CISA Question 163

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  System already list out all changes, most efficient way should be check list have approval or not.

• 1

  Your analysis is very clear on the pros and cons of each option. However, option D: verifying user management approval of changes is not the most effective method of detecting unauthorized changes because it is primarily aimed at process control rather than actually detecting changes that have occurred. Even with management approval, unauthorized changes may still escape review. Conversely, while B. manually comparing code in a production program with a controlled copy may indeed be time-consuming in large-scale environments, this approach is still useful if assisted by automated tools such as a version control system or a change monitoring system. The most direct and effective detection method because it can specifically detect any unauthorized changes. The manual alignment process can also be automated to reduce time consumption and errors. Therefore, B is often considered the most effective method, especially with the help of auxiliary tools.

• Chose C2

  Answer: C while user management approval is a critical control, it might not be the most efficient method for detecting unauthorized changes in an environment with automated reporting mechanisms. Reviewing the last compile date of production programs aligns better with the context of automatic reporting and provides a more direct and efficient means of detecting unauthorized changes.