CISA Practice Test 29 — 15 Questions

Question 1

Refer to the exhibit. An auditor reviews the ACL and notes that it allows traffic from a specific host while blocking other IPs in the same subnet. What is the most likely security issue?

Accepted Answer

The ACL is misconfigured because the permit any at the end bypasses the deny.. Option B is correct because the ACL has a 'permit any' statement at the end, which overrides the preceding 'deny' statements. In Cisco ACLs, packets are processed sequentially from top to bottom; once a match is found, no further rules are evaluated. Therefore, the 'deny' for the subnet is never reached, and all traffic (including from the blocked subnet) is permitted, defeating the intended restriction.

Answer

The ACL blocks all traffic from the subnet except the host, which is desired.

Answer

The ACL allows all traffic from the specific host, which is a risk.

Answer

The ACL should be reversed to deny first.

Question 2

A small business wants to protect customer data collected through its e-commerce website. Which control is most appropriate for protecting the data at rest and in transit?

Accepted Answer

Use encryption for data at rest and in transit.. Encryption is the only control that directly protects the confidentiality and integrity of data both at rest (e.g., AES-256 for database files) and in transit (e.g., TLS 1.3 for HTTPS). It renders data unreadable without the proper decryption key, ensuring that even if storage media or network traffic is intercepted, the customer data remains secure.

Answer

Implement a network firewall to block unauthorized access.

Answer

Perform regular backups of the database to ensure data availability.

Answer

Deploy an intrusion detection system (IDS) to monitor for threats.

Question 3

An organization uses role-based access control (RBAC). An employee is transferred to a new department. According to best practices, what should be done regarding the employee's access rights?

Accepted Answer

Immediately revoke all previous access and assign new role permissions.. Option C is correct because RBAC mandates that access rights are strictly tied to job functions. When an employee changes departments, their previous role permissions are no longer applicable and must be immediately revoked to prevent unauthorized access, while new role permissions are granted to align with their new responsibilities. This follows the principle of least privilege and ensures that access rights are always current with the employee's role.

Answer

Remove access to the previous department's resources after a grace period.

Answer

Keep all access but log usage.

Answer

Keep previous access and grant new role permissions.

Question 4

A company is migrating its customer database to a public cloud provider. Which of the following encryption strategies best protects data while minimizing performance impact on queries?

Accepted Answer

Use column-level encryption and tokenization for sensitive fields.. Option C is correct because column-level encryption and tokenization allow sensitive fields (e.g., SSNs, credit card numbers) to be protected while leaving non-sensitive columns unencrypted, preserving query performance on indexed and frequently queried data. Tokenization replaces sensitive values with non-sensitive placeholders, enabling joins and lookups without decryption overhead, and column-level encryption limits decryption to only the required fields per query.

Answer

Encrypt the entire database at rest using AES-256, and decrypt for each query.

Answer

Encrypt the database at the application layer before storage.

Answer

Rely on the cloud provider's default encryption for the storage.

Question 5

A company stores sensitive customer data in a database. To comply with privacy regulations, the data must be anonymized for analytics. Which technique provides the strongest anonymization while preserving data utility?

Accepted Answer

Differential privacy with calibrated noise.. Differential privacy with calibrated noise is the strongest anonymization technique because it provides a formal mathematical guarantee that the output of a query does not reveal whether any specific individual's data was included. By adding carefully calibrated noise to query results, it preserves statistical utility for analytics while ensuring that re-identification is provably infeasible, meeting strict privacy regulations like GDPR or CCPA.

Answer

Tokenization with a reversible mapping.

Answer

Removing direct identifiers like names and SSNs.

Answer

Data masking with static substitution.

Question 6

An organization is implementing a data loss prevention (DLP) solution. Which of the following is the MOST important step to ensure the DLP rules are effective?

Accepted Answer

Classify data based on sensitivity. Data classification is the foundational step for effective DLP rules because it defines which data is sensitive and how it should be handled. Without classification, DLP policies cannot accurately identify or enforce rules on sensitive content, leading to false positives or missed detections. Classification enables the DLP system to apply context-aware rules (e.g., regex patterns for PII, keywords for confidential documents) that align with the organization's data governance requirements.

Answer

Encrypt all data at rest

Answer

Establish an incident response team

Answer

Create user awareness training

Question 7

During a security assessment, an auditor discovers that employees are sharing passwords to access a critical system. Which of the following controls would BEST mitigate this risk?

Accepted Answer

Implement multi-factor authentication. Multi-factor authentication (MFA) mitigates the risk of password sharing because even if credentials are shared, an attacker cannot authenticate without the second factor (e.g., a one-time passcode from a hardware token or authenticator app). MFA decouples authentication from a single shared secret, making shared passwords insufficient for access. This directly addresses the root cause—reliance on passwords alone—rather than attempting to prevent sharing behavior.

Answer

Provide security awareness training

Answer

Log all authentication attempts

Answer

Enforce complex password policies

Question 8

A small business wants to protect customer data stored on a local file server. Which of the following is the MOST cost-effective control to prevent unauthorized access?

