Isaca Updated CISA Exam Questions and Answers by jeremy

The best way to ensure a successful investigation is to preserve digital evidence immediately, including both a forensic image of the system and volatile memory capture where feasible. ISACA defines digital forensics as identifying, preserving, analyzing, and presenting digital evidence in a legally acceptable manner. That makes evidence preservation the first priority.

Option A is correct because creating a system image preserves the state of the disk, while capturing memory preserves volatile information that may be lost if the system is altered, powered off, or rebooted. ISACA’s glossary notes that memory dumps allow analysis of memory contents at the time of failure, which supports preserving volatile evidence for forensic review.

Option B is not the best answer. Isolating the system may help preserve evidence, but by itself it does not collect the volatile and nonvolatile evidence needed for a strong investigation. Evidence preservation is stronger when the system is forensically imaged and memory is captured.

Option C is incorrect because rebooting can destroy volatile evidence and alter timestamps or system state, which can undermine a forensic investigation. That runs directly counter to digital forensics principles centered on preservation.

Option D may be useful later, but interviews are secondary to preserving digital evidence. Human recollection cannot substitute for properly preserved forensic artifacts.

Therefore, A is the best answer because it preserves the most complete and reliable digital evidence for investigation.

References (Official ISACA):

ISACA, Overview of Digital Forensics — digital forensics is the process of identifying, preserving, analyzing and presenting digital evidence.

ISACA Glossary, Digital forensics.

ISACA Glossary, Memory dump.

Separate authorization for input of transactions. This control would have best prevented this type of fraud in a retail environment by ensuring that the warehouse employee who handles the inventory items does not have the authority to enter adjustments to the inventory system. This would create a segregation of duties that would reduce the risk of collusion and concealment of theft.

The other options are not as effective as option A in preventing this type of fraud. Option B, statistical sampling of adjustment transactions, is a detective control that may help identify fraudulent transactions after they have occurred, but it does not prevent them from happening in the first place. Option C, unscheduled audits of lost stock lines, is also a detective control that may reveal discrepancies between the physical and recorded inventory, but it does not address the root cause of the fraud. Option D, an edit check for the validity of the inventory transaction, is a preventive control that may help verify the accuracy and completeness of the transaction data, but it does not prevent unauthorized or fraudulent adjustments.

 An IS auditor is conducting a review of a data center. An observation that could indicate an access control issue is muddy footprints directly inside the emergency exit. Access control is a process that ensures that only authorized entities or individuals can access or use an information system or resource, and prevents unauthorized access or use. Access control can be implemented using various methods or mechanisms, such as physical, logical, administrative, etc. Muddy footprints directly inside the emergency exit could indicate an access control issue, as they could suggest that someone has entered the data center through the emergency exit without proper authorization or authentication, and potentially compromised the security or integrity of the data center. Security cameras deployed outside main entrance is not an observation that could indicate an access control issue, but rather a control that could enhance access control, as security cameras are devices that capture and record video footage of the surroundings, and can help monitor and deter unauthorized access or activity. Antistatic mats deployed at the computer room entrance is not an observation that could indicate an access control issue, but rather a control that could prevent static electricity damage, as antistatic mats are devices that dissipate or reduce static charges from people or objects, and can help protect electronic equipment from electrostatic discharge (ESD). Fencing around facility is two meters high is not an observation that could indicate an access control issue, but rather a control that could improve physical security, as fencing is a barrier that encloses or surrounds an area, and can help prevent unauthorized entry or intrusion. 

Among the options provided, fingerprint scanning has the highest rate of false negatives. False negatives occur when a biometric system fails to recognize an authentic individual. Factors such as skin conditions (wet, dry, greasy), finger injuries, and inadequate scanning can contribute to false negatives in fingerprint scanning1. In comparison, iris recognition23, face recognition45, and retina scanning67 generally have lower rates of false negatives.