CISA Exam Dumps - Certified Information Systems Auditor

The audit team’s most important course of action is to consult the legal department to understand the procedure for requesting data from a different jurisdiction, as this will ensure that the data analytics techniques are compliant with the applicable laws and regulations of both countries12. Requesting data from a foreign branch may involve legal risks such as data privacy, data sovereignty, and data protection34, and the audit team should seek legal guidance before proceeding with the data extraction and analysis.

References

1: Data Analytics and Auditing Standards 2: Data Analytics and the Audit Process 3: Data Privacy and Data Protection: US Law and Legislation 4: Data Sovereignty: What It Is and Why It Matters

The best answer is C. Patch-related risk may not be adequately assessed.

ISACA guidance on emergency changes emphasizes that emergency changes must still be declared, assessed, approved, authorized after the fact, and recorded. The key risk with emergency patching is that urgency can cause insufficient assessment of the patch’s effect on security, stability, compatibility, and business operations. If risk is not adequately assessed, the organization may introduce outages, vulnerabilities, or unintended consequences into production.

Option A is a concern, but incomplete records are generally secondary to poor risk evaluation. Option B may be necessary operationally and can be controlled. Option D is less compelling because ISACA’s guidance recognizes that emergency changes may receive preliminary approval and retroactive authorization, so the key issue is not the absence of standard documented approvals upfront, but whether the change is properly controlled and assessed.

Therefore, the correct answer is C, because inadequate risk assessment is the most serious concern when applying emergency patches.

References (Official ISACA):

ISACA, Improving the RFP and Contracts Process With COBIT 5 — emergency changes should be declared, assessed, authorized, and recorded.

ISACA Journal, Speeding Up Software Delivery With Effective Change Management — emergency change procedures should still be run through standard review retrospectively.

ISACA, Protecting SAP Systems in the Cybersecurity Era — patch management should include risk and applicability assessment before deployment.

 The best action that audit management should consider first is to reassign the audit to an internal audit subject matter expert. This is because cloud service audits require specialized knowledge and skills to assess the risks and controls associated with the cloud service provider and the cloud service customer. An IS auditor who is unfamiliar with the technologies in use and their associated risks to the business may not be able to perform an effective and efficient audit, and may miss important issues or provide inaccurate recommendations. Therefore, it is important to ensure that the IS auditor assigned to the cloud service audit has the appropriate competence and experience.

The other options are not as good as reassigning the audit to an internal audit subject matter expert. Conducting a follow-up audit after a suitable period has elapsed may not address the quality issues of the initial audit, and may also delay the identification and remediation of any problems. Rescheduling the audit assignment for the next financial year may expose the organization to unnecessary risks and may not meet the audit objectives or expectations. Extending the duration of the audit to give the auditor more time may not be feasible or cost-effective, and may not guarantee that the auditor will acquire the necessary knowledge and skills in time.

The management decision that presents the greatest risk associated with data leakage is not providing security awareness training to staff. This is because staff are often the weakest link in the information security chain, and they may unintentionally or maliciously leak sensitive data through various channels, such as email, social media, cloud storage, or removable media. Security awareness training is essential to educate staff on the importance of protecting data, the policies and procedures for handling data, and the best practices for preventing and reporting data leakage incidents. Not requiring desktops to be encrypted, allowing staff to work remotely, and not updating security policies in the past year are also management decisions that may increase the risk of data leakage, but they are not as significant as not providing security awareness training to staff. Encryption, remote work, and security policies are technical or administrative controls that can be implemented or enforced by management, but they cannot fully prevent or mitigate human errors or malicious actions by staff. References: CISA Review Manual (Digital Version), [ISACA Privacy Principles and Program Management Guide]

For online payment security, bothconfidentiality(protection of data) andnonrepudiation(ensuring the sender cannot deny a transaction) are essential.

Option A (Incorrect):DES is outdatedandinsecurefor modern encryption needs. It has been replaced by stronger algorithms.

Option B (Incorrect):AES provides strong encryption(confidentiality) but does not handlenonrepudiationon its own.

Option C (Correct):PKI (Public Key Infrastructure)is the best solution because it providesencryption for confidentialityanddigital signatures for nonrepudiation, ensuring bothsecuretransactions andauthenticationof parties involved.

Option D (Incorrect):AVPN secures network traffic, but it does not address nonrepudiation, which is critical in online payments.