Exam CISA topic 1 question 102 discussion

C. Recommend that management enhance the policy and improve threat awareness training.

The auditor must verify whether the alerts truly lacked actionable intelligence or if they were improperly closed without thorough investigation. By analyzing the closed alerts, the auditor can: i.Identify potential false negatives or missed threats. ii.Assess whether the process for handling alerts is adequate and effective. iii.Determine if systemic issues exist, such as poor threat intelligence integration or inadequate training.

option A only addresses the immediate concern, however, option C is the BEST way to address the situation.

There might me some risks not resolved. You need to ivestigate further before enhancing policies and awareness.

While further reviewing closed unactioned alerts (Option A) could provide insights into specific instances of mishandling, recommending enhancements to the policy and training (Option C) addresses the underlying issue more comprehensively. It allows the organization to proactively improve its network threat response process rather than just reacting to past incidents.

Further review

why answer B?

By recommending that management enhances the policy and improves threat awareness training, the auditor addresses the underlying issues. Enhancing the policy can provide clearer guidelines and expectations for handling alerts, including criteria for closure. Improving threat awareness training can better equip the support team with the knowledge and skills to evaluate alerts effectively and take appropriate action.