Section: Protection of Information Assets
Explanation:
An IS auditor must first understand relative business processes before performing an application audit.

Explanation/Reference:
Explanation:
Firewall systems are the primary tool that enable an organization to prevent unauthorized access between networks. An organization may choose to deploy one or more systems that function as firewalls. Routers can filter packets based on parameters, such as source address, but are not primarily a security tool.
Based on Media Access Control (MAC) addresses, layer 2 switches separate traffic in a port as different segments and without determining if it is authorized or unauthorized traffic. A virtual LAN (VLAN) is a functionality of some switches that allows them to switch the traffic between different ports as if they are in the same LAN. Nevertheless, they do not deal with authorized vs. unauthorized traffic.

Section: Governance and Management of IT
Explanation/Reference:
Plan - Establish the objectives and processes necessary to deliver results in accordance with the expected
output (the target or goals). By establishing output expectations, the completeness and accuracy of the
spec is also a part of the targeted improvement. When possible start on a small scale to test possible
effects.
For your exam you should know the information below:
PDCA (plan-do-check-act or plan-do-check-adjust) is an iterative four-step management method used in
business for the control and continuous improvement of processes and products. It is also known as the
Deming circle/cycle/wheel, Stewart cycle, control circle/cycle, or plan-do-study-act (PDSA). Another
version of this PDCA cycle is OPDCA. The added "O" stands for observation or as some versions say
"Grasp the current condition."
The steps in each successive PDCA cycle are:

PLAN
Establish the objectives and processes necessary to deliver results in accordance with the expected output
(the target or goals). By establishing output expectations, the completeness and accuracy of the spec is
also a part of the targeted improvement. When possible start on a small scale to test possible effects.
DO
Implement the plan, execute the process, make the product. Collect data for charting and analysis in the
following "CHECK" and "ACT" steps.
CHECK
Study the actual results (measured and collected in "DO" above) and compare against the expected results
(targets or goals from the "PLAN") to ascertain any differences. Look for deviation in implementation from
the plan and also look for the appropriateness and completeness of the plan to enable the execution, i.e.,
"Do". Charting data can make this much easier to see trends over several PDCA cycles and in order to
convert the collected data into information. Information is what you need for the next step "ACT".
ACT
Request corrective actions on significant differences between actual and planned results. Analyze the
differences to determine their root causes. Determine where to apply changes that will include
improvement of the process or product. When a pass through these four steps does not result in the need
to improve, the scope to which PDCA is applied may be refined to plan and improve with more detail in the
next iteration of the cycle, or attention needs to be placed in a different stage of the process.
The following answers are incorrect:
DO - Implement the plan, execute the process, make the product. Collect data for charting and analysis in
the following "CHECK" and "ACT" steps.
CHECK - Study the actual results (measured and collected in "DO" above) and compare against the
expected results (targets or goals from the "PLAN") to ascertain any differences
ACT -Request corrective actions on significant differences between actual and planned results. Analyze the
differences to determine their root causes. Determine where to apply changes that will include
improvement of the process or product
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 107