CISA Question 279

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D2

  One might be tempted to choose C. But C. is not a control, i.e. logging per se is not yet a control. It only becomes part of a control with the review, but the actual control here is the review. So the correct answer is D. Data changes are independently reviewed by another group.

• Chose D5

  Option D directly addresses the detection of unauthorized data changes by having a separate group or individual review the changes independently. This independent review can help identify discrepancies or anomalies that may indicate unauthorized access or alterations to data, providing an effective control for detecting unauthorized changes. Option C poses a Self-review threat since it is responsibility that is shared, not simply access.

• Chose C1

  Data are logged into another application to be reviewed. If it’s independently reviewed by another group, logs can be tampered with. C is the answer