- (Topic 3)
An organization has virtualized its server environment without making any other changes to the network or security infrastructure. Which of the following is the MOST significant risk?

1. A. Inability of the network intrusion detection system (IDS) to monitor virtual server-lo- server communications
2. B. Vulnerability in the virtualization platform affecting multiple hosts
3. C. Data center environmental controls not aligning with new configuration
4. D. System documentation not being updated to reflect changes in the environment

Correct Answer: A
The most significant risk in virtualizing the server environment without making any other changes to the network or security infrastructure is the inability of the network intrusion detection system (IDS) to monitor virtual server-to-server communications. This can create blind spots for the IDS and allow malicious traffic to bypass detection. A vulnerability in the virtualization platform affecting multiple hosts is a potential risk, but not necessarily more significant than the loss of visibility. Data center environmental controls not aligning with new configuration or system documentation not being updated to reflect changes in the environment are operational issues, not security issues. References: ISACA, CISA Review Manual, 27th Edition, 2018, page 373

- (Topic 1)
Which of the following is the BEST control to prevent the transfer of files to external parties through instant messaging (IM) applications?

1. A. File level encryption
2. B. File Transfer Protocol (FTP)
3. C. Instant messaging policy
4. D. Application-level firewalls

Correct Answer: D
Application level firewalls are the best control to prevent the transfer of files to external parties through instant messaging (IM) applications, because they can inspect and filter network traffic based on application-specific protocols and commands, such as IM file transfer commands. Application level firewalls can block or allow IM file transfers based on predefined rules or policies. File level encryption, file transfer protocol (FTP), and instant messaging policy are not effective controls to prevent IM file transfers, because they do not restrict or monitor IM network traffic. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.4.1

- (Topic 2)
Which of the following should be of MOST concern to an IS auditor reviewing the public key infrastructure (PKI) for enterprise email?

1. A. The certificate revocation list has not been updated.
2. B. The PKI policy has not been updated within the last year.
3. C. The private key certificate has not been updated.
4. D. The certificate practice statement has not been published

Correct Answer: A

- (Topic 4)
Which of the following findings should be of GREATEST concern to an IS auditor assessing the risk associated with end-user computing (EUC) in an organization?

1. A. Insufficient processes to track ownership of each EUC application?
2. B. Insufficient processes to lest for version control
3. C. Lack of awareness training for EUC users
4. D. Lack of defined criteria for EUC applications

