Newly Released Isaca CISA Exam PDF

Comprehensive and Detailed Explanation:

In PKI, when a document is digitally signed:

The signer uses their private key to create the signature.

The recipient uses the signer’s public key to decrypt and verify the signature.

If the decrypted hash matches the document’s computed hash, the document is authentic and unaltered.

Option A: Correct — verification is done with the public key.

Option B: Incorrect — the private key is only used to sign, not verify.

Option C: Wrong — the receiver’s public key is irrelevant.

Option D: Not applicable — audit history is not part of PKI validation.

???? ISACA Reference: CISA Review Manual 27th Edition, Domain 5, section on PKI and digital signatures.

Full disk encryption (FDE) is a means of protecting information by encrypting all of thedata on a disk, including temporary files, programs, and system files1. FDE is best suited for addressing the risk scenario of physical theft of media on which information is stored, as it prevents unauthorized access to the data even if the device is lost or stolen2. FDE does not prevent data leakage as a result of employees leaving to work for competitors, as they may still have access to the data while using the device or copy the data to another device before leaving. FDE does not prevent noncompliance fines related to storage of regulated information, as it does not ensure that the data is stored in accordance with the applicable laws and regulations. FDE does not prevent unauthorized logical access to information through an application interface, as it does not control the access rights and permissions of users and applications. *References: According to the ISACA IT Audit and Assurance Standards, Guidelines and Tools and Techniques for IS Audit and Assurance Professionals, section 2402 Planning, “The IS audit and assurance professional should identify and assess risk relevant to the area under review.” 3 Oneof the risk factors to consider is “the sensitivity of information processed, stored or transmitted by the system” 3. FDE is one of the possible controls to mitigate the risk of unauthorized disclosure of sensitive information due to physical theft of media.