Exam CISA topic 1 question 802 discussion

C. Reviewing the parameter settings The BEST audit procedure to determine whether a firewall is configured in compliance with the organization's security policy is reviewing the parameter settings. This audit procedure involves reviewing the configuration parameters of the firewall to determine whether they comply with the organization's security policy. The auditor can use the security policy as a benchmark and compare the firewall's parameter settings to the policy's requirements. If the firewall's parameter settings comply with the security policy, the auditor can conclude that the firewall is configured in compliance with the organization's security policy.