Isaca Exam CISA Topic 8 Question 96 Discussion

Comprehensive and Detailed Step-by-Step Explanation:

Conducting vulnerability assessments only once per year, right before an audit, creates a false sense of security and leaves systems exposed between assessments.

Annual Testing Before Audit (Correct Answer -- A)

Risks undetected vulnerabilities for extended periods.

Example: A company only tests security before a compliance audit, allowing zero-day threats to persist for months.

Internal Team Conducting Assessments (Incorrect -- B)

Not ideal, but regular assessments are more critical.

Focusing on Critical Systems (Incorrect -- C)

Not perfect, but better than no testing at all.

Using Open-Source Tools (Incorrect -- D)

Open-source tools can be effective if properly configured.

References:

ISACA CISA Review Manual

NIST 800-115 (Technical Guide to Security Testing)