First Step Before Enabling Auditing on a Loan System
Short answer
B Determine the performance, storage, and operational impact of enabling the audit feature on the home-loan system before anything else.
Question
Key Takeaways
The question tests change-management sequencing for enabling auditing: you must first understand what enabling it will do to the system before you can cost it, staff it, or scan for vulnerabilities.
For a bank processing sensitive home-loan privacy data with no prior auditing, the correct first action is to determine the impact of enabling the audit feature. The page explains why impact assessment on performance, storage, and operations precedes cost/benefit analysis, staffing, and scanning.
Common mistake: Learners often pick C (cost/benefit analysis), assuming budget comes first; but a credible cost/benefit analysis is impossible until you know the audit feature's actual performance, storage, and workflow impact.
Expert Analysis
Why the Answer Is Correct
Option B is correct because enabling auditing on a production banking system that has never logged activity is a significant change with real technical consequences. Audit logging consumes CPU, memory, and disk I/O, generates large volumes of log data, and can affect application responsiveness and backup windows for a system handling sensitive home-loan privacy information. Only after quantifying that impact can the bank sensibly decide the scope of auditing, estimate storage and retention needs, and then proceed to cost/benefit analysis (C) and staffing for log review (D). ISACA and standard governance practice place impact assessment as the first step of change implementation, making "determine the impact" the correct first step.
Why the Other Options Are Wrong
Option A (vulnerability scan) is unrelated to the immediate decision; scanning identifies existing weaknesses but tells you nothing about the operational consequences of turning auditing on. Option C (cost/benefit analysis) is a legitimate later step, but it cannot be performed accurately before the impact—performance, storage, and staffing load—is understood, so it is not the first step. Option D (allocate funds for audit log review staffing) is likewise a downstream action; without knowing log volume and review requirements, the bank cannot size or fund the review team. Ordering matters here: impact → cost/benefit → funding/staffing → implementation.
Community Comment Notes
The vote distribution is unanimous for B (100%), and the community reasoning aligns with the analysis: as g_man_rap noted, "Auditing can have significant effects on system performance, storage requirements, and operational workflows." Other comments were less substantive—LordXander simply reasoned "Just because other options make less sense"—and one learner (nosavotor) openly asked others to confirm the accuracy of the data, so the consensus, while correct, was not deeply reasoned. The strongest support remains the point that assessing how the system will handle the additional load is essential before enabling auditing.
Official Reference
https://csrc.nist.gov/pubs/sp/800/92/final
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a question asks for the "first step" of a control or change rollout, choose the assessment/analysis action over any spending, staffing, or tooling action—analysis always precedes implementation and budgeting. Eliminate options that presuppose knowledge you do not yet have (for example, you cannot analyze cost or hire reviewers before knowing the feature's impact).
Frequently Asked Questions
Why isn't a cost/benefit analysis the first step before enabling auditing?
Does performing a vulnerability scan help before turning on auditing?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
g_man_rap 👍 1B. Determine the impact of enabling the audit feature. Analysis: Understanding the impact of enabling auditing is critical. Auditing can have significant effects on system performance, storage requirements, and operational workflows. It is essential to assess how the system will handle the additional load of recording and storing audit logs and how it may affect the system’s responsiveness and other functionalities. This option ensures that the bank can plan for any necessary infrastructure upgrades or adjustments in system configurations before the feature is activated.
-
nosavotor 👍 1Could someone help me confirm the accuracy of this data
-
insaniunt 👍 1 Answered BB. Determine the impact of enabling the audit feature.
-
LordXander 👍 1 Answered BJust because other options make less sense
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.