Certified Information Systems Auditor CISA (CISA) — Questions 301–375

The CAB is responsible for reviewing and approving changes, assessing risks, and ensuring proper planning and testing.

Risk assessment should consider the inherent risk of each unit, including financial impact, complexity, and past issues, to prioritize high-risk areas.

Software Asset Management (SAM) ensures license compliance and cost optimization. Regular compliance audits prevent legal and financial penalties. License optimization helps avoid over-purchasing or under-licensing.

Requiring change management approval for all production changes is a preventive control that ensures every modification to production data is formally authorized, reviewed, and documented before implementation. This directly prevents unauthorized changes by enforcing a gatekeeping process where only approved changes proceed, reducing the risk of data integrity breaches. Without this control, even with other safeguards, an attacker or insider could bypass technical controls by simply requesting a change through official channels.

Architecture review, threat modeling, and designing security controls are key design-phase controls to ensure security is built in.

The primary benefit of aligning IT strategy with business strategy is improved resource allocation (Option B). This alignment ensures that IT investments and projects are directed toward activities that directly support business goals, maximizing value and minimizing waste. While increased technical efficiency (Option A), reduced IT costs (Option C), and enhanced security posture (Option D) are possible outcomes, they are not the primary benefit; they are secondary benefits that may result from proper alignment.

Pseudonymisation reduces the link between data and an individual but does not fully anonymize the data; the pseudonymised data remains personal data if the pseudonym can be reversed using additional information held separately.

Inherent risk is the risk without controls. Factors include complexity, data sensitivity, and changes in the environment.

Configuring SoD rules within the ERP system helps enforce segregation and prevent conflicts during operations.

Mobile Device Management (MDM) with containerization creates a separate, encrypted workspace on the employee's device that isolates corporate data from personal data. This ensures that the organization can enforce security policies (e.g., remote wipe, access controls) on the corporate container without affecting the user's personal information, which is critical for BYOD environments where full-device control is not feasible.

The primary purpose of a post-implementation review (PIR) is to determine whether the system or project has delivered the expected business benefits, such as improved efficiency, cost savings, or enhanced functionality. This aligns with the IS auditor's focus on value realization and governance, ensuring that the investment achieved its intended objectives before the project is formally closed.

PAM tools primarily help control and monitor the use of privileged accounts, thus reducing the risk of misuse by enforcing policies like session recording and just-in-time access.

Compliance depends on employees understanding the policy and knowing what is expected. Training and communication are critical to raise awareness and ensure adherence.

User acceptance testing (UAT) is the final phase of testing where actual end-users validate the system against real-world business requirements and workflows. It confirms that the system meets the agreed-upon business needs, functional specifications, and operational criteria before production deployment. Unlike technical testing phases, UAT focuses on business process alignment and user satisfaction.

Mean time to repair (MTTR) measures the average time taken to restore a failed IT service or component, directly reflecting operational efficiency and incident response effectiveness. It is a standard KPI for IT operations because it quantifies the speed of recovery, which is critical for minimizing downtime and maintaining service levels.

Inherent risk is the susceptibility to misstatement before considering controls. Complexity of transactions and volume of transactions increase inherent risk. Control effectiveness is part of control risk, and auditor experience relates to detection risk.

Reconciliation controls between source and target systems are the most critical control for ensuring data integrity during migration because they provide a systematic method to verify that every record has been accurately transferred without loss, duplication, or corruption. This typically involves comparing record counts, hash totals, or checksums (e.g., using MD5 or SHA-256) between the legacy and new databases, and flagging any discrepancies for correction before the system goes live.

Increasing the password history setting (e.g., to 10) prevents users from reusing their most recent passwords by storing a specified number of previous password hashes. When a user attempts to change their password, the system compares the new password against the stored history and rejects it if it matches any of the remembered passwords. This directly addresses the weakness of easy password reuse.

The planned remediation (e.g., an automated code review tool) does not ensure that the developer who writes the code is different from the person who reviews it. This fails to address the root cause of segregation of duties, making it the most significant weakness. Options A, C, and D are either less critical or not as directly related to the core issue.

RAID 5 can tolerate a single disk failure. If a second disk fails during rebuild, the array is broken and data loss occurs.

SMART stands for Specific, Measurable, Achievable, Relevant, Time-bound.

The IdP is the authoritative source for authentication events in a SAML 2.0 federated identity model. The cloud platform only receives and logs successful SAML assertions, so it cannot log failed login attempts. Enabling detailed logging on the IdP for all authentication attempts (successes and failures) and forwarding those logs to the SIEM provides the necessary visibility into brute-force attacks without changing the platform or architecture.

A mantrap requires one person to enter at a time and prevents unauthorized individuals from following an authorized person through a door.

