Isaca Updated CISA Exam Questions and Answers by timur

 The greatest impact as a result of the ongoing deterioration of a detective control is an increased number of false negatives in security logs. A detective control is a control that monitors and identifies any deviations or anomalies from the expected or normal behavior or performance of a system or process. A security log is a record of events or activities that occur within a system or network, such as user access, file changes, system errors, or security incidents. A false negative is a situation where a security log fails to detect or report an actual deviation or anomaly that has occurred, such as an unauthorized access, a malicious modification, or a security breach. An increased number of false negatives in security logs can have a significant impact on the organization’s security posture and risk management, because it can prevent timely detection and response to security threats, compromise the accuracy and reliability of security monitoring and reporting, and undermine the accountability and auditability of user actions and transactions. The other options are not as impactful as anincreased number of false negatives in security logs, because they either do not affect the detection capability of a detective control, or they have less severe consequences for security management. References: CISA Review Manual (Digital Version)1, Chapter 5, Section 5.2.1

The best way to reduce the immediate risk associated with using an unsupported version of the software is to segregate the outdated software system from the main network. An unsupported software system may have unpatched vulnerabilities that could be exploited by attackers to compromise the system or access sensitive data. By isolating the system from the rest of the network, the organization can limit the exposure and impact of a potential breach. Verifying all patches have been applied to the outdated software system, closing all unused ports on the outdated software system and monitoring network traffic attempting to reach the outdated software system are also good practices, but they do not address the root cause of the risk, which is the lack of vendor support and updates. References:

CISA Review Manual, 27th Edition, page 2951

CISA Review Questions, Answers and Explanations Database - 12 Month Subscription

 The most important thing to determine when conducting a post-implementation review is whether success criteria have been achieved. A post-implementation review is a process of evaluating the results and outcomes of a project or initiative after it has been completed and implemented. The success criteria are the measurable indicators that define what constitutes a successful project or initiative in terms of its objectives, benefits, quality, performance, and stakeholder satisfaction. The IS auditor should verify whether the success criteria have been achieved by comparing the actual results and outcomes with the expected or planned ones, and by assessing whether they meet or exceed the expectations and requirements of the stakeholders. The IS auditor should also identify any gaps, issues, or risks that may affect the sustainability or scalability of the project or initiative, and provide recommendations for improvement or remediation. The other options are not as important as determining whether success criteria have been achieved when conducting a post-implementation review, because they either focus on specific aspects or components of the project or initiative rather than theoverall value proposition, or they are part of the pre-implementation or implementation phases rather than the post-implementation phase. References: CISA Review Manual (Digital Version)1, Chapter 4, Section 4.2.3

The best answer is B. The policies are not regularly reviewed and updated.

ISACA guidance notes that, when auditing policy documents, one of the quickest indicators of trouble is the absence of current reviews, changes, approvals, and alignment with actual practice. If policies are outdated, they may no longer reflect the organization’s control environment, regulatory obligations, technologies, or business processes. That creates a direct governance and compliance risk.

Option A is generally a positive sign, not a concern, because formal review and approval supports governance. Option C can matter, but lack of direct mapping to best practices is usually less serious than having stale policies that no longer reflect reality. Option D is not ideal if policies exclude broader stakeholders, but IT policies are often primarily directed toward IT staff while still being supported by wider governance documents. The most serious issue is that outdated policies may be ineffective, unenforceable, or inconsistent with current controls.

References (Official ISACA):

ISACA, Do Your Policy Documents Represent Current Practices?

ISACA Journal, IS Audit Basics: The Auditors, IS/IT Policies and Compliance