Certified Information Systems Auditor CISA (CISA) — Questions 601–675

Service level management ensures alignment with business needs, monitors performance, and provides a basis for improvement.

Mantraps and biometric readers are physical access controls. Fire suppression and UPS are environmental controls. Cable locks secure equipment but do not prevent entry to the data center.

A configuration management database (CMDB) is the correct control because it maintains a detailed record of software versions, patches, and configurations across all IT assets. By referencing the CMDB during disaster recovery planning, the team ensures that backup and restore environments are compatible, preventing version mismatch failures. Without this, the backup server may have outdated or incompatible software, as seen in the scenario.

A mantrap is a small room with two sets of interlocking doors, designed to prevent tailgating by allowing only one person to enter at a time. CCTV, badge access, and visitor logs are supportive but do not directly prevent tailgating.

Follow-up is the phase dedicated to verifying that management has implemented corrective actions for previous findings.

Detailed test plans should be developed during the system design phase because this is when the system's architecture, interfaces, and data flows are fully specified. Creating test plans at this stage ensures that tests are aligned with the design specifications and can validate that the implemented system meets the intended technical requirements, rather than waiting until after coding.

The root cause should be identified before recommending specific actions. Performance testing or analysis will reveal the cause.

In the waterfall model, requirements are defined upfront and formal sign-off at each phase is critical. Formal user acceptance testing (UAT) is the key control to ensure the system meets business needs before deployment.

Option C is correct because it aligns with agile risk management principles: when a critical compliance vulnerability (PII exposure) is discovered, the highest-priority user story must be re-estimated and inserted into the current sprint backlog, even if it means adjusting the release schedule. The IS auditor’s focus is on ensuring that the risk is actively mitigated, not deferred, and re-prioritization is the standard agile response to newly identified high-severity risks.

Threat modeling proactively identifies potential security threats and vulnerabilities in the system architecture to design appropriate controls.

Without a rollback plan, if the deployment fails, the system may be unavailable for an extended period, impacting business operations.

Option A is correct because implementing load balancing distributes the workload across multiple servers, addressing the performance issue. Options B, C, and D are not the best; B is hasty, C helps but is not best, D does not fix the problem.

Penetration testing aims to identify exploitable vulnerabilities that could be used by an attacker.

Job rotation (C) is effective because it prevents any single employee from maintaining exclusive control over critical IT functions over time, reducing the window for concealing fraudulent activities. By periodically rotating roles, anomalies or unauthorized actions that might otherwise go unnoticed are more likely to be detected by the incoming staff member, thereby deterring fraud.

A full backup contains all data and requires only one restore operation, making it faster than restoring from incremental or differential backups.

If remediation has not occurred, the auditor should escalate the issue to management to ensure action is taken.

UAT is performed after system testing is complete and before deployment to ensure the system meets user requirements.

COBIT 2019 includes governance components such as principles, policies, frameworks, processes, organizational structures, culture, ethics, behavior, information, services, infrastructure, and applications.

Audit evidence from an independent source is considered more reliable because it is obtained from a third party outside the audited entity, reducing the risk of bias or manipulation. For example, a system-generated log from a SIEM tool is more reliable than a manually created spreadsheet from the IT department. Independence directly supports the objectivity and verifiability of the evidence.

Release planning defines the scope and schedule; testing ensures the release meets quality standards. Deployment is part of release, but planning and testing are foundational.

The primary risk of a COTS solution is that it is designed for a broad market and may not fully align with the organization's specific business processes. This misalignment can force the organization to change its workflows or perform costly customizations, which can negate the benefits of a packaged solution and introduce project delays or failures.

The firewall rule is the root cause of the unauthorized access — it allowed connections from any IP address, directly enabling the external attacker to query the database. Correcting this rule immediately cuts off all external access to the database, stopping the ongoing breach at the network layer. This is the most effective immediate action because it addresses the misconfiguration that allowed the attack to succeed, regardless of the encryption or web application issues.

A SOC 2 report (Service Organization Control 2) is specifically designed to provide assurance over a service provider's controls related to security, availability, processing integrity, confidentiality, and privacy. It is issued by an independent service auditor and is the most reliable and relevant source of audit evidence when auditing outsourced IT operations, as it directly addresses the controls in place at the provider.

