The best source ofinformation for examining the classification of new data is the risk assessment results, because they provide an objective and consistent basis for determining the value, sensitivity, and criticality of the data, as well as the potential impact of unauthorized disclosure, modification, or loss of the data12. The risk assessment results can help to definethe appropriate classification levels and criteria for the data, such as public, internal, confidential, or restricted12. Input by data custodians, security policy requirements, and current levelof protection are not the best sources of information for examining the classification of new data, because they may not reflect the actual risk exposure or business needs of the data. References: 1: CISA Review Manual (Digital Version), Chapter 5, Section5.4.2 2: CISA Online Review Course, Module 5, Lesson
4

The best answer is C. Periodically restoring backup media for key databases.
ISACA guidance is very clear that backup restoration should be tested periodically. A backup is only useful if it can actually be restored successfully within business needs. Organizations sometimes assume that because backups exist, recovery is assured, but ISACA specifically warns that recovery procedures and restoration capability must be tested.
Option A is important for resilience, but offsite storage does not prove the backup is recoverable. Option B helps administration and tracking, but inventory alone does not validate restorability. Option D protects confidentiality of backup data, but it does not ensure successful recovery. The strongest control for recoverability is periodic test restoration.
References (Official ISACA):
ISACA, Ensuring Data Security: The Importance of Cloud Backups and Drill Testing ISACA Journal, Governance of Key Aspects of System Patch Management - recommends periodic testing of backup restoration.
ISACA Journal, IS Audit Basics: Backup and Recovery

A governing body monitors IT performance most effectively when IT performance metrics are aligned with business goals. ISACA's COBIT-based governance guidance consistently emphasizes that metrics should help leadership and governing bodies monitor the achievement of enterprise business goals and related IT goals. Metrics are useful for governance only when they are connected to what the enterprise is trying to achieve.
Option D is correct because a governing body is responsible for oversight at the strategic level. Strategic oversight depends on understanding whether IT is supporting business objectives, not just whether technical measures are being collected. ISACA states that metrics help management monitor achievements of business- related and IT-related goals.
Option A is useful at an operational or service management level, but it is narrower than business alignment.
Service delivery objectives matter, yet the governing body's concern is broader enterprise value and strategic alignment.
Option B is not the best answer because manufacturer recommendations may help establish technical asset baselines, but they do not ensure metrics support governance needs or enterprise performance oversight.
Option C is attractive because automated, quantitative data improves reliability and efficiency, but automation alone does not guarantee the metrics are the right ones. Governance requires relevant metrics tied to business outcomes, not just easily measured data.
Therefore, D is the best answer because proper alignment between business goals and IT performance metrics is what most enables a governing body to monitor IT performance meaningfully.
References (Official ISACA):
ISACA Journal, Performance Measurement Metrics for IT Governance - metrics help management monitor achievement of business-related and IT-related goals.
ISACA Journal, How to Construct a Governance System From the Board Level to the Code Level - enterprise goals are cascaded into IT alignment goals, metrics and results.
ISACA, Charting the Course of IT Governance - performance measurement involves defining and monitoring KPIs for IT and communicating performance to stakeholders.
ISACA, Seven Key Features, Lessons and Tips From a COBIT Journey of 27 Years - COBIT uses goals, metrics and capabilities at enterprise and IT levels.

Continuous auditing is a method of performing audit-related activities on a real-time or near real-time basis.
Continuous auditing is best suited for real-time transactions, such as online banking, e-commerce, or electronic funds transfer, that require immediate verification and assurance. Low-value transactions are not necessarily suitable for continuous auditing, as they may not pose significant risks or require frequent monitoring. Irregular transactions are not suitable for continuous auditing, as they may not occur frequently or consistently enough to justify the use of continuous auditing techniques. Manual transactions are not suitable for continuous auditing, as they may not be captured or processed by automated systems that enable continuous auditing. References:
CISA Review Manual, 27th Edition, pages 307-3081
CISA Review Questions, Answers and Explanations Database, Question ID: 253

The best control for detecting unauthorized data changes in an IT organization where many responsibilities are shared is to have data changes independently reviewed by another group. This is because an independent review can provide an objective and unbiased verification of the data changes and ensure that they are authorized, accurate, and complete. An independent review can also help to detect any errors, fraud, or malicious activities that may have occurred during the data changes. An independent review can also provide assurance that the data integrity and security are maintained. References:
CISA Review Manual (Digital Version), Chapter 4, Section 4.31
CISA Online Review Course, Domain 1, Module 4, Lesson 22