CISA Exam Dumps - Isaca Certification Questions and Answers

IfIT is not involvedinstrategic planning,IT strategy may diverge from business needs, leading tomisalignment and inefficiencies.

Option A (Incorrect):Business strategy alignmentis important, but the greater risk is thatIT investments do not support business goals.

Option B (Incorrect):Lack of emerging technology awareness is a risk, butIT-business misalignment has broader consequences.

Option C (Correct):Thegreatest riskis when IT strategyfails to align with business objectives, leading towasted investments, inefficiencies, and competitive disadvantages.

Option D (Incorrect):IT goals being overlooked is a concern, butmisalignment of IT and business strategies is a more critical risk.

 Application containers are a form of operating system virtualization that share the same kernel as the host operating system. This means that any vulnerability or compromise in the kernel can affect all the containers running on the same host, as well as the host itself. Additionally, containers may have privileged access to the kernel resources and functions, which can pose a risk of unauthorized or malicious actions by the container processes. Therefore, securing the kernel is a critical aspect of application container security.

Shared registries (option A) are not an inherent risk in the application container infrastructure, but they are a potential risk that depends on how they are configured and managed. Shared registries are repositories that store and distribute container images. They can be public or private, and they can have different levels of security and access controls. Shared registries can pose a risk of exposing sensitive data, distributing malicious or vulnerable images, or allowing unauthorized access to images. However, these risks can be mitigated by using secure connections, authentication and authorization mechanisms, image signing and scanning, and encryption.

Host operating system (option B) is not an inherent risk in the application container infrastructure, but it is a potential risk that depends on how it is configured and maintained. Host operating system is the underlying platform that runs the application containers and provides them with the necessary resources and services. Host operating system can pose a risk of exposing vulnerabilities, misconfigurations, or malware that can affect the containers or the host itself. However, these risks can be mitigated by using minimal and hardened operating systems, applying patches and updates, enforcing security policies and controls, and isolating and monitoring the host.

Shared data (option C) is not an inherent risk in the application container infrastructure, but it is a potential risk that depends on how it is stored and accessed. Shared data is the information that is used or generated by the application containers and that may be shared among them or with external entities. Shared data can pose a risk of leaking confidential or sensitive data, corrupting or losing data integrity, or violating data privacy or compliance requirements. However, these risks can be mitigated by using secure storage solutions, encryption and decryption mechanisms, access control and auditing policies, and backup and recovery procedures.

Therefore, option D is the correct answer.

Evidence of a control’s performance must be verifiable. A missing signature or date means there is no confirmation that the review was actually performed. This undermines the completeness and reliability of the control. Accuracy (A) and content (B) relate to quality but do not address the missing attestation. Industry standards (C) may be relevant, but the auditor’s main concern is that the absence of sign-off creates doubt about whether the control occurred at all. ISACA audit guidance highlights that sufficient and appropriate evidence is required to support the conclusion that a control is operating as designed.

References (ISACA): ISACA Standards – Evidence Collection; ISACA ITAF Guidelines.