The use of unauthorized or illegal software should be prohibited by an organization. Software piracy results in inherent exposure and can result in severe fines. An IS auditor must convince the user and user management of the risk and the need to eliminate the risk. An IS auditor should not
assume the role of the enforcing officer and take on any personal involvement in removing or deleting the unauthorized software.

Choice A is incorrect because more than one person would typically need to have a key to the vault to ensure that individuals responsible for the offsite vault can take vacations and rotate duties. Choice B is not correct because an IS auditor would not be concerned with whether paper documents are stored in the offsite vault. In fact, paper documents, such as procedural documents and a copy of the contingency plan, would most likely be stored in the offsite vault, and the location of the vault is important, but not as important as the files being synchronized.

Section: Protection of Information Assets
Explanation:
The recovery point objective (RPO) is based on the acceptable data loss in the case of a disruption. In this
scenario the organization needs a short RPO. Virtual tape libraries, disk- based snapshots and disk-to-tape
backup would require time to complete the backup, while continuous data backup happens online (in real
time).