A primary responsibility of an IT steering committee is prioritizing IT projects in accordance with business requirements, as this ensures that IT resources are allocated to support the strategic objectives and needs of the organization. Reviewing periodic IT risk assessments, validating and monitoring the skill sets of IT department staff, and establishing IT budgets for the business are important activities, but they are not the primary responsibility of an IT steering committee. They may be delegated to other IT governance bodies or functions within the organization. References: CISA Review Manual (Digital Version), Chapter 1: Information Systems Auditing Process, Section 1.2: IT Governance

The rules of engagement define the scope, objectives, methodology, deliverables, and limitations of the penetration testing. They also specify the legal and ethical boundaries, communication channels, and escalation procedures. Establishing the rules of engagement is the first step when planning to conduct penetration testing for a client, as it ensures that both parties agree on the expectations and outcomes of the testing. The other options are important steps, but they should be done after the rules of engagement are established. References: CISA Review Manual (Digital Version) 1, page 381.

The best approach for determining the overall IT risk appetite of an organization when business units use different methods for managing IT risks is to prioritize the organization’s IT risk scenarios. IT risk appetite is the amount and type of IT risk that an organization is willing to accept in pursuit of its objectives. IT risk scenarios are hypothetical situations that describe the potential impact of IT risk events on the organization’s objectives, processes, and resources. By prioritizing the organization’s IT risk scenarios, the IS auditor can identify the most significant IT risks that affect the organization as a whole, and align them with the organization’s strategic goals, values, and culture. Prioritizing the organization’s IT risk scenarios can also help to communicate and monitor the IT risk appetite across the organization, and facilitate consistent and informed decision making. The other approaches (A, B and D) are not effective for determining the overall IT risk appetite of an organization, as they do not consider the impact and likelihood of IT risks on the organization’s objectives, nor do they account for the diversity and complexity of IT risks across different business units. References: CISA Review Manual (Digital Version), Chapter 2: Governance and Management of Information Technology, Section 2.3: Information Technology Risk Management

A digital signature is a cryptographic technique that uses the sender’s private key to generate a unique code for a message or document. The receiver can use the sender’s public key to verify the authenticity and integrity of the message or document. A digital signature can prevent unauthorized change, as any modification to the message or document will invalidate the signature and alert the receiver of tampering.
References
What is a digital signature?
Digital Signature – an overview | ScienceDirect Topics
ISACA CISA Review Manual, 27th Edition, page 253

Section: Governance and Management of IT

Section: Protection of Information Assets
Explanation:
Mandatory access controls are prohibitive; anything that is not expressly permitted is forbidden. Only within this context do discretionary controls operate, prohibiting still more access with the same exclusionary principle. When systems enforce mandatory access control policies, they must distinguish between these and the mandatory access policies that offer more flexibility.
Discretionary controls do not override access controls and they do not have to be permitted in the security policy to be effective.

Section: Protection of Information Assets
Explanation:
A software baseline is the cut-off point in the design and development of a system beyond which additional
requirements or modifications to the design do not or cannot occur without undergoing formal strict
procedures for approval based on a business cost-benefit analysis. Failure to adequately manage the
requirements of a system through baselining can result in a number of risks. Foremost among these risks
is scope creep, the process through which requirements change during development. Choices, C and D
may not always result, but choice A is inevitable.

