The most effective control to protect information assets in a data center from theft by a vendor is to monitor and restrict vendor activities. A vendor may have legitimate access to the data center for maintenance or support purposes, but they may also have malicious intentions or be compromised by an attacker. By monitoring and restricting vendor activities, the organization can ensure that the vendor only performs authorized tasks and does not access or tamper with sensitive data or equipment. Issuing an access card to the vendor, concealing data devices and information labels, and restricting use of portable and wireless devices are also useful controls, but they are not as effective as monitoring and restricting vendor activities in preventing theft by a vendor. References:
CISA Review Manual, 27th Edition, page 3381
CISA Review Questions,Answers and Explanations Database - 12 Month Subscription

The business owner is the person or entity that has the authority and responsibility for defining the purpose and scope of the processing of personal data, as well as the expected outcomes and benefits. The business owner is also accountable for ensuring that the processing of personal data complies with the applicable laws and regulations, such as the General Data Protection Regulation (GDPR) or the Data Protection Act 2018 (DPA 2018).
One of the requirements of the GDPR and the DPA 2018 is to adhere to the principle of storage limitation, which states that personal data should be kept for no longer than is necessary for the purposes for which it is processed1. This means that the business owner should determine and justify how long they need to retain personal data, based on factors such as:
The nature and sensitivity of the personal data
The legal or contractual obligations or rights that apply to the personal data The business or operational needs and expectations that depend on the personal data The risks and impacts that may arise from retaining or deleting the personal data The business owner should also establish and document the conditions and methods for the destruction of personal data, such as:
The criteria and triggers for deciding when to destroy personal data
The procedures and tools for securely erasing or anonymising personal data The roles and responsibilities for carrying out and overseeing the destruction of personal data The records and reports for verifying and evidencing the destruction of personal data Therefore, retention periods and conditions for the destruction of personal data should be determined by the business owner, as they are in charge of defining and managing the processing of personal data, as well as ensuring its compliance with the law.

The correct answer is A. It acts as a measuring tool and progress indicator.
The primary benefit of periodic maturity model assessments is that they allow the organization to measure its current level of capability or maturity and compare progress over time. This helps management understand whether processes are improving, staying the same, or declining.
ISACA explains that COBIT performance management evaluates how well governance and management systems work and how they can be improved to achieve target levels of process and practice capability and maturity. ISACA also describes maturity models as methods based on measuring progress through predefined levels of increasing maturity.
Option B is not the best answer because a maturity assessment may identify weaknesses, but it does not automatically fix them. Option C is related, because maturity assessment results may support an improvement plan, but execution of the plan is not the primary benefit of the assessment itself. Option D is too broad; maturity assessments may support consistency and improvement, but their primary value is measurement and progress tracking.
This question maps mainly to Governance and Management of IT, because maturity assessment supports governance, performance monitoring, process improvement, and management oversight.
References: ISACA CISA Exam Content Outline, Domain 2; ISACA COBIT performance management and maturity model guidance.

The primary benefit of using a dry-pipe fire-suppression system rather than a wet-pipe system is that a dry- pipe system has a decreased risk of leakage, as the pipes are filled with pressurized air or nitrogen instead of water until the system is activated. A wet-pipe system has a higher risk of leakage, corrosion, and freezing. A dry-pipe system is not more effective at suppressing flames, as it uses the same water-based suppressant as a wet-pipe system. A dry-pipe system does not allow more time to abort release of the suppressant, as it has a delay of only a few seconds before the water is released. A dry-pipe system does not disperse dry chemical suppressants exclusively, as it uses water as the primary suppressant. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.2.3