CISA Exam Dumps - Certified Information Systems Auditor

The correct answer is A. The recovery time objective (RTO) has a longer duration than documented in the disaster recovery plan (DRP).

This is the greatest concern because the third-party provider’s SLA does not support the bank’s disaster recovery requirement. If the SLA allows a longer recovery time than the DRP requires, the bank may be unable to recover critical services within the approved recovery objective during a disaster.

Option B is a concern because SLAs should be periodically reviewed, but it is less serious than a direct mismatch between the SLA and the DRP recovery requirement. Option C is not a concern because a shorter RPO is better than the DRP requirement; it means less data loss than required. Option D may be a concern depending on backup architecture and resilience, but the clearest and most direct issue is that the provider’s RTO exceeds the bank’s DRP requirement.

ISACA third-party risk management guidance states that contract provisions, typically in SLAs, should address risk-related commitments, and third-party risk management should combine the vendor risk profile with the risk profile of the engagement.

 The most effective control over visitor access to highly secured areas is to require visitors to be escorted by authorized personnel. This control ensures that visitors are supervised at all times and do not enter any restricted or sensitive areas without permission. It also allows authorized personnel to verify the identity, purpose, and clearance of the visitors, and to monitor their behavior and activities. Escorting visitors also reduces the risk of tailgating, piggybacking, or unauthorized duplication of access credentials.

Requiring visitors to use biometric authentication, monitoring visitors online by security cameras, and requiring visitors to enter through dead-man doors are all examples of technical controls that can enhance visitor access control, but they are not as effective as escorting visitors. Biometric authentication can provide a high level of identity verification, but it does not prevent visitors from accessing unauthorized areas or compromising security in other ways. Security cameras can provide a record of visitor movements and actions, but they may not deter or detect security breaches in real time. Dead-man doors can prevent unauthorized entry by requiring two-factor authentication, but they do not ensure that visitors are accompanied by authorized personnel.