CISA Exam Dumps - Certified Information Systems Auditor

Network topology diagrams are the most important for an IS auditor to review when evaluating the design of controls related to network monitoring, because they show how the network components are connected and configured, and what security measures are in place to protect the network from unauthorized access or attacks. Incident monitoring logs, the ISP service level agreement, and reports of network traffic analysis are useful for evaluating the effectiveness and performance of network monitoring, but not the design of controls. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.3.3

Exploitationis the phase where testersleverage identified vulnerabilitiestogain unauthorized accessto systems.

Exploitation (Correct Answer – B)

Attackers use techniques such as SQL injection, buffer overflow, or privilege escalation.

Example:A tester exploits a weak password to gain admin access.

Exfiltration (Incorrect – A)

The process of stealing dataaftergaining access.

Reconnaissance (Incorrect – C)

The initial stage where attackers gather information about the target.

Scanning (Incorrect – D)

Involves identifying open ports and services but does not involve actual attacks.

Internalquality assurance (QA) reviewsare conducted toensure conformancewith professionalaudit standards and methodology.

Option A (Correct):The primary purpose of QA reviews is toconfirm that the internal audit function adheres to industry standards, such asISACA’s IT audit frameworkand theInternational Standards for the Professional Practice of Internal Auditing (IPPF).

Option B (Incorrect):Whilegovernance and performance metricsare important,conformance to standardsis theprimary goalof QA reviews.

Option C (Incorrect):Risk management is part of audits, butQA reviews focus on adherence to methodologyrather than reducing audit risk.

Option D (Incorrect):Efficient resource usageis a goal butnot the main objectiveof an audit QA program.

 Ongoing monitoring of the audit activities is the most important activity to include as part of the quality assurance (QA) program requirements for an internal audit department. An IS auditor should perform regular reviews and evaluations of the audit processes, methods, standards, and outcomes to ensure that they comply with the QA program objectives and criteria. This will help to maintain and improve the quality and consistency of the audit services and deliverables. The other options are less important activities to include as part of the QA program requirements, as they may involve long-term resource planning, user satisfaction reports, or feedback from internal audit staff. References:

CISA Review Manual (Digital Version), Chapter 2, Section2.61

CISA Review Questions, Answers and Explanations Database, Question ID 224

The best way for the auditor to address this issue is to verify management has approved a policy exception to accept the risk. A policy exception is a formal authorization that allows a deviation from the established policy requirements for a specific situation or period of time. A policy exception should be based on a risk assessment that evaluates the impact and likelihood of the potential threats and vulnerabilities, as well as the cost and benefit of the alternative controls. A policy exception should also be documented, approved, and monitored by management.

Recommending the application be patched to meet requirements is not the best way for the auditor to address this issue. Patching the application may not be feasible, cost-effective, or timely, given that the application will be decommissioned in three months. Patching the application may also introduce new risks or errors that could affect the functionality or performance of the application.

Informing the IT director of the policy noncompliance is not the best way for the auditor to address this issue. Informing the IT director of the policy noncompliance may not resolve the issue or mitigate the risk, especially if the IT director is already aware of the situation and has decided to accept it. Informing the IT director of the policy noncompliance may also create unnecessary conflict or tension between the auditor and the auditee.

Taking no action since the application will be decommissioned in three months is not the best way for the auditor to address this issue. Taking no action may expose the organization to significant risks or consequences, such as data breaches, regulatory fines, or reputational damage, if the application is compromised or exploited by malicious actors. Taking no action may also violate the auditor’s professional standards and responsibilities, such as due care, objectivity, and reporting.

ADLP strategyaims toprevent data breachesby ensuringusers handle data securely.

Option A (Incorrect):Avoiding financial and reputational risk is anoutcome, but not theprimary goalof training.

Option B (Incorrect):Data availabilityis important but is notdirectly relatedto DLP user training.

Option C (Correct):User training should focus on secure data handling, as human error is a leading cause of data loss incidents.

Option D (Incorrect):Data governanceensurescompliance, but secure handling practices are themain goal of DLP training.