The correct answer is D. Recovery point objective (RPO) because the issue is related to data loss or data inconsistency after recovery, not simply the time taken to restore the database. RPO defines the point in time to which data must be recoverable after an outage or disruption. In practical terms, it answers: "How much data can the business afford to lose?" ISACA's contingency planning guidance explains that RPO represents the point in time prior to disruption to which business data can be recovered using the most recent backup, and it is directly related to the amount of data loss the business can tolerate.
The organization restored from the most recent available backup, but customers are reporting discrepancies.
This suggests the backup/recovery strategy may not meet the organization's acceptable data-loss requirement.
For example, if the business can tolerate losing only 15 minutes of transactions but backups are taken every
24 hours, recovered customer data may be outdated or incomplete. That is an RPO failure.
Option A is not the best answer because an SLA defines agreed service expectations, but the immediate audit concern is whether the backup point met the required data recovery point. Option B is not the best answer because MTO, also commonly discussed as maximum tolerable downtime, relates to the maximum outage period the business can tolerate, not the point to which data must be restored. Option C is not the best answer because RTO focuses on how quickly a system must be restored, while this case is about the correctness and completeness of recovered data.
This question maps mainly to Information Systems Operations and Business Resilience, because ISACA's CISA Exam Content Outline includes Database Management, Data Backup, Storage, and Restoration, Business Continuity Plan, and Disaster Recovery Plans under Domain 4.
References: ISACA CISA Exam Content Outline, Domain 4; ISACA Journal, Information System Contingency Planning Guidance.

The best answer is A. To ensure the appropriate level of protection to assets.
ISACA guidance explains that asset categorization indicates the level of concern that should be given to an asset, and that identifying and classifying critical assets is done to avoid adverse effects from theft, loss, compromise, or misuse. In other words, classification tells the organization how much protection a given asset requires.
Option B may be a by-product, but alignment to standards is not the primary reason. Option C is broader than the specific purpose of classification. Option D may follow from classification, but classification is primarily about matching protection strength to asset importance and sensitivity.
References (Official ISACA):
ISACA Journal, IT Asset Valuation, Risk Assessment and Control Implementation Model ISACA Journal, Effective Reporting to the BoD on Critical Assets

The best answer is A. Using automated tools to collect logs and raise alerts based on use cases.
ISACA's log management guidance emphasizes building log management programs that use automated collection, correlation, and alerting driven by defined use cases. It specifically discusses configuring use cases and alerts so that relevant events generate actionable alerts. This creates value by improving detection, response speed, and operational visibility at scale.
Option B. Reporting results to senior management can be useful, but that is more about governance reporting than day-to-day monitoring and management.
Option C. Selecting logs only from critical systems may reduce volume, but by itself it does not provide the active monitoring and alerting needed to create operational value.
Option D. Encrypting logs before archiving protects confidentiality and integrity, but it does not best help monitor and manage logs in an operational sense.
Therefore, A is the correct answer because automated log collection and alerting based on defined use cases is the most effective way to turn operational logs into actionable organizational value.
References (Official ISACA):
ISACA Journal, Log Management as an Enabler for Data Protection and Automated Threat Detection.
ISACA Journal, A Framework for SIEM Implementation.
ISACA, Securing Artificial Intelligence: Opportunities and Challenges.

An IS auditor's primary concern would be whether the recovery site devices can handle the storage requirements. The storage requirements are determined by the amount and type of data that needs to be backed up and restored in case of a disaster at the primary data center. The recovery site devices should have enough capacity, performance, reliability, and compatibility to meet these requirements.
If the recovery site devices cannot handle the storage requirements, then there is a risk that some data may not be backed up properly or may not be available for recovery when needed. This couldresult in data loss, corruption, or inconsistency, which could affect the business continuity and integrity of the organization.
Therefore, an IS auditor should verify that:
The recovery site devices have sufficient storage space to accommodate all the data that needs to be backed up from the primary data center.
The recovery site devices have adequate bandwidth and speed to transfer and access data efficiently and effectively.
The recovery site devices have appropriate security features and controls to protect data from unauthorized access or modification.
The recovery site devices are compatible with the primary data center devices in terms of hardware, software, format, and protocol.
References:
10: What Is a Disaster Recovery Site? Hot, Cold and Warm Site
11: Disaster recovery site - What is the ideal distance to mitigate risks? - Advisera
12: Offsite Data Backup Storage vs Disaster Recovery (DR) - LINBIT

The best method to safeguard data on an organization's laptop computers is full disk encryption. Full disk encryption is a technique that encrypts all the data stored on a harddrive, including the operating system, applications, files, and folders. This means that if the laptop is lost, stolen, or accessed by an unauthorized person, they will not be able to read or modify any data without knowing the encryption key or password. Full disk encryption provides a strong level of protection for data at rest, as it prevents data leakage or exposure in case of physical theft or loss of the device.
References:
How to Protect theData on Your Laptop
6 Steps to Practice Strong Laptop Security