CISA Question 427

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  While considering peak activity periods for the business (option C) is important for minimizing disruptions and ensuring that follow-up activities do not conflict with critical business operations, it is secondary to the remediation dates provided by management. The urgency and criticality of addressing audit findings are primarily determined by the agreed-upon remediation dates.

• 1

  While the complexity of business processes (option D) identified in the audit is important, it primarily influences the approach and effort required for remediation rather than the initial determination of timeframes. Timeframes are typically set based on the urgency of the issue, regulatory requirements, and the commitments made by management in their responses.

• 3

  A. Remediation dates included in management responses