Explanation
Maintaining an onboarding and annual security awareness program is the best way to prevent social engineering incidents because it can educate the users about the common techniques and tactics used by social engineers and how to avoid falling victim to them. Ensuring user workstations are running the most recent version of antivirus software, including security responsibilities in job descriptions and requiring signed acknowledgment, and enforcing strict email security gateway controls are all good security practices, but they do not directly address the human factor that is exploited by social engineering. References:
ISACA, CISA Review Manual, 27th Edition, 2020, p. 3671
ISACA, CISA Review Questions, Answers & Explanations Database - 12 Month Subscription2

Section: Protection of Information Assets
Explanation:
Configuration management is widely accepted as one of the key components of any network, since it
establishes how the network will function internally and externally, it also deals with the management of
configuration and monitoring performance. Topological mappings provide outlines of the components of the
network and its connectivity. Application monitoring is not essential and proxy server troubleshooting is
used for troubleshooting purposes.

Explanation/Reference:
Explanation:
Since the recovery time is longer in plan B, resumption and recovery costs can be expected to be lower.
Walkthrough costs are not a part of disaster recovery. Since the management considered a higher window for recovery in plan B, downtime costs included in the plan are likely to be higher.

It is a common mistake to use scenario planning for business continuity. The problem is that it is impossible to plan and document actions for every possible scenario. Planning for just selected scenarios denies the fact that even improbable events can cause an organization to break down. Best practice planning addresses the four possible areas of impact in a disaster: premises, people, systems, and suppliers and other dependencies. All scenarios can be reduced to these four categories and can be handled simultaneously. There are very few special scenarios which justify an additional separate analysis, it is a good idea to use best practices and external advice for such an important topic, especially since knowledge of the right level of preparedness and the judgment about adequacy of the measures taken is not available in every organization. The recovery time objectives (RTOs) are based on the essential business processes required to ensure the organization's survival, therefore it would be inappropriate for them to be based on IT capabilities. Best practice guidelines recommend having 20%-40% of normal capacity available at an emergency site; therefore, a value of 50% would not be a problem if there are no additional factors.