Integration testing is the best way to ensure that an application is performing according to its specifications, because it tests the interaction and compatibility of different modules or components of the application. Unit testing, pilot testing and system testing are also important, but they do not cover the whole functionality and integration of the application as well as integration testing does. References: CISA Review Manual (Digital Version)1, Chapter 4, Section 4.2.3

Access to the spreadsheet is given only to those who require access is the most important control for maintaining the security of data in the spreadsheet. An IS auditor should ensure that the principle of least privilege is applied to limit the access to sensitive financial data and prevent unauthorized disclosure, modification, or deletion. The other options are less important controls that may enhance the accuracy, availability, or integrity of data in the spreadsheet, but not its security. References:
CISA Review Manual (Digital Version), Chapter 6, Section 6.31
CISA Review Questions, Answers and Explanations Database, Question ID 210

When information processing is outsourced, the contract should explicitly require the service provider to comply with applicable legal and regulatory requirements. ISACA guidance on third-party risk and outsourcing consistently emphasizes that contracts must address legal obligations, compliance responsibilities, and regulatory expectations because the enterprise remains accountable for the data and services even when they are handled by a third party.
Option C is the best answer because legal compliance is broader and more fundamental than operational specifics such as backup procedures or security administration details. ISACA states that enterprises remain responsible for safeguarding sensitive information and complying with legal and regulatory requirements regardless of what the contract says or which third party processes the data. Therefore, an auditor should expect the contract to expressly address compliance with those requirements.
Option A may be included in many outsourcing contracts, especially for critical services, but backup and recovery processes are service-level or operational matters. They are important, yet not as fundamental as requiring compliance with legal obligations. If the contract fails to address legal compliance, the organization faces regulatory, liability, and governance exposure even if backups are adequate.
Option B is incorrect because audit objectives are normally defined by the auditor or audit plan, not by the outsourcing contract. The contract may include audit rights, access rights, reporting rights, or the right to inspect controls, but it would not typically define the auditor's objectives. ISACA outsourcing guidance highlights right-to-audit clauses rather than audit objectives as contract content.
Option D may also appear in the contract through security requirements, roles, and responsibilities, but it is narrower than legal compliance. Security administration processes matter, yet they are subordinate to the overarching requirement that outsourced processing comply with applicable law, regulation, and contractual obligations.
So, the strongest answer is C because an outsourced processing contract must specify compliance with legal requirements, which is a core expectation in ISACA's third-party governance and risk guidance.
References (Official ISACA):
ISACA Journal, A Risk-Based Management Approach to Third-Party Data Security Risk and Compliance - enterprises remain responsible for complying with legal and regulatory requirements even when using third parties.
ISACA Journal, Critical Information Systems Processes - contracts should include legal obligations and responsibilities.
ISACA Journal, Ensuring Vendor Compliance and Third-Party Risk Mitigation - contracts should include pertinent clauses for compliance requirements.
ISACA, Cloud Computing Evolution and Regulation in the Financial Services Industry - outsourcing arrangements should include audit and access rights in line with regulatory requirements.

The best answer is C.
ISACA's glossary defines DNS poisoning as a cyberattack that alters DNS records to redirect users to fraudulent websites. Since the attack mechanism is DNS manipulation, the strongest control among the choices is DNS server security hardening. That directly addresses the infrastructure being targeted.
Option A can reduce user susceptibility but does not directly prevent redirection attacks. Option B can help at the endpoint, but it does not address poisoned or compromised DNS infrastructure as directly as DNS hardening. Option D is designed mainly to protect web applications from HTTP-layer attacks, not to stop DNS-based traffic redirection.
References (Official ISACA):
* ISACA Glossary, Domain name system (DNS) poisoning.

Data loss can occur due to various reasons, such as accidental deletion, hardware failure, malware infection, theft, or unauthorized access. Data classification procedures can help to identify and protect sensitive data, but they are not sufficient to prevent data loss. The most effective way to protect against data loss is to conduct periodic security awareness training for employees, which can educate them on the importance of data security, the best practices for data handling and storage, and the common threats and risks to data.