CISA Exam Dumps - Certified Information Systems Auditor

The most significant impact to an organization that does not use an IT governance framework is inadequate alignment of IT plans and business objectives. IT governance is a framework for the governance and management of enterprise information and technology (I&T) that supports enterprise goal achievement1. IT governance helps to ensure that IT investments and activities are aligned with the business strategy, vision, and values of the organization. IT governance also helps to optimize the value of IT, manage IT-related risks, and measure and monitor IT performance1.

Without an IT governance framework, an organization may face challenges such as:

Lack of clarity and direction for IT decision making

Inconsistent or conflicting IT priorities and demands

Inefficient or ineffective use of IT resources and capabilities

Poor quality or delivery of IT services and products

Increased exposure to IT-related threats and vulnerabilities

Reduced customer satisfaction and trust in IT

Missed opportunities for innovation and competitive advantage

Therefore, an organization that does not use an IT governance framework may fail to achieve its business objectives and may lose its competitive edge in the market.

References:

COBIT 2019 Framework Introduction and Methodology, Section 1.1: What Is Governance of Enterprise I&T?

IT Governance: Definitions, Frameworks and Planning, Section 1: What Is IT Governance?

Hashing is a technique that transforms data into a fixed-length value, called a hash or a digest, that uniquely represents the original data. Hashing can be used to validate the integrity of data communicated between production databases and a big data analytics system by comparing the hash values of the data before and after the communication. If the hash values match, the data has not been altered; if they differ, the data has been tampered with or corrupted. Hashing is a better security control than encrypting, running and comparing the count function, or hosting a digital certificate for this purpose because:

Encrypting in-scope data sets can protect the confidentiality of the data, but not necessarily the integrity. Encryption algorithms can be broken or bypassed by malicious actors, or encryption keys can be compromised or lost. Moreover, encryption adds overhead to the communication process and may affect the performance of the big data analytics system.

Running and comparing the count function within the in-scope data sets can only verify the number of records or elements in the data sets, but not the content or quality of the data. The count function cannot detect any changes or errors in the data values, such as missing, duplicated, corrupted, or manipulated data.

Hosting a digital certificate for in-scope data sets can provide authentication and non-repudiation for the data sources, but not integrity for the data itself. A digital certificate is a document that contains information about the identity and public key of an entity, such as a person, organization, or device. A digital certificate does not contain or verify the actual data that is communicated between production databases and a big data analytics system.

References:

Ensuring Data Integrity with Hash Codes

Database Security: An Essential Guide

Control methods of Database Security

An outsourced accounting application has the most inherent risk and should be prioritized during audit planning because it involves external parties, sensitive data, and complex transactions that are susceptible to material misstatement, error, or fraud12. An outsourced accounting application also requires more oversight and monitoring from the internal audit department to ensure compliance with the service level agreement and the organization’s policies and standards3.

References

1: Inherent Risk: Definition, Examples, and 3 Types of Audit Risks 2: 3 Types of Audit Risk - Inherent, Control and Detection - Accountinguide 3: IS Audit Basics: The Core of IT Auditing

Threat modeling is an approach that enables IS auditors to identify, analyze, and mitigate potential security vulnerabilities within an application by understanding the threats, attacks, vulnerabilities, and countermeasures. This proactive technique helps in designing secure applications.

References

ISACA CISA Review Manual 27th Edition, Page 276-277 (Threat Modeling)

User requirements are the foundation of any successful application. Properly defining what the application needs to do and how it should serve users is critical before moving into design or development.

References:

Project Management Methodologies (Agile, Waterfall, etc.): All major methodologies emphasize the criticality of understanding user requirements during the initial project phases.

Software Development Lifecycle (SDLC): Requirements gathering is a cornerstone of the initiation phase within the SDLC.

ISACA Resources: While not explicitly tied to a CISA document, ISACA's emphasis on governance and aligning IT with business objectives reinforces the importance of starting with clear user requirements.

The IS auditor should be most concerned if completeness testing has not been performed on the log data, as this could indicate that some logs are missing, corrupted, or tampered with, and that the log aggregation system is not reliable or accurate12. Completeness testing is a process of verifying that all the logs generated by the source systems are successfully collected, transferred, and stored by the log aggregation system, and that there are no gaps or inconsistencies in the log data34. Completeness testing is essential for ensuring the integrity and validity of the log data, and for supporting the risk management practices of the organization.

References

1: Log Aggregation: How it Works, Methods, and Tools - Exabeam2 2: Log Aggregation & Monitoring Relation in Cybersecurity4 3: Log Aggregation: What It Is & How It Works | Datadog3 4: Data Flow Testing - GeeksforGeeks1