Certified Information Systems Auditor CISA (CISA) — Questions 301–375

Differing data protection, privacy, and financial reporting rules across jurisdictions force the framework to reconcile incompatible mandates, which is the central governance obstacle. A single global policy cannot satisfy every regulator simultaneously, so conflicting requirements are the most likely challenge.

End-of-life software no longer receives vendor security patches, so known vulnerabilities remain unmitigated and exploitable. This is the most significant risk because it directly exposes the organisation to compromise, outweighing the lesser concerns of reduced support or licence compliance.

Stakeholder involvement is a requirements analysis activity; excluding them there produces unvalidated, incomplete requirements that cascade into a project failing its objectives. The neglected phase is therefore requirements analysis, where elicitation and sign-off should have occurred.

Segmentation places enforcement points between network zones, so a compromised host cannot freely reach other systems. This directly satisfies the containment constraint: it restricts lateral movement, limiting blast radius and buying incident responders time before the attacker pivots to critical assets.

The learning and growth perspective covers the intangible enablers of the other three perspectives, specifically staff competencies, training and skills development. It is the only balanced scorecard perspective addressing IT employee capabilities, so metrics on training and skills sit here rather than in business value, user orientation or operational excellence.

This is the most significant risk because without a capacity plan, the organization cannot proactively address resource constraints. High utilization and I/O wait times indicate the server is near its limits, and any further growth or unexpected demand could cause performance degradation or outages, directly impacting SLAs.

Business process owners hold the job-function knowledge needed to judge whether assigned roles are appropriate, and policy already mandates their involvement in segregation of duties reviews. Delegating the quarterly review to them satisfies that requirement and enables detection of toxic role combinations the IT manager cannot assess.

Resolving by 2:00 PM satisfies the four-hour SLA window starting at 10:00 AM, giving the critical incident team the full mandated response period. Any later resolution breaches the defined service commitment, triggering escalation and SLA penalty provisions under the organisation's incident management process.

Testing controls occurs during fieldwork, where the auditor executes procedures such as inspection, inquiry, observation and re-performance to gather evidence supporting the preliminary control effectiveness conclusions formed during planning, directly satisfying the stem's fieldwork requirement.

Storing keys alongside ciphertext collapses the two-party separation encryption depends on: anyone gaining server access obtains both data and keys, rendering encryption ineffective. This defeats HIPAA's safe harbour premise, which assumes keys remain protected and separate, so a single compromise exposes all protected health information.

Offsite storage places backup media beyond the reach of site-specific events such as fire, flood or theft that could destroy both production systems and locally held copies. This satisfies the recoverability requirement by ensuring a surviving copy exists after a site-wide disaster.

Requirements are baselined and formally approved by the business owner before design begins, since later phases build directly on that frozen scope. Sign-off here authorises the project to proceed, whereas design and testing approvals occur within their own phases.

Mandatory approval workflows enforce segregation of duties, ensuring purchase orders exceeding a defined threshold require authorised sign-off before commitment. This directly prevents unauthorised purchases by blocking orders that lack the required approval chain, satisfying the design-phase control objective.

Without identified data owners, no one is accountable for classifying, protecting or authorising access to data assets, undermining the entire classification policy. This governance gap is more critical than documentation or labelling weaknesses because ownership underpins every subsequent control.

Ransomware commonly spreads to connected backup systems, so isolating backups from production and verifying that restoration actually works are essential controls. An untested or network-accessible backup may be encrypted along with production data. Confirming both isolation and successful restoration directly demonstrates whether the organization can recover without paying a ransom.

A mantrap with interlocking doors physically admits one person per cycle, so a second individual cannot follow through before the first door closes. This directly satisfies the stem's requirement to prevent unauthorised tailgating, unlike detective controls such as CCTV, which record the breach only after entry has occurred.

Known errors in the KEDB should drive permanent fixes through problem management, eliminating recurrence. Resolution averaging six hours against a four-hour SLA, with recurring known errors, shows problem management is not converting KEDB entries into root-cause resolutions.

The sprint review inspects the completed increment against acceptance criteria, giving stakeholders tangible evidence of progress and a forum to raise issues. This transparency lets auditors verify that delivered functionality matches requirements rather than relying solely on documentation.

Comparing system configuration against documented user requirements establishes whether the reporting defects stem from misconfiguration or from requirements never implemented. This diagnostic step precedes remediation, ensuring recommendations target the actual cause rather than merely retraining users or patching reports.

