Exam CISA Topic 5 Question 752 Discussion

Actual exam question for ISACA's CISA exam
Question #: 752
Topic #: 5
An organization has implemented a new data classification scheme and asks the IS auditor to evaluate its effectiveness. Which of the following would be of GREATEST concern to the auditor?

Suggested Answer: D Vote an answer

by shery.aj89 at Aug 14, 2025, 04:59 AM

Limited Time Offer

15%

Off

Get Premium CISA Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
shery.aj89
2025-08-14 04:59:13
Selected Answer: A
In a data classification scheme, access decisions should be based on predefined classification rules and policies, not solely on individual manager discretion.

Allowing end-user managers to decide access on their own introduces inconsistency, bias, and potential security gaps, undermining the purpose of a standardized classification program.

B (many classification categories) may create complexity but is not as high-risk as inconsistent access control.

C (compliance manager decides classification) is less than ideal — classification should be done by data owners — but it’s not as critical as uncontrolled access.

D (classifying most data as confidential) can cause inefficiencies but does not inherently weaken security as much as giving arbitrary access rights.
upvoted 1 times
...
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10