Pearson CISA New Attempt

 An external assessment of network vulnerability is a process of identifying and evaluating the weaknesses and risks that affect the security and availability of a network froman outsider’s perspective. The most important factor to verify during this process is the completeness of network asset inventory, which is a list of all the devices, systems, and software that are connected to or part of the network. A complete and accurate network asset inventory can help identify the scope and boundaries of the network, the potential attack vectors and entry points, the critical assets and dependencies, and the existing security controls and gaps. Without a complete network asset inventory, an external assessment of network vulnerability may miss some important assets or vulnerabilities, leading to inaccurate or incomplete results and recommendations.

The correct answer is C. The consolidated responsibilities do not allow for appropriate separation of duties.

The primary risk is that too many critical responsibilities are concentrated in one individual. This creates a segregation/separation of duties issue, because one person may be able to initiate, approve, implement, and monitor critical IT activities without independent review. In IT, this could allow unauthorized changes, inappropriate access, fraud, errors, or malicious actions to occur without timely detection.

ISACA defines segregation/separation of duties as a basic internal control that prevents or detects errors and irregularities by assigning incompatible responsibilities to different individuals. ISACA also notes that SoD helps ensure no single person is in a position to introduce fraudulent or malicious code without detection.

Option A is not the best answer because resource optimization may be affected, but the major control risk is excessive authority and incompatible duties. Option B is incorrect because the issue is not limited authority; the concern is too much combined authority. Option D is a valid secondary concern because succession planning may be weakened when knowledge is concentrated in one person, but CISA questions usually prioritize the control risk of inadequate separation of duties over staffing continuity concerns.

This maps mainly to Governance and Management of IT because the issue relates to organizational structure, IT governance, resource management, roles, responsibilities, and control ownership. ISACA’s CISA Exam Content Outline includes organizational structure, IT governance, IT resource management, and determining whether ownership of IT risk, controls, and standards has been defined.