- (Topic 1)
An IS auditor will be testing accounts payable controls by performing data analytics on the entire population of transactions. Which of the following is MOST important for the auditor to confirm when sourcing the population data?

1. A. The data is taken directly from the system.
2. B. There is no privacy information in the data.
3. C. The data can be obtained in a timely manner.
4. D. The data analysis tools have been recently updated.

Correct Answer: A
The most important thing for the auditor to confirm when sourcing the population data for testing accounts payable controls by performing data analytics is that the data is taken directly from the system. Taking the data directly from the system can help ensure that the data is authentic, complete, and accurate, and that it has not been manipulated or modified by any intermediary sources or processes. The other options are not as important as taking the data directly from the system, as they do not affect the validity or reliability of the data. There is no privacy information in the data is a privacy concern that can help protect the confidentiality and integrity of personal or sensitive data, but it does not affect the accuracy or completeness of the data. The data can be obtained in a timely manner is a logistical concern that can help facilitate the efficiency and effectiveness of the data analytics process, but it does not affect the authenticity or accuracy of the data. The data analysis tools have been recently updated is a technical concern that can help enhance the functionality and performance of the data analytics tools, but it does not affect the validity or reliability of the data. References: CISA Review Manual (Digital Version), Chapter 3, Section 3.2

- (Topic 4)
Which of the following is MOST important to include in security awareness training?

1. A. How to respond to various types of suspicious activity
2. B. The importance of complex passwords
3. C. Descriptions of the organization's security infrastructure
4. D. Contact information for the organization's security team

Correct Answer: A
The most important thing to include in security awareness training is how to respond to various types of suspicious activity. Security awareness training is a program that educates employees about the importance of security and how to avoid common threats and risks. One of the main objectives of security awareness training is to enable employees to recognize and report any signs of malicious or unauthorized activity, such as phishing emails, malware infections, data breaches, or social engineering attempts. By teaching employees how to respond to various types of suspicious activity, security awareness training can help to prevent or mitigate the impact of security incidents, protect the organization’s assets and reputation, and comply with legal and regulatory requirements.
The other options are not as important as option A. The importance of complex passwords is a useful topic, but not the most important thing to include in security awareness training. Complex passwords are passwords that are hard to guess or crack by using a combination of letters, numbers, symbols, and cases. Complex passwords can help to protect user accounts and data from unauthorized access, but they are not sufficient to prevent all types of security incidents. Moreover, complex passwords may be difficult to remember or manage by users, and may require additional measures such as password managers or multi-factor authentication. Descriptions of the organization’s security infrastructure is a technical topic, but not the most important thing to include in security awareness training. Security infrastructure is the set of hardware, software, policies, and procedures that provide the foundation for the organization’s security posture and capabilities. Security infrastructure may include firewalls, antivirus software, encryption tools, access control systems, backup systems, etc. Descriptions of the organization’s security infrastructure may be relevant for some employees who are involved in security operations or administration, but they may not be necessary or understandable for all employees who need security awareness training. Contact information for the organization’s security team is a practical detail, but not the most important thing to include in security awareness training. Security team is the group of people who are responsible for planning, implementing, monitoring, and improving the organization’s security strategy and activities. Contact information for the organization’s security team may be useful for employees who need to report or escalate a security issue or request a security service or support. However, contact information for the organization’s security team is not enough to ensure that employees know how to respond to various types of suspicious activity.
References: Security Awareness Training | SANS Security Awareness, Security Awareness Training | KnowBe4, Security Awareness Training Course (ISC)² | Coursera

- (Topic 1)
An IS auditor is following up on prior period items and finds management did not address an audit finding. Which of the following should be the IS auditor's NEXT course of action?

1. A. Note the exception in a new report as the item was not addressed by management.
2. B. Recommend alternative solutions to address the repeat finding.
3. C. Conduct a risk assessment of the repeat finding.
4. D. Interview management to determine why the finding was not addressed.

Correct Answer: D
If an IS auditor finds that management did not address a prior period audit finding, the next course of action should be to interview management to determine why the finding was not addressed, as this would help to understand the root cause, the impact, and the risk level of the issue. Noting the exception in a new report, recommending alternative solutions, or conducting a risk assessment are possible subsequent steps, but they should not precede interviewing management. References: CISA Review Manual (Digital Version), Chapter 1, Section 1.6

- (Topic 2)
Which of the following would be of MOST concern for an IS auditor evaluating the design of an organization's incident management processes?

1. A. Service management standards are not followed.
2. B. Expected time to resolve incidents is not specified.
3. C. Metrics are not reported to senior management.
4. D. Prioritization criteria are not defined.

Correct Answer: D
he design of an incident management process should include prioritization criteria to ensure that incidents are handled according to their impact and urgency. Without prioritization criteria, the organization may not be able to allocate resources effectively and respond to incidents in a timely manner. Expected time to resolve incidents, service management standards, and metrics reporting are important aspects of incident management, but they are not as critical as prioritization criteria for the design of the process. References: ISACA Journal Article: Incident Management: A Practical Approach

- (Topic 1)
What should be the PRIMARY basis for selecting which IS audits to perform in the coming year?

1. A. Senior management's request
2. B. Prior year's audit findings
3. C. Organizational risk assessment
4. D. Previous audit coverage and scope

Correct Answer: C
The primary basis for selecting which IS audits to perform in the coming year is the organizational risk assessment. An organizational risk assessment is a formal process for identifying, evaluating, and controlling risks that may affect the achievement of the organization’s goals and objectives3. An organizational risk assessment can help IS auditors prioritize and plan their audit activities based on the level of risk exposure and impact of each area or process within the organization. An organizational risk assessment can also help IS auditors align their audit objectives and criteria with the organization’s strategy and performance indicators. Senior management’s request, prior year’s audit findings, and previous audit coverage and scope are also possible bases for selecting which IS audits to perform in the coming year, but not as primary as the organizational risk assessment. These factors are more secondary or supplementary sources of information that can help IS auditors refine or adjust their audit plan based on specific needs or issues identified by management or previous audits. However, these factors may not reflect the current or emerging risks that may affect the organization’s operations or performance. References: ISACA CISA Review Manual 27th Edition, page 295