First Step Before Enabling Auditing on a Loan System
A bank stores and processes sensitive privacy information related to home loans. However, auditing has never been enabled on the system. What is the first step that the bank should take before enabling the audit feature?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests change-management sequencing for enabling auditing: you must first understand what enabling it will do to the system before you can cost it, staff it, or scan for vulnerabilities.
For a bank processing sensitive home-loan privacy data with no prior auditing, the correct first action is to determine the impact of enabling the audit feature. The page explains why impact assessment on performance, storage, and operations precedes cost/benefit analysis, staffing, and scanning.
Learners often pick C (cost/benefit analysis), assuming budget comes first; but a credible cost/benefit analysis is impossible until you know the audit feature's actual performance, storage, and workflow impact.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is correct because enabling auditing on a production banking system that has never logged activity is a significant change with real technical consequences. Audit logging consumes CPU, memory, and disk I/O, generates large volumes of log data, and can affect application responsiveness and backup windows for a system handling sensitive home-loan privacy information. Only after quantifying that impact can the bank sensibly decide the scope of auditing, estimate storage and retention needs, and then proceed to cost/benefit analysis (C) and staffing for log review (D). ISACA and standard governance practice place impact assessment as the first step of change implementation, making "determine the impact" the correct first step.
Why the Other Options Are Wrong
Option A (vulnerability scan) is unrelated to the immediate decision; scanning identifies existing weaknesses but tells you nothing about the operational consequences of turning auditing on. Option C (cost/benefit analysis) is a legitimate later step, but it cannot be performed accurately before the impact—performance, storage, and staffing load—is understood, so it is not the first step. Option D (allocate funds for audit log review staffing) is likewise a downstream action; without knowing log volume and review requirements, the bank cannot size or fund the review team. Ordering matters here: impact → cost/benefit → funding/staffing → implementation.
Community Comment Notes
The vote distribution is unanimous for B (100%), and the community reasoning aligns with the analysis: as g_man_rap noted, "Auditing can have significant effects on system performance, storage requirements, and operational workflows." Other comments were less substantive—LordXander simply reasoned "Just because other options make less sense"—and one learner (nosavotor) openly asked others to confirm the accuracy of the data, so the consensus, while correct, was not deeply reasoned. The strongest support remains the point that assessing how the system will handle the additional load is essential before enabling auditing.
Official Reference
Exam Strategy
When a question asks for the "first step" of a control or change rollout, choose the assessment/analysis action over any spending, staffing, or tooling action—analysis always precedes implementation and budgeting. Eliminate options that presuppose knowledge you do not yet have (for example, you cannot analyze cost or hire reviewers before knowing the feature's impact).
Frequently Asked Questions
Why isn't a cost/benefit analysis the first step before enabling auditing?
A cost/benefit analysis depends on knowing the audit feature's actual performance, storage, and staffing load. That impact must be determined first, or the cost estimates would be guesswork.
Does performing a vulnerability scan help before turning on auditing?
No. A scan finds existing weaknesses in the system but reveals nothing about the operational consequences of enabling audit logging, so it is not the first step.