Exam CISA topic 1 question 982 discussion

The correct answer is D, Implement an automated control to prevent deployment if the developer is also trying to deploy the change. In this scenario, the IS auditor has identified a segregation of duties concern, which is a principle that is intended to ensure that no single individual has complete control over a process or system. By having both production and developer access, the DevOps team may be able to both develop and deploy changes to the organization's systems, potentially leading to conflicts of interest or the potential for fraud or abuse. To address this concern, the auditor's best recommendation would be to implement an automated control that prevents deployment if the developer is also trying to deploy the change. This would ensure that there is a separation between the development and deployment of changes, and it would help to reduce the risk of potential conflicts of interest or abuse.

Option D, "Implement automated controls to prevent deployment if developers are also trying to deploy changes," is generally considered a good security measure, but is not directly a specific audit measure for the specific issue. Also, it is not necessary to completely prevent developers from deploying changes, but appropriate management and audit mechanisms are important. Therefore, the auditor should recommend weekly management reviews aimed at ensuring separation of duties.

The best recommendation in this situation is to implement a periodic reauthorization process for DevOps engineers' access to production systems. Option B suggests reauthorizing access quarterly, allowing the head of IT operations to periodically review and confirm the necessity of the access. This approach provides a balance between the need for access and the segregation of duties concerns. It acknowledges the necessity of both types of access for the DevOps team but introduces a control mechanism to regularly review and validate that access is still appropriate. This helps mitigate the risk associated with the potential conflict of duties. Option B is generally considered a more practical and balanced approach to managing the segregation of duties concern in DevOps environments. It introduces a control without completely restricting necessary access, allowing for ongoing operational efficiency while maintaining a level of oversight.

Answer D ı guess