Section: Protection of Information Assets

Reviewing the application implementation documents is the best way for an IS auditor to assess the design of an automated application control. An automated application control is a control that is embedded in the application software and is executed by the system without human intervention. An automated application control is designed to ensure the accuracy, completeness, validity, and authorization of transactions and data processed by the application. Examples of automated application controls are input validation, edit checks, calculations, reconciliations, and exception reports.
The application implementation documents are the documents that describe the design specifications, logic, and functionality of the application and its controls. The application implementation documents may include:
Business requirements document – a document that defines the business objectives, needs, and expectations of the application.
Functional specifications document – a document that describes the features, functions, and interfaces of the application and its controls.
Technical specifications document – a document that details the technical architecture, design, and configuration of the application and its controls.
Test plan and test cases – a document that outlines the testing strategy, methodology, and scenarios for verifying the functionality and performance of the application and its controls.
User manual and training material – a document that provides instructions and guidance on how to use the application and its controls.
By reviewing the application implementation documents, an IS auditor can:
Gain an understanding of the purpose, scope, and nature of the application and its controls.
Evaluate whether the application and its controls are designed to meet the business requirements and objectives.
Identify any gaps, inconsistencies, or errors in the design of the application and its controls.
Compare the design of the application and its controls with the best practices and standards in the industry.
Determine whether the application and its controls are adequately tested and documented.
Interviewing the application developer is not the best way for an IS auditor to assess the design of an automated application control. An interview is a verbal communication technique that involves asking questions and listening to responses. An interview can be useful for obtaining general information or clarifying specific issues related to the application and its controls. However, an interview alone cannot provide sufficient evidence or documentation to support the auditor’s assessment of the design of an automated application control. An interview may also be subject to bias, misunderstanding, or misinterpretation by either party.
Obtaining management attestation and sign-off is not the best way for an IS auditor to assess the design of an automated application control. Management attestation and sign-off is a formal process that involves obtaining written confirmation from management that they have reviewed and approved the design of the application and its controls. Management attestation and sign-off can indicate management’s commitment and accountability for the quality and effectiveness of the application and its controls. However, management attestation and sign-off cannot substitute for an independent and objective evaluation by an IS auditor.
Management attestation and sign-off may also be influenced by pressure, conflict of interest, or fraud.
Reviewing system configuration parameters and output is not the best way for an IS auditor to assess the design of an automated application control. System configuration parameters are settings that define how the system operates or interacts with other components. System output is data or information that is produced by the system as a result of processing transactions or performing functions. Reviewing system configuration parameters and output can help an IS auditor to verify whether the system is configured correctly and whether it produces accurate and reliable output. However, reviewing system configuration parameters and output cannot provide a comprehensive view of how the application and its controls are designed to achieve their objectives. Reviewing system configuration parameters and output may also require technical expertise or access rights that may not be available to an IS auditor.

