Certified Information Systems Auditor CISA (CISA) — Questions 526–600

The log entry shows a service account (svc_backup) executing commands that create a new local user and add it to the Administrators group, which is a classic privilege escalation technique. The use of net user and net localgroup commands from a service account indicates an attempt to gain unauthorized administrative access, often as a precursor to lateral movement. This is not normal administrative activity because service accounts are typically restricted to specific tasks and should not be creating interactive user accounts.

GAAS (Generally Accepted Auditing Standards) are relevant for external audits, including compliance audits.

A Service Level Agreement (SLA) with key performance indicators (KPIs) is the most critical control because it defines measurable targets (e.g., average speed to answer, first-call resolution rate, ticket closure time) and establishes contractual remedies for non-compliance. Without an SLA, the organization has no enforceable mechanism to hold the provider accountable for service quality, making it the foundational control for outsourced IT help desk governance.

A walkthrough helps the auditor understand the process flow and identify controls in place.

The exhibit shows an ACL that permits DNS traffic (UDP port 53) only to host 10.2.2.10. Since users can browse HTTPS (TCP/443) but cannot resolve domain names, the ACL is blocking DNS queries to any other DNS server. Option B correctly identifies that the ACL restricts DNS to a single server, and if users are configured to query a different DNS server, resolution fails.

COBIT 2019 defines governance as having three key objectives: evaluate, direct, and monitor. Management objectives are grouped into domains like APO, BAI, DSS, MEA.

Audit rights allow the organization to verify that the vendor's controls are operating effectively. This directly addresses the risk of inadequate vendor security controls, which could expose the organization to data breaches or compliance violations.

A DLP system is the correct control because it can inspect email content and attachments in real time, applying policies to block or quarantine unauthorized disclosures of intellectual property. Unlike encryption, which only protects data in transit but does not prevent an authorized user from sending sensitive information, DLP provides content-aware enforcement at the point of transmission.

The exhibit describes a brute-force attack against an SSH service, where an attacker repeatedly attempts to guess credentials. Implementing account lockout after three failed attempts is the most direct control to prevent this type of event, as it halts further login attempts after a threshold, stopping the attack in its tracks regardless of password strength or patching.

The auditor should first verify actual performance against the criteria defined in the business case to determine if objectives were met.

The policy that no single person can approve a transaction enforces the separation of duties (SoD) principle. In financial applications, SoD requires that critical tasks, such as initiating and approving a transaction, be divided among multiple individuals to prevent fraud or error. This control ensures that no single user has the authority to complete a high-risk action alone, directly aligning with the requirement stated.

The attack pattern—bursts of exactly 4 failed attempts (just below the lockout threshold of 5) from different IPs, then stopping—is a textbook password spraying attack. The attacker is trying commonly used passwords against a high-value account (senior executive) while deliberately avoiding account lockout to remain undetected. Since the attempts stop at the SAML authentication prompt and never reach MFA, the attacker is testing passwords against the IdP's SAML endpoint, which validates credentials before triggering conditional access policies.

Network segmentation reduces the scope of the PCI DSS assessment by isolating the cardholder data environment from other networks, so only systems that handle card data need to comply with PCI DSS.

Iterative models develop systems through repeated cycles (iterations) that incorporate user feedback, unlike waterfall where requirements are fixed upfront.

The auditor should verify that the risk acceptance is formally documented and approved by the appropriate management, including compensating controls, to ensure the risk is managed.

Incident response follows: detection, containment, eradication/recovery, review, and improvement.

A business case must justify the investment in a new system by demonstrating how it supports the organization's strategic goals and provides net financial benefit. Alignment with business strategy (C) ensures the system directly enables key objectives, while cost-benefit analysis (E) quantifies the expected return on investment, making both essential for approval.

Agile methodologies emphasize iterative development with continuous stakeholder feedback, which is critical for a customer portal where user needs evolve. This ensures the final product aligns with actual requirements, reducing rework and increasing satisfaction. Option A directly captures this core benefit.

Accountable (A) is the person who is ultimately answerable for the correct and thorough completion of the deliverable or task, and who must approve the work.

Chargeback increases transparency and encourages business units to use IT resources efficiently.

Overly permissive rules that are not justified create significant risk. The auditor should first confirm the business need and then recommend removal or tightening of the rule. If no valid justification exists, the rule should be removed.

Audit risk = Inherent risk × Control risk × Detection risk. Assuming inherent risk = 80%, control risk = 20%, detection risk = 5%, audit risk = 0.8 × 0.2 × 0.05 = 0.008 = 0.8%.

Identifying and classifying sensitive data is the foundational step in a DLP strategy. Without knowing where sensitive data resides (e.g., PII, PCI, IP), DLP policies cannot accurately detect or prevent unauthorized transfers. Classification enables the DLP system to apply context-aware rules, such as blocking credit card numbers in email attachments or flagging confidential documents uploaded to cloud storage.

