ISACA Certified Information Systems Auditor Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  During audit fieldwork, an IS auditor learns that employees are allowed to connect their personal devices to company-owned computers. How can the auditor BEST validate that appropriate security controls are in place to prevent data loss? A. Verify the data loss prevention (DLP) tool is properly configured by the organization. B. Review compliance with data loss and applicable mobile device user acceptance policies. C. Verify employees have received appropriate mobile device security awareness training. D. Conduct a walk-through to view results of an employee plugging in a device to transfer confidential data.

• Chose A1

  First step is to check to configuration of the DPL tools installed on the computers. Next step could be D.

• Chose A1

  A. Verify the DLP tool is properly configured by the organization. ✅ This aligns with ISACA’s audit testing principle: “An IS auditor should evaluate control design and determine whether it is operating effectively.” Checking DLP configuration = direct test of the control’s design and operation. DLP is the actual technical safeguard preventing data exfiltration (USB blocking, outbound filtering, etc.). ➡️ This is the kind of objective, evidence-based validation ISACA favors.