Isaca Updated CISA Exam Questions and Answers by azlan

The greatest advantage of vulnerability scanning over penetration testing is that the testing process can be automated to cover large groups of assets. Vulnerability scanning is an automated, high-level security test that reports its findings of known vulnerabilities in systems, networks, applications, and devices. Vulnerability scanning can be performed frequently, quickly, and efficiently to scan a large number of assets and identify potential weaknesses that need to be addressed. Vulnerability scanning can also help organizations comply with security standards and regulations, such as PCI DSS1.

The other options are not as advantageous as option D, as they may not reflect the true benefits or limitations of vulnerability scanning compared to penetration testing. The testing produces a lower number of false positive results, but this is not necessarily true, as vulnerability scanning may report vulnerabilities that are not exploitable or relevant in the context of the organization. Network bandwidth is utilized more efficiently, but this may not be a significant advantage, as vulnerability scanning may still consume considerable network resources depending on the scope and frequency of the scans. Custom-developed applications can be tested more accurately, but this is also not true, as vulnerability scanning may not be able to detect complex or unknown vulnerabilities that require manual analysis or exploitation.

 Impact assessment is an activity that occurs during the issues management process for a system development project. Issues management is a process of identifying, analyzing, resolving, and monitoring issues that may affect the project scope, schedule, budget, or quality. Impact assessment is a technique of evaluating the severity and priority of an issue, as well as its implications for the project objectives and deliverables. The other options are not activities that occur during the issues management process, but rather related to other processes such as contingency planning, configuration management, or help desk management. References:

CISA Review Manual (Digital Version), Chapter 4, Section 4.3.31

CISA Review Questions, Answers and Explanations Database, Question ID 217

The correct answer is C. Provide evidence for the finding and request a follow-up meeting.

When management disagrees with an audit finding in the draft report, the auditor should support the finding with sufficient and appropriate evidence and discuss the matter with management. The purpose is to clarify facts, resolve misunderstandings, validate the evidence, and determine whether the finding should remain, be modified, or be removed.

Option A is incorrect because the auditor should not rewrite a finding simply because management disagrees. Changes should be based on evidence. Option B is too rigid because issuing the report without further discussion may damage audit quality and stakeholder communication. Option D may be appropriate only if the disagreement cannot be resolved or involves significant risk, but escalation to the audit committee is not the immediate next step.

ISACA’s CISA Exam Content Outline includes audit evidence collection, audit reporting, communication of findings, and conducting audit follow-up under Domain 1. The auditor’s conclusion should be evidence-based and properly communicated.

Granting access on a need-to-know basis ensures that a service provider only has the permissions necessary to perform their specific tasks. This principle minimizes the risk of unauthorized access or accidental misuse of the system by restricting access to essential areas only. It aligns with the least privilege principle, a cornerstone of effective access control.

Limited Administrator Access with Expiration (Option A):This is helpful but does not ensure that the access granted aligns with the specific job requirements.

Deleting User IDs After Completion (Option C):This is a good practice but applies after the task, not during access.

Access Corresponding to the SLA (Option D):While important, this focuses on timeframes and does not restrict permissions effectively.