Correct Answer: D
The finding that should be of greatest concern to an IS auditor assessing the risk associated with end-user computing (EUC) in an organization is the lack of defined criteria for EUC applications. EUC applications are applications that are developed and maintained by end-users, rather than by IT professionals, to support their business functions and processes. Examples of EUC applications include spreadsheets, databases, reports, and scripts. The lack of defined criteria for EUC applications means that the organization does not have clear and consistent standards or guidelines to identify, classify, and manage EUC applications. This can lead to various risks, such as:
✑ Inaccurate or unreliable data and results from EUC applications that are not validated, verified, or tested
✑ Unauthorized or inappropriate access or use of EUC applications that are not secured, controlled, or monitored
✑ Inconsistent or incompatible data and results from EUC applications that are not integrated, documented, or updated
✑ Loss or corruption of data and results from EUC applications that are not backed up, recovered, or archived
Therefore, the IS auditor should be most concerned about the lack of defined criteria for EUC applications, as it can affect the quality, integrity, and availability of the EUC applications and the data they produce.
Insufficient processes to track ownership of each EUC application is a finding that should be of concern to an IS auditor assessing the risk associated with EUC in an organization, but it is not the greatest concern. The ownership of an EUC application refers to the person or group who is responsible for creating, maintaining, and using the EUC application. Insufficient processes to track ownership of each EUC application means that the organization does not have adequate mechanisms or records to identify and communicate who owns each EUC application. This can lead to risks, such as:
✑ Lack of accountability or ownership for the quality and accuracy of the EUC application and its data
✑ Lack of support or maintenance for the EUC application when the owner leaves or changes roles
✑ Lack of awareness or training for the users of the EUC application on its purpose and functionality
However, these risks are less severe than those caused by the lack of defined criteria for EUC applications.
Insufficient processes to test for version control is a finding that should be of concern to an IS auditor assessing the risk associated with EUC in an organization, but it is not the greatest concern. Version control is a process that tracks and manages the changes made to an EUC application over time. Insufficient processes to test for version control means that the organization does not have adequate procedures or tools to ensure that the changes made to an EUC application are authorized, documented, and tested. This can lead to risks, such as:
✑ Errors or inconsistencies in the data and results from different versions of the EUC application
✑ Conflicts or confusion among the users of the EUC application on which version is current or correct
✑ Loss or overwrite of data and results from previous versions of the EUC application
However, these risks are less severe than those caused by the lack of defined criteria for EUC applications.
Lack of awareness training for EUC users is a finding that should be of concern to an IS auditor assessing the risk associated with EUC in an organization, but it is not the greatest concern. Awareness training for EUC users is a process that educates and informs the users of the EUC applications on their roles, responsibilities, and risks. Lack of awareness training for EUC users means that the organization does not have adequate programs or materials to raise the knowledge and skills of the users on how to use and manage the EUC applications effectively and securely. This can lead to risks, such as:
✑ Misuse or abuse of the EUC applications by users who are not aware of their impact or implications
✑ Non-compliance or violation of policies or regulations by users who are not aware of their requirements or expectations
✑ Dissatisfaction or frustration among users who are not aware of their benefits or limitations
However, these risks are less severe than those caused by the lack of defined criteria for EUC applications.
References:
✑ End-user computing - Wikipedia 1
✑ How to Manage the Risks Associated with End User Computing 2
✑ Managing end user computing risks - KPMG UK 3

- (Topic 3)
Which of the following is the BEST reason to implement a data retention policy?

1. A. To limit the liability associated with storing and protecting information
2. B. To document business objectives for processing data within the organization
3. C. To assign responsibility and ownership for data protection outside IT
4. D. To establish a recovery point detective (RPO) for (toaster recovery procedures

Correct Answer: A
The best reason to implement a data retention policy is to limit the liability associated with storing and protecting information. A data retention policy is a document that defines how long data should be kept by an organization and how they should be disposed of when they are no longer needed. A data retention policy should comply with the applicable laws and regulations that govern the data retention requirements and obligations of organizations, such as tax laws, privacy laws, or industry standards4. Implementing a data retention policy can help to limit the liability associated with storing and protecting information by reducing the amount of data that need to be stored and secured, minimizing the risk of data breaches or leaks, ensuring compliance with legal or contractual obligations, and avoiding potential fines or penalties for non- compliance5. The other options are less relevant or incorrect because:
✑ B. Documenting business objectives for processing data within the organization is not a reason to implement a data retention policy, as it is more related to data governance than data retention. Data governance refers to the policies, procedures, and controls that define how data are collected, used, managed, and shared within an organization. Data governance helps to ensure that data are aligned with business objectives and support decision making6.
✑ C. Assigning responsibility and ownership for data protection outside IT is not a reason to implement a data retention policy, as it is more related to data accountability than data retention. Data accountability refers to the identification and assignment of roles and responsibilities for data protection among different stakeholders within an organization. Data accountability helps to ensure that data are handled appropriately and securely by authorized parties7.
✑ D. Establishing a recovery point objective (RPO) for disaster recovery procedures is not a reason to implement a data retention policy, as it is more related to data backup than data retention. Data backup refers to the process of creating copies of data that can be restored in case of data loss or corruption. Data backup helps to ensure that data are available and recoverable in case of disaster8. RPO is a measure of the maximum amount of data that can be lost or acceptable in case of disaster9. References: Data Retention Policy - ISACA, Data Retention - ISACA, Data Governance - ISACA, Data Accountability - ISACA, Data Backup - ISACA, Recovery Point Objective - ISACA