Certified Information Systems Auditor CISA (CISA) — Questions 226–300

A nightly full backup means up to 24 hours of data could be lost, far exceeding the 15-minute RPO, and weekly offsite shipment means recovery after a site loss could depend on tapes that are days old. This is the most significant finding because the strategy cannot meet the defined recovery objectives at all, leaving the business exposed to substantial data loss and extended outage.

A service desk exists to give users one consistent entry point for logging incidents and service requests, ensuring nothing is lost across multiple channels. This single-point-of-contact function is its defining purpose, distinct from resolution, which second-level and specialist teams perform.

A crisis management team with defined roles ensures that during a disaster, there is clear leadership and decision-making. This addresses the gap in roles and responsibilities. The team should include representatives from IT, business units, and communications. Clear authority helps avoid confusion and delays. This is a key recommendation to improve the ITSCP's effectiveness and alignment with the BCP.

The effectiveness of controls over the completeness and accuracy of the evidence directly impacts its reliability. If the system that generates the evidence lacks proper controls, the evidence may be incomplete or inaccurate. The auditor must assess whether the controls ensure the data is reliable. This is a core consideration in IS auditing, as evidence from systems with strong controls is more trustworthy.

Permanent files hold enduring reference material relevant across multiple audits, such as organisational charts, policies and system inventories. An IT department organisational chart retains ongoing relevance to governance and segregation-of-duties assessments, unlike current-year working papers that are superseded each engagement.

A shared Layer 2 domain means hosts in the corporate VLAN and the CDE can communicate at the data-link layer, bypassing the firewall that was intended to be the sole control point. An attacker on a compromised workstation could reach CDE hosts directly via ARP and MAC-level traffic, defeating the segmentation the organization believes is in place. This is the most severe issue because the compensating control does not actually enforce the separation it claims to provide.

A falling recurrence rate evidences root cause elimination rather than repeated firefighting, showing problems are fixed permanently. This directly satisfies the effectiveness indicator, since volume alone or speed of closure does not prove the process prevents incidents from returning.

Outsourcing transfers code and data to a third party, so the auditor's primary concern is safeguarding intellectual property and confidential data through contractual controls, access restrictions and monitoring, since loss or misuse directly threatens the organisation's assets and compliance obligations.

SSO lets users authenticate once and access multiple systems through a trusted identity provider, centralising credential verification. It is a core IAM component because it reduces password sprawl while preserving authentication assurance across federated applications.

Defined KPIs with reporting frequency make the provider's performance measurable and enforceable, directly satisfying the SLA's need for objective, auditable service commitments. Without quantified metrics and a stated reporting cadence, the organisation cannot verify delivery, trigger remedies, or evidence due diligence to auditors assessing third-party management.

Containerisation creates a managed, encrypted work partition on the employee-owned device, isolating corporate applications and data from the personal profile. A selective wipe then removes only the container's contents, leaving personal photos, messages and apps untouched, satisfying the policy's requirement to protect corporate data without affecting personal data.

Elevating the data center floor above the expected flood level is a preventive physical control that directly reduces the risk of floodwater reaching the equipment. By placing the data center on a higher floor or raising the entire facility, water from a flood would need to rise significantly before affecting operations. This is the most effective way to mitigate flood risk, as it addresses the threat at its source by keeping water out.

Strategic alignment ensures IT investments and initiatives directly support organisational objectives, satisfying the governance requirement to link technology decisions with business strategy. COBIT and ISO/IEC 38500 both identify this linkage as a core governance component, distinct from operational execution, because governance must direct where IT resources are deployed rather than merely manage their day-to-day running.

ISACA IT Audit Standards require that auditors possess or obtain the competencies necessary to perform the engagement. When a team member lacks the technical skill to evaluate a control, the auditor should either ensure appropriate training or bring in a qualified specialist. This preserves the integrity of the audit opinion and complies with the standards' competence requirement, rather than accepting an inherent limitation.

Offline backups taken before the attack remain unencrypted and unreachable by ransomware, satisfying the requirement to minimise data loss. Unlike replicas or online backups, which may also be encrypted or corrupted, offline media preserves a clean recovery point, enabling restoration of critical files without paying the ransom.

Re-performance involves the auditor independently executing the control procedure or calculation and comparing the result with the organisation's own performance. This directly satisfies the stem's constraint of independently verifying effectiveness, unlike inspection or observation, which only confirm that a control exists or was performed.

Retention schedules ensure data is deleted when no longer needed.

