Discuss Isaca CISA Exam Topic 6 Question 2

Which audit technique provides the GREATEST assurance that incident management procedures are effective?

ADetermining whether incidents are categorized and addressed

BComparing incident management procedures to best practices

CPerforming comprehensive vulnerability scanning and penetration testing

DEvaluating end-user satisfaction survey results

Suggested Answer: A

Get Premium CISA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

15 comments · newest first

Arlyne 11 months ago

A is important too, but B really stands out for effectiveness.

Eileen 12 months ago

Wait, evaluating surveys? That seems too subjective for assurance.

Shawnna 12 months ago

I’m not so sure about C. Scanning doesn’t cover everything.

Maybelle 12 months ago

Totally agree with B! It’s all about comparing to standards.

Cherri 1 year ago

I think option B is the best choice. Best practices are key!

Coral 1 year ago

I recall discussing how categorizing incidents is crucial, but I wonder if it’s enough on its own. Could option A really be the best?

Arminda 1 year ago

I'm not entirely sure, but I remember a practice question that emphasized the importance of comparing procedures to best practices. Maybe option B is the right answer?

Tyisha 1 year ago

I think option C might be the best choice since vulnerability scanning and penetration testing can really show how effective the incident management procedures are in practice.

Ronny 1 year ago

Evaluating end-user satisfaction seems important, but I feel like it might not provide the greatest assurance. I’m leaning towards option A instead.

Lavelle 1 year ago

Hmm, the interface description and IP address seem a bit odd. I'll need to think through the possible outcomes carefully.

Daron 1 year ago

I thought notifications could be sent to multiple destinations depending on the scope of the syslog objects, not just one. I should've reviewed that section again!

Sabra 1 year ago

Okay, I've got this. Complexity and integration are the two main factors that affect technical risk, so I'll select those.

Kate 1 year ago

Ah, I think I see it now. The health scores are different, so that rules out option A. Let me double-check the other details.

Brock 1 year ago

QAIP is about ongoing monitoring and periodic self-assessment, not benchmarking to industry best practices.

Clay 1 year ago

Okay, I've got this. The default entry point for a console application is the Main method, not the Class method, so I'll select option B.

Isaca CISA Exam - Topic 6 Question 2 Discussion