CISA Exam Dumps - Certified Information Systems Auditor

 The most important consideration for a go-live decision when implementing an upgraded enterprise resource planning (ERP) system is the business case. The business case is the document that defines and justifies the need, value, feasibility, and risks of the project. It also outlines the expected costs, benefits, outcomes, and impacts of the project. The business case provides the basis for measuring and evaluating the success of the project. Therefore, before deciding to go live with an upgraded ERP system, it is essential to review and validate the business case to ensure that it is still relevant, accurate, realistic, and achievable.

A rollback strategy, test cases, and post-implementation review objectives are not the most important considerations for a go-live decision when implementing an upgraded ERP system. These are important elements of project planning, execution, and evaluation, but they are not sufficient to determine whether the project is worth pursuing or delivering. These elements should be aligned with and derived from the business case.

The most significant impact to an organization that does not use an IT governance framework is inadequate alignment of IT plans and business objectives. IT governance is a framework for the governance and management of enterprise information and technology (IandT) that supports enterprise goal achievement1. IT governance helps to ensure that IT investments and activities are aligned with the business strategy, vision, and values of the organization. IT governance also helps to optimize the value of IT, manage IT-related risks, and measure and monitor IT performance1.

Without an IT governance framework, an organization may face challenges such as:

Lack of clarity and direction for IT decision making

Inconsistent or conflicting IT priorities and demands

Inefficient or ineffective use of IT resources and capabilities

Poor quality or delivery of IT services and products

Increased exposure to IT-related threats and vulnerabilities

Reduced customer satisfaction and trust in IT

Missed opportunities for innovation and competitive advantage

Therefore, an organization that does not use an IT governance framework may fail to achieve its business objectives and may lose its competitive edge in the market.

The primary responsibility of a project steering committee is to provide regular project updates and oversight. A project steering committee is an advisory group that consists of senior stakeholders and experts who offer guidance and support to a project manager and their team. The steering committee is mainly concerned with the direction, scope, budget, timeline, and methods used to realize a given project1.

One of the key roles of a steering committee is to monitor the progress and performance of the project and ensure that it aligns with the business objectives and stakeholder expectations. The steering committee also provides feedback, advice, and recommendations to the project manager and helps them resolve any issues or challenges that may arise during the project lifecycle. The steering committee communicates regularly with the project manager and other stakeholders through meetings, reports, and presentations23.

Therefore, providing regular project updates and oversight is the primary responsibility of a project steering committee.

Understanding the specific agile methodology that will be followed is the first step that an IS auditor should do to ensure the effectiveness of the project audit. An IS auditor should familiarize themselves with the agile approach, principles, practices, and tools that will be used by the project team, as well as the roles and responsibilities of the project stakeholders. This will help the IS auditor to identify and assess the relevant risks and controls for the project audit. The other options are not the first steps that an IS auditor should do, but rather possible subsequent actions that may depend on the specific agile methodology. References:

CISA Review Manual (Digital Version), Chapter 4, Section 4.3.21

CISA Review Questions, Answers and Explanations Database, Question ID 211

 The IS auditor’s best course of action when reviewing the use of an outsourcer for disposal of storage media is to determine exposure to the business. Storage media, such as hard disks, tapes, flash drives, or CDs, may contain sensitive or confidential information that needs to be protected from unauthorized access, disclosure, or misuse. The IS auditor should verify that the outsourcer has a process that appropriately sanitizes the media before disposal, such as wiping, degaussing, shredding, or incinerating, and that the process is effective and compliant with the organization’s policies and standards. The IS auditor should also assess the potential impact and risk to the business if the storage media is not properly sanitized or disposed of, such as data breaches, reputational damage, legal or regulatory penalties, or loss of competitive advantage. The other options are not the best course of action, because they either do not address the root cause of the problem,or they are reactive rather than proactive measures. References: CISA Review Manual (Digital Version)1, Chapter 5, Section 5.2.7

The correct answer is A. Identifying functional requirements the new system must meet.

The accounts payable business process owner understands how the accounts payable process works, what business rules must be followed, what approvals are required, what reports are needed, what controls are required, and what exceptions must be handled. Therefore, the business process owner’s most important project responsibility is to identify and validate the functional requirements the new system must meet.

Functional requirements describe what the system is supposed to accomplish. ISACA describes functional requirements as being focused on system functionality, while performance requirements address areas such as transaction speed, scalability, and related system characteristics.

Option B is not the best answer because delivering the project on time and on budget is mainly the responsibility of the project manager and project governance structure. Option C is not the best answer because monitoring resource utilization is an IT operations or capacity management responsibility. Option D is not the best answer because infrastructure security is primarily the responsibility of IT/security teams, although the business owner should help identify business control and data protection needs.

This question maps to Information Systems Acquisition, Development and Implementation because requirements definition, business participation, and implementation readiness are core system acquisition and implementation topics in Domain 3 of the CISA Exam Content Outline.

 Information security governance is the subset of enterprise governance that provides strategic direction, ensures that objectives are achieved, manages risk appropriately, uses organizational resources responsibly, and monitors the success or failure of the enterprise security program. Information security governance is essential for ensuring that an organization’s information assets are protected from internal and external threats, and that the organization complies with relevant laws and standards.

Demonstrated support from which of the following roles in an organization has the most influence over information security governance? The answer is C, the board of directors. The board of directors is the highest governing body of an organization, responsible for overseeing its strategic direction, performance, and accountability. The board of directors sets the tone at the top for information security governance by:

Establishing a clear vision, mission, and values for information security

Approving and reviewing information security policies and standards

Allocating sufficient resources and budget for information security

Appointing and empowering a chief information security officer (CISO) or equivalent role

Holding management accountable for information security performance and compliance

Communicating and promoting information security awareness and culture

The board of directors has the most influence over information security governance because it has the ultimate authority and responsibility for ensuring that information security is aligned with the organization’s business objectives, risks, and stakeholder expectations.

The correct answer is B. Vulnerability scanning.

For a very large e-commerce platform, vulnerability scanning is the best technique among the options because it provides automated, broad coverage for identifying security weaknesses across web applications, servers, interfaces, and related components. ISACA defines vulnerability scanning as an automated process used to proactively identify security weaknesses in a network or individual system. ISACA’s CISA Exam Content Outline also includes threat and vulnerability management and the use of technical security testing to identify potential vulnerabilities.

Option A, code review, can be very useful for identifying insecure coding practices and logic flaws, but it is usually more time-consuming and less practical as the primary technique for a very large e-commerce environment. It may also require access to source code and specialized development expertise.

Option C, logical security testing, focuses mainly on access rights, authentication, authorization, and logical access controls. It is important, but it is narrower than vulnerability scanning for identifying web application security flaws.

Option D, penetration testing, is valuable because it attempts to exploit vulnerabilities in a controlled manner. ISACA defines penetration testing as a live test of security defenses by mimicking real-life attackers. However, penetration testing is usually more targeted and is often used to validate exploitability of vulnerabilities. For broad identification of web application flaws in a very large platform, vulnerability scanning is the stronger answer.

This question maps mainly to Protection of Information Assets because the CISA Exam Content Outline includes security testing tools and techniques, security monitoring, threat and vulnerability management, and protection of information assets under Domain 5.