Isaca Updated CISA Exam Questions and Answers by moshe

The correct answer is C. Reviewing escalated project issues.

A steering committee provides governance, oversight, prioritization, funding direction, issue escalation, and decision-making support for major initiatives. In a digital transformation program, the steering committee is most likely to review escalated project issues, resolve conflicts, approve major decisions, and ensure the program remains aligned with business objectives.

ISACA guidance on digital transformation governance highlights the importance of project governance frameworks, steering committees, and escalation paths. ISACA also describes executive steering committees as bodies that guide strategy, approve funding, make formal risk decisions, and support clear escalation paths and decision-making protocols.

Option A is not correct because designing interface controls is a technical/system design responsibility. Option B is usually performed by business analysts, process owners, and project teams. Option D is usually prepared by the project manager or program manager, although the steering committee may review the status reports.

This question maps to Governance and Management of IT, because steering committees are part of IT governance, strategic oversight, resource allocation, and project/program governance.

A data loss prevention (DLP) tool implemented in monitor mode only observes and logs potential data leakage but does not actively prevent it. This leaves the organization vulnerable to data breaches, making it the most critical concern in a pre-implementation review.

Crawlers for Sensitive Data (Option B):While crawlers may pose a performance impact, they are essential for discovering sensitive data.

Deep Packet Inspection (Option C):Though it introduces privacy considerations, it is a standard DLP functionality for inspecting data in transit.

Encryption Key Management (Option D):While important for security, improper management does not immediately prevent DLP functionality.

A lack ofMobile Device Management (MDM) enrollmentis the biggest concern, asunmanaged devicespose a serious security risk.

Not All Devices Enrolled in MDM (Correct Answer – C)

Unenrolled devices can bypass security policies.

Example:A stolen, unenrolled device may lack encryption, exposing corporate data.

Biometric Authentication Required (Incorrect – A)

Biometrics are anenhanced security measure, not a concern.

VPN Not Required for Internal Network (Incorrect – B)

VPNs are typically used for external access, not always needed internally.

Remote Wipe Requires Internet (Incorrect – D)

A limitation but stillless riskythan allowing unsecured devices.