Isaca Updated CISA Exam Questions and Answers by rogan

A certificate authority (CA) is critical in a public key cryptographic system for mitigating man-in-the-middle (MITM) attacks. It ensures that public keys are authentic by issuing digital certificates, which bind a public key to an entity. The CA’s role in verifying identities and providing trust anchors prevents attackers from spoofing keys.

Strong Encryption Algorithms (Option A):Encryption ensures confidentiality but does not address spoofing risks.

Kerberos Authentication (Option B):Useful for mutual authentication but not central to public key infrastructure (PKI).

Registration Authority (Option C):Supports the CA but does not directly prevent MITM attacks.

 The most important thing for an IS auditor to verify when reviewing the use of an outsourcer for disposal of storage media is that the vendor’s process appropriately sanitizes the media before disposal. As explained in the previous question, storage media may contain sensitive or confidential information that needs to be protected from unauthorized access, disclosure, or misuse. The IS auditor should verify that the vendor has a process that appropriately sanitizes the media before disposal, such as wiping, degaussing, shredding, or incinerating, and that the process is effective and compliant with the organization’s policies and standards. The other options are not as important as verifying the vendor’s process, because they either do not ensure the security and privacy of the information on the media, or they aresecondary to the vendor’s process. References: CISA Review Manual (Digital Version)1, Chapter 5, Section 5.2.7

If SoD cannot be fully implemented, an independent review of changes after deployment provides assurance that inappropriate or unauthorized code has not been introduced. Other options either weaken controls or fail to provide adequate oversight.

References (ISACA): COBIT® BAI06 (Managed IT Changes).