CISA Question 58

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  The best answer is A: Audit logging is not enabled. Authentication, authorization and accountability (AAA) work as three separate layers, and the CISA Review Manual (28th ed., section 5.3.2) says accountability depends on logging every action to create an audit trail. Options B, C and D (no single sign-on, weak passwords, inconsistent security baseline) are weaknesses in preventive controls, and a detective control like logging can still catch abuse after the fact. Without logs, there is nothing to fall back on, even if every preventive control is strong. Privileged users, for example, are allowed to change data, so preventive controls cannot stop misuse of that access, whether intentional or accidental. Only logs can show who did what and when. Missing logs also leave the auditor unable to test the other controls. A weak control is still a control; a missing one is a gap.

• Chose D2

  A security baseline is the minimum approved security configuration standard for systems. If it is not consistently applied, then: Some CRM servers/systems may be hardened Others may have weak configurations Security controls become unpredictable Vulnerabilities may exist across the environment

• Chose D2

  Answer D is correct because security baselining is making sure that minimum requirements are set for all systems. All other options may be specified in the security baseline.