Section: Information System Operations, Maintenance and Support
Explanation/Reference:
Diskless workstations are example of Thin client computer.
A thin client (sometimes also called a lean, zero or slim client) is a computer or a computer program that
depends heavily on some other computer (its server) to fulfill its computational roles. This is different from
the traditional fat client, which is a computer designed to take on these roles by itself. The specific roles
assumed by the server may vary, from providing data persistence (for example, for diskless nodes) to
actual information processing on the client’s behalf.
For your exam you should know the information below:
Common Types of computers
Supercomputers
A supercomputer is focused on performing tasks involving intense numerical calculations such as weather
forecasting, fluid dynamics, nuclear simulations, theoretical astrophysics, and complex scientific
computations. A supercomputer is a computer that is at the frontline of current processing capacity,
particularly speed of calculation. The term supercomputer itself is rather fluid, and the speed of today’s
supercomputers tends to become typical of tomorrow’s ordinary computer. Supercomputer processing
speeds are measured in floating point operations per second, or FLOPS. An example of a floating point
operation is the calculation of mathematical equations in real numbers. In terms of computational
capability, memory size and speed, I/O technology, and topological issues such as bandwidth and latency,
supercomputers are the most powerful, are very expensive, and not cost-effective just to perform batch or
transaction processing. Transaction processing is handled by less powerful computers such as server
computers or mainframes.
Mainframes
The term mainframe computer was created to distinguish the traditional, large, institutional computer
intended to service multiple users from the smaller, single user machines. These computers are capable of
handling and processing very large amounts of data quickly. Mainframe computers are used in large
institutions such as government, banks and large corporations. They are measured in MIPS (million
instructions per second) and respond to up to 100s of millions of users at a time.
Mid-range servers
Midrange systems are primarily high-end network servers and other types of servers that can handle the
large-scale processing of many business applications. Although not as powerful as mainframe computers,
they are less costly to buy, operate, and maintain than mainframe systems and thus meet the computing
needs of many organizations. Midrange systems have become popular as powerful network servers to help
manage large Internet Web sites, corporate intranets and extranets, and other networks. Today, midrange
systems include servers used in industrial process-control and manufacturing plants and play major roles in
computer-aided manufacturing (CAM). They can also take the form of powerful technical workstations for
computer-aided design (CAD) and other computation and graphics-intensive applications. Midrange system
are also used as front-end servers to assist mainframe computers in telecommunications processing and
network management.
Personal computers
A personal computer (PC) is a general-purpose computer, whose size, capabilities and original sale price
makes it useful for individuals, and which is intended to be operated directly by an end-user with no
intervening computer operator. This contrasted with the batch processing or time-sharing models which
allowed larger, more expensive minicomputer and mainframe systems to be used by many people, usually
at the same time. Large data processing systems require a full-time staff to operate efficiently.
Laptop computers
A laptop is a portable personal computer with a clamshell form factor, suitable for mobile use.[1] They are
also sometimes called notebook computers or notebooks. Laptops are commonly used in a variety of
settings, including work, education, and personal multimedia.
A laptop combines the components and inputs as a desktop computer; including display, speakers,
keyboard, and pointing device (such as a touchpad), into a single device. Most modern-day laptop
computers also have a webcam and a mice (microphone) pre-installed. [citation needed] A laptop can be
powered either from a rechargeable battery, or by mains electricity via an AC adapter. Laptops are a
diverse category of devices, and other more specific terms, such as ultra-books or net books, refer to
specialist types of laptop which have been optimized for certain uses. Hardware specifications change
vastly between these classifications, forgoing greater and greater degrees of processing power to reduce
heat emissions.
Smartphone, tablets and other handheld devices
A mobile device (also known as a handheld computer or simply handheld) is a small, handheld computing
device, typically having a display screen with touch input and/or a miniature keyboard.
A handheld computing device has an operating system (OS), and can run various types of application
software, known as apps. Most handheld devices can also be equipped with Wi-Fi, Bluetooth, and GPS
capabilities that can allow connections to the Internet and other Bluetooth-capable devices, such as an
automobile or a microphone headset. A camera or media player feature for video or music files can also be
typically found on these devices along with a stable battery power source such as a lithium battery.
Early pocket-sized devices were joined in the late 2000s by larger but otherwise similar tablet computers.
Much like in a personal digital assistant (PDA), the input and output of modern mobile devices are often
combined into a touch-screen interface.
Smartphone’s and PDAs are popular amongst those who wish to use some of the powers of a conventional
computer in environments where carrying one would not be practical. Enterprise digital assistants can
further extend the available functionality for the business user by offering integrated data capture devices
like barcode, RFID and smart card readers.
Thin Client computers
A thin client (sometimes also called a lean, zero or slim client) is a computer or a computer program that
depends heavily on some other computer (its server) to fulfill its computational roles. This is different from
the traditional fat client, which is a computer designed to take on these roles by itself. The specific roles
assumed by the server may vary, from providing data persistence (for example, for diskless nodes) to
actual information processing on the client’s behalf.
The following answers are incorrect:
The other types of computers are not example of diskless workstation.
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 246
http://en.wikipedia.org/wiki/Thin_client
http://en.wikipedia.org/wiki/Mobile_device
http://en.wikipedia.org/wiki/Personal_computer
http://en.wikipedia.org/wiki/Classes_of_computers
http://en.wikipedia.org/wiki/Laptop

Section: Protection of Information Assets
Explanation/Reference: https://www.slideshare.net/desmond.devendran/chap5-2007-cisa-review-course

