The best recommendation to prevent unauthorized access to cloud-based applications and data is to implement multi-factor authentication (MFA). MFA is a method of verifying the identity of a user by requiring two or more pieces of evidence, such as a password, a code sent to a phone, or a biometric factor. MFA adds an extra layer of security to prevent unauthorized access, even if the user's password is compromised or stolen. MFA can also help comply with data privacy and security regulations, such as the General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA).
The other options are not as effective as MFA in preventing unauthorized access. An intrusion detection system (IDS) is a tool that monitors network traffic and alerts administrators of suspicious or malicious activity, but it does not prevent access by itself. Updating security policies and procedures is a good practice, but it does not ensure that users follow them or that they are enforced. Utilizing strong anti-malware controls on all computing devices can help protect against malware infections, but it does not prevent users from accessing cloud-based applications and data from any Internet-connected web browser.
References:
ISACA, CISA Review Manual, 27th Edition, 2019, p. 2471
ISACA, CISAReview Questions, Answers and ExplanationsDatabase - 12 Month Subscription2 What Is Cloud Security? | Google Cloud3
5 Cloud Application Security Best Practices | Snyk4

The correct answer is D. Create an interdisciplinary IT steering committee to oversee IT prioritization and spending.
The issue is not just poor documentation; it is weak IT governance. Projects are being managed informally and separately by isolated project managers. This indicates a lack of centralized prioritization, oversight, accountability, and alignment with business objectives. An interdisciplinary IT steering committee would help ensure that IT initiatives are reviewed, prioritized, funded, monitored, and aligned with enterprise strategy.
ISACA's glossary defines an IT steering committee as an executive-management-level committee that assists in delivering IT strategy, oversees day-to-day management of IT service delivery and IT projects, and focuses on implementation aspects. This directly addresses the problem described in the question.
Option A is too extreme. Stopping all projects could harm the organization and is not a mature governance response unless there is an immediate critical risk. Option B is weak because a follow-up audit only checks later whether improvement occurred; it does not create governance now. Option C may improve documentation, but a project management tool alone does not establish governance, prioritization, or business accountability.
This question maps to Governance and Management of IT because the concern is IT governance maturity, project oversight, prioritization, and spending. ISACA's CISA Exam Content Outline includes organizational structure, IT governance, IT strategy, IT resource management, and evaluation of IT project management alignment with organizational objectives.
References: ISACA CISA Exam Content Outline, Domain 2; ISACA Interactive Glossary, "IT steering committee."

An acceptable use policy (AUP) is a document that defines the rules and guidelines for using an organization' s IT resources, such as networks, devices, and software. It aims to protect the organization's assets, security, and productivity. An AUP should be formally acknowledged by users to ensure that they are aware of their responsibilities and obligations when using the IT resources. Without formal acknowledgment, users may not be held accountable for violating the AUP or may claim ignorance of the policy. This can expose the organization to legal, regulatory, reputational, or operational risks. Lack of data for measuring compliance, violation of industry standards, and noncompliance with documentation requirements are also possible risks from not having users acknowledge the AUP, but they are less significant than lack of user accountability. References: Workable: Acceptable use policy template, Wikipedia: Acceptable use policy

The concept of materiality is most important for an IS auditor to apply when planning an audit engagement, because it helps the auditor to determine the scope, objectives, procedures and resources of the audit.
Materiality is the degree to which an omission or misstatement of information could affect the users' decisions or the achievement of the audit objectives. By applying the concept of materiality, the auditor can focus on the most significant and relevant areas of the audit and avoid wasting time and effort on trivial or immaterial matters. The other options are not as important as planning an audit engagement, because they are either based on or affected by the materiality assessment done during the planning phase. References:
ISACA, CISA Review Manual, 27th Edition, chapter 1, section 1.31
ISACA, IT Audit and Assurance Standards, Guidelines and Tools and Techniques forIS Audit and Assurance Professionals, section 12022