The correct answer is B. The last login to the user account was days after the last working date.
This is the greatest concern because it indicates the terminated employee's account may have remained active and may have been used after employment ended. That creates a direct risk of unauthorized access, data theft, fraud, sabotage, or misuse of organizational systems.
Option A is a concern because passwords should generally be subject to appropriate password controls, but it is less severe than evidence of post-termination account activity. Option C may indicate weak password management, but again it is not as serious as actual account use after termination. Option D is a governance weakness, but the strongest evidence of immediate risk is the login activity after the employee's last working date.
This maps to Protection of Information Assets because it relates to logical access control, identity and access management, and protection against unauthorized access. ISACA's CISA Exam Content Outline includes Domain 5, Protection of Information Assets, and the official outline includes identity and access management and information asset protection topics.
References: ISACA CISA Exam Content Outline, Domain 5; ISACA Interactive Glossary, access control and related control concepts.

The best answer is B. It provides a timeline and schedule for deploying new releases into production.
ISACA release and change guidance explains that successful deployment requires scrutiny over change and release, including scheduling, coordination among parties, and validation before implementation. That aligns directly with the role of a release plan: organizing when and how releases move into production.
Option A is more closely related to configuration management. Option C is too narrow because release plans cover much more than database integration. Option D is more closely associated with change evaluation and impact assessment before approval. The release plan's main function is the coordinated timeline and schedule for production rollout.
References (Official ISACA):
* ISACA Journal, Implementing Emerging Technologies
* ISACA Journal, Speeding Up Software Delivery With Effective Change Management

The best way to ensure payment transaction data is restricted to the appropriate users is implementing role- based access at the application level. Role-based access is a method of access control that assigns permissions or privileges to users based on their roles or functions within an organization or system. Role-based access can help ensure that payment transaction data is restricted to the appropriate users, by allowing only authorized users who have a legitimate need orpurpose to access or use the payment transaction data, and preventing unauthorized or unnecessary access or use by other users. Implementing two-factor authentication is a possible way to enhance the security and verification of user identities, but it is not the best way to ensure payment transaction data is restricted to the appropriate users, as it does not define what permissions or privileges users have on the payment transaction data. Restricting access to transactions using network security software is a possible way to protect the network communication and transmission of payment transaction data, but it is not the best way to ensure payment transaction data is restricted to the appropriate users, as it does not specify what actions or operations users can perform on the payment transaction data.
Using a single menu for sensitive application transactions is a possible way to simplify the user interface and navigation of payment transaction data, but it is not the best way to ensure payment transaction data is restricted to the appropriate users, as it does not limit what users can access or use the payment transaction data.

The primary factor to determine system criticality is the maximum allowable downtime (MAD), which is the maximum period of time that a system can be unavailable before causing significant damage or risk to the organization. TheMAD reflects the business impact and the recovery requirements of the system, and it can be used to prioritize the systems and allocate the resources for disaster recovery planning. The other options are not as important as the MAD, and they may vary depending on the system characteristics and the recovery strategy. The recovery point objective (RPO) is the maximum amount of data loss that is acceptable for a system. The mean time to restore (MTTR) is the average time required to restore a system after a failure. The key performance indicators (KPIs) are metrics that measure the performance and effectiveness of a system. References: CISA Review Manual (Digital Version) 1, page 468-469.