Effective proactive capacity management includes monitoring trends to forecast future needs and setting threshold alerts to trigger action before capacity issues occur. Analyzing historical costs is financial, not capacity; reviewing backup logs is operational; conducting BIA is for BCP.

For a compliance audit, the criteria are the specific requirements of the regulation or law that the organization must adhere to.

The most critical deficiency because without an account lockout policy, the system is vulnerable to brute-force password guessing attacks. Even if other controls like SSH key authentication are missing, a lockout policy is a fundamental defense that directly mitigates repeated login attempts, which is a primary attack vector for gaining unauthorized access.

Tabletop exercises simulate real incidents and allow the team to practice their response, revealing gaps in the plan and coordination.

The backup policy shows a retention period of only 30 days, which is insufficient to meet common regulatory requirements such as GDPR, HIPAA, or SOX that often mandate retention of critical data for months or years. Without adequate retention, the organization risks non-compliance, legal penalties, and inability to produce historical records during audits or litigation.

End-of-life software no longer receives security patches from the vendor, meaning any newly discovered vulnerabilities will remain unaddressed. This creates a direct and exploitable attack surface, making lack of security patches the most significant risk because it can lead to data breaches, system compromise, and regulatory non-compliance.

The requirements analysis phase is where stakeholder needs are formally captured and documented. Without key stakeholder involvement, the project lacks a validated baseline of what must be built, leading to misaligned objectives and scope creep. The IS auditor’s finding directly points to a failure in this phase, as it is the only SDLC phase that defines the project’s success criteria from the user’s perspective.

Segmentation limits the spread of attacks by isolating sensitive systems.

The learning and growth perspective in a balanced scorecard focuses on employee capabilities, skills, and training.

The core issue is that the IT manager lacks the business process knowledge to assess whether role combinations create segregation of duties (SoD) conflicts. Company policy explicitly requires SoD reviews to be performed by business process owners. Assigning the access review to business process owners from each department (Option C) directly aligns with policy and ensures that those with functional knowledge evaluate whether role assignments violate SoD rules, such as a user having both 'create purchase order' and 'approve purchase order' roles.

P1 incidents are critical and require immediate resolution. With a 4-hour SLA from the time of reporting (10:00 AM), the resolution must occur by 2:00 PM.

Fieldwork involves executing audit procedures; walkthroughs and testing controls are part of fieldwork.

Encryption safe harbor only applies if encryption meets specific standards; gaps in key management can invalidate safe harbor.

Offsite storage of backup media (Option B) is essential because it protects against site-level disasters such as fire, flood, or physical theft. Without geographic separation, a single incident could destroy both the primary data and its backups, making recovery impossible. This control directly supports the recoverability objective by ensuring a usable copy exists outside the primary facility.

In waterfall, each phase ends with a formal sign-off; the requirements phase is critical to ensure business needs are documented and approved.

Mandatory approval workflows for purchase orders above a threshold are critical because they enforce a policy-based control that prevents unauthorized high-value purchases by requiring explicit authorization from a designated approver. This control is designed into the system to intercept transactions that exceed a predefined limit, ensuring that no single user can bypass financial authority limits.

Without identified data owners, no one is accountable for classifying, protecting, or granting access to data assets. This foundational gap undermines the entire data classification policy, making it impossible to enforce controls like encryption or access reviews. The CISA emphasizes that data owner assignment is the first step in any data governance framework.

The regex pattern '.*' in the resource block is overly permissive and could match unintended tables beyond the intended 'sales_' prefix. In AWS IAM policies, the resource element uses regex-like patterns, and '.*' after 'sales_' would match any characters, including tables like 'sales_archive_private' or 'sales_2024_sensitive', potentially exposing sensitive data. This violates the principle of least privilege and is a critical control issue.

Insufficient incident notification procedures are the most significant control failure because they directly undermine the entire incident response lifecycle. Without defined notification procedures, even if monitoring, alerting, and response are technically sound, the right stakeholders (e.g., CISO, legal, PR, regulators) may never be informed, leading to regulatory non-compliance, reputational damage, and failure to meet breach notification laws like GDPR Article 33 or SEC cyber rules. This procedural gap creates a systemic failure that cannot be compensated by technical speed alone.

Audit engagement follows: planning (scope, program), fieldwork, analysis, and reporting with management review.

Mantraps and turnstiles are designed to prevent tailgating by allowing only one person per entry.

If known errors are causing P1 incidents, problem management should have identified workarounds or permanent fixes. The fact that these incidents recur indicates a weakness in the problem management process, which should reduce incidents from known errors.

The sprint review is a key control in agile to demonstrate completed work to stakeholders and obtain feedback. It serves as a form of user acceptance testing and helps ensure the product meets stakeholder needs.

In an RFP for a new system, including the vendor's financial stability information (B) is critical to assess the vendor's long-term viability and ability to support the system over its lifecycle. This helps mitigate the risk of vendor failure or bankruptcy, which could disrupt operations and leave the organization with an unsupported system.