The error message indicates a violation of a UNIQUE constraint on the 'email' column. The INSERT statement attempts to add 'john.doe@example.com', but that value already exists in the table. The database rejects the operation because the constraint ensures no duplicate email addresses are allowed.

The design phase defines the system architecture and ensures security controls are incorporated rather than added later.

The audit process includes planning, fieldwork, reporting, and follow-up.

The primary control weakness is the lack of automated escalation and tracking for incident reassignments. Without automated mechanisms (e.g., workflow triggers, timestamped reassignment logs, or integration with IT service management tools), the service desk can reassign P2 incidents to second-level support without updating the incident record, leading to untracked delays. This directly violates the SLA of 8 hours, as the average resolution time of 10 hours indicates that incidents are not being monitored or escalated properly, causing them to exceed the target.

GDPR requires responses to access requests and erasure requests within one month, subject to certain conditions.

Co-sourcing is a hybrid model where certain IT functions are outsourced and others are kept in-house.

Option D is the most significant finding because user jdoe has overlapping permissions from multiple group memberships (e.g., HR_Managers and Payroll_Admin), which can result in unintended cumulative effective permissions. In Windows NTFS, effective permissions are the sum of all allowed permissions from each group, minus any explicit denies, so overlapping group memberships often grant more access than intended, violating the principle of least privilege.

Client-side encryption ensures that data is encrypted before it leaves the organization's control, so the cloud provider never has access to the plaintext or the encryption keys. In the event of a provider breach, the encrypted data remains confidential because only the organization holds the keys to decrypt it. This is the only option that guarantees confidentiality regardless of the cloud provider's security posture.

Emergency changes require a rollback plan to ensure the system can be restored if the change fails. A full test plan may be abbreviated.

Background checks help verify the trustworthiness of employees who have access to sensitive information, reducing the risk of insider threats.

Option B is correct because delaying the release by one week allows the team to implement a proper, permanent fix for the ERP integration module's performance issue, which is critical given that the legacy ERP will be retired shortly after go-live. A temporary workaround would risk system instability and transaction failures under peak load, potentially causing data loss or corruption during the transition. The three-week estimate for a proper fix addresses the root cause, ensuring the system can handle peak loads reliably before the legacy system is decommissioned.

The Evaluate-Direct-Monitor (EDM) domain in COBIT 2019 is focused on governance responsibilities typically performed by the board of directors and executive management.

Defined roles and responsibilities for IT decisions (Option A) are a key indicator of a mature IT governance process because they establish clear accountability and authority, aligning with frameworks like COBIT 5. This ensures that decision-making rights are assigned to specific roles (e.g., IT steering committee, CIO, business process owners), reducing ambiguity and enabling effective oversight. Without such definition, governance lacks the structural foundation needed for consistent and auditable decision-making.

The log entry shows a failed authentication attempt from the backup server's IP address (10.0.0.15) using the service account 'svc_backup'. The event ID 4625 indicates an account logon failure, and the 'Failure Reason' field explicitly states 'Unknown user name or bad password'. Since the account name is correct, the most likely cause is multiple failed authentication attempts (e.g., due to a stale or incorrect password cached in the backup software) leading to account lockout, not a single event.

Conducting UAT in production exposes sensitive production data and live systems to test scripts and users who may not have proper authorization, creating a direct path for security breaches. Production environments typically have broader access controls and audit trails that are not designed to isolate test activities, increasing the risk of unauthorized data exposure or modification. This violates the principle of segregation of duties and can lead to compliance issues with standards like PCI DSS or HIPAA.

Regular restoration tests verify that backups are recoverable, and offsite storage ensures availability after a site disaster. Encryption, labeling, and capacity are security or operational considerations but not essential for recoverability.

Intrusion detection systems (A) and review of security incident logs (C) are detective controls that identify events after they occur.

The primary reason for storing backup media offsite is to ensure data availability and recoverability in the event of a site-level disaster, such as a fire, flood, or physical destruction of the primary data center. This aligns with the core business continuity principle of geographic separation to avoid a single point of failure. Without offsite storage, a site disaster would destroy both primary and backup data, making recovery impossible.

Standard format commands do not securely erase data; data can still be recovered. Secure sanitization methods (e.g., degaussing, shredding) should be used.

Option C is correct because the IS auditor's first priority is to gather evidence and understand the context before taking action. The employee's sales role and non-business hours access may be legitimate (e.g., supporting a client in a different time zone). Discussing with the supervisor is a standard audit procedure to verify authorization, aligning with ISACA's audit evidence collection and due professional care.

