The correct answer is C. Determine the level of employee adherence to the policies.
To obtain assurance that IT policies have been effectively implemented, the auditor must determine whether employees actually follow the policies in daily operations. A policy may be well written, approved, and aligned with standards, but it is not effectively implemented unless users, administrators, managers, and process owners comply with it.
ISACA guidance on policy compliance explains that assurance over compliance requires collecting sufficient information through methods such as direct observation, metrics, corroboration, tests, controls, audits, self- assessments, and critical questioning. ISACA's CISA Exam Content Outline also includes evaluating the organization's management of IT policies and practices, including compliance with legal and regulatory requirements.
Option A is not the best answer because external certifications may provide some comfort, but they do not prove that the organization's own employees are consistently following internal IT policies.
Option B is not the best answer because benchmarking shows whether policies are well designed compared with industry standards. It does not prove that the policies are implemented or followed.
Option D is not the best answer because security breaches are lagging indicators. A lack of breaches does not prove policy effectiveness, and an increase in breaches may be caused by many factors unrelated to policy implementation.
This question maps mainly to Governance and Management of IT because IT policies, standards, procedures, practices, and compliance with those practices are part of IT governance.
References: ISACA CISA Exam Content Outline, Domain 2; ISACA article on determining policy compliance.

Explanation/Reference:
Privacy release supports shared extensions among several devices, ensuring that only one device at a time can use an extension.
For you exam you should know below mentioned PBX features and Risks:
System Features
Description
Risk
Automatic Call distribution
Allows a PBX to be configured so that incoming calls are distributed to the next available agent or placed on-hold until one become available
Tapping and control of traffic
Call forwarding
Allow specifying an alternate number to which calls will be forwarded based on certain condition User tracking
Account codes
Used to:
Track calls made by certain people or for certain projects for appropriate billing Dial-In system access (user dials from outside and gain access to normal feature of the PBX) Changing the user class of service so a user can access a different set of features (i.e. the override feature)
Fraud, user tracking, non authorized features
Access Codes
Key for access to specific feature from the part of users with simple instruments, i.e. traditional analog phones.
Non-authorized features
Silent Monitoring
Silently monitors other calls
Eavesdropping
Conferencing
Allows for conversation among several users
Eavesdropping, by adding unwanted/unknown parties to a conference
override(intrude)
Provides for the possibility to break into a busy line to inform another user an important message Eavesdropping
Auto-answer
Allows an instrument to automatically go when called usually gives an auditor or visible warning which can easily turned off
Gaining information not normally available, for various purpose
Tenanting
Limits system user access to only those users who belong to the same tenant group - useful when one company leases out part of its building to other companies and tenants share an attendant, trunk lines,etc Illegal usage, fraud, eavesdropping
Voice mail
Stores messages centrally and - by using a password - allows for retrieval from inside or outside lines.
Disclosure or destruction of all messages of a user when that user's password in known or discovered by an intruder, disabling of the voice mail system and even the entire switch by lengthy messages or embedded codes, illegal access to external lines.
Privacy release
Supports shared extensions among several devices, ensuring that only one device at a time can use an extension. Privacy release disables the security by allowing devices to connect to an extension already in use.
Eavesdropping
No busy extension
Allows calls to an in-use extension to be added to a conference when that extension is on conference and already off-hook
Eavesdropping a conference in progress
Diagnostics
Allows for bypassing normal call restriction procedures. This kind of diagnostic is sometimes available from any connected device. It is a separate feature, in addition to the normal maintenance terminal or attendant diagnostics
Fraud and illegal usage
Camp-on or call waiting
When activated, sends a visual audible warning to an off-hook instrument that is receiving another call.
Another option of this feature is to conference with the camped-on or call waiting Making the called individual a party to a conference without knowing it.
Dedicated connections
Connections made through the PBX without using the normal dialing sequences. It can be used to create hot-lines between devices i.e. one rings when the other goes off-hook. It is also used for data connections between devices and the central processing facility
Eavesdropping on a line
The following were incorrect answers:
Call forwarding - Allow specifying an alternate number to which calls will be forwarded based on certain condition
Tenanting -Limits system user access to only those users who belong to the same tenant group - useful when one company leases out part of its building to other companies and tenants share an attendant, trunk lines,etc
Voice Mail -Stores messages centrally and - by using a password - allows for retrieval from inside or outside lines.
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number358

Section: Protection of Information Assets
Explanation:
A registration authority is responsible for verifying information supplied by the subject requesting a certificate, and verifies the requestor's right to request certificate attributes and that the requestor actually possesses the private key corresponding to the public key being sent.
Certification authorities, not registration authorities, actually issue certificates once verification of the information has been completed; because of this, choice B is incorrect. On the other hand, the sender who has control of their private key signs the message, not the registration authority. Registering signed messages is not a task performed by registration authorities.

Section: Protection of Information Assets