Difference estimation, stratified mean, and unstratified mean are valid sample types for substantive testing.
Quantitative mean is just a distracter.

Section: Protection of Information Assets
Explanation:
The contract should specify the number of subscribers permitted to use the site at any one time. Physical
security measures are not a part of the contract, although they are an important consideration when
choosing a third-party site. The total number of subscribers is not a consideration; what is important is
whether the agreement limits the number of subscribers in a building or in a specific area. The references
that other users can provide is a consideration taken before signing the contract; it is by no means part of
the contractual provisions.

The number of reopened tickets is a key performance indicator (KPI) that measures how often the IT help desk function fails to resolve the issues or problems reported by the customers on the first attempt123. A high number of reopened tickets indicates poor quality of service, low customer satisfaction, and wasted resources

Section: Protection of Information Assets
Explanation:
A digital signature through the private cryptographic key authenticates a transmission from a sender
through the private cryptographic key. It is a string of bits that uniquely represent another string of bits, a
digital document. An electronic signature refers to the string of bits that digitally represents a handwritten
signature captured by a computer system when a human applies it on an electronic pen pad, connected to
the system.

Explanation
Data classification is the first consideration when deciding whether data should be moved to a cloud provider for storage because it determines the level of protection and security required for the data. Data classification also helps to identify the legal and regulatory requirements that apply to the data, such as privacy, retention and disposal policies. Data storage costs, vendor cloud certification and service level agreements (SLAs) are important factors to consider, but they are secondary to data classification. References: CISA Review Manual (Digital Version) 1, Chapter 5, Section 5.3.2