Before relying on a SOC 2 report, the auditor must confirm that its scope covers the relevant trust services criteria and systems, that the period aligns with the audit period, and that the opinion is unqualified or appropriately qualified. Only then can the auditor assess whether the report provides sufficient evidence. Using the report without this evaluation could lead to inappropriate reliance.

Reviewing learning management system completion records provides direct, timestamped evidence that each employee finished the annual training, satisfying the policy's compliance verification requirement. Unlike interviews or observation, which sample behaviour, the LMS record is authoritative and auditable per employee, enabling exception reporting for those overdue.

Once a vendor ends support, no further security patches or vulnerability fixes are released, leaving known exploits permanently unpatched on production servers. This exposes the organisation to compromise and non-compliance, since compensating controls cannot fully substitute for vendor-supplied remediation.

Unannounced inspections provide direct, first-hand evidence of whether sensitive documents and media are actually secured when staff leave workstations, satisfying the need to verify real compliance rather than assumed adherence. Announced checks or policy reviews only confirm intent, not operational practice.

The any-any rule grants broad internal-to-DMZ access with no business justification, violating least privilege and expanding the attack surface. Removing it and verifying no impact eliminates the exposure while confirming that no legitimate dependency remains.

Halting go-live addresses the root governance failures: unsigned business requirements and incomplete UAT with unresolved critical defects. Proceeding would expose the institution to regulatory breach and data corruption, so the auditor must recommend remediation before implementation rather than accepting post-implementation fixes.

Successful phishing attacks measure actual user behaviour under real adversarial conditions, directly evidencing whether awareness training changed outcomes. Completion rates and quiz scores reflect attendance, not resistance, so a sustained reduction in successful phishing satisfies the stem's effectiveness indicator by demonstrating transferred vigilance rather than passive knowledge.

Verbal approval of frequent scope changes bypasses formal change control, the mechanism that preserves baselined scope, cost and schedule. This directly evidences weak governance, since the stem asks for indicators of poor project governance: undocumented, unauthorised scope creep escapes audit trail and steering committee oversight.

Frameworks like COBIT emphasize risk management.

A rule permitting any service from the Internet to the internal network exposes every internal host and port to unrestricted external access, effectively bypassing perimeter segmentation. This is the most severe finding because it enables broad exploitation, far exceeding risks from individual permissive rules.

A valid vendor certificate means the binary passes signature checks, so detection relies on behaviour rather than reputation; malicious code signed with a compromised or misused certificate is signed malware. This matches the stem's trusted-signature-but-malicious-execution scenario.

A duplicate username violates the UNIQUE constraint on the USERS table, causing the insert to fail and the application to log the resulting database error. This directly satisfies the stem's constraint: the logged error stems from a rejected insert, not from authentication, connectivity or permission issues elsewhere.

When one person can initiate, approve and record a transaction, no independent check exists, enabling fictitious vendors, duplicate payments or unauthorised adjustments to pass undetected. This is the classic fraud exposure that segregation of duties controls are designed to prevent.

RBAC grants permissions through roles, so a transfer creates risk of accumulated privileges. Revoking all prior access and assigning only the new department's role permissions enforces least privilege and prevents the employee retaining unnecessary rights from the previous position.

Penetration testing actively simulates real attacks against the payment application, exposing exploitable vulnerabilities in authentication, input handling and cardholder data flows. This directly validates security controls, which functional or unit testing cannot, making it most critical before release.

Simulations test and improve behavior.

Without regular updates on remediation status, the audit committee cannot hold management accountable for resolving audit findings. This increases the likelihood that significant control weaknesses remain unaddressed, exposing the organization to unresolved risks. The audit committee's oversight role is critical to ensuring that management takes corrective action, so this is the most direct and significant risk.

Alignment directs funding and resources toward initiatives that deliver measurable business value, so IT spend directly supports strategic goals. This satisfies the stem's requirement for the primary benefit of linking IT strategy to business strategy.

The SLA defines which party owns network bandwidth and performance thresholds. Before evaluating the vendor's claim, the auditor must establish contractual responsibility, since that determines whether the shortfall is a vendor breach or a client-side infrastructure issue.

The hypervisor management interface is a high-value target because it controls the entire virtual infrastructure. If an attacker accesses it with default credentials, they can potentially shut down, modify, or create virtual machines, and even move laterally to other systems. This could lead to a complete compromise of all hosted workloads, data breaches, and service outages. This is the most critical risk because it affects the entire virtual environment, not just a single VM.