The S3 bucket policy includes a condition `aws:SecureTransport` set to `true`, which explicitly denies any request that is not made over HTTPS. The `Effect: Allow` on the `Principal: "*"` grants anonymous read access, but the `Condition` block ensures that only HTTPS requests are permitted, making anonymous read access allowed only over HTTPS.

Reviewing the system configuration against user requirements (option B) is the correct first step because it directly addresses the root cause of incorrect report generation by verifying alignment with documented requirements. Conducting new user acceptance testing (option A) is premature without understanding the configuration issue; disabling reports (option C) and patching (option D) are reactive and skip necessary diagnosis.

Segregation of duties between development and production environments ensures that code cannot be directly moved from development to production without independent review and testing. This control prevents unauthorized or untested code from affecting live systems, which is a fundamental principle of change management. Without this separation, a developer could introduce malicious or defective code directly into production, bypassing all quality and security checks.

The most appropriate recommendation is to configure the server to archive logs to a centralized log management system. This ensures logs are preserved beyond the 24-hour overwrite window by sending them to a separate, persistent storage location, which also supports security monitoring, forensics, and compliance requirements. Centralized logging (e.g., using syslog, SIEM, or a dedicated log collector) provides redundancy, integrity checks, and long-term retention without relying on the local server's limited storage.

User acceptance testing (UAT) is the final phase of the testing lifecycle where actual end-users validate that the system fulfills their business requirements and is ready for production deployment. Unlike technical testing types, UAT focuses on real-world workflows, data accuracy, and usability to confirm the system meets the agreed-upon acceptance criteria.

UAT should be performed by actual end users using real data to validate business requirements.

A change request should include a test plan to verify the change works as intended and a rollback plan to revert if the change fails. These are critical for risk management and governance.

In a financial system implementation, low-severity issues that do not impair core financial processing or controls can be accepted as known risks. Documenting them with a remediation plan and proceeding with go-live aligns with ISACA’s guidance that UAT sign-off does not require zero defects, only that critical and high-severity defects are resolved. This approach balances business needs with risk management, avoiding unnecessary delays while ensuring accountability through formal risk acceptance.

Key rotation ensures that if a key is compromised, only data encrypted with that key after a certain point is at risk; data encrypted with previous keys remains protected if those keys are properly destroyed.

The appropriate action is to formally accept the risk through a documented risk acceptance process, with sign-off from management. This ensures accountability and awareness. The other options are either premature or inappropriate.

Based on sample results, the error rate is 2.5%, which can be projected to the population with a confidence level.

Emergency changes require a documented rationale and timely post-implementation review to ensure proper authorization and minimal risk.

Re-performance and inspection of audit logs provide direct evidence of control effectiveness.

The log clearly indicates the target directory is full. Options A, B, C are not indicated in the log.

Data retention and disposal schedules are essential to a data classification program because they define how long each classification level of data must be retained and the secure methods for its disposal (e.g., degaussing, cryptographic erasure, or physical shredding). This ensures that data is not kept beyond its useful life, reducing the risk of unauthorized access or legal non-compliance. Without these schedules, the classification program lacks the lifecycle management component necessary for operational security.

In agile development, security and compliance requirements like segregation of duties (SoD) must be addressed as early as possible, especially for a financial application where regulatory compliance is critical. Delaying SoD to a future sprint introduces significant risk and violates the principle of 'secure by design.' The IS auditor's best recommendation is to insist that SoD be implemented in the next sprint, ensuring that the control is prioritized and integrated into the development lifecycle without waiting for an indefinite future iteration.

Configuring file-level permissions (e.g., NTFS permissions on Windows or POSIX ACLs on Linux) is the most cost-effective control because it directly restricts which users or groups can read, write, or modify specific files and folders on the server. This granular access control prevents unauthorized access without requiring additional hardware or complex management, making it ideal for a small business with limited budget.

Deploying a DLP solution in monitor-only mode allows the organization to observe what data is being transmitted and generate alerts without blocking any traffic. This enables security teams to analyze the alerts against actual business workflows, fine-tune policies, and eliminate false positives before moving to an active enforcement mode. It is a best practice for initial deployment to avoid disrupting legitimate business operations.

If managers approve access without verifying actual job requirements, the recertification process is ineffective. This indicates a rubber-stamping issue. The other options are less critical or address different aspects.

To restore from incremental backups, you need the last full backup (Sunday) and all incremental backups from Monday through Wednesday.

The most significant finding is that the IOS version is outdated and may contain security vulnerabilities. An outdated IOS version can have known exploits that compromise the router's security, which is a critical risk for the organization. While other options describe operational states, they do not present the same level of immediate security threat as running unsupported or vulnerable firmware.