Failure torevoke access upon terminationposes the greatest security risk, as ex-employees could still access sensitive data or systems.
No Policy to Revoke Access (Correct Answer - A)
A terminated employee retaining access can lead todata breaches or insider threats.
Example:A former employee misuses active credentials to access financial systems.
Lack of Security Awareness Training (Incorrect - B)
Important but does not pose an immediate security risk like an active ex-employee account.
No NDAs (Incorrect - C)
Protects intellectual property but is not as critical as system access.
No Access Revocation for Role Changes (Incorrect - D)
Still a concern, but ex-employees with active access are ahigherrisk.
References:
ISACA CISA Review Manual
NIST 800-53 (Access Control)

The most effective method for positive authentication for physical access is a retina scan because it uses a biometric characteristic that is strongly tied to the individual and difficult to share, transfer, or replicate compared with cards, codes, or visual checks. ISACA materials discussing physical access and identity verification recognize biometrics such as retina scans as a high-assurance authentication mechanism.
Option B is correct because positive authentication means reliably confirming that the person presenting for access is truly the claimed individual. A retina scan verifies "something you are," which is generally stronger than "something you have" or "something you know" for physical access authentication.
Option A is weaker because a proximity card is only possession-based authentication. It can be lost, borrowed, stolen, or shared, so it does not positively verify identity to the same degree as biometrics. This makes it less effective than a retina scan.
Option C is also weaker. A numeric keypad depends on a code that can be disclosed or observed, and a surveillance camera is more detective than authentication-focused. Together they do not provide the same strong identity binding as biometrics.
Option D improves assurance somewhat, but a smart card is still possession-based and a security guard's judgment can be fallible. Human verification helps, but it does not usually match the direct individual-specific certainty of biometric authentication.
Therefore, B is the best answer because a retina scan most effectively provides positive authentication by directly verifying an individual's unique biometric characteristic.
References (Official ISACA):
* ISACA Journal, Against the Quantum Threat: Selective Compatibility - references retina and palm print scans being confirmed at each use to prevent identity theft.
* ISACA News and Trends biometric authentication resources index.

During the second year of the ERP system upgrade project, the focus shifts to ensuring that the updated business processes integrate seamlessly with the new system functionality. User acceptance testing (UAT) validates that the system meets user requirements and business objectives.
* Data Migration (Option A):Data migration is more relevant in the first phase when upgrading the system version.
* Sociability Testing (Option B):This is less critical than confirming user functionality for process changes.
* Initial User Access Provisioning (Option D):This is part of security and access controls but not the primary focus of business process validation.
Reference:ISACA CISA Review Manual, Job Practice Area 3: Information Systems Operations and Business Resilience.

The best way for the auditor to address this issue is to verify management has approved a policy exception to accept the risk. A policy exception is a formal authorization that allows a deviation from the established policy requirements for a specific situation or period of time. A policy exception should be based on a risk assessment that evaluates the impact and likelihood of the potential threats and vulnerabilities, as well as the cost and benefit of the alternative controls. A policy exception should also be documented, approved, and monitored by management.
Recommending the application be patched to meet requirements is not the best way for the auditor to address this issue. Patching the application may not be feasible, cost-effective, or timely, given that the application will be decommissioned in three months. Patching the application may also introduce new risks or errors that could affect the functionality or performance of the application.
Informing the IT director of the policy noncompliance is not the best way for the auditor to address this issue.
Informing the IT director of the policy noncompliance may not resolve the issue or mitigate the risk, especially if the IT director is already aware of the situation and has decided to accept it. Informing the IT director of the policy noncompliance may also create unnecessary conflict or tension between the auditor and the auditee.
Taking no action since the application will be decommissioned in three months is not the best way for the auditor to address this issue. Taking no action may expose the organization to significant risks or consequences, such as data breaches, regulatory fines, or reputational damage, if the application is compromised or exploited by malicious actors. Taking no action may also violate the auditor's professional standards and responsibilities, such as due care, objectivity, and reporting.
References:
ISACA, CISA Review Manual, 27th Edition, 2019, p. 289
ISACA, CISA Review Questions, Answers and Explanations Database - 12 Month Subscription Cybersecurity Engineering for Legacy Systems: 6 Recommendations - SEI Blog How to Secure Your Company's Legacy Applications - iCorps