MENU
When reviewing an organization's information security policies, an IS auditor should verify that the policies have been defined PRIMARILY on the basis of:
Suggested Answer: D
Get Premium CISA Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
13 comments · newest first
EM
Emmanuel
11 months ago
Wait, are we sure that's the best approach?
CH
Cherelle
12 months ago
Agreed, risk management is key!
RO
Rosalind
12 months ago
Past incidents can inform policies, but not the primary basis.
SY
Sylvia
12 months ago
I think industry best practices are more relevant.
LE
Lemuel
1 year ago
Definitely should be based on a risk management process.
ED
Edda
1 year ago
I definitely recall that industry best practices are important, but I wonder if they are enough on their own.
SH
Sherita
1 year ago
I feel like past incidents could inform policies, but they shouldn't be the main basis. It's tricky!
VE
Veronika
1 year ago
I think the policies should be based on a risk management process, but I'm not entirely sure if that's the primary focus.
JU
Julian
1 year ago
I remember a practice question that emphasized the importance of an information security framework, so I might lean towards option B.
NA
Natalie
1 year ago
I'm a bit confused by this question. I'm not sure which two attributes are required - maybe I should review the material again.
AN
Antonio
1 year ago
I've got this! The key is to set the group ID bit on the directory so that new files inherit the group ownership. So the answer is definitely chmod g+s sales.
SU
Sue
1 year ago
Okay, let's see here. I think the key is to figure out why those orders are still showing up in the Ship Confirm program after being shipped. I'll start by checking the order activity rules.
PI
Pilar
1 year ago
Hmm, I'm a bit confused. Does the stock split affect the option contract itself, or just the underlying shares? I'll need to think this through carefully.