Certified Information Systems Auditor CISA (CISA) — Questions 376–450

A portfolio management process systematically evaluates and prioritizes investments based on risk and value, aligning with board objectives. Steering committee provides oversight, but portfolio management is the mechanism for prioritization.

ITIL best practices emphasize that process design should precede tool selection. Conducting a process review with stakeholders ensures the self-service portal aligns with defined incident management workflows, such as categorization, prioritization, and escalation, before committing to a specific tool. This step also satisfies the IT governance requirement for a clear business case by validating requirements against ITIL guidelines.

Backup reliability requires regular testing (restore verification), secure offsite storage to protect against site disasters, and retention aligned with business recovery objectives. Encryption is important but not directly for reliability; compression may affect performance but not reliability.

Re-performance involves the auditor independently executing the control to verify its effectiveness.

Operational audit assesses effectiveness and efficiency; missed deadlines indicate inefficiency or ineffectiveness.

In waterfall, requirements are defined upfront and changes are difficult. If a key stakeholder did not sign off, there is a risk that later phases will be based on incomplete or incorrect requirements.

Emergency changes bypassing CAB approval pose high risk as they may not undergo proper testing and review.

The IT balanced scorecard typically includes financial, customer, internal process, and learning and growth perspectives.

Without formal access controls, users may receive excessive privileges, there is no audit trail for access grants, and segregation of duties is violated. While password security and user lockout are relevant, the primary risks stem from the lack of control over provisioning.

A change request should include justification for the change and a rollback plan to mitigate risks.

Segregation of duties between development and testing is a key control because it ensures that code is independently verified before release, preventing developers from approving their own changes and reducing the risk of undetected defects or malicious code. In a well-managed SDLC, this separation enforces an independent testing phase, which is critical for maintaining code integrity and security.

Analytical procedures, such as comparing processing times to benchmarks, can identify inefficiencies. Observation may show procedures but not efficiency quantitatively.

A mantrap allows only one person to pass at a time, preventing unauthorized individuals from following an authorized person.

An acceptable use policy should clearly define what constitutes acceptable and unacceptable use, including consequences for violations. This supports governance by establishing rules and accountability.

The auditor selected a sample from the entire population without stratification, and the selection method is not described as random or systematic; however, the description implies a non-statistical judgmental sample. Stratified sampling would require dividing the population into subgroups (e.g., by value).

The primary risk of a non-representative pilot is that region-specific variations in regulatory, cultural, or technical infrastructure (e.g., data privacy laws like GDPR, local labor regulations, or network latency) will not be exercised. This means defects or integration failures that are unique to other regions remain hidden until full rollout, undermining the pilot's purpose as a risk-reduction mechanism. Option C directly captures this core risk of undetected issues.

Low UAT pass rate indicates unresolved defects or unmet user requirements, leading to user dissatisfaction and potential workarounds that compromise controls.

An incorrect impact assessment (Option C) is the most significant risk because it directly undermines the change management process. If the impact is misjudged, the change may introduce unanticipated failures, data corruption, or security vulnerabilities into the production environment. Unlike vague descriptions or pending approvals, an incorrect impact assessment can lead to catastrophic system outages or compliance violations that are difficult to reverse.

A data classification scheme assigns sensitivity labels (e.g., public, internal, confidential, restricted) to information assets. Its primary purpose is to ensure that appropriate security controls—such as access control lists, encryption strength, and monitoring—are applied proportionally to the data's sensitivity. Without classification, controls would be either insufficient for high-risk data or overly restrictive for low-risk data, undermining both security and operational efficiency.

Availability = MTBF / (MTBF + MTTR) = 200 / (200 + 20) = 200 / 220 ≈ 0.909 = 90.9%.

Security requirements must be identified and approved early to ensure proper controls are built into the system. The requirements phase is the appropriate stage for this.

BIA steps: identify processes, define recovery objectives, assess impact, prioritize, and document.

Encryption protects data confidentiality even if physical security is breached. Physical locks, access controls, and offsite storage are important but do not protect against all threats like theft during transit.

Learning & Growth is 30 hours short of 150 (20% deficit), while Financial is 10% short, Internal Process is 4% short, and Customer exceeds target. Thus, Learning & Growth has the largest negative gap.

