Control self-assessment (CSA) is a process that allows business units to evaluate the effectiveness of internal controls. It is primarily used toestablish baselines(Option B) for measuring control effectiveness and risk management.
ISACA CISA Reference:CSA is a recognized internal control mechanism that supports risk assessment and control improvement.
Risk Implication:If CSAs are not conducted properly, organizations may lack visibility into weak controls, increasing exposure to risks.
Alternative Choices:
Option A:CSA does not focus on asset valuation.
Option C:Strategic business goals are assessed separately through governance processes.
Option D:CSA complements, but does not replace, formal audits.

Quantum algorithms, such as Shor's algorithm, can factor large prime numbers exponentially faster than classical computers, threatening the security of RSA and elliptic-curve cryptography. Similarly, Grover's algorithm reduces the effective strength of symmetric key algorithms by half, requiring larger key sizes.
While post-quantum cryptography is being developed, current algorithms may become obsolete once practical quantum computers exist. Options B, C, and D are incorrect because quantum does not inherently improve encryption, nor is training the key issue-it is the fundamental breakage of cryptographic assumptions.
References (ISACA): ISACA Journal - Cryptographic Risks and Quantum Computing; CISA Review Manual, Cryptography.

Maximum Tolerable Outage (MTO) (A) defines the longest time an organization can tolerate an IT service being unavailable before significant business impact occurs. It determines business continuity planning and disaster recovery strategies.
Other options:
RPO (B) defines acceptable data loss but does not determine the total outage limit.
SDO (C) is related to service agreements but does not set the risk threshold.
AIW (D) is similar to MTO but is not as commonly used in disaster recovery planning.
Reference: ISACA CISA Review Manual, Information Systems Operations and Business Resilience

Failure torevoke access upon terminationposes the greatest security risk, as ex-employees could still access sensitive data or systems.
No Policy to Revoke Access (Correct Answer - A)
A terminated employee retaining access can lead todata breaches or insider threats.
Example:A former employee misuses active credentials to access financial systems.
Lack of Security Awareness Training (Incorrect - B)
Important but does not pose an immediate security risk like an active ex-employee account.
No NDAs (Incorrect - C)
Protects intellectual property but is not as critical as system access.
No Access Revocation for Role Changes (Incorrect - D)
Still a concern, but ex-employees with active access are ahigherrisk.
References:
ISACA CISA Review Manual
NIST 800-53 (Access Control)

The best recommendation to include in an organization's bring your own device (BYOD) policy to help prevent data leakage is to require multi-factor authentication on BYOD devices. BYOD is a practice that allows employees to use their own personal devices, such as smartphones, tablets, or laptops, to access the organization's network, data, and systems. Data leakage is a risk that involves the unauthorized or accidental disclosure or transfer of sensitive or confidential data from the organization to external parties or devices.
Multi-factor authentication is a security measure that requires users to provide two or more pieces of evidence to verify their identity and access rights, such as passwords, tokens, biometrics, or codes. Multi-factor authentication can help prevent data leakage by reducing the likelihood of unauthorized access to the organization's data and systems throughBYOD devices, especially if they are lost, stolen, or compromised. The other options are not as effective as requiring multi-factor authentication on BYOD devices, because they either do not prevent data leakage directly, or they are reactive rather than proactive measures. References: CISA Review Manual (Digital Version)1, Chapter 5, Section 5.2.3