Section: Protection of Information Assets
Explanation:
When transmitting data, a sequence number and/or time stamp built into the message to make it unique
can be checked by the recipient to ensure that the message was not intercepted and replayed. This is
known as replay protection, and could be used to verify that a payment instruction was not duplicated. Use
of a cryptographic hashing algorithm against the entire message helps achieve data integrity. Enciphering
the message digest using the sender’s private key, which signs the sender’s digital signature to the
document, helps in authenticating the transaction. When the message is deciphered by the receiver using
the sender’s public key, it ensures that the message could only have come from the sender. This process
of sender authentication achieves nonrepudiation.

Explanation/Reference:
Salami slicing or Salami attack refers to a series of many small actions, often performed by clandestine means, that as an accumulated whole produces a much larger action or result that would be difficult or unlawful to perform all at once. The term is typically used pejoratively. Although salami slicing is often used to carry out illegal activities, it is only a strategy for gaining an advantage over time by accumulating it in small increments, so it can be used in perfectly legal ways as well.
An example of salami slicing, also known as penny shaving, is the fraudulent practice of stealing money repeatedly in extremely small quantities, usually by taking advantage of rounding to the nearest cent (or other monetary unit) in financial transactions. It would be done by always rounding down, and putting the fractions of a cent into another account. The idea is to make the change small enough that any single transaction will go undetected.
In information security, a salami attack is a series of minor attacks that together results in a larger attack.
Computers are ideally suited to automating this type of attack.
The following answers are incorrect:
Eavesdropping – is the act of secretly listening to the private conversation of others without their consent, as defined by Black’s Law Dictionary. This is commonly thought to be unethical and there is an old adage that “eavesdroppers seldom hear anything good of themselves…eavesdroppers always try to listen to matters that concern them.” Traffic analysis – is the process of intercepting and examining messages in order to deduce information from patterns in communication. It can be performed even when the messages are encrypted and cannot be decrypted. In general, the greater the number of messages observed, or even intercepted and stored, the more can be inferred from the traffic. Traffic analysis can be performed in the context of military intelligence, counter-intelligence, or pattern-of-life analysis, and is a concern in computer security.
Masquerading – A masquerade attack is an attack that uses a fake identity, such as a network identity, to gain unauthorized access to personal computer information through legitimate access identification. If an authorization process is not fully protected, it can become extremely vulnerable to a masquerade attack.
Masquerade attacks can be perpetrated using stolen passwords and logons, by locating gaps in programs, or by finding a way around the authentication process. The attack can be triggered either by someone within the organization or by an outsider if the organization is connected to a public network. The amount of access masquerade attackers get depends on the level of authorization they’ve managed to attain. As such, masquerade attackers can have a full smorgasbord of cybercrime opportunities if they’ve gained the highest access authority to a business organization. Personal attacks, although less common, can also be harmful.
The following reference(s) were/was used to create this question:
http://searchfinancialsecurity.techtarget.com/definition/eavesdropping
http://en.wikipedia.org/wiki/Salami_slicing
http://en.wikipedia.org/wiki/Eavesdropping
http://en.wikipedia.org/wiki/Traffic_analysis
http://www.techopedia.com/definition/4020/masquerade-attack

Explanation
A database administrator (DBA) is responsible for maintaining the integrity, security and performance of the database systems. A DBA who is also responsible for developing and executing changes into the production environment may have a conflict of interest and pose a risk to the data quality and availability. Therefore, the IS auditor should first identify whether any compensating controls exist to mitigate this risk, such as independent reviews, approvals, audits or monitoring of the changes. Determining whether another DBA could make the changes, reporting a potential segregation of duties violation and ensuring a change management process is followed prior to implementation are possible actions that the auditor could take after identifying the compensating controls or the lack thereof. References:
Database Administrator (DBA) Definition
Segregation of Duties | ISACA
[Compensating Control Definition]

Section: The process of Auditing Information System