The best metric to measure the alignment of IT and business strategy is the percentage of enterprise risk assessments that include IT-related risk. This metric indicates how well the organization identifies and manages the IT risks that could affect its strategic objectives and performance. A high percentage of enterprise risk assessments that include IT-related risk shows that the organization considers IT as an integral part of its business strategy and aligns its IT resources and capabilities with its business needs and goals
. References: : CISA Review Manual (Digital Version), Chapter 2: Governance and Management of IT, Section 2.2: IT Strategy, page 67 : CISA Online Review Course, Module 2: Governance and Management of IT, Lesson 2.2: IT Strategy

Decreased time for incident resolution is the best indicator that an incident management process is effective.
Incident management is a process that aims to restore normal service operation as quickly as possible after an incident, which is an unplanned interruption or reduction in quality of an IT service. Decreased time for incident resolution means that the incident management process is able to identify, analyze, respond to, and resolve incidents efficiently and effectively. The other indicators do not necessarily reflect the effectiveness of the incident management process, as they may depend on other factors such as the nature, frequency, and severity of incidents. References: CISA Review Manual, 27th Edition, page 372

Restricting program functionality according to user security profiles is the best control for ensuring appropriate segregation of duties within an accounts payable department. An IS auditor should verify that the access rights and permissions of the accounts payable staff are based on their roles and responsibilities, and that they are not able to perform incompatible or conflicting functions such as creating, approving, or paying invoices. This will help to prevent fraud, errors, or abuse of authority within the accounts payable process.
The other options are less effective controls for ensuring segregation of duties, as they may involve audit trails, access restrictions, or user identification. References:
* CISA Review Manual (Digital Version), Chapter 6, Section 6.31
* CISA Review Questions, Answers & Explanations Database, Question ID 223

Comprehensive and Detailed Step-by-Step Explanation:
Wireless security relies onstrong encryptionto prevent unauthorized access and data interception.
* Option A (Correct):WPA3is thelatest and most secureWi-Fi encryption standard, offeringstronger protectionagainst brute-force attacks and improvingkey management.
* Option B (Incorrect):DES is outdatedand vulnerable tomodern attacks, making it unsuitable for wireless security.
* Option C (Incorrect):WEP is highly insecuredue toweak encryptionand can be cracked inminutesusing basic tools.
* Option D (Incorrect):SSL secures web traffic, notwireless networks.
Reference:ISACA CISA Review Manual -Domain 5: Protection of Information Assets- Coverswireless security, encryption, and network security best practices.