Which areas are listed as high-value cyber audit focus?

• A. Governance, risk acceptance, third-party risk, incident response, IAM.
• B. Marketing alignment, customer service, branding.
• C. Physical security, HVAC, facility maintenance.
• D. Data backup frequency, restore tests, and archiving.

Answer: (A)

The main idea this item tests is which cybersecurity areas most influence an effective audit program. The strongest set of focus areas includes governance, risk acceptance, third-party risk, incident response, and identity and access management. These areas are foundational to how an organization governs cybersecurity, decides what risk to tolerate, and manages external dependencies, while also ensuring there are tested plans to detect, respond to, and recover from incidents. Identity and access management is central because controlling who can access systems and what they can do is a primary defense against breaches, making it a constant audit priority.

The other options don’t cover this breadth. Marketing alignment, customer service, and branding are not security-focused and don’t address how risks are governed or mitigated. Physical security, HVAC, and facility maintenance relate to the environment but are largely outside the core cyber risk controls. Data backup frequency, restore tests, and archiving are important for recovery, but they represent a narrower area of focus compared to the comprehensive governance, risk management, and incident readiness elements highlighted in the correct set.