Adopting a governance framework spanning all IT-related activities and stakeholder needs directly satisfies COBIT 2019's alignment principle, since the framework cascades enterprise goals into IT objectives and defines decision rights, accountability and performance measurement across every domain, ensuring IT strategy remains traceable to business intent rather than isolated departmental priorities.

Proceeding to Europe while the Asia synchronisation fault remains undiagnosed risks replicating the defect across regions and compounding data integrity issues. Root cause analysis first satisfies the audit objective of confirming the phased roll-out is controlled before further deployment, rather than masking an unresolved defect.

Because the project is on time and on budget yet benefits are not materializing, the gap is in benefits management, not delivery. A formal benefits realization plan assigns accountability for outcome metrics and establishes periodic measurement so deviations trigger corrective action. This directly addresses the governance objective of ensuring IT investments deliver value, which is exactly what the CIO asked the auditor to assess.

Encryption applies cryptographic protection to customer data both at rest and in transit, directly meeting the stem's dual requirement. At rest, it renders stored records unreadable; in transit, TLS or similar protects data moving between the browser and web server.

Security awareness training addresses the human behaviour behind documents left on desks, teaching staff classification handling and the clean desk requirement. It complements procedural controls by changing the culture that causes the exposure the auditor observed.

Logging the defect and performing impact analysis before approving a fix ensures the incorrect interest calculation is properly assessed against scope, dependencies, and financial risk. This satisfies the UAT control requirement, preventing hasty changes that could introduce further errors into a financial application.

The change advisory board's primary function is to assess each change's risk and impact, prioritise it against other changes, and authorise or reject it, satisfying the stem's focus on the change management process. Implementation and post-implementation review sit with other roles, not the CAB.

In a decentralised organisation, coverage should be prioritised by a risk assessment weighing inherent risk against control effectiveness across business units. This directs limited audit resources to the units with the greatest residual exposure, satisfying the stem's requirement for the most appropriate prioritisation factor.

Automated licence optimisation tools continuously reconcile installed software against entitlements, reclaiming unused seats and flagging over-deployment before true-up audits. This directly satisfies the stem's consideration of ongoing licence management, since manual tracking cannot scale across large estates and typically causes compliance breaches or unnecessary spend.

Ensures changes are authorized before implementation.

Documenting and approving security requirements during the requirements phase ensures controls are baselined before design and coding begin. This satisfies the stem's constraint that security requirements be formally documented and approved at the earliest phase, preventing costly retrofitting later.

The design phase translates requirements into technical specifications, so designing security controls here embeds confidentiality, integrity and availability measures into the solution before coding begins. Addressing security at design prevents costly retrofitting and satisfies the SDLC control objective of proactive risk mitigation.

Aligning IT strategy with business strategy ensures IT investments, staffing and budgets target the organisation's actual priorities. This directly produces improved resource allocation, since resources flow to initiatives that demonstrably support business objectives rather than isolated technical goals.

Pseudonymisation replaces direct identifiers but retains a key enabling re-identification, so the data remains personal data under GDPR and its protections still apply. This limits the control: it reduces risk but does not remove the organisation's compliance obligations.

Complexity of the cloud architecture directly elevates inherent risk, since intricate multi-tenant, hybrid or interconnected designs enlarge the attack surface and obscure control gaps before any mitigation exists. It satisfies the stem's inherent-risk constraint by capturing design-driven uncertainty the auditor must weigh independently of implemented controls.

Without forecasting or trend analysis, capacity shortfalls during predictable peaks such as month-end can lead to resource exhaustion, causing outages or severe performance degradation. This directly threatens service availability and business operations. The risk is significant because the organization already experiences high utilization and has no forward-looking process to anticipate and remediate capacity constraints before they impact users.

Embedding SoD rules into role-based access controls means the ERP enforces conflicting-duty separation at design time, preventing toxic combinations such as creating a vendor and approving its payment. Configuring this during implementation satisfies the stem's concern before go-live.

MDM with containerization separates corporate data into an encrypted, policy-controlled workspace on the personal device, leaving personal apps outside its scope. This directly satisfies BYOD's core constraint: protecting corporate information on hardware the organisation does not own, while enforcing selective wipe and access controls without erasing employees' personal content.

PAM with approval workflows and session recording would have blocked or flagged the database administrator's credential use for bulk export, since it enforces just-in-time elevation and logs privileged sessions. MFA and DLP failed because the access was internal and encrypted.

A post-implementation review compares actual outcomes against the business case after a system goes live, determining whether the projected benefits, costs and objectives were realised. This assessment informs corrective action and improves future project justification.

