Section: Protection of Information Assets
Explanation:
A review of the parameter settings will provide a good basis for comparison of the actual configuration to the security policy and will provide audit evidence documentation. The other choices do not provide audit evidence as strong as choice A.

Section: Information System Operations, Maintenance and Support
Explanation/Reference:
PPP (Point-to-Point Protocol) is a protocol for communication between two computers using a serial
interface, typically a personal computer using a MODEM connected by phone line to a server.
For your exam you should know below information about WAN Technologies:
Point-to-point protocol
PPP (Point-to-Point Protocol) is a protocol for communication between two computers using a serial
interface, typically a personal computer connected by phone line to a server. For example, your Internet
server provider may provide you with a PPP connection so that the provider's server can respond to your
requests, pass them on to the Internet, and forward your requested Internet responses back to you. PPP
uses the Internet protocol (IP) (and is designed to handle others). It is sometimes considered a member of
the TCP/IP suite of protocols. Relative to the Open Systems Interconnection (OSI) reference model, PPP
provides layer 2 (data-link layer) service. Essentially, it packages your computer's TCP/IP packets and
forwards them to the server where they can actually be put on the Internet.
PPP is a full-duplex protocol that can be used on various physical media, including twisted pair or fiber
optic lines or satellite transmission. It uses a variation of High Speed Data Link Control (HDLC) for packet
encapsulation.
PPP is usually preferred over the earlier de facto standard Serial Line Internet Protocol (SLIP) because it
can handle synchronous as well as asynchronous communication. PPP can share a line with other users
and it has error detection that SLIP lacks. Where a choice is possible, PPP is preferred.
Point-to-point protocol

X.25
X.25 is an ITU-T standard protocol suite for packet switched wide area network (WAN) communication.
X.25 is a packet switching technology which uses carrier switch to provide connectivity for many different
networks.
Subscribers are charged based on amount of bandwidth they use. Data are divided into 128 bytes and
encapsulated in High Level Data Link Control (HDLC).
X.25 works at network and data link layer of an OSI model.

X.25
Frame Relay
Works on a packet switching
Operates at data link layer of an OSI model
Companies that pay more to ensure that a higher level of bandwidth will always be available, pay a
committed information rate or CIR
Two main types of equipment's are used in Frame Relay
1. Data Terminal Equipment (DTE) - Usually a customer owned device that provides a connectivity
between company's own network and the frame relay's network.
2. Data Circuit Terminal Equipment (DCE) - Service provider device that does the actual data transmission
and switching in the frame relay cloud.
The Frame relay cloud is the collection of DCE that provides that provides switching and data
communication functionality. Frame relay is any to any service.

Frame Relay
Integrated Service Digital Network
Enables data, voice and other types of traffic to travel over a medium in a digital manner previously used
only for analog voice transmission.
Same copper telephone wire is used.
Provide digital point-to-point circuit switching medium.
ISDN

Asynchronous Transfer Mode (ATM)
Uses Cell switching method
High speed network technology used for LAN, MAN and WAN
Like a frame relay it is connection oriented technology which creates and uses fixed channel
Data are segmented into fixed size cell of 53 bytes
Some companies have replaced FDDI back-end with ATM
Asynchronous Transfer Mode
Multiprotocol Label Switching (MPLS)
Multiprotocol Label Switching (MPLS) is a standards-approved technology for speeding up network traffic
flow and making it easier to manage. MPLS involves setting up a specific path for a given sequence of
packets, identified by a label put in each packet, thus saving the time needed for a router to look up the
address to the next node to forward the packet to. MPLS is called multiprotocol because it works with the
Internet Protocol (IP), Asynchronous Transport Mode (ATM), and frame relay network protocols. With
reference to the standard model for a network (the Open Systems Interconnection, or OSI model), MPLS
allows most packets to be forwarded at the Layer 2 (switching) level rather than at the Layer 3 (routing)
level. In addition to moving traffic faster overall, MPLS makes it easy to manage a network for quality of
service (QoS). For these reasons, the technique is expected to be readily adopted as networks begin to
carry more and different mixtures of traffic.
MPLS

The following answers are incorrect:
X.25 - X.25 is an ITU-T standard protocol suite for packet switched wide area network (WAN)
communication.X.25 is a packet switching technology which uses carrier switch to provide connectivity for
many different networks.
Frame Relay - The Frame relay cloud is the collection of DCE that provides that provides switching and
data communication functionality. Frame relay is any to any service.
ISDN -Enables data, voice and other types of traffic to travel over a medium in a digital manner previously
used only for analog voice transmission. Same copper telephone wire is used. Provide digital point-to-point
circuit switching medium.
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 266

Explanation/Reference:
Explanation:
Off-site data storage should be kept synchronized when preparing for the recovery of timesensitive data such as that resulting from transaction processing.

The most important outcome of an information security program is to improve the organizational awareness of security responsibilities, as this will foster a culture of security and ensure that all stakeholders are aware of their roles and obligations in protecting the information assets of the organization. An information security program should also aim to achieve other outcomes, such as identifying operating system weaknesses, understanding and accepting emerging security technologies, and reducing the cost to mitigate information security risk, but these are not as important as improving the awareness of security responsibilities, which is the foundation of any effective information security program. *References: According to the ISACA IT Audit and Assurance Standards, Guidelines and Tools and Techniques for IS Audit and Assurance Professionals, section 2402 Planning, "The IS audit and assurance professional should identify and assess risk relevant to the area under review." 1 One of the risk factors to consider is "the level of awareness of management and staff regarding IT risk management" 1. According to the ISACA IT Audit and Assurance Guideline G13 Information Security Management, "The objective of an information security management audit/assurance review is to provide management with an independent assessment relating to the effectiveness of information security management within the enterprise." The guideline also states that "the audit/assurance professional should evaluate whether there is an appropriate level of awareness throughout the enterprise regarding information security policies, standards, procedures and guidelines." According to a web search result from Microsoft Security, "Information security programs need to: ... Support the execution of decisions." 2 One of the ways to support the execution of decisions is to ensure that everyone in the organization understands their security responsibilities and follows the security policies and procedures.

Section: Protection of Information Assets
Explanation:
Above almost all other concerns, failing to perform user acceptance testing often results in the greatest negative impact on the implementation of new application software.