Exam CISA topic 1 question 71 discussion

I am really blown away by everybody saying it is A. The config will tell you where and what the firewall does. Location of firewall means absolutely nothing. Physical location? I mean a firewall ALWAYS sits in front of your business network...

option A network topology is the first thing for the is auditor to review

I think the answer is B. Most important is configuration (D), but the very first thing IS auditor reviews must be standards (B).

I say A, by location they don't mean physical location. The FW should be placed the between public interface and private network. Location is key.

What is the purpose of reviewing configuration first when the firewall have been placed at the worng place? Of course when you audit a network security first thing you say to the the client you ask for the network topology to understand the how the devices are set up. When it comes to the MOST important I agree should be D.

ChatGPT Reviewing firewall standards (option B) is indeed an important aspect of auditing the security architecture of an online application. Firewall standards provide guidelines and best practices for configuring, managing, and monitoring firewalls, which are critical components of network security. By reviewing firewall standards first, an IS auditor can establish a baseline understanding of the organization's firewall requirements and expectations.

Answer: D

location comes first

When auditing the security architecture of an online application, the FIRST step for an IS auditor should be to review the firewall standards. These standards define the rules, policies, and configurations governing the firewall’s operation. By assessing compliance with established standards, the auditor can gain insights into the effectiveness of the firewall’s design and implementation.

Firewall Standard

It should be B

Surprise to see nobody talking about Firewall standard....I think it should be B. Based on standard only we can validate the configuration etc...

the key is online application

First, you need to review the firewall configuration, then you will have to determine whether this configuration is suitable to where the firewall was placed or not.

whatever reviewing that you are doing, it is useless if you dont know what should be taken care by that device. It is very important to understand the location, the deployment and the protection that device is taking care for the organization. Hence, location of firewall must be identified first before anything else.

SUPPORT A

I also vote for A because a firewall not connected to the Internet does not have the same risk as one that is connected to the Internet. This is because internal firewalls tend to be more permissive than external firewalls.