CISA Exam Dumps - Certified Information Systems Auditor

 Data leakage prevention (DLP) is the process of preventing unauthorized access, disclosure, or transfer of sensitive data. In a multi-tenant cloud environment, where multiple customers share the same infrastructure and resources, DLP is a critical challenge. One of the best methods to enforce DLP in such an environment is to require tenants to implement data classification policies. Data classification policies define the types and levels of sensitivity of data, and the corresponding security controls and measures to protect them. By implementing data classification policies, tenants can ensure that their data is properly labeled, encrypted, segregated, and monitored according to their specific requirements and compliance standards. This can help prevent data leakage from accidental or malicious actions by other tenants, cloud service providers, or external parties.

A firewall between internal network segments improves security and reduces risk by inspecting all traffic flowing between network segments and applying security policies. This will prevent unauthorized or malicious access, data leakage, or network attacks from compromising the network resources or data. Logging all packets passing through network segments may provide audit trails and evidence, but not prevent or mitigate security incidents. Monitoring and reporting on sessions between network participants may help to identify anomalous or suspicious activities, but not block or filter them. Ensuring all connecting systems have appropriate security controls enabled may enhance the overall network security posture, but not isolate or segregate different network segments. References: Info Technology and Systems Resources | COBIT, Risk, Governance … - ISACA, section “Book COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution | Digital | English”

The best approach to optimize resources when both internal and external audit teams are reviewing the same IT general controls area is to leverage the work performed by external audit for the internal audit testing. This can avoid duplication of efforts, reduce audit costs and enhance coordination between the audit teams. The internal audit team should evaluate the quality and reliability of the external audit work before relying on it. Ensuring both the internal and external auditors perform the work simultaneously is not an efficient use of resources, as it would create redundancy and possible interference. Requesting that the external audit team leverage the internal audit work may not be feasible or acceptable, as the external audit team may have different objectives, standards and independence requirements. Rolling forward the general controls audit to the subsequent audit year is not a good practice, as it would delay the identification and remediation of any control weaknesses in a high-risk area. References: ISACA, CISA Review Manual, 27th Edition, 2018, page 247

The first step in ensuring secure configuration of new IT assets is to establish the baseline configuration requirements those assets must meet. ISACA guidance supports the use of documented security configuration standards, secure baselines, and hardening requirements before deployment. Without predefined hardening standards, vulnerability scanning or remediation lacks a clear benchmark for what “secure” should look like.

Option B is correct because defining and implementing hardening standards establishes the secure baseline for systems, operating systems, applications, and devices. ISACA material notes that resources should adhere to a minimum-security baseline composed of standard security configurations, and secure configurations should be documented and maintained. This makes hardening standards the logical and control-oriented first step.

Option A is not first. Identifying and remediating vulnerabilities is important, but this activity should follow the establishment of hardening standards. Otherwise, there is no approved baseline against which to assess and remediate deviations. In CISA logic, standards come before testing against standards.

Option C is also not first for the same reason. Vulnerability scanning is an assessment technique, but organizations must first define the secure configuration baseline or hardening standard to know what they expect from the asset. Scanning should validate configuration and identify weaknesses after standards have been established.

Option D is clearly incorrect because purchasing tools is not the starting point of good control design. Tools may support implementation and verification, but governance requires that standards be defined first. In ISACA terms, sound control begins with policy, standards, and procedures, not with tool acquisition.

Therefore, the best answer is B because secure configuration starts with defining and applying hardening standards, which then enable scanning, validation, and remediation activities.

References (Official ISACA):

ISACA-linked guidance, A Look at CIS Controls Version 7.1 — “Establish Secure Configurations” and maintain documented security configuration standards.

ISACA, Best Practices for Auditable Security Controls — all resources should adhere to a minimum-security baseline of standard security configurations.

ISACA, Can Hardening Reduce Cyberrisk? — highlights hardening systems and infrastructure to reduce risk.

ISACA, Digital Businesses Need Tailored Security Solutions and Services — refers to minimum baseline hardening standards and guidelines.

Comprehensive and Detailed Explanation:

When verifying the integrity of a bit-for-bit copy of digital evidence, hashing algorithms are used. The primary factors in selecting a hashing algorithm are speed and collision resistance.

MD5 (Message Digest 5): While not cryptographically secure for all modern applications due to collision vulnerabilities, it is very fast and still acceptable in forensic integrity verification where speed is critical and the probability of collision is negligible for one-time checks.

SHA-1 / SHA-2: Provide stronger cryptographic assurance but are slower than MD5. They are preferred for long-term integrity assurance but not when processing speed is the top priority.

AES (Advanced Encryption Standard): AES is an encryption algorithm, not a hashing algorithm, and therefore is not appropriate for integrity verification.

📖 ISACA Reference: CISA Review Manual 27th Edition, Domain 5 (Protection of Information Assets), section on cryptographic controls for evidence integrity.