Explanation
The greatest risk of using a reciprocal site for disaster recovery is the inability to utilize the site when required. A reciprocal site is an agreement between two organizations to provide backup facilities for each other in case of a disaster. However, this arrangement may not be reliable or enforceable, especially if both organizations are affected by the same disaster or have conflicting priorities. Therefore, the IS auditor should recommend that management consider alternative options for disaster recovery, such as dedicated sites or cloud services12. References:
CISA Review Manual, 27th Edition, page 3381
CISA Review Questions, Answers & Explanations Database - 12 Month Subscription

Explanation
Following a configuration management process to maintain applications is the primary reason for ensuring proper change control. Configuration management is a process of identifying, documenting, controlling, and verifying the configuration items and their interrelationships within an IT system or environment. Following a configuration management process can help to ensure that any changes to the applications are authorized, tested, documented, and tracked throughout their lifecycle. This will help to prevent unauthorized or improper changes that could affect the functionality, performance, or security of the applications. The other options are not the primary reasons for following a configuration management process, but rather possible benefits or outcomes of doing so. References:
CISA Review Manual (Digital Version), Chapter 4, Section 4.3.31
CISA Review Questions, Answers & Explanations Database, Question ID 225

Residual biometric characteristics, such as fingerprints left on a biometric capture device, may be reused by an attacker to gain unauthorized access. A brute force attack involves feeding the biometric capture device numerous different biometric samples. A cryptographic attack targets the algorithm or the encrypted data, in a mimic attack, the attacker reproduces characteristics similar to those of the enrolled user, such as forging a signature or imitating a voice.

Section: Protection of Information Assets
Explanation:
Phishing attacks can be mounted in various ways; intrusion detection systems (IDSs) and strong
authentication cannot mitigate most types of phishing attacks. Assessing web site security does not
mitigate the risk. Phishing uses a server masquerading as a legitimate server. The best way to mitigate the
risk of phishing is to educate users to take caution with suspicious internet communications and not to trust
them until verified. Users require adequate training to recognize suspicious web pages and e-mail.