Certified Information Systems Auditor CISA (CISA) — Questions 601–675

The incompatibility suggests that the hot site was not properly configured to mirror production, possibly due to lack of change synchronization or testing.

Lack of documentation (C) is a common risk in custom-developed software because without comprehensive technical and user documentation, the organization faces challenges in maintenance, troubleshooting, and knowledge transfer. This risk is especially acute when the original developers leave, leaving the system opaque and difficult to support. Proper documentation is essential for ongoing operations, audits, and future enhancements.

Regular access reviews and recertification (Option C) are the most effective preventive control because they ensure that user permissions are periodically validated against current job roles and business needs. By systematically revoking excessive or outdated entitlements, this process directly reduces the attack surface for unauthorized access, addressing the root cause of privilege creep rather than merely detecting or deterring misuse.

A deficiency that could result in a material misstatement is classified as a material weakness.

Re-performance is when the auditor independently executes a control to confirm it operates as intended.

The correct sequence for a disaster recovery test is to first define the objectives, then prepare the test environment and resources, execute the test, evaluate the results against the objectives, and finally update the disaster recovery plan based on findings. This order ensures a structured and effective testing process.

Eliminating regular project status meetings removes a key communication channel for escalating critical project issues to stakeholders. Without these meetings, stakeholders may not receive timely updates on security vulnerabilities, integration failures, or compliance gaps in the cloud-based HR system, leading to delayed remediation and potential data breaches.

Under GDPR, the two primary mechanisms for legitimizing cross-border data transfers are Binding Corporate Rules (BCRs) approved by a supervisory authority and Standard Contractual Clauses (SCCs) adopted by the European Commission. Adequacy decisions, while a valid basis for transfers to specific countries, are not a mechanism that organizations can directly implement; they are a determination by the European Commission. Encryption does not legitimize a transfer, and explicit consent alone is generally not considered sufficient as a transfer mechanism under GDPR.

Service level management ensures alignment with business needs, monitors performance, and provides a basis for improvement.

Mantraps and biometric readers are physical access controls. Fire suppression and UPS are environmental controls. Cable locks secure equipment but do not prevent entry to the data center.

A configuration management database (CMDB) is the correct control because it maintains a detailed record of software versions, patches, and configurations across all IT assets. By referencing the CMDB during disaster recovery planning, the team ensures that backup and restore environments are compatible, preventing version mismatch failures. Without this, the backup server may have outdated or incompatible software, as seen in the scenario.

A mantrap is a small room with two sets of interlocking doors, designed to prevent tailgating by allowing only one person to enter at a time. CCTV, badge access, and visitor logs are supportive but do not directly prevent tailgating.

Follow-up is the phase dedicated to verifying that management has implemented corrective actions for previous findings.

Detailed test plans should be developed during the system design phase because this is when the system's architecture, interfaces, and data flows are fully specified. Creating test plans at this stage ensures that tests are aligned with the design specifications and can validate that the implemented system meets the intended technical requirements, rather than waiting until after coding.

The root cause should be identified before recommending specific actions. Performance testing or analysis will reveal the cause.

In the waterfall model, requirements are defined upfront and formal sign-off at each phase is critical. Formal user acceptance testing (UAT) is the key control to ensure the system meets business needs before deployment.

It aligns with agile risk management principles: when a critical compliance vulnerability (PII exposure) is discovered, the highest-priority user story must be re-estimated and inserted into the current sprint backlog, even if it means adjusting the release schedule. The IS auditor’s focus is on ensuring that the risk is actively mitigated, not deferred, and re-prioritization is the standard agile response to newly identified high-severity risks.

Threat modeling proactively identifies potential security threats and vulnerabilities in the system architecture to design appropriate controls.

Without a rollback plan, if the deployment fails, the system may be unavailable for an extended period, impacting business operations.

Implementing load balancing distributes the workload across multiple servers, addressing the performance issue. Options B, C, and D are not the best; B is hasty, C helps but is not best, D does not fix the problem.

Penetration testing aims to identify exploitable vulnerabilities that could be used by an attacker.

Job rotation (C) is effective because it prevents any single employee from maintaining exclusive control over critical IT functions over time, reducing the window for concealing fraudulent activities. By periodically rotating roles, anomalies or unauthorized actions that might otherwise go unnoticed are more likely to be detected by the incoming staff member, thereby deterring fraud.

A full backup contains all data and requires only one restore operation, making it faster than restoring from incremental or differential backups.

If remediation has not occurred, the auditor should escalate the issue to management to ensure action is taken.

UAT is performed after system testing is complete and before deployment to ensure the system meets user requirements.

COBIT 2019 includes governance components such as principles, policies, frameworks, processes, organizational structures, culture, ethics, behavior, information, services, infrastructure, and applications.