COTS packages typically have a faster implementation timeline because the core functionality already exists, reducing development time.

Extensive customization of an ERP system typically involves modifying the core code or configuration beyond standard parameters. This creates a custom code base that diverges from the vendor's standard release, making future upgrades significantly more complex and costly because each upgrade requires re-applying and testing all customizations against the new version, often requiring specialized skills and extensive regression testing.

External auditors are independent third parties, while internal auditors are employees of the organization.

A walkthrough test involves reviewing the plan step by step in a meeting, with no actual failover or impact on production, making it low-risk.

The Recovery Time Objective (RTO) defines the maximum acceptable downtime for a system after a disaster. Since the organization's RTO is 4 hours and the system was recovered in 3.5 hours, the recovery time directly satisfies the RTO metric. The 30 minutes of data loss is irrelevant to RTO; it pertains to the Recovery Point Objective (RPO).

Incorporating an external specialist with ERP expertise ensures the audit is conducted effectively despite the team's lack of experience.

Tabletop exercises focus on discussion and coordination among participants without technical testing.

The primary consideration for determining audit scope is a risk assessment of the financial system. ISACA standards require auditors to use a risk-based approach to focus audit efforts on areas with the highest residual risk, ensuring that resources are allocated to the most critical controls and processes. Without a risk assessment, the scope may be too broad or miss key vulnerabilities, such as segregation of duties or access control weaknesses in the new system.

The error indicates failure to mount the backup target, implying a connectivity issue with the storage array. A syntax error would produce a script error; disk space would show a different error; authentication would show a credentials error.

Mandatory vacation is a fraud detection control that helps uncover irregularities when an employee is away.

Recovery time objectives (RTOs) are essential because they define the maximum acceptable downtime for the system, directly driving the design of backup and recovery strategies. Without RTOs, the BCP cannot prioritize recovery actions or allocate resources effectively, making them a foundational element for any newly developed system.

Proper exception management requires compensating controls and a time-bound approval with periodic review.

A right to audit the vendor's security practices is essential in a SaaS contract because it allows the organization to independently verify that the vendor's controls (e.g., access management, patch management, incident response) meet contractual and regulatory requirements. Without this clause, the organization must rely solely on the vendor's self-assessments or third-party reports like SOC 2, which may not cover all relevant risks or may be outdated. This right is a key mechanism for ensuring ongoing data protection in a shared responsibility model.

Option D is correct because the error indicates that the backup server cannot access the virtual disk, which is typically a LUN masking or zoning issue. Option A is plausible but the message specifically points to storage access; Option B is not indicated; Option C is possible but less direct.

Option B is correct: Immediately reporting the critical vulnerability to management is the first step because the risk of data exposure is severe and requires urgent attention. Option A delays action, C assumes a compromise that hasn't been confirmed, and D is premature without management directive.

P1 incidents are the highest severity, typically involving a critical service outage affecting all users with significant business impact.

A full interruption test (also called full-scale test) involves actual failover, shutting down primary operations and running completely from the alternate site.

Without manager confirmation, access may remain for users who no longer need it, leading to segregation of duties conflicts or unauthorized access. Annual reviews without manager sign-off increase the risk that access is not appropriately revoked when roles change.

The estimated error rate is calculated by dividing the number of errors found in the sample (3) by the sample size (50), yielding 6%. This is a point estimate of the population error rate, assuming the sample is representative. The auditor would then use statistical sampling techniques to determine a confidence interval for the true population error rate.

The ITIL 4 guiding principle 'Think and work holistically' emphasizes considering the entire service value system and how all components interact.

The exhibit shows an access control list (ACL) permitting TCP ports 443 (HTTPS) and 22 (SSH) from any source to host 10.1.1.100. Since the ACL is applied inbound on the internet-facing interface, only HTTPS and SSH traffic are allowed through to that host. Therefore, option C is correct.

The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the impact of their disruption, which directly drives the recovery time objectives (RTOs) and recovery point objectives (RPOs). These RTOs and RPOs form the foundation for selecting appropriate recovery strategies and technologies, such as synchronous replication for near-zero RPO or warm standby sites for specific RTO windows. Without a BIA, the BCP would lack the business-driven metrics needed to prioritize recovery efforts and allocate resources effectively.