CISA Protection of Information Assets Practice Question
An IS auditor is reviewing an organization's vulnerability management program. The auditor notes that a critical vulnerability in a key application has not been patched for 90 days, and there is no documented risk acceptance. What should the auditor do FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Determine if compensating controls exist to mitigate the vulnerability
The auditor should determine if compensating controls are in place to mitigate the risk, as this information is essential to assess the residual risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Report the finding as a non-compliance with the patch management policy
Why it's wrong here
While policy compliance is important, the auditor should first understand the risk context.
- ✗
Discuss with management the absence of a risk acceptance
Why it's wrong here
This is a step, but not the first action; the auditor needs more information.
- ✗
Escalate the issue to senior management immediately
Why it's wrong here
Escalation may be needed later, but first gather facts.
- ✓
Determine if compensating controls exist to mitigate the vulnerability
Why this is correct
Compensating controls may reduce risk; the auditor should evaluate them before making a recommendation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.