Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Systems Auditor · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
A is the HIGHEST risk
Highest risk to the business as people may exploit the vulnerabilities in the network environment.
A. Network penetration tests are not performed – This poses the highest risk because penetration testing is a critical control for identifying exploitable vulnerabilities in a live network environment. Without it, the organization may be unaware of serious security flaws that could lead to unauthorized access, data breaches, or service disruption. This represents a direct threat to the organization's security posture. Comparisons: B. Firewall policy not approved by the information security officer – This is a governance/control issue, but it doesn't directly expose the network to threats like missing penetration tests do. C. Firewall rules not documented – This weakens change management and troubleshooting, but again, it is less risky than not actively testing for vulnerabilities. D. Incomplete network device inventory – Important for security and asset management, but this is a supporting control. The lack of penetration testing has a more immediate and severe impact on risk exposure.