Comprehensive and Detailed Step-by-Step Explanation:
For online payment security, bothconfidentiality(protection of data) andnonrepudiation(ensuring the sender cannot deny a transaction) are essential.
* Option A (Incorrect):DES is outdatedandinsecurefor modern encryption needs. It has been replaced by stronger algorithms.
* Option B (Incorrect):AES provides strong encryption(confidentiality) but does not handlenonrepudiationon its own.
* Option C (Correct):PKI (Public Key Infrastructure)is the best solution because it providesencryption for confidentialityanddigital signatures for nonrepudiation, ensuring bothsecuretransactions andauthenticationof parties involved.
* Option D (Incorrect):AVPN secures network traffic, but it does not address nonrepudiation, which is critical in online payments.
Reference:ISACA CISA Review Manual -Domain 5: Protection of Information Assets- Covers encryption, PKI, and secure payment processing.

Explanation/Reference:
Explanation:
A global enterprise product reengineering (EPR) software package can be applied to a business to replace, simplify and improve the quality of IS processing. Documentation is intended to help understand how, why and which solutions that have been selected and implemented, and therefore must be specific to the project. Documentation is also intended to support quality assurance and must be comprehensive.

Explanation/Reference:
Explanation:
Because of the configuration and the way IDS technology operates, the main problem in operating IDSs is the recognition (detection) of events that are not really security incidents- false positives, the equivalent of a false alarm. An IS auditor needs to be aware of this and should check for implementation of related controls, such as IDS tuning, and incident handling procedures, such as the screening process to know if an event is a security incident or a false positive. Trap messages are generated by the Simple Network Management Protocol (SNMP) agents when an important event happens, but are not particularly related to security or IDSs.
Reject-error rate is related to biometric technology and is not related to IDSs. Denial-of-service is a type of attack and is not a problem in the operation of IDSs.

Section: Protection of Information Assets
Explanation:
An IS auditor must first understand relative business processes before performing an application audit.