Centralised management and monitoring consolidates privileged accounts into a controlled vault, enabling credential checkout, session recording and anomaly detection. This directly addresses the core PAM objective of curbing unmonitored, standing administrative access across the estate.

Training and awareness sessions translate the new policy into employee understanding, directly satisfying the compliance constraint that staff must know what the policy requires before they can follow it. Without this, controls and monitoring address ignorance rather than intent, so awareness is the foundational step for achieving consistent adherence.

Signature files that are 47 days stale mean newly discovered malware families and variants cannot be detected by the endpoint control. This directly defeats the preventive purpose of the anti-malware solution and represents a material gap in the protection of information assets. The auditor should report this as the primary concern because it exposes the organization to known, circulating threats.

Interviews and documentation review are core planning techniques used to understand the IT environment, including infrastructure, applications, and control processes. They help the auditor identify risks and design an appropriate audit programme. ISACA standards emphasize obtaining sufficient knowledge of the area under review during planning, and these techniques efficiently provide that understanding before fieldwork begins.

User acceptance testing is performed by business users against real workflows, confirming the system satisfies stated business needs rather than merely matching technical specifications. Unit, integration and system testing verify code and interfaces; only UAT directly satisfies the stem's constraint of validating fitness for business purpose before go-live.

Outsourcing data centre operations transfers processing to a third party, so the board must secure contractual regulatory compliance and audit rights. These clauses preserve oversight and evidence-gathering ability, satisfying the governance obligation for accountability over outsourced services.

Complexity of transactions is a direct indicator of inherent risk because intricate processes and calculations are inherently more susceptible to errors or misstatements, even before considering internal controls. For a financial system, highly complex transactions, such as those involving derivatives or multi-currency conversions, present a greater predisposition to material misstatement. An IS auditor must recognise this increased susceptibility when assessing the risk profile of the system.

Reconciliation controls compare source and target records, detecting omissions, duplications and value mismatches introduced during migration. This directly satisfies the stem's data integrity constraint, since completeness and accuracy of migrated financial data are verified before the new system goes live.

Password history records previously used hashes, so raising it to 10 prevents users from cycling back to any of their last ten passwords. This directly blocks the reuse weakness the auditor identified, forcing genuinely new credentials at each change.

RAID 5 tolerates only one simultaneous disk failure, storing parity across all member disks. With one disk already failed, the array runs in degraded mode with no redundancy; a second failure during rebuild leaves insufficient parity to reconstruct missing data, so the volume is lost. This satisfies the stem's double-failure constraint.

Measurable makes the recommendation verifiable: it specifies a quantifiable metric or threshold so the auditee and auditor can objectively confirm whether the action was implemented and effective, satisfying the SMART criterion that otherwise leaves recommendations unverifiable.

Automated enforcement ensures compliance by preventing access until the AUP is acknowledged. This is the best recommendation because it addresses the root cause—human error or process bypass—and provides a preventive control. Manual reminders or training alone are less effective. Automated enforcement is a standard practice for ensuring policy compliance at scale.

A mantrap permits only one person through an interlocking door sequence at a time, physically preventing an unauthorised individual from following an authenticated person. This directly satisfies the stem's constraint by eliminating the single-entry tailgating vector that badge readers alone cannot address.

P1 denotes the highest priority, reserved for incidents causing critical business impact or major service outage, demanding immediate response and continuous effort until resolution. This matches the ITIL priority matrix, where priority derives from impact and urgency, so P1 definitions must reflect severe disruption requiring escalation.

Tracking utilisation trends over time reveals gradual growth before thresholds are breached, enabling forecasting and timely scaling. This satisfies the stem's requirement for proactive capacity management, since trend analysis anticipates future demand rather than reacting to incidents. Point-in-time monitoring alone would be reactive, whereas historical baselines support informed planning decisions.

The regulation's own text supplies the authoritative criteria against which compliance is measured, since the audit tests conformity with those mandated requirements rather than internal policy or generic frameworks. It directly satisfies the stem's demand for the primary source of audit criteria in a regulatory compliance audit.

A tabletop exercise walks participants through a simulated incident, testing decision-making, roles, communication and plan completeness without production disruption. This validates the IR plan's effectiveness against the stem's requirement, unlike reviewing documentation, which only confirms the plan exists.

Chain-of-custody logs with signed handoffs demonstrate that the sealed containers were tracked from pickup to delivery, providing direct evidence that physical protection was maintained during transit. This is the strongest audit evidence available for the transit leg of the media lifecycle, since the auditor can trace each tape shipment and confirm no unaccounted gaps or broken seals occurred.