Isaca CISA Practice Test - Questions Answers, Page 74

The best way to mitigate risk to an organization's network associated with devices permitted under a BYOD policy is to implement a network access control system, as this will allow the organization to monitor, authenticate, and authorize the devices that connect to the network, and to enforce security policies and compliance requirements12.A network access control system can help to prevent unauthorized or compromised devices from accessing sensitive data or resources, and to detect and isolate any potential threats or vulnerabilities34.

Reference

1: Network Access Control (NAC) - ISACA2: Network Access Control (NAC) - Cisco3: BYOD Security Risks: 6 Ways to Protect Your Organization - ReliaQuest54: How to Mitigate BYOD Risks and Challenges - CIOReview6

A continuous integration/continuous development (CI/CD) process helps to reduce software failure risk by enabling smaller incremental changes to the software code, rather than large and infrequent updates12.Smaller incremental changes allow developers to detect and fix errors, bugs, or vulnerabilities more quickly and easily, and to ensure that the software is always in a working state34.Smaller incremental changes also reduce the complexity and uncertainty of the software development process, and improve the quality and reliability of the software product5.

Reference

1: What is CI/CD?Continuous integration and continuous delivery explained12: 5 CI/CD challenges---and how to solve them | TechBeacon43: Continuous Integration vs Continuous Delivery vs Continuous Deployment24: 7 CI/CD Challenges & their Must-Know Solutions | BrowserStack35: 5 common pitfalls of CI/CD---and how to avoid them | InfoWorld5

The best way to enable the organization to work toward improvement in its security threat and vulnerability management program is to use a capability maturity model to identify a path to an optimized program.A capability maturity model is a framework that helps organizations assess their current level of performance and maturity in a specific domain, and provides guidance and best practices to achieve higher levels of excellence12.A capability maturity model for vulnerability management can help the organization to evaluate its current practices, identify gaps and weaknesses, and implement improvement actions based on the defined criteria and objectives34.

Reference

1: What is a Capability Maturity Model?12: Capability Maturity Model - Wikipedia23: Vulnerability Management Maturity Model - SANS Institute44: 5 Stages Of Vulnerability Management Maturity Model - SecPod Blog3

This control is best implemented through system configuration because it can be enforced automatically by setting a parameter in the network operating system or directory service.This ensures that temporary workers do not have access to the network beyond their authorized period, and reduces the risk of unauthorized or malicious use of their accounts12.

Reference 1: Configuration and Change Management - CISA 2: What is IT Governance? - Definition from Techopedia

The business case for an information system investment is a document that provides the rationale and justification for the investment, based on the expected costs, benefits, risks, and impacts of the project12.The business case should be available for review until the benefits have been fully realized, because it serves as a baseline for measuring the actual performance and outcomes of the project against the planned ones34.This helps to evaluate the success and value of the investment, and to identify any gaps or issues that need to be addressed5.

Reference

1: The Business Case for Security - CISA

2: Beyond the Business Case: New Approaches to IT Investment

3: #HowTo: Build a Business Case for Cybersecurity Investment

4: ISACA CISA Certified Information Systems Auditor Exam ... - PUPUWEB

5: The Business Case for Security | CISA

Quarterly steering committee meetings best demonstrate alignment of the IT department with the corporate mission because they provide a regular forum for strategic planning, decision making, and communication between IT leaders and business stakeholders12.Steering committee meetings help to ensure that IT goals and initiatives are aligned with the business vision, mission, and objectives, and that IT performance and value are monitored and evaluated34.

Reference

1: IT Governance and the Balanced Scorecard - ISACA Journal

2: IT Steering Committee Best Practices: A Recipe for Success

3: What is IT Governance?- Definition from Techopedia

4: CISA Cybersecurity Strategic Plan | CISA

The change management process is the set of procedures and activities that ensure that changes to the information system are authorized, tested, documented, and implemented in a controlled manner12.A defect in a recent release indicates that there may be issues with the quality assurance, testing, or approval of the changes, which could affect the reliability, security, and performance of the system3. Therefore, the auditor's next step should be to evaluate the change management process and identify the root cause of the defect, as well as the impact and remediation of the incident.

Reference

1: Change Management - CISA

2: What is Change Management?- Definition from Techopedia

3: How to Audit Change Management - ISACA Journal

: The Business Case for Security | CISA

A digital signature is a mathematical algorithm that validates the authenticity and integrity of a message or document by generating a unique hash of the message or document and encrypting it using the sender's private key1.The primary reason for using a digital signature is to authenticate the sender of a message, as only the sender has access to their private key and can produce a valid signature2.A digital signature also verifies the integrity of the data, as any modification to the message or document will result in a different hash value and invalidate the signature1.However, a digital signature does not provide availability or confidentiality to the transmission, as it does not prevent denial-of-service attacks or encrypt the entire message or document3.

Reference

1: Understanding Digital Signatures | CISA

2: Signature Verification | CISA

3: SECFND: Digital Signatures from Skillsoft | NICCS