Isaca Updated CISA Exam Questions and Answers by tamara

 The best method to safeguard data on an organization’s laptop computers is full disk encryption. Full disk encryption is a technique that encrypts all the data stored on a harddrive, including the operating system, applications, files, and folders. This means that if the laptop is lost, stolen, or accessed by an unauthorized person, they will not be able to read or modify any data without knowing the encryption key or password. Full disk encryption provides a strong level of protection for data at rest, as it prevents data leakage or exposure in case of physical theft or loss of the device.

The best answer is B. To establish the organization’s accountability for the use and protection of personal information.

ISACA privacy guidance emphasizes accountability as a core privacy principle and describes privacy notices as documents that explain how personal information is collected, used, shared, retained, and protected. A privacy notice is fundamentally about transparency and accountability to data subjects regarding the organization’s handling of personal information.

Option A is incorrect because a privacy notice is not primarily a liability shield. Option C is incorrect because a privacy notice may disclose sharing practices, but it is not primarily to obtain blanket approval for sale of personal information. Option D is also incorrect because compliance of controls is a broader privacy governance objective; the notice itself is mainly for transparent disclosure and accountability.

References (Official ISACA):

ISACA, Privacy Notice.

ISACA Privacy Resource Center.

ISACA Journal, Creating a Compliant and Accountable Data Culture.

ISACA, Using ISACA Privacy Principles for GDPR Compliance.

 A checksum is classified as a detective control. A checksum is a mathematical value that is calculated from a data set and used to verify the integrity of the data. A checksum can detect if the data has been altered or corrupted during transmission or storage. A checksum does not prevent or correct the data corruption, but it alerts the user or system of the problem. Therefore, it is a detective control. A preventive control is a control that prevents an error or incident from occurring. A corrective control is a control that restores normal operations after an error or incident has occurred. Anadministrative control is a controlthat involves policies, procedures, standards, guidelines, or organizational structures. References: CISA Review Manual (Digital Version)1, page 439.

 The most important thing to assess when conducting a business impact analysis (BIA) is the completeness of critical asset inventory. This is because the critical asset inventory is the basis for identifying and prioritizing the business processes, functions, and resources that are essential for thecontinuity of operations. The critical asset inventory should include both tangible and intangible assets, such as hardware, software, data, personnel, facilities, contracts, and reputation. The critical asset inventory should also be updated regularly to reflect any changes in the business environment or needs. References:

CISA Review Manual (Digital Version), Chapter 5, Section 5.41

CISA Online Review Course, Domain 3, Module 3, Lesson 12