Audit evidence from an independent source is considered more reliable because it is obtained from a third party outside the audited entity, reducing the risk of bias or manipulation. For example, a system-generated log from a SIEM tool is more reliable than a manually created spreadsheet from the IT department. Independence directly supports the objectivity and verifiability of the evidence.

Release planning defines the scope and schedule; testing ensures the release meets quality standards. Deployment is part of release, but planning and testing are foundational.

The primary risk of a COTS solution is that it is designed for a broad market and may not fully align with the organization's specific business processes. This misalignment can force the organization to change its workflows or perform costly customizations, which can negate the benefits of a packaged solution and introduce project delays or failures.

The firewall rule is the root cause of the unauthorized access — it allowed connections from any IP address, directly enabling the external attacker to query the database. Correcting this rule immediately cuts off all external access to the database, stopping the ongoing breach at the network layer. This is the most effective immediate action because it addresses the misconfiguration that allowed the attack to succeed, regardless of the encryption or web application issues.

A SOC 2 report (Service Organization Control 2) is specifically designed to provide assurance over a service provider's controls related to security, availability, processing integrity, confidentiality, and privacy. It is issued by an independent service auditor and is the most reliable and relevant source of audit evidence when auditing outsourced IT operations, as it directly addresses the controls in place at the provider.

The error message indicates a violation of a UNIQUE constraint on the 'email' column. The INSERT statement attempts to add 'john.doe@example.com', but that value already exists in the table. The database rejects the operation because the constraint ensures no duplicate email addresses are allowed.

The design phase defines the system architecture and ensures security controls are incorporated rather than added later.

The audit process includes planning, fieldwork, reporting, and follow-up.

The primary control weakness is the lack of automated escalation and tracking for incident reassignments. Without automated mechanisms (e.g., workflow triggers, timestamped reassignment logs, or integration with IT service management tools), the service desk can reassign P2 incidents to second-level support without updating the incident record, leading to untracked delays. This directly violates the SLA of 8 hours, as the average resolution time of 10 hours indicates that incidents are not being monitored or escalated properly, causing them to exceed the target.

GDPR requires responses to access requests and erasure requests within one month, subject to certain conditions.

Co-sourcing is a hybrid model where certain IT functions are outsourced and others are kept in-house.

The most significant finding because user jdoe has overlapping permissions from multiple group memberships (e.g., HR_Managers and Payroll_Admin), which can result in unintended cumulative effective permissions. In Windows NTFS, effective permissions are the sum of all allowed permissions from each group, minus any explicit denies, so overlapping group memberships often grant more access than intended, violating the principle of least privilege.

Client-side encryption ensures that data is encrypted before it leaves the organization's control, so the cloud provider never has access to the plaintext or the encryption keys. In the event of a provider breach, the encrypted data remains confidential because only the organization holds the keys to decrypt it. This is the only option that guarantees confidentiality regardless of the cloud provider's security posture.

Emergency changes require a rollback plan to ensure the system can be restored if the change fails. A full test plan may be abbreviated.

Background checks help verify the trustworthiness of employees who have access to sensitive information, reducing the risk of insider threats.

Delaying the release by one week allows the team to implement a proper, permanent fix for the ERP integration module's performance issue, which is critical given that the legacy ERP will be retired shortly after go-live. A temporary workaround would risk system instability and transaction failures under peak load, potentially causing data loss or corruption during the transition. The three-week estimate for a proper fix addresses the root cause, ensuring the system can handle peak loads reliably before the legacy system is decommissioned.

The Evaluate-Direct-Monitor (EDM) domain in COBIT 2019 is focused on governance responsibilities typically performed by the board of directors and executive management.

Defined roles and responsibilities for IT decisions (Option A) are a key indicator of a mature IT governance process because they establish clear accountability and authority, aligning with frameworks like COBIT 5. This ensures that decision-making rights are assigned to specific roles (e.g., IT steering committee, CIO, business process owners), reducing ambiguity and enabling effective oversight. Without such definition, governance lacks the structural foundation needed for consistent and auditable decision-making.

The log entry shows a failed authentication attempt from the backup server's IP address (10.0.0.15) using the service account 'svc_backup'. The event ID 4625 indicates an account logon failure, and the 'Failure Reason' field explicitly states 'Unknown user name or bad password'. Since the account name is correct, the most likely cause is multiple failed authentication attempts (e.g., due to a stale or incorrect password cached in the backup software) leading to account lockout, not a single event.

Conducting UAT in production exposes sensitive production data and live systems to test scripts and users who may not have proper authorization, creating a direct path for security breaches. Production environments typically have broader access controls and audit trails that are not designed to isolate test activities, increasing the risk of unauthorized data exposure or modification. This violates the principle of segregation of duties and can lead to compliance issues with standards like PCI DSS or HIPAA.

