The best way to detect that a distributed denial of service (DDoS) attack is occurring is to use automated monitoring of logs. A DDoS attack disrupts the operations of a server, service, or network byflooding it with unwanted Internet traffic2. Automated monitoring of logs can help pinpoint potentialDDoS attacks by analyzing network traffic patterns, monitoring traffic spikes or other unusual activity, and alertingadministrators or security teams of any anomalies or malicious requests, protocols, or IP blocks3.
Automated monitoring of logs can also help identify the source, type, and impact of the DDoS attack, and provide evidence for further investigation or mitigation.
The other options are not as effective as automated monitoring of logs for detecting DDoS attacks. Customer service complaints are an indirect and delayed indicator of a DDoS attack, as they rely onusers reporting problems with accessing a website or service. Customer service complaints may also be caused by other factors unrelated to DDoS attacks, such as server errors or network issues. Server crashes are an extreme and undesirable indicator of a DDoS attack, as they indicate that the server has already been overwhelmed by the attack and has stopped functioning. Server crashes may also result in data loss or corruption, service disruption, or reputational damage. Penetration testing is a proactive and preventive measure for assessing the security posture of a system or network, but it does not detect ongoing DDoS attacks. Penetration testing may involve simulating DDoS attacks to test the resilience or vulnerability of a system or network, but it does not monitor real-time traffic or identify actual attackers.
References:
* ISACA CISA Review Manual 27th Edition (2019), page 254
* How to prevent DDoS attacks | Methods and tools | Cloudflare2
* Understanding Denial-of-Service Attacks | CISA3

The best answer is B. End users are able to create their own cloud server instances.
The biggest concern is uncontrolled provisioning, because allowing end users to create their own server instances can bypass governance, security baselines, cost controls, asset management, and monitoring.
ISACA's cloud and auditable security guidance emphasizes the importance of strong governance, control over misconfigurations, and consistent security baselines in cloud environments. Unrestricted self-provisioning significantly increases the risk of shadow IT and insecure deployments.
Option A is usually a normal protective arrangement. Option C can be appropriate depending on design and identity strategy. Option D is a governance weakness, but it is less immediate than uncontrolled creation of cloud infrastructure by end users. In audit terms, uncontrolled server creation directly threatens configuration, access control, and accountability.
References (Official ISACA):
ISACA, Best Practices for Auditable Security Controls
ISACA, The Role of Digital Transformation Audits

An audit report of the controls by the service provider's external auditor provides the best evidence that a third-party service provider's information security controls are effective. An external auditor is an independent and objective party that can assess the design and operating effectiveness of the service provider' s information security controls based on established standards and criteria. An external auditor can also provide an opinion on the adequacy and compliance of the service provider's information security controls, as well as recommendations for improvement.
Documentation of the service provider's security configuration controls is a source of evidence that a third- party service provider's information security controls are effective, but it is not the best evidence.
Documentation of the security configuration controls can show the settings and parameters of the service provider's information systems and networks, but it may not reflect the actual implementation and operation of the controls. Documentation of the security configuration controls may also be outdated, incomplete, or inaccurate.
An interview with the service provider's information security officer is a source of evidence that a third-party service provider's information security controls are effective, but it is not the best evidence. An interview with the information security officer can provide insights into the service provider's information security strategy, policies, and procedures, but it may not verify the actual performance and compliance of the information security controls. An interview with the information security officer may also be biased, subjective, or misleading.
A review of the service provider's policies and procedures is a source of evidence that a third-party service provider's information security controls are effective, but it is not the best evidence. A review of the policies and procedures can show the service provider's information security objectives, requirements, and guidelines, but it may not demonstrate the actual execution and enforcement of the information security controls. A review of the policies and procedures may also be insufficient, inconsistent, or outdated.
References:
ISACA, CISA Review Manual, 27th Edition, 2019, p. 284
ISACA, CISA Review Questions, Answers and Explanations Database - 12 Month Subscription

The correct answer is A. Engage a third party to conduct regular quality assurance (QA) reviews.
The most effective way to validate that IS audit quality is maintained is to have an independent third party perform regular QA reviews. Independent QA reviews provide objective assurance that audit work follows applicable standards, uses appropriate methodology, maintains sufficient evidence, supports conclusions, and meets quality expectations.
Option B is not the best answer because CSAs are performed with management to assess controls; they do not independently validate audit quality. Option C may help monitor internal audit activity, but a dashboard is only a reporting tool and does not independently validate quality. Option D may encourage individual performance, but annual staff evaluations are not as objective or comprehensive as independent QA reviews.
This maps to Information Systems Auditing Process , because ISACA's CISA Exam Content Outline includes IS audit standards, guidelines, functions, codes of ethics, audit project management, reporting, and quality of audit work under Domain 1. ( ISACA ) References: ISACA CISA Exam Content Outline, Domain 1; ISACA audit assurance and quality concepts. ( ISACA )

The best recommendation to address the situation of inconsistencies in privacy requirements across third- party service provider contracts is to prioritize contract amendments for third-party providers. This is because:
Privacy requirements are essential to ensure the protection of personal information and compliance with relevant laws and regulations, such as the GDPR and the CCPA123.
Inconsistencies in privacy requirements can create risks of data breaches, legal liabilities, reputational damage, and consumer distrust for the organization that outsources its data processing to third-party providers123.
Suspending contracts with third-party providers that handle sensitive data (option A) is not a feasible or effective solution, as it may disrupt the business operations and cause contractual penalties or disputes4.
Reviewing privacy requirements when contracts come up for renewal (option C) is not a proactive or timely approach, as it may leave the organization exposed to privacy risks for a long period of time until the contracts expire4.
Requiring third-party providers to sign nondisclosure agreements (NDAs) (option D) is not a sufficient measure, as NDAs only cover the confidentiality of information, but not other aspects of privacy, such as data minimization, retention, access, deletion, and security4.
Therefore, the best recommendation is to prioritize contract amendments for third-party providers (option B), as this would allow the organization to align the privacy requirements with its own policies and standards, as well as with the applicable laws and regulations. This would also enable the organization to monitor and audit the compliance of third-party providers with the privacy requirements and enforce appropriate remedies or sanctions in case of noncompliance45.
References: 1: Understanding CPRA service provider contract requirements - Transcend 2: What you must know about 'third parties' under GDPR and CCPA 3: Data Privacy Implications for Service Provider and Third-Party Contracts 4: Privacy and outsourcing for businesses - Office of the Privacy Commissioner of Canada 5: Data Security Guidelines for outsourcing and third party compliance - European Union Agency for Network and Information Security