Certified Information Systems Auditor (CISA) — Question 428

During audit fieldwork, an IS auditor learns that employees are allowed to connect their personal devices to company-owned computers. How can the auditor
BEST validate that appropriate security controls are in place to prevent data loss?

Answer options

• A. Verify the data loss prevention (DLP) tool is properly configured by the organization.
• B. Review compliance with data loss and applicable mobile device user acceptance policies.
• C. Verify employees have received appropriate mobile device security awareness training.
• D. Conduct a walk-through to view results of an employee plugging in a device to transfer confidential data.

Correct answer: A

Explanation

The correct answer is A because validating the configuration of the data loss prevention (DLP) tool directly assesses the control measures in place to prevent data loss. Options B and C focus on policy compliance and training, which are important but do not directly validate the effectiveness of the security controls. Option D is not a proactive measure and merely observes behavior rather than confirming security controls.