CISA Question 71

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  First step you need to know the enterprise firewall standards. Location of the firewall within the network is a design assessment which is 2nd step.

• Chose A1

  Correct answer is A. Even if you have installed the best firewall and configured is very well it would be useless if you placed is on wrong side of the network depending on the objective you're trying to address.

• Chose A1

  The question asks what an IS auditor should review FIRST when auditing the security architecture of an online application. Before looking at configurations, firmware, or policy standards, the auditor must understand the overall design, specifically: - What the firewall is protecting - Whether it is positioned correctly (e.g., DMZ, internal network, web/app/DB tiers) - Which network segments it separates - Whether the architecture exposes the application to unnecessary risk If a firewall is in the wrong place, no configuration or standard will make it secure. This is why architecture-level audit begins with placement/topology, not policy. ISACA/CISA principle: When auditing architecture, start at the highest level — network design, trust zones, and placement of controls. Only after that do you drill into configurations and standards.