Testing techniques vary in formality and purpose. Walkthroughs are informal, inspections are formal with checklists, desk checking is a self-review, and unit testing verifies individual components. Common confusions involve swapping walkthrough and inspection definitions.

A walkthrough helps the auditor understand the flow of transactions and identify control points, which aids in assessing control design and identifying risks.

Low user satisfaction may stem from inadequate training, unmet requirements, or data migration issues affecting business processes. While budget and timeline were met, these operational aspects often drive satisfaction. Integration testing completeness is important but more technical; vendor SLA compliance is contractual and less directly tied to user satisfaction.

The auditor should determine if compensating controls are in place to mitigate the risk, as this information is essential to assess the residual risk.

In agile development, security should be integrated continuously rather than treated as an afterthought. Including security stories in the product backlog ensures that security requirements are prioritized, estimated, and implemented incrementally within each sprint, aligning with the agile principle of delivering value early and often. This approach embeds security into the development lifecycle from the start, reducing technical debt and vulnerabilities.

Recording privileged sessions without review means that while a log of activities exists, it is not analyzed for signs of compromise or policy violations. The primary risk is that after a security incident, the recorded sessions may be the only source of evidence to reconstruct the attack, but without prior review, the organization may fail to identify malicious activity in a timely manner or may lose critical forensic data if logs are overwritten or deleted before an incident is discovered.

The Indexes option in Apache enables directory listing, which exposes the entire contents of a directory when no index file (e.g., index.html) is present. This can reveal sensitive files, configuration backups, or source code, making it a critical information disclosure vulnerability. Unlike other options, Indexes directly leads to unauthorized data exposure without requiring any additional conditions.

The access list permits TCP traffic from source network 192.168.1.0/24 to destination port 443 (HTTPS). The permit statement for TCP with eq 443 explicitly allows HTTPS traffic from that subnet, and there is no subsequent deny statement blocking it.

The sprint review is a demonstration of working software where controls can be observed. The retrospective is about process improvement, not control assessment.

Client-side encryption with keys managed on-premises ensures that the cloud provider never has access to the encryption keys or the plaintext data. Even if the cloud provider's infrastructure is compromised or they have administrative access, the data remains encrypted and unreadable. This provides the strongest protection because the cloud provider is excluded from the cryptographic trust boundary.

The ACL shown permits HTTPS (TCP port 443) from any source to the server at 10.0.0.100, and then has a 'permit ip any any' statement at the end. Because ACLs are processed top-down, the first match wins; HTTPS traffic matches the first line and is permitted, while HTTP (TCP port 80) is not explicitly denied, so it matches the 'permit ip any any' line and is also allowed. Thus, both HTTP and HTTPS are permitted, making option A correct.

Business-IT strategy mapping workshops facilitate direct communication and collaboration, ensuring both sides understand and agree on priorities. Status reports, budget increases, or outsourcing do not address the communication gap.

If the restore takes longer than the RTO, the backup and recovery process does not meet the required timeline. This could be due to inadequate infrastructure or testing.

GDPR requires mandatory appointment of a DPO for organizations that process special categories of data or engage in large-scale systematic monitoring. The other regulations do not have a DPO requirement.

An adverse SOC 2 opinion indicates material weaknesses in controls; the organization should seek compensating controls or consider alternative vendors.

Incremental backups with transaction log backups every 15 minutes meets the 15-minute RPO by capturing all changes since the last full or incremental backup, while transaction log backups record every individual database transaction. This method minimizes storage by only backing up changes and reduces performance impact compared to continuous replication, as log backups are lightweight and can be scheduled without constant I/O overhead.

ITIL 4 has seven guiding principles. 'Focus on value' and 'Progress iteratively with feedback' are two of them. 'Centralize decision making' and 'Standardize services' are not ITIL 4 principles, and 'Automate everything' is not a principle.

If the auditor's independent re-performance shows the control is effective, the control is operating effectively, despite the initial indication of a deviation.

User acceptance testing (UAT) with role-based test cases is the most effective approach because it directly validates that the identity management system enforces the correct access controls for each user role in real-world scenarios. Unlike lower-level tests, UAT involves actual users executing role-specific transactions to confirm that permissions, segregation of duties, and policy rules are properly implemented. This ensures that the system behaves as intended from an end-user and auditor perspective, which is critical for compliance and security.

When an organization requires highly specialized functionality that is not available in any commercial off-the-shelf (COTS) product, building a custom application becomes the only viable option. COTS products are designed for broad market needs and often lack the unique features or compliance requirements that a custom solution can provide. This factor overrides cost, time, and maintenance considerations because no amount of configuration or customization of a COTS product can meet the specific functional gap.

