Exam CISA topic 1 question 1793 discussion

Definitely D. accountability is circumvented because multiple users are sharing a single account. Not good. Dont know enough about how the tool functions to vote C. C would be a second choice.

Based on the CISA Official Review Manual 28th Edition, the observation of greatest concern is D. The IT team accesses the scheduler admin panel via a generic account. This finding aligns with the manual’s strong stance against shared privileged accounts, as evidenced by Section 5.3.14 and the self-assessment, due to its significant risks to accountability, integrity, and availability - crucial for a job scheduling tool’s operation.

D. The IT team accesses the scheduler admin panel via a generic account. Using a generic account for accessing the scheduler admin panel poses significant security risks. It makes it difficult to track individual user actions, which can lead to accountability issues and complicate incident response. Additionally, it increases the risk of unauthorized access, as generic accounts are often less secure and more prone to misuse.

I'm leaning toward C on this due to this being an audit certificate. One would think they would care most about security and encryption out of the options provided. Not to say that option A and D aren't concerns as well. Just C seems to be more concerning.