Certified Information Systems Auditor (CISA) — Question 1202
An audit identified weak password controls in a database system. Which of the following provides the BEST evidence that the audit finding has been remediated?
Answer options
- A. Observation of updated password settings with database administrators (DBAs)
- B. Review of database administrator (DBA) procedures
- C. Attestation from database administrators (DBAs) that password settings have been updated
- D. Interviews with management about remediation completion
Correct answer: A
Explanation
The correct answer is A because direct observation of updated password settings confirms that changes have been made in real-time by the database administrators. Options B and C rely on documentation or self-reports which may not reflect actual implementation, while D involves management's perspective, which does not provide direct evidence of the changes made.