An IS auditor reviewing an information processing environment decides to conduct external penetration testing.

Vendor: Isaca
Product: CISA
Update on: Jul 25, 2025
Questions: 1407

Isaca CISA Question Answer

An IS auditor reviewing an information processing environment decides to conduct external penetration testing. Which of the following is MOST appropriate to include in the audit scope for the organization to distinguish between the auditor's penetration attacks and actual attacks?

Restricted host IP addresses of simulated attacks

Testing techniques of simulated attacks

Source IP addresses of simulated attacks

Timing of simulated attacks