The most likely reason the RTO was not met is that the alternate site lacked sufficient processing capacity to handle the workload. RTO measures the time to restore service availability; if the failover site cannot support the required compute, memory, or I/O throughput, restoration will be delayed or fail outright. This is a common capacity planning failure in DR testing, where the alternate site is sized for minimal operations but not for the full production load.

The recertification process should include a timely follow-up on access changes. Without this, outdated permissions may persist, increasing risk.

Emergency changes bypass normal CAB approval, so it is critical to document the change and have it retrospectively reviewed by the CAB to ensure proper governance.

The 'Strategy' principle of ISO/IEC 38500 states that IT should be aligned with the business strategy and investments should be made for valid business reasons.

A SOC 2 report is specifically designed to provide assurance over a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy, which directly addresses the need to audit the vendor's internal controls for a financial system. It is more efficient than other options because it is a standardized, independent assessment that covers the control environment relevant to financial data processing.

Deploying a system with a known critical defect that fails under expected load conditions violates the principle of delivering a reliable and secure system. The database connection pooling issue causes the portal to crash under concurrent user load, which is a functional failure that directly impacts business operations. Delaying go-live ensures the defect is fixed and user acceptance testing (UAT) is fully passed, aligning with the IS auditor's responsibility to recommend risk mitigation over acceptance of a preventable failure.

Fixed-price contracts are risky when requirements are unclear because the vendor may understate effort or charge high change orders. Time-and-materials contracts are safer for undefined requirements.

A vulnerability management program with regular patching directly addresses the root cause of the compromise: the unpatched vulnerability. By systematically identifying, prioritizing, and applying security patches, the organization eliminates the known weakness that the attacker exploited. This proactive measure prevents the initial compromise, whereas other controls only detect or limit the attack after the vulnerability is exploited.

Shared accounts make it difficult to attribute actions to specific individuals and can lead to loss of audit trail, increasing the risk of undetected misuse.

Maximum Tolerable Downtime (MTD) is the total time a process can be disrupted without causing significant business damage.

The spiral model is risk-driven; failure to identify critical risks undermines the methodology and could lead to project failure.

To move from Level 3 (Established) to Level 4 (Predictable), the process must be measured and controlled using statistical techniques. Implementing metrics and statistical controls directly addresses the gap. Documentation, ownership, and training are earlier-level activities.

The primary benefit of a hardware security module (HSM) is that it provides tamper-resistant, physically secured storage for encryption keys. HSMs are designed to protect keys from extraction or modification, even if an attacker gains physical access to the device, which is critical for maintaining the confidentiality and integrity of cryptographic operations. This aligns with the core purpose of an HSM: to safeguard the root of trust in a key management infrastructure.

Data migration is a critical risk in ERP implementations. Poor data quality from legacy systems can lead to errors, inconsistencies, and business disruption. Ensuring data integrity is paramount.

Backup process: identify data, choose method, schedule, execute/verify, and store offsite.

Defining classification categories (e.g., Public, Internal, Confidential, Restricted) is the foundational step in a data classification policy. These categories establish the criteria for labeling and handling data based on sensitivity and criticality, directly enabling consistent protection controls across the organization.

By identifying and mitigating risks early in each cycle, the spiral model reduces the likelihood of major problems later.

A risk-based audit approach requires focusing on high-risk areas. A new ERP system introduces significant risks, so it should be prioritized in the audit scope.

A key objective of a post-implementation review (PIR) is to capture lessons learned from the project, which helps improve future system development and acquisition processes. This involves documenting what went well, what went wrong, and how processes can be refined, directly supporting continuous improvement in IT governance and project management.

Performing a user access review is the first step because it establishes a baseline of current access rights, identifies segregation of duties conflicts, and uncovers orphaned accounts or excessive privileges. Without this foundational assessment, subsequent IAM controls like SSO or MFA would be deployed on an insecure or non-compliant access framework, violating the principle of 'least privilege' and potentially failing audit requirements.

The governance policy mandates UAT before deployment, and skipping it could compromise patient safety and data integrity in the EHR system. By escalating the risk to the steering committee, the project manager ensures that the decision is made at the appropriate governance level, balancing project pressures with compliance and quality. This approach aligns with the CISA domain of Governance and Management of IT, where adherence to policies and risk escalation are key controls.

Availability = MTBF/(MTBF+MTTR). 0.9999 = 720/(720+MTTR) => MTTR = 720/0.9999 - 720 = 0.072 hours ≈ 4.32 minutes.

