CISA Practice Test 28 — 15 Questions

Question 1

Based on the exhibit, which control deficiency is most critical for the IS auditor to address?

Accepted Answer

The system lacks a policy to lock accounts after repeated failed login attempts. Option D is the most critical deficiency because without an account lockout policy, the system is vulnerable to brute-force password guessing attacks. Even if other controls like SSH key authentication are missing, a lockout policy is a fundamental defense that directly mitigates repeated login attempts, which is a primary attack vector for gaining unauthorized access.

Answer

SSH is configured to allow root login

Answer

The admin user logged in successfully with a password

Answer

Public key authentication is not being used

Question 2

A multinational corporation is implementing a bring your own device (BYOD) policy. Which of the following is the most important security control to ensure corporate data is protected on employee devices?

Accepted Answer

Implement mobile device management (MDM) with containerization.. Option D is correct because Mobile Device Management (MDM) with containerization creates a separate, encrypted workspace on the employee's device that isolates corporate data from personal data. This ensures that the organization can enforce security policies (e.g., remote wipe, access controls) on the corporate container without affecting the user's personal information, which is critical for BYOD environments where full-device control is not feasible.

Answer

Require employees to install antivirus software.

Answer

Prohibit the use of personal devices for work.

Answer

Mandate full-device encryption.

Question 3

Which TWO of the following are key components of an effective information security awareness program?

Accepted Answer

Mandatory training for all employees. Option C is correct because mandatory training for all employees ensures that every user understands their security responsibilities, recognizes threats like phishing, and follows organizational policies. This is a foundational element of an awareness program as defined by frameworks such as NIST SP 800-50, which emphasizes that awareness and training must be tailored to roles and delivered to all personnel. Without mandatory participation, coverage gaps leave the organization vulnerable to social engineering and policy violations.

Answer

Periodic review of security logs

Answer

Annual password change policy

Answer

Regular vulnerability scans

Question 4

A security auditor discovers that a server has been compromised due to an unpatched vulnerability. Which of the following would have most effectively prevented this incident?

Accepted Answer

Implementing a vulnerability management program with regular patching.. Option B is correct because a vulnerability management program with regular patching directly addresses the root cause of the compromise: the unpatched vulnerability. By systematically identifying, prioritizing, and applying security patches, the organization eliminates the known weakness that the attacker exploited. This proactive measure prevents the initial compromise, whereas other controls only detect or limit the attack after the vulnerability is exploited.

Answer

Enabling firewall rules to limit access.

Answer

Installing a host-based intrusion detection system (HIDS).

Answer

Using strong passwords on the server.

Question 5

Refer to the exhibit. Which of the following services is accessible from the internet to host 10.1.1.100?

Accepted Answer

HTTPS and SSH. The exhibit shows an access control list (ACL) permitting TCP ports 443 (HTTPS) and 22 (SSH) from any source to host 10.1.1.100. Since the ACL is applied inbound on the internet-facing interface, only HTTPS and SSH traffic are allowed through to that host. Therefore, option C is correct.

Answer

HTTP only

Answer

Telnet only

Answer

FTP only

Question 6

During an audit of a privileged access management (PAM) system, the auditor finds that privileged sessions are recorded but not reviewed. What is the primary risk?

Accepted Answer

Missing evidence of malicious activity after an incident.. Recording privileged sessions without review means that while a log of activities exists, it is not analyzed for signs of compromise or policy violations. The primary risk is that after a security incident, the recorded sessions may be the only source of evidence to reconstruct the attack, but without prior review, the organization may fail to identify malicious activity in a timely manner or may lose critical forensic data if logs are overwritten or deleted before an incident is discovered.

Answer

Inability to detect real-time threats.

Answer

Increased administrative overhead.

Answer

Non-compliance with licensing agreements.

Question 7

Which physical security control is most effective for preventing unauthorized individuals from tailgating into a data center?

Accepted Answer

Mantrap (dual-door interlocking system).. A mantrap, or dual-door interlocking system, is the most effective physical security control against tailgating because it physically isolates individuals in a small vestibule where both doors cannot be opened simultaneously. This forces authentication and verification for each person before the second door unlocks, preventing an unauthorized person from following an authorized individual through a single entry point.

Answer

Security guards at the entrance.

Answer

Closed-circuit television (CCTV) surveillance.

Answer

Biometric fingerprint readers.

Question 8

An organization uses the access list above on its perimeter firewall. Which of the following is a valid conclusion?

Accepted Answer

All HTTPS traffic from the 192.168.1.0 subnet is allowed.. Option B is correct because the access list permits TCP traffic from source network 192.168.1.0/24 to destination port 443 (HTTPS). The permit statement for TCP with eq 443 explicitly allows HTTPS traffic from that subnet, and there is no subsequent deny statement blocking it.

Answer

All HTTP traffic from the 192.168.2.0 subnet is allowed.