Accepted Answer

Configure file-level permissions. Configuring file-level permissions (e.g., NTFS permissions on Windows or POSIX ACLs on Linux) is the most cost-effective control because it directly restricts which users or groups can read, write, or modify specific files and folders on the server. This granular access control prevents unauthorized access without requiring additional hardware or complex management, making it ideal for a small business with limited budget.

Answer

Enable detailed audit logs

Answer

Implement full-disk encryption

Answer

Deploy biometric authentication

Question 9

Refer to the exhibit. An auditor finds that users are able to reuse previous passwords easily. Which setting should be modified to address this weakness?

Accepted Answer

Increase the password history to 10. Increasing the password history setting (e.g., to 10) prevents users from reusing their most recent passwords by storing a specified number of previous password hashes. When a user attempts to change their password, the system compares the new password against the stored history and rejects it if it matches any of the remembered passwords. This directly addresses the weakness of easy password reuse.

Answer

Increase the minimum password age to 7 days

Answer

Enable password expiration notifications

Answer

Increase the maximum password age to 30 days

Question 10

Which of the following is the PRIMARY purpose of conducting a penetration test?

Accepted Answer

To exploit vulnerabilities to assess real-world impact. The primary purpose of a penetration test is to exploit vulnerabilities in a controlled manner to assess the real-world impact and business risk, not merely to list them. While vulnerability scanning identifies weaknesses, penetration testing goes further by simulating an attacker's actions to determine if and how a vulnerability can be leveraged to compromise systems, data, or operations. This aligns with the CISA focus on evaluating the effectiveness of security controls under realistic attack conditions.

Answer

To test incident response capabilities

Answer

To meet compliance requirements

Answer

To identify vulnerabilities in a system

Question 11

Which of the following are effective controls to protect sensitive data in use? (Choose TWO.)

Accepted Answer

Homomorphic encryption. Homomorphic encryption allows computations to be performed directly on encrypted data without decrypting it first, thereby protecting the data while it is in use. This is a critical control for scenarios where sensitive data must be processed by untrusted environments, as the plaintext is never exposed during processing.

Answer

Transport Layer Security (TLS)

Answer

Access control lists (ACLs)

Answer

Hashing

Question 12

A company's security policy requires that all laptops have full-disk encryption. During an audit, 10% of laptops are found without encryption. Which of the following is the MOST effective corrective action?

Accepted Answer

Deploy centralized endpoint management to enforce encryption. Centralized endpoint management (e.g., Microsoft Intune, SCCM, or a third-party MDM) allows administrators to enforce full-disk encryption (such as BitLocker or FileVault) via policy, automatically encrypting non-compliant laptops and preventing users from disabling encryption. This is the most effective corrective action because it addresses the root cause—lack of enforcement—rather than relying on user action or manual processes.

Answer

Require users to manually enable encryption

Answer

Distribute encryption keys to users

Answer

Conduct security awareness training on encryption

Question 13

An organization has implemented a database activity monitoring (DAM) solution. Which of the following are BEST practices for tuning the DAM to reduce false positives? (Choose TWO.)

Accepted Answer

Implement exclusions for routine maintenance activities. Implementing exclusions for routine maintenance activities (Option A) is a best practice because these activities often generate predictable database queries that are not indicative of security threats. By excluding them, the DAM solution avoids alerting on benign operations, thereby reducing false positives without compromising security coverage.

Answer

Enable alerts for all database queries

Answer

Increase the sensitivity of all detection rules

Answer

Review alerts in real-time only

Question 14

An organization is evaluating a cloud-based identity as a service (IDaaS) for single sign-on (SSO). Which of the following security concerns is MOST critical to address?

Accepted Answer

Compromise of the identity provider's credentials. The compromise of the identity provider's (IdP) credentials is the most critical security concern because the IdP acts as the central trust anchor for all SSO transactions. If an attacker gains control of the IdP's signing key or administrative credentials, they can forge SAML assertions for any user, bypassing all downstream authentication and gaining unauthorized access to every connected service provider (SP). This represents a single point of failure that undermines the entire SSO trust model.

Answer

Lack of encryption for SAML assertions

Answer

Incompatibility with legacy applications

Answer

Downtime of the IDaaS provider

Question 15

Refer to the exhibit. Which of the following statements is TRUE regarding this S3 bucket policy?

Accepted Answer

Anonymous read access is allowed only over HTTPS. Option A is correct because the S3 bucket policy includes a condition `aws:SecureTransport` set to `true`, which explicitly denies any request that is not made over HTTPS. The `Effect: Allow` on the `Principal: "*"` grants anonymous read access, but the `Condition` block ensures that only HTTPS requests are permitted, making anonymous read access allowed only over HTTPS.

Answer

The bucket is fully public for all actions

Answer

Write access is allowed over HTTP

Answer

Only authenticated users can access objects

CISA Practice Test 29 — 15 Questions

Exhibit

CISA Practice Test 29 — 15 Questions

Exhibit