Isaca Updated CISA Exam Questions and Answers by khalil

The most important input during the planning phase for an audit on the implementation of a bring your own device (BYOD) program is policies including BYOD acceptable user statements. Policies are documents that define the organization’s objectives, requirements, expectations, and responsibilities regarding a specific topic or area. BYOD policies should include acceptable user statements that specify what types of personal devices are allowed to connect to the corporate network, what security measures must be implemented on those devices, what data can be accessed or stored on those devices, what actions must be taken in case of device loss or theft, and what consequences will apply for non-compliance. Policies including BYOD acceptable user statements can provide an IS auditor with a clear understanding of the scope, criteria, and objectivesof the BYOD program audit. Findings from prior audits, results of a risk assessment, and an inventory of personal devices to be connected to the corporate network are also useful inputs for planning a BYOD program audit, but they are not as important as policies including BYOD acceptable user statements. References: ISACA CISA Review Manual 27th Edition, page 381.

The best answer is B. Implementing cryptographic hash functions.

To ensure integrity, the organization needs a control that can detect unauthorized alteration. Cryptographic hash functions are specifically designed to verify that data has not been modified. Timestamping helps with sequencing and timing, limiting access helps reduce risk of tampering, and archiving helps retention, but hashing is the strongest direct method for validating integrity. This answer is standard ISACA-aligned control reasoning based on the security objective of integrity.

ISACA’s log-management guidance emphasizes the need for trustworthy, purposeful logging and monitoring. For log data to be trusted as evidence or for operations, it must be protected against undetected modification. Among the given choices, cryptographic hashing is the most effective direct mechanism for that purpose.

References (Official ISACA):

ISACA Journal, Log Management as an Enabler for Data Protection and Automated Threat Detection.

ISACA Journal, A Framework for SIEM Implementation.

 IT performance measures are indicators of how well an organization is achieving its IT goals and objectives. Benchmarking surveys are useful tools for comparing an organization’s IT performance measures with those of other organizations in the same industry or sector. Benchmarking surveys can provide insights into best practices, gaps, trends, and opportunities for improvement. IT governance frameworks, utilization reports, and balanced scorecards are not as helpful for comparing ITperformance measures across organizations, as they may vary in scope, methodology, and terminology. References: IT Resources | Knowledge and Insights | ISACA, CISA Review Manual (Digital Version)

The best way to ensure the quality and integrity of test procedures used in audit analytics is to centralize procedures and implement change control. Centralizing procedures means storing themin a common repository that can be accessed and updated by authorized users. Change control means implementing a process for tracking, reviewing, approving, and documenting any changes made to the procedures. This ensures that the procedures are consistent, accurate, reliable, and secure. References: CISA Review Manual, 27th Edition, page 401