PDF CISA Study Guide

 Identifying required IT skill sets that support key business processes is the first step to enable the alignment of IT staff development plans with IT strategy. An IT strategy is a plan that defines how IT will support the organization’s goals and objectives. Identifying required IT skill sets means determining the knowledge, abilities, and competencies that IT staff need to perform their roles and responsibilities effectively and efficiently. This can help to align IT staff development plans with IT strategy, as well as to identify and address any skill gaps or needs within the IT workforce. The other options are not the first steps to enable alignment, but rather possible subsequent actions that may depend on the required IT skill sets. References:

CISA Review Manual (Digital Version), Chapter 5, Section 5.11

CISA Review Questions, Answers and ExplanationsDatabase, Question ID 229

The correct answer is A. Requiring log review by management.

In a small organization, full separation of duties may be difficult because one administrator may need to perform firewall configuration changes. When preventive separation is not practical, an effective compensating control is independent management review of firewall activity logs. This helps detect unauthorized, inappropriate, or unapproved changes made by the administrator.

This is especially important because a firewall administrator usually requires privileged access to perform the job. Therefore, simply restricting the administrator’s access may not be realistic if the administrator is responsible for firewall configuration. ISACA notes that segregation of duties can be challenging in small organizations and may need to be supported through compensating controls and monitoring. ISACA’s glossary also defines an audit trail as a logical path linking a sequence of events, which supports the use of logs to trace actions and detect inappropriate changes.

Option B is not the best answer because the administrator needs some level of firewall access to perform assigned duties. Option C is a useful preventive control, but approval alone does not prove that only approved changes were actually implemented. Option D is weak because an annual audit is too infrequent to provide timely detection of unauthorized firewall changes.

This question maps mainly to Protection of Information Assets because firewall administration, privileged access, and security configuration changes directly affect network security and protection of information assets. ISACA’s CISA Exam Content Outline includes identity and access management, network and endpoint security, and security monitoring under Domain 5.

Enterprise architecture (EA) governance ensures that IT and business alignment is maintained and that new processes and technologies integrate well with existing structures.

Option A (Correct):The primary purpose of EA governance is to ensure that new technologies, processes, and systems align and harmonize with existing architecture to maintain operational efficiency and consistency.

Option B (Incorrect):While adaptability to emerging technology trends is important, EA governance focuses more on structure, consistency, and compliance rather than just adaptability.

Option C (Incorrect):Compliance with regulations is crucial, but it is just one component of governance. EA governance has a broader scope, including strategic alignment and process integration.

Option D (Incorrect):Ensuring ROI is an important financial consideration, but it is not themainobjective of EA governance.

From a risk management standpoint, the best approach for implementing a large and complex data center infrastructure is a deployment plan based on sequenced phases. ISACA guidance repeatedly supports phased implementation for complex, high-risk changes because it allows the organization to manage dependencies, reduce disruption, validate results incrementally, and maintain operational continuity while lessons from earlier phases can inform later ones.

Option D is correct because phased deployment reduces concentration of implementation risk. Instead of exposing the organization to a single large-scale failure point, phased rollout allows testing, adjustment, monitoring, and controlled transition. ISACA material discussing complex implementations emphasizes structured, phased approaches to handle technical debt, compatibility issues, and continuity concerns.

Option A is incorrect because a big bang deployment concentrates risk, even if a proof of concept was successful. A proof of concept demonstrates feasibility in limited conditions, but it does not eliminate the operational risks of a full-scale one-time cutover in a complex environment. For large infrastructure changes, CISA logic generally prefers phased approaches over big bang implementations.

Option B is useful, but simulation alone is not the best answer. Simulation can support planning and testing, yet it does not by itself provide the controlled risk reduction that phased deployment offers during actual implementation. In CISA questions, the best risk-management choice is usually the one that combines control and gradual exposure reduction, which is phased rollout.

Option C is incorrect because “prototyping and a one-phase deployment” still culminates in a single-phase rollout, which is riskier than sequenced deployment. A prototype can improve design understanding, but it does not replace the value of incremental implementation in a complex production environment.

Therefore, D is the best answer because a sequenced, phased deployment is the most effective risk-management approach for large and complex infrastructure implementations.

References (Official ISACA):

ISACA, Passwordless Authentication: Risk, Reward, and Readiness — supports a carefully crafted phased implementation to manage complexity and maintain continuity.

ISACA Journal, Working Toward a White Box Approach — highlights the risks created by complexity in large IT initiatives.

ISACA Journal, Essential Frameworks and Methodologies to Maximize the Value of IT — supports structured project and program management sequencing.

ISACA Journal, A Strategic Risk-Based Approach to Systems Security Engineering — supports using a risk-based approach for complex systems change.