Deploying DLP in monitoring mode first establishes a behavioural baseline of sensitive-data flows without blocking legitimate business activity. This satisfies the stem's requirement for effective deployment by revealing false positives and policy gaps before enforcement, letting the organisation tune rules and classify data accurately prior to switching to active blocking.

Because inline prevention sits directly in the traffic path, a misclassified signature, a capacity limit, or a hardware fault can drop legitimate sessions for every user behind it. Availability of business services becomes dependent on the IPS tuning and resilience. This is the most significant operational risk and explains why fail-open design, bypass, and staged tuning are essential before enforcement mode is enabled.

Segregation of duties between development and production prevents developers from promoting their own code, which is the control that most directly mitigates unauthorised or untested changes. Verifying this separation confirms the change management process enforces independent review and approval before production deployment.

Forwarding logs to a centralised log management system preserves them beyond the server's 24-hour overwrite cycle, and typically enforces retention and access controls. Local archiving on the same server would still be vulnerable to the same overwrite and tampering risks.

User acceptance testing is executed by end-users themselves, directly satisfying the stem's requirement that testing be performed by end-users. It validates the system against business needs and real-world workflows rather than technical specifications, confirming fitness for purpose before go-live. This distinguishes it from unit, integration and system testing, which developers or testers conduct.

Effectiveness depends on testers representing real users exercising genuine business workflows against representative data. Business testers with realistic data validate that the system meets actual operational needs, whereas IT staff or synthetic data would miss usability and process gaps.

A test plan evidences that the change was verified before release, confirming the requester identified how functionality and related controls would be validated. Without it, governance cannot demonstrate that the change works as intended or that regression risk was assessed prior to production deployment.

Monitoring IT investment performance and benefits realization is a key governance responsibility of the IT strategy committee. By overseeing whether IT projects deliver expected value, the committee ensures accountability and supports continuous improvement. This oversight helps prevent wasteful spending and ensures that IT contributes to business success.

The board is ultimately responsible for IT governance, including risk oversight. By delegating all oversight to the CIO and only receiving annual summaries, the board has effectively abdicated its responsibility. This creates a governance gap where IT risks may not be adequately addressed at the highest level. The auditor should flag this as a significant deficiency because it undermines the principles of effective IT governance.

Five errors in 200 gives a 2.5% sample rate, and statistical projection applies a confidence interval around it. The range 1% to 4% reflects that sampling uncertainty, whereas a single point estimate would overstate precision.

Documenting each emergency change with justification and reviewing it promptly afterwards confirms the control operated: the change was authorised retrospectively and assessed, rather than bypassing governance entirely, which is the strongest evidence of proper control.

If the retention period is shorter than the investigation window defined by policy, evidence required to investigate incidents will be unavailable. Detection may occur, but without 90 days of logs the team cannot reconstruct the scope, timeline, or root cause of events that surface late. This is a direct conflict between a configured control and a documented requirement, making it the most concerning finding because it undermines incident response and forensic capability.

Re-performance of access provisioning using a test account lets the auditor independently execute the control and observe actual system behaviour, producing direct evidence. This satisfies the stem's requirement for the strongest evidence of access control effectiveness.

Retention and disposal schedules operationalise classification by defining how long each category is kept and how it is destroyed. Without them, labels carry no lifecycle consequence, so the programme cannot satisfy legal, regulatory or contractual retention constraints identified during classification.

Assigning and communicating explicit incident response roles, with named accountability, removes the confusion staff reported and gives the untested policy operational substance. This directly satisfies the governance gap the board identified, enabling escalation and stakeholder notification to function during future incidents.

Establishing a formal IT governance framework ensures that IT is aligned with business strategy and that the board provides oversight. This addresses the root cause: the CEO's view that IT is merely support and does not need board representation. A governance framework defines roles, responsibilities, and processes for IT decision-making, ensuring IT is managed as a strategic asset.

File-level permissions restrict access through the operating system's existing access control, requiring no new hardware or software spend. This directly satisfies the stem's cost-effectiveness constraint while preventing unauthorised access to the customer data on the local file server.

Monitor-only mode logs what the DLP policy would have blocked without enforcing it, letting analysts review alerts and tune rules against real traffic. This reduces false positives before enforcement, satisfying the requirement for the best initial deployment approach.

