Exam CISA topic 1 question 222 discussion

Actual exam question from Isaca's CISA

Question #: 222
Topic #: 1

When evaluating information security governance within an organization, which of the following findings should be of MOST concern to an IS auditor?

A. An information security governance audit was not conducted with in the past year.
B. Information security policies are updated annually.
C. The data center manager has final sign-off on security projects.
D. The information security department has difficulty filling vacancies.

Show Suggested Answer

Suggested Answer: C 🗳️

by Greensign at Oct. 4, 2022, 4:17 a.m.

Comments

Submit Cancel

yukli1998

1 month ago

Selected Answer: C

C: Security projects should be governed and approved by a dedicated information security function or executive-level governance body, not by operational managers like a data center manager, who may have conflicting priorities (e.g., performance over security).

upvoted 1 times

...

1Naa

4 months, 3 weeks ago

Selected Answer: D

it can result in a lack of expertise, inadequate security coverage, and operational inefficiencies. This can lead to a higher risk of security incidents, breaches, and compliance failures, as there may not be sufficient qualified personnel to enforce policies, monitor threats, and respond to incidents.

upvoted 1 times

...

akosigengen

8 months, 1 week ago

C. why would be DC Manager approved a security project?

upvoted 3 times

...

MOHAMMADSALTI

1 year, 10 months ago

Selected Answer: C

This means that projects may be unaligned with business strategy

upvoted 3 times

...

Greensign

2 years, 1 month ago

I think D is suitable answer

upvoted 2 times

...

Exam CISA All Questions

View all questions & answers for the CISA exam