Exam CISA topic 1 question 349 discussion

in principle in a first step it is necessary to review the security parameters and then improve the change management process, for me the right answer is B.

The issue is not that there has been problems with change management processes. The issue is that the current settings are not effective. The system settings should be reviewed to ensure that sufficient protections for this system be implemented. The answer should be B.

Option B proposes performing a configuration review. A configuration review involves identifying and documenting the current configuration of the application servers, comparing it to a known secure baseline, and identifying any deviations. This process can help identify vulnerabilities and provide guidance on how to remediate them. Therefore, option B is a valid recommendation and could be considered the BEST option.

As an IS auditor, the best recommendation to address the issue of inconsistent security settings on application servers would be to standardize and centralize the security configurations of these servers. This can be achieved through the use of security configuration management tools and/or policies and procedures that ensure all application servers are configured consistently and securely. Additionally, the IS auditor could recommend implementing security monitoring and continuous audit processes to detect and remediate any future deviations from the standardized security configuration. Regular security assessments and penetration testing can also help identify and address potential vulnerabilities in a timely manner. Overall, the goal should be to ensure that all application servers have consistent and secure security configurations, and that any deviations from the standard are quickly identified and remediated to reduce the risk of potential vulnerabilities.

Correct answer is A. improve the Change management process. From CISA Q&A, Similar question, A4-81, There should be a complete change management process that includes testing, scheduling and approval. wrong answer B. is only a detection control.

Perform a configuration review?...again? so how did the IS Auditor discover the inconsistency in the first place? I don't think B is right.

I think it is A. Perform a configuration review of what? Obviously there is a Change Management process but it is not being followed. You can review the configuration of the server and fix the configuration but the issue will happen again unless the process is improved.