The correct answer is D. The organization's systems inventory is kept up to date.
The completeness of vulnerability scanning depends first on whether the organization knows all systems that should be scanned. If the inventory is incomplete or outdated, some servers, endpoints, databases, cloud assets, applications, or network devices may be excluded from scanning. This creates a false sense of security because the vulnerability scan may appear successful while critical assets were never assessed.
A current inventory supports scan coverage, scope definition, vulnerability ownership, remediation tracking, and risk prioritization. ISACA's CISA Exam Content Outline includes threat and vulnerability management, information asset security, network and endpoint security, and security testing tools and techniques under the protection of information assets area.
Option A is important for access control over the scanning tool, but it does not prove the scan included all relevant systems. Option B is useful for governance and reporting, but reporting results to the CISO does not prove completeness. Option C is not relevant because whether the scanning tool is cloud-hosted or on- premises does not determine whether the full environment is scanned.
References: ISACA CISA Exam Content Outline, Domain 5; ISACA Interactive Glossary, "Vulnerability scanning" and "Vulnerability management."

The correct answer is B. Discuss the concern with audit management.
When an employee reports a critical security concern to an IS auditor, the auditor should first discuss the matter with audit management. This ensures the concern is handled through the proper audit reporting and escalation process. Audit management can help determine whether the issue is within audit scope, whether immediate escalation is needed, whether a special review should be authorized, and whether legal, compliance, security, or executive management should be involved.
Option A is not correct because recommending a rollback is a management decision. The auditor should not directly decide or recommend operational action without proper evaluation and authorization. Option C may become appropriate later, but the auditor should not independently begin an application review without audit management's awareness and approval. Option D may be required if legal implications exist, but the auditor should not go directly to legal counsel before following the audit escalation process unless required by policy or law.
This question maps to Information Systems Auditing Process because it concerns audit communication, escalation, auditor responsibility, and handling audit-relevant information. ISACA's CISA Exam Content Outline includes IS audit standards, audit planning, audit evidence, audit reporting, and communication of audit results under Domain 1.
References: ISACA CISA Exam Content Outline, Domain 1; ISACA audit communication and escalation principles.

The absence of a right-to-audit clause in the outsourcing contract for a cloud service provider would be of greatest concern to an IS auditor1. This clause gives the client the right to audit the service provider's activities that are relevant to the services being provided1. It is crucial for ensuringthat the service provider is complying with the terms of the contract and meeting the client's standards for performance, security, and other aspects1. Without this clause, the client may not be able to effectively monitor and manage risks associated with the outsourcing arrangement1.
References:
Audit rights in outsourcing: certifications and third party reports

File transfer protocol (FTP) is a service that allows users to transfer files between computers over a network.
If enabled within firewall rules, FTP would present the greatest risk, as it can expose sensitive data to unauthorized access, modification, or deletion. FTP does not provide encryption or authentication, which makes it vulnerable to eavesdropping, spoofing, and tampering attacks. Simple mail transfer protocol (SMTP), simple object access protocol (SOAP), and hypertext transfer protocol (HTTP) are also services that can be used to exchange data over a network, but they have more security features than FTP, such as encryption, authentication, or validation. References: CISA Review Manual (Digital Version)