Isaca Updated CISA Exam Questions and Answers by thiago

Encryption is the process of transforming information into an unreadable form using a secret key, so that only authorized parties can access it. Encryption would protect the confidentiality of information sent in email messages, as it would prevent unauthorized parties from intercepting and reading the messages. Secure Hash Algorithm 1 (SHA-1) is a cryptographic hash function that produces a fixed-length output from an input. SHA-1 does not encrypt information, but rather verifies its integrity by detecting any changes or modifications. Digital signatures are electronic signatures that use encryption and hash functions to authenticate the identity of the sender and the integrity of the message. Digital signatures do not protect the confidentiality of information, but rather ensure its authenticity and non-repudiation. Digital certificates are electronic documents that contain the public key and identity information of an entity, such as a person, organization or device. Digital certificates are issued by trusted third parties called certificate authorities (CAs). Digital certificates do not protect the confidentiality of information, but rather enable secure communication and encryption by verifying the identity and public key of an entity. References:

[Encryption Definition]

[Secure Hash Algorithm 1 (SHA-1) Definition]

[Digital Signature Definition]

[Digital Certificate Definition]

The correct answer is D. Recovery point objective (RPO) because the issue is related to data loss or data inconsistency after recovery, not simply the time taken to restore the database. RPO defines the point in time to which data must be recoverable after an outage or disruption. In practical terms, it answers: “How much data can the business afford to lose?” ISACA’s contingency planning guidance explains that RPO represents the point in time prior to disruption to which business data can be recovered using the most recent backup, and it is directly related to the amount of data loss the business can tolerate.

The organization restored from the most recent available backup, but customers are reporting discrepancies. This suggests the backup/recovery strategy may not meet the organization’s acceptable data-loss requirement. For example, if the business can tolerate losing only 15 minutes of transactions but backups are taken every 24 hours, recovered customer data may be outdated or incomplete. That is an RPO failure.

Option A is not the best answer because an SLA defines agreed service expectations, but the immediate audit concern is whether the backup point met the required data recovery point. Option B is not the best answer because MTO, also commonly discussed as maximum tolerable downtime, relates to the maximum outage period the business can tolerate, not the point to which data must be restored. Option C is not the best answer because RTO focuses on how quickly a system must be restored, while this case is about the correctness and completeness of recovered data.

This question maps mainly to Information Systems Operations and Business Resilience, because ISACA’s CISA Exam Content Outline includes Database Management, Data Backup, Storage, and Restoration, Business Continuity Plan, and Disaster Recovery Plans under Domain 4.

A digital signature is a cryptographic technique that uses the sender’s private key to generate a unique code for a message or document. The receiver can use the sender’s public key to verify the authenticity and integrity of the message or document. A digital signature can prevent unauthorized change, as any modification to the message or document will invalidate the signature and alert the receiver of tampering.

References

What is a digital signature?

Digital Signature - an overview | ScienceDirect Topics

ISACA CISA Review Manual, 27th Edition, page 253