Without traceability from requirements to configuration items, the team cannot quickly determine which customizations support which business needs or which vendor patches will affect them. During an upgrade, this gap forces costly discovery work and increases the chance of breaking critical functionality. The greatest risk is therefore an inability to assess upgrade impact, which can delay patching and introduce production outages.

Managers rubber-stamping approvals defeats the review's purpose: recertification exists to confirm each user's access still matches current job requirements. Without that verification, excessive or stale entitlements persist, violating least privilege and undermining the control's effectiveness. This directly addresses the stem's concern about review effectiveness, unlike process timing or documentation issues.

Incremental backups capture only changes since the previous backup, so restoration requires the last full backup plus every incremental in sequence. Sunday's full plus Monday, Tuesday and Wednesday incrementals satisfies the stem's Wednesday failure scenario.

Portfolio management processes let the board prioritise and monitor IT investments against risk and value criteria, directly satisfying the stem's requirement. It provides the governance mechanism for balancing investment mix, whereas other components address resource, performance or compliance concerns.

ITIL-aligned requirements must be defined before tool selection, ensuring the ITSM solution supports incident management processes rather than forcing process change. A stakeholder process review establishes the business case the steering committee requires, addressing governance and alignment constraints.

Uptime measures how well resources were used to keep systems running, indicating efficiency, while missed deadlines show the department failed to achieve its objectives, indicating ineffectiveness. Efficiency and effectiveness are distinct axes, so the department can be efficient yet ineffective.

Unsigned requirements leave scope unbaselined, so later changes cascade through design, build and test with no approved reference point. In waterfall, defects introduced at requirements cost most to correct, and the missing sign-off removes the control that would otherwise catch stakeholder misalignment before construction begins.

Emergency changes bypassing subsequent CAB review leave the most critical control gap: changes reach production without retrospective scrutiny, risking undocumented, untested modifications to a financial application. Other findings are less severe because normal changes still receive approval before deployment.

Absent formal requests or approvals, no record exists linking an account to an authoriser or business justification. This defeats accountability and non-repudiation, leaving the auditor unable to reconstruct who granted access, when, or why — undermining investigation, disciplinary action and regulatory evidence.

Justification records the business or technical reason the change is needed, letting the Change Advisory Board weigh benefit against risk and cost. Without it, approvers cannot judge whether the change is warranted, so the document fails its decision-support purpose.

Separating development from testing prevents developers from validating their own code, reducing the risk that defects or unauthorised changes pass undetected. This segregation of duties is a fundamental SDLC control auditors expect within a well-managed development process.

Consequences of non-compliance give the acceptable use policy enforceable weight, satisfying governance's need for accountability. Without stated disciplinary or access-revocation outcomes, the policy remains advisory and staff face no deterrent. This directly supports the stem's governance objective by linking defined behaviour to measurable sanctions, ensuring violations are addressed consistently rather than left to managerial discretion.

Before optimizing auto-scaling or adjusting capacity, the organization needs accurate data on resource usage and performance. Monitoring tools provide visibility into when and why degradation occurs, enabling informed decisions. Without this baseline, any capacity changes are guesswork. The auditor should recommend establishing monitoring first as it is foundational to effective capacity management and will inform subsequent actions.

A non-representative pilot exercises only one region's data volumes, tax rules and integrations, so defects unique to other regions stay hidden until full rollout. The primary risk is therefore undetected issues elsewhere, defeating the pilot's purpose of validating the design organisation-wide.

Passing only 60% of UAT cases means 40% of tested business scenarios failed, so the system may not satisfy requirements and users will adopt manual workarounds that undermine controls and reporting integrity. This is the most significant risk.

Allowing RDP from any source IP exposes the server to brute-force attacks, credential stuffing, and exploitation of RDP vulnerabilities. The most appropriate recommendation is to restrict access to known trusted IPs or require users to connect via VPN, which adds an authentication layer. This reduces the attack surface and aligns with the principle of least privilege. It directly addresses the risk of unauthorized access.

Classification assigns sensitivity labels that determine which security controls apply, ensuring protection is proportionate to data value and regulatory requirements. It is the foundational input to control selection, not an end in itself; encryption, access rules and retention all derive from the assigned classification tier.

Availability equals MTBF divided by the sum of MTBF and MTTR: 200 / (200 + 20) = 200/220 = 0.909, giving 90.9%. The 20-hour repair window is the only downtime component, so the system is available for 200 of every 220 hours.

Security requirements must be captured alongside functional requirements so they are baselined and approved before design begins. Documenting them in the requirements phase lets the business owner formally accept them, preventing costly retrofitting of controls during coding or testing.

