Section: Protection of Information Assets
Explanation:
An assessment of how well an organization's application portfolio supports the organization's business objectives is a key component of the overall IT strategic planning process. This drives the demand side of IT planning and should convert into a set of strategic IT intentions. Further assessment can then be made of how well the overall IT organization, encompassing applications, infrastructure, services, management processes, etc., can support the business objectives. Operational efficiency initiatives belong to tactical planning, not strategic planning. The purpose of an IT strategic plan is to set out how IT will be used to achieve or support an organization's business objectives. A listing of approved suppliers of IT contract resources is a tactical rather than a strategic concern. An IT strategic plan would not normally include detail ofa specific technical architecture.

Web services facilitate the exchange of information between two systems, regardless of the operating system or programming language used. Communication is not necessarily securer or faster, and there is no documentation benefit in using web services.

Section: The process of Auditing Information System

The most useful thing to do when planning to audit an organization's compliance with cybersecurity regulations in foreign countries is to map the different regulatory requirements to the organization's IT governance framework. This is because an IT governance framework is a roadmap that defines the methods used by an organization to implement, manage and report on IT governance within said organization1. IT governance helps align business and IT strategies using a solid and formal framework2. By mapping the different regulatory requirements to the IT governance framework, the auditor can:
* Identify the commonalities and differences among the various cybersecurity regulations that apply to the organization's operations in different countries.
* Assess the level of compliance and maturity of the organization's IT governance practices against each regulatory requirement.
* Evaluate the risks and gaps associated with non-compliance or partial compliance with any of the regulatory requirements.
* Recommend appropriate actions or improvements to enhance the organization's IT governance and cybersecurity posture.
Option D is correct because mapping the different regulatory requirements to the organization's IT governance framework is a systematic and effective way to plan and conduct an audit of compliance with cybersecurity regulations in foreign countries.

Explanation/Reference:
The word NOT the keyword used in the question. You need to find out the technique which preacher do not use to exploit PBX.
SYN Flood -Sends a flood of TCP/SYN packets with forged sender address, causing half-open connections and saturates available connection capacity on the target machine.
For CISA Exam you should know below mentioned techniques used by preacher for illegal purpose of PBX.
Eavesdropping on conversation, without the other parties being aware of it Eavesdropping on conference call
Illegal forwarding calls from specific equipment to remote numbers
Forwarding a user's to an unused or disabled number, thereby making it unreachable by external calls.
The following were incorrect answers:
The other options presented correctly describes the techniques used preacher for illegal purpose of PBX.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 357