Isaca Certification CISA Syllabus Exam Questions Answers

The most appropriate and effective fire suppression method for an un-staffed computer room is carbon dioxide (CO2). Carbon dioxide is a gaseous clean agent that extinguishes fire by displacing oxygen and reducing the combustion process. Carbon dioxide is suitable for un-staffed computer rooms because it does not leave any residue, damage, or corrosion on the electronic equipment, and it does not require water or other chemicals that could harm the environment or human health. However, carbon dioxide can pose a risk of asphyxiation to any person who may enter the computer room during or after the discharge, so proper safety precautions and warning signs should be in place.

The other options are not as appropriate or effective as carbon dioxide for an un-staffed computer room:

Water sprinkler. This is a common fire suppression method that uses water to cool down and extinguish fire. However, water sprinkler is not suitable for un-staffed computer rooms because it can cause severe damage to the electronic equipment, such as short circuits, corrosion, or data loss. Water sprinkler can also create a risk of electric shock to any person who may enter the computer room during or after the discharge.

Fire extinguishers. These are portable devices that contain a pressurized agent that can be sprayed on a fire to put it out. However, fire extinguishers are not effective for un-staffed computer rooms because they require manual operation by a trained person who can identify the type and location of the fire, and use the appropriate extinguisher. Fire extinguishers can also cause damage to the electronic equipment if they contain water or chemical agents.

Dry pipe. This is a type of sprinkler system that uses pressurized air or nitrogen in the pipes instead of water until a fire is detected. When a fire is detected, the air or nitrogen is released and water flows into the pipes and sprinklers. However, dry pipe is not ideal for un-staffed computer rooms because it still uses water as the extinguishing agent, which can damage the electronic equipment as mentioned above. Dry pipe also has a slower response time than wet pipe sprinkler systems, which can allow the fire to spread more quickly.

 A network firewall is a device or software that monitors and controls the incoming and outgoing network traffic based on predefined rules. A network firewall can help reduce the risk of denial of service (DoS) attacks, which are attempts to overwhelm a system or network with excessive requests or traffic, by filtering or blocking unwanted or malicious packets. A SQL injection attack is a type of code injection attack that exploits a vulnerability in a web application’s database query, by inserting malicious SQL statements into the input fields. A phishing attack is a type of social engineering attack that attempts to trick users into revealing sensitive information or installing malware, by sending fraudulent emails or messages that impersonate legitimate entities. An insider attack is a type of malicious activity that originates from within an organization, such as employees, contractors, or partners, who abuse their access privileges or credentials to compromise the confidentiality, integrity, or availability of information systems or data. A network firewall cannot prevent these types of attacks, as they rely on exploiting human or application weaknesses rather than network vulnerabilities.

The most important factor for successful implementation of a corporate data classification program is having an approved data classification policy. ISACA guidance emphasizes that data classification must be directed and supported by top management and aligned with business objectives. Without a formally approved policy, the organization lacks authority, consistency, accountability, and an enterprise-wide basis for implementation.

Option D is correct because a policy provides the official framework that defines classification levels, ownership responsibilities, handling rules, protection expectations, and enforcement expectations. ISACA policy guidance also notes that enterprise policies formally document and communicate required and prohibited activities. A data classification program cannot be consistently implemented without this governance foundation.

Option A is useful but secondary. Best practices can help shape the design of the program, but they do not substitute for an approved internal policy. Organizations need formal internal direction before best practices can be operationalized consistently.

Option B is important in privacy-sensitive environments, but a privacy impact assessment is not the main prerequisite for a general corporate data classification program. A PIA addresses privacy risks in specific processing activities, while classification is a broader governance mechanism for all forms of data.

Option C is also not the most important. A DLP product may support enforcement, but tools should follow policy, not replace it. ISACA generally frames policy and governance as the foundation on which technical controls are later implemented.

Therefore, D is the best answer because policy approval is the key governance step that enables a corporate data classification program to be implemented successfully across the enterprise.

References (Official ISACA):

ISACA Journal, Security Adjustments to Strengthen the Bond Between Risk Registers and Information — data classification should be built under the direction of top management and aligned with business objectives.

ISACA Journal, same article — data classification should be approved by top management.

ISACA, New Policy Template Library Toolkit Equips Organizations to Build and Customize Policies — policies formally document and communicate required and prohibited activities.

ISACA, Practical Data Security and Privacy for GDPR and CCPA — data discovery and classification are critical, but they need governance support.

 Digital watermarks are hidden marks or codes that can be embedded into digital files, such as images, videos, audio, or documents. They can be used to identify the source, owner, or authorized user of the data, as well as to track any unauthorized copying or distribution of the data. Digital watermarks can help prevent data leakage by deterring potential leakers from sharing sensitive data or by providing evidence of data leakage if it occurs.

The other options are not as effective as digital watermarks in preventing data leakage. Ensuring that paper documents are disposed securely can reduce the risk of physical data leakage, but it does not address the digital data leakage that is more prevalent in today’s environment. Implementing an intrusion detection system (IDS) can help detect and respond to cyberattacks that may cause data leakage, but it does not prevent data leakage from insiders or authorized users who have legitimate access to the data. Verifying that application logs capture any changes made can help audit and investigate data leakage incidents, but it does not prevent them from happening in the first place.