Requesting mitigation measures first addresses the high-risk profile before any acceptance decision, aligning residual risk with the moderate appetite. Identifying controls and their effectiveness gives the committee the information needed to approve, modify or reject the project.

Performance measurement and monitoring are essential to IT governance because they provide the means to assess whether IT is delivering value, managing risks, and using resources efficiently. Without metrics and monitoring, the board and management cannot make informed decisions or hold IT accountable. This component enables continuous improvement and ensures that governance objectives are being met. It is a recognized pillar of effective governance frameworks.

CDP captures changes continuously or near-continuously, enabling recovery to any point in time with minimal data loss. With an RPO of 5 minutes, hourly incrementals are insufficient. CDP can achieve an RPO of seconds or minutes, meeting the requirement. This is the most appropriate recommendation because it directly addresses the gap between the current backup frequency and the required RPO.

Encryption renders tape contents unreadable without the decryption key, protecting data even if physical media is lost, stolen or accessed by unauthorised staff. This directly satisfies the requirement to prevent unauthorised access to backup tapes.

Insufficient processing capacity at the alternate site means the workload cannot be recovered within the required window, directly explaining the missed RTO. This satisfies the stem's constraint by identifying a resource shortfall in the recovery environment rather than a procedural or documentation failure.

Recertification only reduces excessive access if identified changes are actually revoked or modified. Without an execution process, managers' quarterly confirmations produce no remediation, leaving inappropriate rights intact indefinitely — defeating the control's purpose and exposing the financial application to unauthorised transactions.

The Strategy principle of ISO/IEC 38500 requires evaluating IT investments against business rationale and expected outcomes, ensuring proposals have valid business reasons. It differs from Acquire, which governs obtaining IT assets, and Conformance, which addresses compliance with rules.

A SOC 2 report covers the vendor's controls against trust services criteria, giving the organisation independent assurance over security and processing integrity. It is obtained once and shared with many customers, avoiding the cost of exercising the contractual audit right.

With only a daily manual check, a failed batch job could go unnoticed for up to 24 hours. This delay can disrupt dependent business processes, such as financial reporting or payroll, causing operational and financial impact. Automated monitoring with alerts would enable immediate detection and response. This is the most significant risk because it directly affects timeliness and availability of critical processing.

The greatest concern is the collapse of segregation of duties: one shared production operator ID performs execution, modification of job control statements, restart, and release of held jobs. Because the same credential spans all these functions, no independent review or approval can be enforced, and actions cannot be attributed to an individual. This defeats the detective and preventive controls that a batch environment depends on.

Deploying a system that crashes under concurrent load breaches availability, a core IS control objective. User acceptance testing has not passed, so the defect represents an unmitigated risk to a critical student service. The auditor should recommend delaying go-live until the connection pooling fix is implemented and acceptance testing succeeds.

A vulnerability management programme with regular patching directly addresses the root cause: the unpatched software flaw. Continuous scanning identifies missing updates, and scheduled remediation closes the exposure window before attackers exploit it, which no detective or compensating control could achieve as effectively.

Shared credentials remove the unique user identifier that links an action to a person, so no one can be held answerable for privileged changes. This directly undermines the accountability principle the audit is testing, since attribution becomes impossible when several administrators use one login.

Maximum Tolerable Downtime directly expresses the longest period a critical process may remain unavailable before unacceptable business impact occurs, which is precisely the outage limit a BIA must document. Recovery Time Objectives for individual systems are then derived to sit within this business-defined threshold, satisfying the stem's requirement for the maximum acceptable outage.

An HSM stores cryptographic keys inside hardened hardware that detects and responds to physical tampering, preventing key extraction. This tamper-resistant storage is the primary benefit, protecting keys from compromise even if the host system is breached.

Without enrollment or inspection, the hospital cannot enforce encryption, remote wipe, or data-retention controls on personally owned devices. Clinical data cached locally on an unmanaged laptop or tablet survives the end of employment, and the organization has no technical means to erase it. This loss of control over protected health information is the most significant exposure because it creates both regulatory breach liability and direct patient-privacy harm.

Incomplete or inaccurate conversion transfers corrupt, missing or duplicated records into the ERP, directly undermining financial reporting, payroll accuracy and subsequent processing. This is the most significant migration risk because defects introduced silently during conversion are difficult to detect and costly to remediate once live.