CISA Exam Dumps - Certified Information Systems Auditor

The best control to minimize the risk of unauthorized access to lost company-owned mobile devices is device encryption. Device encryption is a process that transforms data on a device into an unreadable format using a cryptographic key. Device encryption protects the data stored on the device from being accessed by unauthorized parties, even if they bypass the password or PIN protection. Device encryption can also prevent data leakage if the device is disposed of or recycled without proper data sanitization. Password or PIN protection is a basic control that prevents unauthorized access to the device by requiring a secret code or pattern to unlock it. However, password or PIN protection can be easily compromised by brute force attacks, shoulder surfing, or social engineering. Device trackingsoftware is a tool that allows the device owner or administrator to locate, lock, or wipe the device remotely in case of loss or theft. However, device tracking software depends on the device’s network connectivity and GPS functionality, which may not be available or reliable in some situations. Periodic backup is a process that copies the data from the device to another storage location for recovery purposes. Periodic backup can help restore the data in case of loss or damage of the device, but it does not prevent unauthorized access to the data on the device itself. References: CISA ReviewManual (Digital Version), Chapter 5: Protection of Information Assets, Section 5.4: Mobile Devices

The best course of action for an IS auditor who finds that some critical recommendations have not been implemented is to evaluate senior management’s acceptance of the risk. The IS auditor should understand the reasons why the recommendations have not been implemented and the implications for the organization’s risk exposure. The IS auditor should also verify that senior management has formally acknowledged and accepted the residual risk and has documented the rationale and justification for their decision. The IS auditor should communicate the findings and the risk acceptance to the audit committee and other relevant stakeholders. References:

CISA Review Manual (Digital Version)

CISA Questions, Answers and Explanations Database

The best answer is A. Release management.

In continuous delivery, code moves frequently from development toward production, but the key control point that connects development output to live production deployment is release management. ISACA explains that continuous delivery takes integration output that has met release criteria and updates the application in production. That means the practical bridge between development and production is the release process that governs packaging, approval, timing, and movement into production.

Option C. DevOps is closely related, but it is broader than the specific connector. ISACA describes DevOps as focusing on automation and integration of processes before and after software release into production. That makes DevOps the broader operating model, while release management is the specific connector between development and production in the delivery pipeline.

Option B. Log management is important for monitoring and troubleshooting, but it does not connect development to production.

Option D. Data management is also important, but it is not the delivery bridge in this context.

Therefore, the correct answer is A, because release management is the function that controls and enables the movement of approved changes from development into production.

References (Official ISACA):

ISACA Journal, Speeding Up Software Delivery With Effective Change Management — continuous delivery updates production with integration output meeting release criteria.

ISACA Journal, Three Strategies for a Successful DevSecOps Implementation — DevOps is broader automation/integration around release into production.

The IS auditor’s best course of action is to evaluate the implemented control to ensure it mitigates the risk to an acceptable level. This is because the objective of a follow-up audit is to verify that corrective actions have been accomplished as scheduled and that theyare effective in preventing orminimizing future recurrence1. If senior management has implemented a different remediation action plan than what was previously agreed upon, the IS auditor should assess whether the alternative control is adequate and appropriate for the situation. Requesting justification from management for not implementing the recommended control (option D) may be a secondary step, but it is not the best course of action. Reporting the deviation by the control owner in the audit report (option A) may be premature and unnecessary if the implemented control is satisfactory. Canceling the follow-up audit and rescheduling for the next audit period (option C) is not advisable, as it would delay the verification of the effectiveness of the implemented control and potentially expose the organization to further risks. References: 1: Follow-up Audits - Canadian Audit and Accountability Foundation

Full disk encryption (FDE) is a means of protecting information by encrypting all of thedata on a disk, including temporary files, programs, and system files1. FDE is best suited for addressing the risk scenario of physical theft of media on which information is stored, as it prevents unauthorized access to the data even if the device is lost or stolen2. FDE does not prevent data leakage as a result of employees leaving to work for competitors, as they may still have access to the data while using the device or copy the data to another device before leaving. FDE does not prevent noncompliance fines related to storage of regulated information, as it does not ensure that the data is stored in accordance with the applicable laws and regulations. FDE does not prevent unauthorized logical access to information through an application interface, as it does not control the access rights and permissions of users and applications. *References: According to the ISACA IT Audit and Assurance Standards, Guidelines and Tools and Techniques for IS Audit and Assurance Professionals, section 2402 Planning, “The IS audit and assurance professional should identify and assess risk relevant to the area under review.” 3 Oneof the risk factors to consider is “the sensitivity of information processed, stored or transmitted by the system” 3. FDE is one of the possible controls to mitigate the risk of unauthorized disclosure of sensitive information due to physical theft of media.

Quarterly steering committee meetings best demonstrate alignment of the IT department with the corporate mission because they provide a regular forum for strategic planning, decision making, and communication between IT leaders and business stakeholders12. Steering committee meetings help to ensure that IT goals and initiatives are aligned with the business vision, mission, and objectives, and that IT performance and value are monitored and evaluated34.

References

1: IT Governance and the Balanced Scorecard - ISACA Journal

2: IT Steering Committee Best Practices: A Recipe for Success

3: What is IT Governance? - Definition from Techopedia

4: CISA Cybersecurity Strategic Plan | CISA