Inspirational journeys

Follow the stories of academics and their research expeditions

CISA—Certified Information Systems Auditor - Part 368

Mary Smith

Sat, 21 Feb 2026

CISA—Certified Information Systems Auditor - Part 368

1. Which of the following is the MOST effective method of destroying sensitive data stored on electronic media?

A) Physical destruction
B) Degaussing
C) Random character overwrite
D) Low-level formatting



2. Email required for business purposes is being stored on employees' personal devices. Which of the following is an IS auditor's BEST recommendation?

A) Implement an email containerization solution on personal devices
B) Prohibit employees from storing company email on personal devices.
C) Ensure antivirus to utilize passwords on personal devices.
D) Require employees to utilize passwords on personal devices.



3. When designing metrics for information security, the MOST important consideration is that the metrics:

A) provide actionable data.
B) apply to all business units.
C) are easy to understand.
D) track trends over time.



4. An organization currently using tape backups takes one full backup weekly and incremental backups daily. They recently augmented their tape backup procedures with a backup-to- disk solution. This is appropriate because:

A) fast synthetic backups for offsite storage are supported.
B) backup to disk is always significantly faster than backup to tape.
C) tape libraries are no longer needed.
D) data storage on disks is more reliable than on tapes.



5. Which of the following should be the MOST important criterion in evaluating a backup solution for sensitive data that must be retained for a long period of time due to regulatory requirements?

A) Full backup window
B) Media costs
C) Restore window
D) Media reliability



1. Right Answer: A
Explanation: Reference:https://www.isaca.org/Journal/archives/2010/Volume-6/Pages/An-Introduction-to-Digital-Records-Management.aspx

2. Right Answer: D
Explanation:

3. Right Answer: D
Explanation: Reference:https://m.isaca.org/Journal/archives/2016/volume-6/Documents/Journal-volume-6-2016.pdf

4. Right Answer: A
Explanation: Disk-to-disk (D2D) backup should not be seen as a direct replacement for backup to tape; rather, it should be viewed as part of a multitier backup architecture that takes advantage of the best features of both tape and disk technologies. Backups to disks are not dramatically faster than backups to tapes in a balanced environment. Most often than not there is hardly a difference, since the limiting components are not tape or disk drives but the overall sustained bandwidth of the backup server's backplane. The advantage in terms of speed is in restoring performance, since all data are on hand and can be accessed randomly, resulting in a dramatic enhancement in throughput. This makes fast synthetic backups (making a full back up without touching the host's data only by using the existing incremental backups) efficient and easy. Although the cost of disks has been reduced, tape-based backup can offer an overall cost advantage over disk-only solutions. Even if RAID arrays are used for D2Dstorage, a failed drive must be swapped out and the RAID set rebuilt before another disk drive fails, thus making this kind of backup more risky and not suitable as a solution of last resort. In contrast, a single tape drive failure does not produce any data loss since the data resides on the tape media. In a multidrive library, the loss of the use of a single tape drive has no impact on the overall level of data protection. Conversely, the loss of a disk drive in an array can put all data at risk. This in itself reinforces the benefits of a disk-to-disk-to-any storage hierarchy, as data could be protected by a tertiary stage of disk storage and ultimately tape. Beyond the drive failure issue, tape has an inherent reliability advantage over any disk drive as it has no boot sector or file allocation table that can be infected or manipulated by a virus.

5. Right Answer: D
Explanation: To comply with regulatory requirements, the media should be reliable enough to ensure an organization's ability to recovery the data should they be required for any reason. Media price is a consideration, but should not be more important than the ability to provide the required reliability. Choices A and C are less critical than reliability.

0 Comments

Leave a comment