Regular restoration tests verify that backups are recoverable, and offsite storage ensures availability after a site disaster. Encryption, labeling, and capacity are security or operational considerations but not essential for recoverability.

Regular review of security incident logs (B) and intrusion detection system (IDS) alerts (C) are detective controls that identify events after they occur.

The primary reason for storing backup media offsite is to ensure data availability and recoverability in the event of a site-level disaster, such as a fire, flood, or physical destruction of the primary data center. This aligns with the core business continuity principle of geographic separation to avoid a single point of failure. Without offsite storage, a site disaster would destroy both primary and backup data, making recovery impossible.

Standard format commands do not securely erase data; data can still be recovered. Secure sanitization methods (e.g., degaussing, shredding) should be used.

The IS auditor's first priority is to gather evidence and understand the context before taking action. The employee's sales role and non-business hours access may be legitimate (e.g., supporting a client in a different time zone). Discussing with the supervisor is a standard audit procedure to verify authorization, aligning with ISACA's audit evidence collection and due professional care.

COTS packages typically have a faster implementation timeline because the core functionality already exists, reducing development time.

The highest priority is to remove the fallback mechanism (option B) because it directly exposes actual cardholder data when tokenization fails, violating PCI DSS requirement 3.4 to render stored cardholder data unreadable. While using a separate encryption key for the vault (option C) is important, the fallback mechanism represents an immediate and undocumented data exposure risk. Therefore, eliminating this fallback and ensuring redundancy in the tokenization system should be the priority.

Extensive customization of an ERP system typically involves modifying the core code or configuration beyond standard parameters. This creates a custom code base that diverges from the vendor's standard release, making future upgrades significantly more complex and costly because each upgrade requires re-applying and testing all customizations against the new version, often requiring specialized skills and extensive regression testing.

External auditors are independent third parties, while internal auditors are employees of the organization.

A walkthrough test involves reviewing the plan step by step in a meeting, with no actual failover or impact on production, making it low-risk.

The Recovery Time Objective (RTO) defines the maximum acceptable downtime for a system after a disaster. Since the organization's RTO is 4 hours and the system was recovered in 3.5 hours, the recovery time directly satisfies the RTO metric. The 30 minutes of data loss is irrelevant to RTO; it pertains to the Recovery Point Objective (RPO).

Incorporating an external specialist with ERP expertise ensures the audit is conducted effectively despite the team's lack of experience.

Tabletop exercises focus on discussion and coordination among participants without technical testing.

The primary consideration for determining audit scope is a risk assessment of the financial system. ISACA standards require auditors to use a risk-based approach to focus audit efforts on areas with the highest residual risk, ensuring that resources are allocated to the most critical controls and processes. Without a risk assessment, the scope may be too broad or miss key vulnerabilities, such as segregation of duties or access control weaknesses in the new system.

The error indicates failure to mount the backup target, implying a connectivity issue with the storage array. A syntax error would produce a script error; disk space would show a different error; authentication would show a credentials error.

Mandatory vacation is a fraud detection control that helps uncover irregularities when an employee is away.

Recovery time objectives (RTOs) are essential because they define the maximum acceptable downtime for the system, directly driving the design of backup and recovery strategies. Without RTOs, the BCP cannot prioritize recovery actions or allocate resources effectively, making them a foundational element for any newly developed system.

Proper exception management requires compensating controls and a time-bound approval with periodic review.

The JSON configuration defines a rule that forwards traffic matching source IP 10.0.1.0/24 and destination port 443 to backend-pool-1. The request from 10.0.1.100 to port 80 does not match the port 443 condition, so the rule is not applied. Since no other rule matches and the load balancer's default action is to drop traffic, the request is dropped.

A right to audit the vendor's security practices is essential in a SaaS contract because it allows the organization to independently verify that the vendor's controls (e.g., access management, patch management, incident response) meet contractual and regulatory requirements. Without this clause, the organization must rely solely on the vendor's self-assessments or third-party reports like SOC 2, which may not cover all relevant risks or may be outdated. This right is a key mechanism for ensuring ongoing data protection in a shared responsibility model.

The error indicates that the backup server cannot access the virtual disk, which is typically a LUN masking or zoning issue. Option A is plausible but the message specifically points to storage access; Option B is not indicated; Option C is possible but less direct.

The severity of the risk—exposed sensitive data on an unsupported system with active external connection attempts—requires immediate escalation to senior management. Waiting (B) or adding compensating controls (D) without management approval could delay critical action. Forensic analysis (A) may be warranted but should be directed by management after the risk is reported.