Explanation/Reference:
Explanation:
From an IS auditor's perspective, the primary objective of auditing the management of service providers should be to determine if the services that were requested were provided in a way that is acceptable, seamless and in line with contractual agreements. Minimizing costs, if applicable and achievable (depending on the customer's need) is traditionally not part of an IS auditor's job. This would normally be done by a line management function within the IT department. Furthermore, during an audit, it is too late to minimize the costs for existing provider arrangements. Subcontracting providers could be a concern, but it would not be the primary concern. Transferring knowledge to the internal IT department might be desirable under certain circumstances, but should not be the primary concern of an IS auditor when auditing IT service providers and the management thereof.

Section: Protection of Information Assets
Explanation/Reference:
The NOT is a keyword used in this question. You need to find out the functionality which is NOT provided
by SSL protocol. The SSL protocol provides:
Confidentiality
Integrity
Authentication, e.g. between client and server
Non-repudiation
For CISA exam you should know the information below about Secure Socket Layer (SSL) and Transport
Layer Security (TLS)
These are cryptographic protocols which provide secure communication on Internet. There are only slight
difference between SSL 3.0 and TLS 1.0. For general concept both are called SSL.
SSL is session-connection layer protocol widely used on Internet for communication between browser and
web servers, where any amount of data is securely transmitted while a session is established. SSL
provides end point authentication and communication privacy over the Internet using cryptography. In
typical use, only the server is authenticated while client remains unauthenticated. Mutual authentication
requires PKI development to clients. The protocol allows application to communicate in a way designed to
prevent eavesdropping, tampering and message forging.
SSL involves a number of basic phases
Peer negotiation for algorithm support
Public-key, encryption based key exchange and certificate based authentication
Symmetric cipher based traffic encryption.
SSL runs on a layer beneath application protocol such as HTTP, SMTP and Network News Transport
Protocol (NNTP) and above the TCP transport protocol, which forms part of TCP/IP suite.
SSL uses a hybrid hashed, private and public key cryptographic processes to secure transmission over the
INTERNET through a PKI.
The SSL handshake protocol is based on the application layer but provides for the security of the
communication session too. It negotiates the security parameter for each communication section. Multiple
session can belong to one SSL session and the participating in one session can take part in multiple
simultaneous sessions.
The following were incorrect answers:
Confidentiality - It is supported by the SSL Protocol
Integrity -It is supported by the SSL Protocol
Authentication - It is supported by the SSL protocol
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 352

Computer processing time is increased for longer asymmetric encryption keys, and the increase may be disproportionate. For example, one benchmark showed that doubling the length of an RSA key from 512 bits to 1,024 bits caused the decrypt time to increase nearly six-fold. An asymmetric algorithm requires more processing time than symmetric algorithms. A hash is shorter than the original message; therefore, a smaller overhead is required if the hash is encrypted rather than the message. Use of asecret key, as a symmetric encryption key, is generally small and used for the purpose of encrypting user data.