, but this is often the intended default for public web content; the vulnerability arises only when combined with other issues like Indexes or weak authentication, and by itself it does not directly expose directory contents.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because TLS only protects data in transit between the client and the cloud provider; once the data reaches the cloud provider's servers, it is decrypted and stored in plaintext, leaving it exposed to the provider. Option C is wrong because server-side encryption with AES-256 means the cloud provider manages the encryption process and typically has access to the keys (or can access them via their key management service), so the provider can decrypt the data at rest. Option D is wrong because enabling the cloud provider's key management service gives the provider control over the encryption keys, allowing them to decrypt the data if they choose or if compelled by legal request.

Why this answer

How to eliminate wrong answers

Option B is wrong because it claims HTTP is blocked, but the 'permit ip any any' at the end of the ACL permits all traffic not explicitly denied, including HTTP. Option C is wrong because it states both HTTP and HTTPS are blocked, but the ACL explicitly permits HTTPS and the 'permit ip any any' permits HTTP. Option D is wrong because it says only HTTP is allowed and HTTPS is blocked, but the ACL explicitly permits HTTPS and the 'permit ip any any' permits HTTP as well, so both are allowed.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because full backups every 24 hours can only restore to the point of the last full backup, which would result in up to 24 hours of data loss, far exceeding the 15-minute RPO. Option B is wrong because synchronous replication requires the primary and standby servers to commit transactions simultaneously, which introduces latency and high performance overhead on the primary database, and it does not inherently provide point-in-time recovery to a specific 15-minute window without additional log management. Option D is wrong because differential backups capture all changes since the last full backup, but if performed every 6 hours, the maximum data loss could be up to 6 hours, which exceeds the 15-minute RPO; moreover, differential backups do not provide the granularity needed for sub-hour recovery.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because regression testing focuses on verifying that existing functionality still works after changes, not on validating the correctness of new access control rules. Option B is wrong because unit testing examines individual components or code modules in isolation, which cannot verify role-based permissions or end-to-end access control enforcement. Option D is wrong because system integration testing checks the interaction between systems (e.g., SSO with LDAP or SAML) but does not specifically validate that role-based access policies are correctly applied to user actions.

Why this answer

How to eliminate wrong answers

Option A is wrong because data volume and storage location influence operational decisions (e.g., replication, latency) but do not define the sensitivity or criticality of the data itself; a single record of PII can be far more sensitive than terabytes of public data. Option B is wrong because data format and encryption status are technical controls applied after classification, not criteria for determining the classification level; encryption status can change without altering the inherent sensitivity of the data. Option C is wrong because creation date and last access time are metadata useful for lifecycle management (e.g., retention policies) but irrelevant to the intrinsic value or risk of the data asset.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because deploying the patch without prior approval violates the change management policy and could lead to unauthorized changes, lack of audit trail, and potential conflicts with other changes. Option B is wrong because waiting 24 hours for the next CAB meeting would leave the system exposed to the active zero-day vulnerability, increasing risk of exploitation. Option C is wrong because deploying without any approval bypasses all governance controls, ignoring the need for documented authorization even for emergency fixes, and could cause operational disruptions without coordination.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because segregation of duties (SoD) controls are about preventing a single user from performing conflicting functions; disabled accounts do not actively perform transactions, so SoD is not directly compromised. Option C is wrong because system performance degradation from a few thousand disabled accounts is negligible in modern ERP databases; the real risk is security, not resource consumption. Option D is wrong because audit trail completeness is not affected—disabled accounts still generate logs for access attempts, and deletion would actually remove historical audit records, whereas disabling preserves them.

Why this answer

How to eliminate wrong answers

Option B is wrong because ensuring compliance with laws and regulations is a secondary objective of IT governance, not the primary purpose; compliance is typically addressed through specific controls and policies within the framework, but the framework's overarching goal is strategic alignment. Option C is wrong because protecting IT assets from cyber threats is a function of information security management and risk management, which are components of governance but not its primary purpose; governance focuses on direction and oversight, not operational security. Option D is wrong because reducing IT operational costs is a potential outcome of effective governance, but it is not the primary purpose; cost reduction is a tactical benefit, whereas governance is fundamentally about value creation and strategic alignment.

Why this order

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a Data Loss Prevention (DLP) solution is primarily a detective and corrective control that monitors and blocks data exfiltration after access has occurred; it does not prevent the initial unauthorized access to sensitive files. Option B is wrong because background checks are a pre-employment screening control that assesses trustworthiness but do not prevent an already-hired employee from subsequently accessing files without authorization. Option D is wrong because enforcing strong password policies only strengthens authentication at the point of login; it does not prevent an authorized user from abusing their legitimate credentials to access files they should not see, which is the core issue in this scenario.

Why this order