Section: Information System Acquisition, Development and Implementation

Explanation/Reference:
Explanation:
A polymorphic virus has the capability of changing its own code, enabling it to have many different variants. Since they have no consistent binary pattern, such viruses are hard to identify.

The organization's software inventory is not complete. This finding would be of greatest concern to an IS auditor assessing an organization's patch management process because:
A software inventory is a list of all the software assets that an organization owns, uses, or manages. A software inventory is essential for effective patch management, as it helps identify the software that needs to be updated, the patches that are available, and the dependencies and compatibility issues that may arise.
Without a complete software inventory, an organization may miss some critical patches, expose itself to security risks, and waste resources on unnecessary or redundant patches.
Applications frequently need to be rebooted for patches to take effect. This finding would be of moderate concern to an IS auditor assessing an organization's patch management process because:
Rebooting applications for patches to take effect is a common and expected practice in some cases, especially for operating system or kernel patches. However, frequent reboots may indicate that the organization is not applying patches in a timely or efficient manner, or that the patches are not well-designed or tested. Frequent reboots may also cause disruption to the business operations and user experience, and increase the risk of data loss or corruption.
Software vendors are bundling patches. This finding would be of low concern to an IS auditor assessing an organization's patch management process because:
Bundling patches is a practice where software vendors combine multiple patches into a single package or update. Bundling patches can have some advantages, such as reducing the number of downloads and installations, simplifying the patch management process, and ensuring consistency and compatibility among patches. However, bundling patches can also have some disadvantages, such as increasing the size and complexity of the updates, delaying the delivery of critical patches, and introducing new bugs or vulnerabilities.
Testing patches takes significant time. This finding would be of low concern to an IS auditor assessing an organization's patch management process because:
Testing patches is a vital step in the patch management process, as it helps ensure that the patches are functional, secure, and compatible with the existing software and hardware environment. Testing patches can take significant time, depending on the scope, complexity, and frequency of the patches. However, testing patches is a necessary investment to avoid potential problems or failures that could result from applying untested or faulty patches.
References:
Best practices for patch management
Server Patch Management: Best Practices and Tools
11 Key Steps of the Patch Management Process

Section: Governance and Management of IT
Explanation/Reference:
Check - Study the actual results (measured and collected in "DO" above) and compare against the
expected results (targets or goals from the "PLAN") to ascertain any differences. Look for deviation in
implementation from the plan and also look for the appropriateness and completeness of the plan to enable
the execution, i.e., "Do". Charting data can make this much easier to see trends over several PDCA cycles
and in order to convert the collected data into information. Information is what you need for the next step
"ACT".
For your exam you should know the information below:
PDCA (plan-do-check-act or plan-do-check-adjust) is an iterative four-step management method used in
business for the control and continuous improvement of processes and products. It is also known as the
Deming circle/cycle/wheel, Stewart cycle, control circle/cycle, or plan-do-study-act (PDSA). Another
version of this PDCA cycle is OPDCA. The added "O" stands for observation or as some versions say
"Grasp the current condition."
The steps in each successive PDCA cycle are:

PLAN
Establish the objectives and processes necessary to deliver results in accordance with the expected output
(the target or goals). By establishing output expectations, the completeness and accuracy of the spec is
also a part of the targeted improvement. When possible start on a small scale to test possible effects.
DO
Implement the plan, execute the process, make the product. Collect data for charting and analysis in the
following "CHECK" and "ACT" steps.
CHECK
Study the actual results (measured and collected in "DO" above) and compare against the expected results
(targets or goals from the "PLAN") to ascertain any differences. Look for deviation in implementation from
the plan and also look for the appropriateness and completeness of the plan to enable the execution, i.e.,
"Do". Charting data can make this much easier to see trends over several PDCA cycles and in order to
convert the collected data into information. Information is what you need for the next step "ACT".
ACT
Request corrective actions on significant differences between actual and planned results. Analyze the
differences to determine their root causes. Determine where to apply changes that will include
improvement of the process or product. When a pass through these four steps does not result in the need
to improve, the scope to which PDCA is applied may be refined to plan and improve with more detail in the
next iteration of the cycle, or attention needs to be placed in a different stage of the process.
The following answers are incorrect:
PLAN - Establish the objectives and processes necessary to deliver results in accordance with the
expected output (the target or goals).
DO - Implement the plan, execute the process, make the product. Collect data for charting and analysis in
the following "CHECK" and "ACT" steps.
ACT -Request corrective actions on significant differences between actual and planned results. Analyze the
differences to determine their root causes. Determine where to apply changes that will include
improvement of the process or product
The following reference(s) were/was used to create this question:
CISA review manual 2014 page number 107

Section: Governance and Management of IT