nerdexam
Isaca

CISA · Question #72

Which of the following should be an IS auditor's GREATEST concern when assessing an IT service configuration database?

The correct answer is D. The database is write-accessible for all users.. The greatest concern for an IS auditor when assessing an IT service configuration database is widespread write-access, as it introduces severe risks to data integrity and system stability.

Submitted by rachelw· Apr 18, 2026Protection of Information Assets

Question

Which of the following should be an IS auditor’s GREATEST concern when assessing an IT service configuration database?

Options

  • AThe database is not encrypted at rest.
  • BThe database is read-accessible for all users.
  • CThe database is executable for all users.
  • DThe database is write-accessible for all users.

How the community answered

(32 responses)
  • A
    16% (5)
  • B
    6% (2)
  • C
    31% (10)
  • D
    47% (15)

Why each option

The greatest concern for an IS auditor when assessing an IT service configuration database is widespread write-access, as it introduces severe risks to data integrity and system stability.

AThe database is not encrypted at rest.

While a lack of encryption at rest is a security concern regarding data confidentiality, it does not pose as immediate a threat to the integrity and operational stability of the configuration data as unrestricted write access.

BThe database is read-accessible for all users.

Read-access for all users primarily raises concerns about information disclosure, which is a confidentiality issue, not directly impacting the integrity of the configuration database itself.

CThe database is executable for all users.

A database file being 'executable' for all users is an unusual and typically incorrect description; database files themselves are data stores, not executables, so this is not a primary or relevant concern.

DThe database is write-accessible for all users.Correct

If an IT service configuration database is write-accessible for all users, it significantly increases the risk of unauthorized or accidental changes, leading to system misconfigurations, service outages, and potential security vulnerabilities due to compromised data integrity.

Concept tested: Data integrity and access control

Source: https://docs.microsoft.com/en-us/azure/architecture/framework/security/design-identity-access

Topics

#Configuration Management#Access Control#Information Integrity#Risk Assessment

Community Discussion

No community discussion yet for this question.

Full CISA Practice