Answer

All traffic from the 192.168.2.0 subnet is allowed.

Answer

All traffic from the Internet to internal hosts is denied.

Answer

All traffic from 192.168.1.0 subnet is allowed on any port.

Answer

All traffic from the Internet is denied.

Answer

The ACL allows SSH traffic from 192.168.1.0 subnet.

Question 9

An organization is migrating sensitive customer data to a public cloud. Which of the following encryption strategies provides the STRONGEST protection against data exposure to the cloud provider?

Accepted Answer

Implement client-side encryption with keys managed on-premises. Client-side encryption with keys managed on-premises ensures that the cloud provider never has access to the encryption keys or the plaintext data. Even if the cloud provider's infrastructure is compromised or they have administrative access, the data remains encrypted and unreadable. This provides the strongest protection because the cloud provider is excluded from the cryptographic trust boundary.

Answer

Use transport layer security (TLS) for data in transit

Answer

Encrypt data at rest using server-side encryption with AES-256

Answer

Enable the cloud provider's key management service

Question 10

Which TWO of the following are primary objectives of a data loss prevention (DLP) strategy?

Accepted Answer

Identify and classify sensitive data. Option B is correct because identifying and classifying sensitive data is the foundational step in a DLP strategy. Without knowing where sensitive data resides (e.g., PII, PCI, IP), DLP policies cannot accurately detect or prevent unauthorized transfers. Classification enables the DLP system to apply context-aware rules, such as blocking credit card numbers in email attachments or flagging confidential documents uploaded to cloud storage.

Answer

Encrypt all data in transit

Answer

Replace all existing security controls

Answer

Ensure compliance with all regulations

Question 11

During a security audit, it is discovered that a database containing customer credit card numbers is not encrypted at rest. The database is used by a legacy application that cannot be modified. Which compensating control most effectively reduces the risk?

Accepted Answer

Isolating the database server on a separate network segment with strict firewall rules. Isolating the database server on a separate network segment with strict firewall rules (e.g., using VLANs and ACLs to restrict traffic to only the legacy application’s IP and port) prevents unauthorized network-level access to the unencrypted data. This compensating control reduces the attack surface by ensuring that even if the database lacks encryption at rest, an attacker cannot reach it without first compromising the network segmentation, which is a critical defense-in-depth layer.

Answer

Enabling detailed audit logging for all database access

Answer

Requiring all users to sign a nondisclosure agreement (NDA)

Answer

Implementing dynamic data masking at the application level

Question 12

During a security audit, it was found that users in the finance department have unnecessary access to HR payroll data. Which access control principle has been violated?

Accepted Answer

Least privilege. The least privilege principle dictates that users should be granted only the minimum permissions necessary to perform their job functions. In this scenario, finance department users have unnecessary access to HR payroll data, directly violating this principle by providing more access than required.

Answer

Mandatory access control

Answer

Separation of duties

Answer

Need to know

Question 13

Which TWO of the following are examples of administrative controls for information security?

Accepted Answer

Access control policy. Access control policy is an administrative control because it defines the rules, roles, and responsibilities for granting or restricting access to information assets. It is a documented directive that governs user behavior and management processes, not a technical mechanism. Administrative controls are management-level safeguards, such as policies, procedures, and training, that guide the implementation of technical and physical controls.

Answer

Intrusion detection system

Answer

Firewall configuration

Answer

Encryption algorithms

Question 14

A financial institution is implementing a data classification policy. Which of the following is the most important factor in determining the classification level of a data asset?

Accepted Answer

The sensitivity and criticality to business operations. The classification level of a data asset is determined by its sensitivity and criticality to business operations because these factors directly drive the required confidentiality, integrity, and availability controls. For example, personally identifiable information (PII) or financial transaction records require higher classification due to regulatory mandates (e.g., GDPR, PCI DSS) and the potential for severe business impact if compromised. Cost, format, or location are secondary attributes that do not inherently define the risk profile or protection needs of the data.

Answer

The cost of acquiring the data

Answer

The format of the data (structured vs unstructured)

Answer

The storage location of the data

Question 15

A company is implementing a cloud-based identity and access management (IAM) system. Which of the following best describes the principle of least privilege in this context?

Accepted Answer

Permissions should be granted based on the user's role and need-to-know.. Option D is correct because the principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions, based on their role and need-to-know. In a cloud-based IAM system, this is typically implemented through role-based access control (RBAC) or attribute-based access control (ABAC), ensuring minimal exposure to sensitive resources and reducing the attack surface.

Answer

Users should have administrative rights for troubleshooting.

Answer

Permissions should be revoked only when an employee leaves the company.

Answer

All users should have the same level of access for consistency.

CISA Practice Test 28 — 15 Questions

Exhibit

CISA Practice Test 28 — 15 Questions

Exhibit