Isaca Updated CISA Exam Questions and Answers by tymon

Unauthorized modifications to scripts (D) pose the greatest risk because they can lead to unintended processing errors, security vulnerabilities, or fraudulent activities. Change management controls should be in place to prevent unauthorized script changes.

Other options:

Minor overrides not authorized (A) is a concern but does not pose as much risk as unauthorized script changes.

Bots incapable of learning (B) is a limitation but not a security risk.

Recording user interactions (C) raises privacy concerns but is not as critical as unauthorized script modifications.

Thoroughsystem testingbefore deployment helps identify potentialbugs, vulnerabilities, and performance issuesto prevent system failures.

System Testing (Correct Answer – B)

Detects defects that could lead to system crashes.

Ensures compatibility and performance stability.

Example:Stress testing an e-commerce application to prevent crashes on Black Friday.

System Recovery Plan (Incorrect – A)

Focuses on recovery after failure rather than prevention.

Business Continuity Plan (Incorrect – C)

Addresses overall business resilience, not application stability.

Transaction Monitoring (Incorrect – D)

Detects fraud and anomalies but does not prevent failures.

The best way to detect unauthorized copies of licensed software on systems is to conduct periodic software scanning. Software scanning is a process of using specialized tools or programs to scan the systems and identify the software installed, the license status, the usage, and the compliance with the software policies and agreements. Software scanning can help to detect any unauthorized, unlicensed, or illegal copies of software on the systems, as well as any discrepancies or violations of the software licenses. Software scanning can also help to optimize the software inventory, reduce the software costs, and improve the security and performance of the systems12.

Some examples of software scanning tools are:

Microsoft Software Inventory Analyzer (MSIA): A free tool that scans Windows-based computers and servers and generates reports on the Microsoft products installed, such as operating systems, applications, and updates3.

Belarc Advisor: A free tool that scans Windows-based computers and generates reports onthe hardware and software installed, including license keys, versions, usage, and security status4.

Lansweeper: A paid tool that scans Windows, Linux, Mac, and other network devices and generates reports on the hardware and software inventory, license compliance, configuration, and vulnerabilities5.

To conduct periodic software scanning, you need to:

Choose a suitable software scanning tool that meets your needs and budget.

Define the scope and frequency of the software scanning, such as which systems to scan, how often to scan, and what information to collect.

Configure and run the software scanning tool according to the instructions and settings.

Review and analyze the software scanning reports and identify any unauthorized copies of licensed software on the systems.

Take appropriate actions to remove or regularize the unauthorized copies of licensed software on the systems.

Document and report the results and findings of the software scanning.

Job scheduling is a core operational control that ensures workloads are executed in an orderly and efficient manner, balancing demands across processing resources. Its primary benefit is optimization of system resources—CPU, memory, I/O, and network bandwidth—leading to improved throughput and consistent service levels. While scheduling may indirectly reduce downtime (A) or support scalability (B), its direct impact is ensuring resources are allocated efficiently. Decreasing complexity (D) is not the key purpose of scheduling. ISACA’s DSS01 (Managed Operations) recognizes workload and job scheduling as crucial practices for sustaining reliable, high-performance IT services.

References (ISACA): COBIT® 2019, DSS01 Managed Operations.