Discuss Isaca CISA Exam Topic 6 Question 89

An IS auditor reviewing the database controls for a new e-commerce system discovers a security weakness in the database configuration. Which of the following should be the IS auditor's NEXT course of action?

AIdentify existing mitigating controls.

BDisclose the findings to senior management.

CAssist in drafting corrective actions.

DAttempt to exploit the weakness.

Suggested Answer: A

When an IS auditor discovers a security weakness in the database configuration, the next course of action should be to identify existing mitigating controls. This involves assessing whether any controls are already in place to address the weakness and mitigate the risk.Understanding the current state of controls helps the auditor determine the severity of the issue and whether additional corrective actions are necessary1.Reference:1(https://www.isaca.org/resources/insights-and-expertise/audit-programs-and-tools)

Get Premium CISA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

32 comments · newest first

Barbra 10 months ago

C seems like a good move, but isn't it a bit premature?

Carlton 11 months ago

Agree with B, management needs to know ASAP!

Oliva 11 months ago

Wait, why would you attempt to exploit the weakness? That sounds risky!

Roxanne 11 months ago

I think identifying existing mitigating controls is a good first step too.

Mari 11 months ago

Definitely should disclose the findings to senior management.

Yasuko 12 months ago

Attempting to exploit the weakness seems risky and unethical. I doubt that's the right approach for an auditor, but I could be wrong.

Juan 12 months ago

I practiced a similar question, and I feel like assisting in drafting corrective actions could be a good next step, but it might depend on the severity of the weakness.

Coral 12 months ago

I'm not entirely sure, but I remember something about the importance of disclosing findings to management. That might be the right move here.

Louann 1 year ago

I think the auditor should first identify existing mitigating controls. It seems like a logical step before escalating the issue.

Corinne 1 year ago

Whoa, hold up! Option D, attempting to exploit the weakness, is definitely not the way to go. That could make the situation much worse. I'd steer clear of that one.

Ruthann 1 year ago

I'm pretty confident that the right answer is B - disclosing the findings to senior management. That's the responsible thing to do, and they'll be able to oversee the appropriate corrective measures.

Dorothy 1 year ago

I'm a bit confused here. Shouldn't the auditor first identify any existing controls that could help mitigate the weakness? Option A seems like a logical first step before deciding on further actions.

Adaline 1 year ago

Okay, let's see. The auditor has identified a security weakness, so the next step should be to address that and mitigate the risk. I'm leaning towards option C - assisting in drafting corrective actions.

Nickie 1 year ago

Hmm, this is a tricky one. I'll need to carefully consider the options and think through the potential consequences of each course of action.

Hoa 1 year ago

Improper segregation of duties is a classic red flag for potential fraud, so I would say that's the most likely answer. The other options could also indicate increased fraud risk, but segregation of duties issues are a clear sign to dig deeper.

Pearline 2 years ago

Option D? Really? That's like trying to put out a fire by throwing gasoline on it. Let's stick to the professional approach and go with B or C.

Huey 2 years ago

↳ replying to Pearline

C) Assist in drafting corrective actions.

Dalene 2 years ago

↳ replying to Pearline

B) Disclose the findings to senior management.

Lonny 2 years ago

↳ replying to Pearline

A) Identify existing mitigating controls.

Ernestine 2 years ago

Wait, we can't just start exploiting the weakness, that's like trying to beat a video game by cheating. I'd go with option C - assist in drafting corrective actions to fix this properly.

Winfred 2 years ago

↳ replying to Ernestine

Identifying existing mitigating controls could also be helpful in understanding the current state of security measures.

Erick 2 years ago

↳ replying to Ernestine

It's important to work with the team to come up with a solution rather than trying to exploit the weakness.

Georgiann 2 years ago

↳ replying to Ernestine

I agree, we should definitely help draft corrective actions to address the security weakness.

Jacklyn 2 years ago

Hmm, I think option A is the way to go. Let's see if there are any existing controls that can mitigate the issue before we go nuclear and disclose it to the higher-ups.

Coletta 2 years ago

Option B all the way! Transparency is key, and senior management needs to know about this weakness ASAP. Once they're aware, we can work on the corrective actions.

Roslyn 2 years ago

I believe the IS auditor should also assist in drafting corrective actions to address the security weakness.

Amber 2 years ago

Clearly, option D is a big no-no. We don't want to create more problems than we already have. I'd say B and C are the way to go - disclose it to management and help them fix it.

Cortney 2 years ago

↳ replying to Amber

C) Assist in drafting corrective actions.

Tenesha 2 years ago

↳ replying to Amber

B) Disclose the findings to senior management.

Miles 2 years ago

↳ replying to Amber

A) Identify existing mitigating controls.

Hannah 2 years ago

I agree with Mertie. Senior management needs to be aware of the security weakness.

Mertie 2 years ago

I think the IS auditor should disclose the findings to senior management.

Isaca CISA Exam - Topic 6 Question 89 Discussion