Isaca Isaca Certification CISA New Questions

A BCP must stay current with organizational changes to ensure its effectiveness during a disruption. Personnel changes and environmental updates are directly relevant to how the BCP would be executed.

References

ISACA CISA Review Manual (Current Edition) - Chapter on Business Continuity and Disaster Recovery

Industry Standards (e.g., ISO 22301, NIST SP 800-34) - Guidelines for maintaining and updating a Business Continuity Plan

The greatest concern for an IS auditor reviewing contracts for licensed software that executes a critical business process is that software escrow was not negotiated. Software escrow is an arrangement where a third-party holds a copy of the source code and documentation of a licensed software in a secure location. The software escrow agreement specifies the conditions under which the licensee can access the escrowed materials, such as in case of bankruptcy, termination, or breach of contract by the licensor. Software escrow is important for ensuring the continuity and availability of a critical business process that depends on a licensed software. Without software escrow, the licensee may face significant risks and challenges in maintaining, modifying, or recovering the software in case of any disruption or dispute with the licensor. References:

CISA Review Manual (Digital Version)

CISA Questions, Answers and Explanations Database

To ensure that theBCP aligns with business strategy, aBusiness Impact Analysis (BIA)is the most valuable resource.

Option A (Incorrect):DRP testing resultsshow how wellsystems recover, but they do notestablish strategic alignmentwith business priorities.

Option B (Correct):ABIA identifies critical processes, financial impact, and business priorities, ensuring that theBCP is alignedwith strategic goals.

Option C (Incorrect):Thecorporate risk management policyis broader and does not focus onbusiness continuity priorities.

Option D (Incorrect):KPIs measure performance, but they do notdefine business continuity needs.

The effectiveness of an organization’s security awareness program can be measured by capturing data on changes in the way people react to threats, such as the ability to recognize and avoid social engineering attacks1. An increase in the number of phishing emails reported by employees indicates that they are more aware of the signs and risks of phishing, and are more likely to take appropriate actions to prevent or mitigate the impact of such attacks23.

References

1: The Importance Of Measuring Security Awareness 2: Measuring the effectiveness of your security awareness program 3: How effective is security awareness training?

The effectiveness of an organization’s security awareness program can be measured by capturing data on changes in the way people react to threats, such as the ability to recognize and avoid social engineering attacks1. An increase in the number of phishing emails reported by employees indicates that they are more aware of the signs and risks of phishing, and are more likely to take appropriate actions to prevent or mitigate the impact of such attacks23.

References

1: The Importance Of Measuring Security Awareness 2: Measuring the effectiveness of your security awareness program 3: How effective is security awareness training?