Isaca Updated CISA Exam Questions and Answers by khalid

The correct answer is D. Establish a global IT risk scoring criteria.

When business units use different risk methods, their risk scores are not comparable. One unit’s “high” risk may not mean the same thing as another unit’s “high” risk. The organization first needs a common risk scoring method so IT risks can be measured, compared, aggregated, and reported consistently across the enterprise.

Option A is not the best first approach because a weighted score is only useful after the organization has consistent scoring criteria. Option B is not appropriate because choosing the highest-rated risk may overstate overall risk appetite and may be based on inconsistent rating methods. Option C is also inappropriate because averaging inconsistent risk scores can produce misleading results.

ISACA’s glossary defines risk appetite as the amount of risk an entity is prepared to accept when pursuing its objectives. ISACA also discusses risk appetite in terms of identifying risk the organization is or is not willing to accept in relation to its values, digital strategy, stakeholder impact, and required actions.

This maps to Governance and Management of IT because risk appetite, IT risk management, risk reporting, and governance decision-making are Domain 2 topics in the CISA Exam Content Outline.

The main purpose of an IDS is to detect and report malicious or suspicious activity on a network or a host. If an IDS fails to identify actual attacks, it means that the IDS is not functioning properly or effectively, and it exposes the organization to serious security risks and potential damage. This is the most concerning scenario for an IS auditor, as it indicates a major deficiency in the IDS performance and configuration.

ReferencesWhat is an intrusion detection system (IDS)?What is Intrusion Detection Systems (IDS)?How does it Work?When reviewing an intrusion detection system (IDS), an IS auditor …Intrusion Detection Systems (IDS)—An Overview with a Generalized …An overview of issues in testing intrusion detection systems - NISTA Review of Intrusion Detection Systems and Their …

This directly addresses the gap for new hires, creates a consistent expectation regardless of hiring date, and formalizes the process within organizational policy.

References

ISACA CISA Review Manual (Current Edition) - Chapters on Information Security Policies, Training and Awareness

Industry Best Practices for Security Awareness - Emphasize the importance of timely and comprehensive training for new employees.

Monitoringcapacity utilizationsupportsavailabilityby ensuring thatresources remain functional and do not exceed operational limits.

Option A (Incorrect):Integrityensures that data isaccurate and unaltered, but monitoring capacity thresholds primarily relates tosystem availability.

Option B (Correct):Availabilityensures that systems remainaccessible and functional, and monitoring capacity utilization helpsprevent downtimeandservice disruptions.

Option C (Incorrect):Confidentialityensures that data isprotected from unauthorized access, which is unrelated to capacity monitoring.

Option D (Incorrect):Nonrepudiationensures that actions can betraced to specific individuals, but it does not relate tocapacity monitoring.