Question 100

Explanation

Correct Answer: B. Access to firewall configuration is restricted. Explanation: When evaluating an organization's firewall, the most important aspect for an IS auditor to verify is whether access to firewall configuration is restricted. Firewall configuration controls the rules and settings that determine which network traffic is allowed or denied. In order to ensure the effectiveness of the firewall, it is crucial that only authorized individuals have access to modify its configuration. By restricting access to firewall configuration, the organization can prevent unauthorized changes or modifications that may compromise the security of the network. Unauthorized changes to firewall configuration can lead to security vulnerabilities, such as allowing unauthorized access or blocking legitimate traffic. While monitoring and analyzing firewall logs (Option A), configuring the firewall to allow only necessary network traffic (Option C), and ensuring firewall hardware and software are up to date (Option D) are also important considerations, they are secondary to the primary control of restricting access to firewall configuration. Without proper access controls, other security measures may be undermined. Therefore, the correct answer is B. Access to firewall configuration is restricted.