Isaca Certification CISA Passing Score

The best answer is C. Insufficient due diligence performed on the vendor.

ISACA guidance on third-party and cloud risk repeatedly emphasizes the need for thorough vendor due diligence before entering or expanding a business relationship. When confidential backups are being migrated to a cloud solution, insufficient due diligence is the greatest concern because it can expose the organization to security, privacy, resilience, and compliance failures across the whole service arrangement.

Option A is relevant for retired media handling, but it is narrower than the overall third-party risk. Option B affects performance and growth, not necessarily confidentiality. Option D is a business issue, but not the greatest audit concern when confidential data is involved. Vendor due diligence is the most important control at this stage.

References (Official ISACA):

ISACA, The Top 5 Cybersecurity Threats and How to Defend Against Them.

ISACA Journal, The Encrypted Truth Is Already Out There.

The most significant risk from not testing patches before putting them into production is the lack of system integrity. Patches are software updates that fix bugs, vulnerabilities or performance issues in an application system. However, patches may also introduce new errors, conflicts or compatibility issues that could affect thefunctionality, reliability or security of the system4. By not testing patches before putting them into production, the organization exposes itself to the risk of system failures, data corruption or unauthorized access. Loss of application support, outdated system documentation and developer access to production are also risks from not testing patches, but they are not as significant as the lack of system integrity. References:

CISA Review Manual, 27th Edition, page 2951

CISA Review Questions, Answers andExplanations Database - 12 Month Subscription

The best answer is B. Implementing cryptographic hash functions.

To ensure integrity, the organization needs a control that can detect unauthorized alteration. Cryptographic hash functions are specifically designed to verify that data has not been modified. Timestamping helps with sequencing and timing, limiting access helps reduce risk of tampering, and archiving helps retention, but hashing is the strongest direct method for validating integrity. This answer is standard ISACA-aligned control reasoning based on the security objective of integrity.

ISACA’s log-management guidance emphasizes the need for trustworthy, purposeful logging and monitoring. For log data to be trusted as evidence or for operations, it must be protected against undetected modification. Among the given choices, cryptographic hashing is the most effective direct mechanism for that purpose.

References (Official ISACA):

ISACA Journal, Log Management as an Enabler for Data Protection and Automated Threat Detection.

ISACA Journal, A Framework for SIEM Implementation.

Comprehensive and Detailed Explanation:

Corrective controls are measures taken to restore systems or processes after an incident or error has occurred.

Option C: Rollback scripts and backup procedures restore systems, making them corrective controls.

Option A: Separation of duties and hash totals are preventive controls.

Option B: Audit reviews are detective, while remediation may include corrective, but audits themselves aren’t corrective.

Option D: Disciplinary actions are deterrent controls.

???? ISACA Reference: CISA Review Manual 27th Edition, Domain 4, section on types of IT controls (preventive, detective, corrective, deterrent).