CISA Exam Dumps - Certified Information Systems Auditor

 The main purpose of an information security management system (ISMS) is to reduce the frequency and impact of information security incidents. An ISMS is a systematic approach to managing information security risks, policies, procedures, and controls within an organization. An ISMS aims to ensure the confidentiality, integrity, and availability of information assets, as well as to comply with relevant laws and regulations. The other options are not the main purpose of an ISMS, but rather some of its possible benefits or components. References:

CISA Review Manual (Digital Version), Chapter 7, Section 7.11

CISA Review Questions, Answers and Explanations Database, Question ID 205

Configuring rule sets is the first activity that should be completed during the implementation of a DLP solution, because rule sets define the criteria and actions for identifying, monitoring, and preventingdata loss incidents12. Rule sets are based on the organization’s data classification, policies, and requirements, and they help to ensure that the DLP solution is aligned with the business objectives and risk appetite34. Configuring rule sets before enabling detection points, establishing exceptions workflow, or configuring reports helps to avoid false positives, false negatives, or unnecessary alerts5.

References

1: 3.13: Deploy a Data Loss Prevention Solution - Read the Docs

2: Plan and implement data loss prevention (DLP) [Guided] - NICCS

3: CONTINUOUS DIAGNOSTICS AND MITIGATION PROGRAM DATA PROTECTION … - CISA

4: Continuous Diagnostics and Mitigation Program Technical … - CISA

5: Data Loss Prevention Best Practices - ISACA Journal

The best answer is A. Identifying the risk scoring criteria.

A risk register becomes useful only when identified risks can be assessed consistently and prioritized. ISACA guidance describes the risk register as a record of identified risks including their determined risk levels, and explains that risk level is determined based on methodology involving threats, vulnerabilities, impact, probabilities, and asset value. That means the criteria for scoring must be established so risks can be evaluated and ranked in a consistent way.

Option B is important after risks are identified and assessed, because ownership drives accountability. Option C follows prioritization and ownership. Option D may help identify risks but is not the key action in populating the register itself. The register’s value depends first on a sound scoring basis that turns a list of concerns into prioritized risk information.

References (Official ISACA):

ISACA Journal, Mitigating Technical Vulnerabilities With Risk Assessment — the risk register records identified risks and their determined risk levels.

ISACA Journal, Addressing Risk Using the New Enterprise Security Risk Management Cycle — risk level is determined using threats, vulnerabilities, impact, probabilities, and asset value.

ISACA, Making Risk Management for Agile Projects Effective — risk registers are updated throughout the project.

The most important aspect of an incident response management program is the ability to detect incidents in a timely and accurate manner. Without effective detection, the organization cannot respond to incidents, mitigate their impact, or prevent their recurrence. The alerting tools and incident responseteam are responsible for monitoring the IT environment, identifying anomalies or threats, and notifying the appropriate stakeholders.

References

ISACA CISA Review Manual, 27th Edition, page 255

What is an incident response plan? And why do you need one?

ISACA CISA Certified Information Systems Auditor Exam … - PUPUWEB

For an organization that has plans to implement web-based trading, it would be most important for an IS auditor to verify that the organization’s information security plan includes security requirements for the new application. Security requirements are statements that define what security features and functions are needed to protect the confidentiality, integrity, and availability of the web-based trading application and its data. Security requirements should be identified and documented during the planning phase of the application development life cycle, before any design or coding activities take place. Attributes for system passwords, security training prior to implementation, and firewall configuration for the web server are also important aspects of information security, but they are not as essential as security requirements for ensuring that the web-based trading application meets its security objectives.