The classification level of a data asset is primarily determined by the potential harm that could result from its unauthorized disclosure, modification, or loss. Legal, regulatory, and business impact factors—such as compliance with GDPR, HIPAA, or PCI DSS—directly dictate the required confidentiality, integrity, and availability controls. Without assessing these impacts, any classification scheme would be arbitrary and fail to align with organizational risk tolerance.

When a high-risk area is identified and the population size is small, 100% testing is justified because the cost of missing a critical error outweighs the cost of testing every item. This approach eliminates sampling risk entirely, ensuring that all errors are detected. In audit, 100% testing is appropriate when the population is small enough to make full examination feasible and the consequences of error are severe.

A risk-based audit approach prioritizes high-risk areas for more intensive testing, aligning with ISACA standards.

Help desk resolution time is a common KPI for IT service management, measuring efficiency.

In agile, the product backlog is the primary control for requirements, and sprint reviews provide stakeholder validation.

Segregation of duties enforcement is essential because it ensures that no single user has excessive privileges that could lead to fraud or error. In an identity management system, this is implemented through role-based access control (RBAC) and access review workflows, preventing conflicts of interest by separating critical functions like user creation, approval, and access assignment.

A right-to-audit clause allows the organization to review the vendor's processes and controls, ensuring compliance with contractual and regulatory requirements.

The greatest risk from delayed access recertification and late removal of terminated employees is that unauthorized users may retain access, leading to potential data breaches or fraudulent activities. While audit trails and policy violations are concerns, the primary risk is unauthorized access.

Data inventory must identify what personal data is held, where it is stored, and how it flows. Legal basis and retention are also important, but location and data elements are foundational.

In agile, sprint reviews, product backlog prioritization, and retrospective actions are key controls to ensure quality and continuous improvement.

Stratified sampling and systematic sampling are both statistical methods that use random selection.

It aligns with the ITIL-based emergency change process, which allows for expedited approval from a designated CAB member or emergency authority when a critical security patch must be deployed within hours to mitigate an active zero-day vulnerability. This ensures the change is authorized without waiting for the full CAB meeting, maintaining security while preserving governance and audit trails.

Mantrap entry (B) and biometric authentication (E) are the most effective preventive controls for unauthorized access to a server room. Mantraps prevent tailgating, and biometrics provide strong authentication. CCTV (C) is a detective control, visitor logbook (D) is an administrative control, and server rack locks (A) are secondary to room access controls.

PIA aims to identify and mitigate privacy risks early in the project lifecycle.

The primary risk of disabling rather than deleting terminated employees' accounts is that a disabled account retains its existing privileges and can be re-enabled by an attacker or insider with sufficient access (e.g., a system administrator with compromised credentials). In an ERP system, this could allow unauthorized re-activation of accounts with elevated roles, bypassing the intended termination process and leading to data theft, fraud, or system compromise.

The primary purpose of an IT governance framework is to ensure that IT investments, strategies, and operations are aligned with and support the overall business strategy, enabling the organization to achieve its goals. This alignment is achieved through mechanisms such as strategic planning, portfolio management, and performance measurement, which are core to frameworks like COBIT 2019. Without this alignment, IT may operate in isolation, leading to wasted resources and missed business opportunities.

Patch management starts with inventory, then evaluation, testing, deployment, and verification.

Security requirements should be defined early to ensure controls are designed in, not bolted on. The best practice is to include security requirements in the requirements phase and have them reviewed by security experts.

People procedures, alternate facilities, and data/technology recovery are core to BC.

Re-performance is the most reliable because the auditor independently performs the control, obtaining direct evidence. Observation is less reliable because the auditor may influence behavior.

Prototyping often prioritizes rapid iteration over formal documentation, leading to incomplete or outdated records of system specifications, design decisions, and user agreements. This lack of adequate documentation creates risks for maintenance, knowledge transfer, and auditability, as the final system may lack the necessary artifacts for ongoing support and compliance.

Fixed-price contracts provide cost certainty for the buyer, as the vendor bears the risk of cost overruns.

ISO/IEC 38500 defines six key principles for the corporate governance of IT: Responsibility, Strategy, Acquisition, Performance, Conformance, and Human Behaviour. The 'Responsibility' principle mandates that individuals and groups within the organization understand and accept their responsibilities for the supply of, and demand for, IT. This is the foundational governance principle because it establishes clear accountability, which is necessary for all other governance activities to function effectively.

In a RACI matrix, the accountable person (A) is ultimately answerable for the outcome. For change management, the change advisory board (CAB) or a senior manager is often accountable.

Fieldwork is the phase where audit procedures are executed to gather evidence.