The hierarchy is: Policy (high-level principles), Standard (mandatory requirements), Guideline (recommended practices), Procedure (step-by-step instructions), Work instruction (detailed task-level instructions).

The Recovery Point Objective (RPO) is a key metric defined in a Business Impact Analysis (BIA) because it specifies the maximum acceptable amount of data loss measured in time, guiding the frequency of backups and replication. In a financial services company, RPO directly determines how much transactional data could be lost during a disruption, which is critical for regulatory compliance and data integrity.

Without business input, the strategy may not support business objectives, leading to misalignment. Option A is a possible outcome. Options B and C are less directly related.

SAM helps ensure compliance with software licenses and avoid penalties.

Lessons learned from tabletop exercises demonstrate that the plan is tested and improved. Other options are components but do not directly indicate effectiveness.

Reconciliation of control totals is the most important control because it directly verifies that the sum of key fields (e.g., total account balances, record counts) in the source system matches the target cloud-based ERP after conversion. This ensures no data is lost, duplicated, or corrupted during the extraction, transformation, and loading (ETL) process, which is critical for maintaining data integrity in a migration from a legacy system.

The customer perspective in an IT balanced scorecard focuses on how users perceive IT services. Help desk resolution time directly measures service quality from the customer's viewpoint.

Before updating the BCP or scheduling tests, the IS auditor must ensure that a current risk assessment is performed to identify and prioritize the impact of changes—such as the introduction of cloud-based applications—on business continuity. Without a risk assessment, updates or tests may address the wrong threats or miss critical dependencies, violating the principle that BCP updates should be risk-driven. This aligns with ISACA's guidance that risk assessment is the foundation for BCP maintenance and testing frequency.

Mean time to resolve (MTTR) is the most appropriate metric for measuring the effectiveness of incident management because it directly reflects how quickly the IT team can restore normal service operation after an incident. In ITIL-based ITSM tools, MTTR tracks the elapsed time from incident logging to resolution, providing a clear indicator of process efficiency and team responsiveness.

If the backup media are stored offsite without a local copy, the time to retrieve and restore may exceed the RTO.

ITIL 4's guiding principle 'Start where you are' encourages leveraging existing capabilities and processes before making changes.

The IT balanced scorecard translates IT performance into business terms, ensuring alignment with strategic goals from multiple perspectives.

COBIT is designed to bridge the gap between business objectives and IT operations by providing a framework that maps IT processes to business goals. The primary benefit is ensuring that IT strategy directly supports and enables business strategy, rather than focusing on cost reduction or risk elimination.

ITIL 4 defines four dimensions: Organizations and People, Information and Technology, Partners and Suppliers, and Value Streams and Processes.

The sprint review is a formal meeting where the development team demonstrates completed work to stakeholders. The auditor can observe validation of acceptance criteria and gather evidence of user acceptance.

The best course is to document the risk acceptance for each delayed patch, ensuring management is aware and accepts the risk. This formalizes the deviation and maintains accountability.

A post-implementation review is a key control in the SDLC because it systematically evaluates whether the delivered system meets the defined business requirements, security objectives, and performance criteria after deployment. It identifies gaps, operational issues, and lessons learned that feed back into future development cycles, ensuring continuous improvement and compliance with governance frameworks like COBIT.

A BCP must include a current list of critical staff and their contact information to enable rapid activation of the plan and coordination during a disruption. Without this, key personnel cannot be reached, delaying response and recovery efforts.

External auditors are independent third parties, while internal auditors are employees. Independence is a key factor in objectivity and reliability of audit work.

The project has consumed only 50% of the budget while delivering 80% of the features, indicating a high probability of scope growth or feature creep. From an IS audit perspective, this imbalance suggests that additional features may be added without corresponding budget increases, leading to total budget overrun. The risk is that the remaining 20% of features will require more than the remaining 50% of the budget, especially if testing and deployment costs are underestimated.

A material weakness is a deficiency, or combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement will not be prevented or detected.

Reconciliation of converted data totals to source system totals is the most critical control because it directly verifies that every record from the legacy system has been accurately migrated without loss or duplication. This control compares aggregate values (e.g., account balances, transaction counts) between the source and target databases, providing a definitive check for completeness and accuracy that other controls cannot guarantee.