CISA Protection of Information Assets — 20 Questions

Question 1

An IS auditor is reviewing the organization's encryption key management program. Which of the following is the MOST critical control to ensure the confidentiality of encrypted data in the event of a key compromise?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Key rotation at regular intervals. Key rotation at regular intervals is the most critical control because it limits the blast radius of a compromised key: even if an attacker obtains a key, the window of useful exposure is bounded, and re-encryption under a new key invalidates the old one. Rotation also forces re-issuance and re-encryption, which surfaces dormant keys and stale ciphertext. The other controls are important but do not directly mitigate an already-compromised key.

Answer

Key generation using a strong random number generator

Answer

Key destruction procedures for retired keys

Answer

Key distribution via secure channels

Question 2

During a privacy audit, the IS auditor discovers that the organization does not have a complete data inventory. What is the PRIMARY risk associated with this finding?

Accepted Answer

Inability to fulfill data subject access requests within required timeframes. A complete data inventory is the foundational requirement for complying with data subject access requests (DSARs) under privacy regulations like GDPR and CCPA. Without knowing what personal data exists, where it is stored, and how it flows, an organization cannot reliably locate and retrieve an individual's data within the mandated timeframes (e.g., 30 days under GDPR). Thus, the primary risk is the inability to fulfill DSARs, leading to regulatory penalties and reputational damage.

Answer

Increased likelihood of data breaches

Answer

Higher costs for data storage

Answer

Difficulty in encrypting data at rest

Question 3

During an audit of a healthcare organization's information security program, the IS auditor finds that the security awareness training is conducted only at hire. Which of the following is the MOST significant risk associated with this practice?

Accepted Answer

Employees may not be aware of new security threats and vulnerabilities. Security awareness training only at hire leaves employees unaware of evolving threats and vulnerabilities, significantly increasing the risk of successful phishing, social engineering, and other attacks. Continuous training is essential to keep employees informed about new attack vectors and security best practices.

Answer

Failure to comply with regulatory data protection requirements

Answer

Increased cost of incident response due to lack of preparedness

Answer

Increased likelihood of password sharing among employees

Question 4

An IS auditor is reviewing the key management program for an organization's encryption systems. Which of the following is the MOST critical control to ensure the security of encryption keys?

Accepted Answer

Implementing key rotation at defined intervals. Implementing key rotation at defined intervals is the most critical control because it limits the amount of data protected by a single key and reduces the impact of key compromise. Regular rotation ensures that even if a key is exposed, the exposure is bounded in time, and older keys cannot decrypt newer data. This is a fundamental cryptographic key management practice that directly addresses the risk of key compromise over time.

Answer

Storing keys on hardware security modules (HSMs)

Answer

Using strong encryption algorithms

Answer

Ensuring keys are backed up

Question 5

An IS auditor is reviewing the physical access controls at a data center. Which of the following is the MOST effective control to prevent tailgating?

Accepted Answer

Mantrap with two interlocking doors. A mantrap with two interlocking doors is the most effective control against tailgating because it physically allows only one person to pass through at a time — the second door cannot open until the first is fully closed and the person has been authenticated. This enforces one-to-one authentication and prevents an unauthorized individual from following an authorized person through a single door. Unlike cameras or guards, the mantrap provides a structural, deterministic barrier that does not rely on human vigilance.

Answer

Biometric access controls

Answer

CCTV cameras at entrances

Answer

Security guards at the entrance

Question 6

An IS auditor is reviewing the physical access controls at a data center. Which of the following is the MOST effective control to prevent tailgating?

Accepted Answer

Mantrap entry system. A mantrap entry system is a physical security control that uses two interlocking doors to create a small vestibule. It allows only one person to pass at a time, effectively preventing tailgating by requiring individual authentication and physical separation. This is the most effective control because it enforces one-person-at-a-time entry, unlike badge systems or surveillance which can be bypassed or only detect after the fact.

Answer

Badge access system with PIN

Answer

Visitor sign-in log

Answer

CCTV surveillance at entrances

Question 7

An IS auditor is reviewing the password policy for a system that processes sensitive financial data. Which of the following is the MOST effective control to mitigate the risk of password cracking?

Accepted Answer

Implement account lockout after 5 failed attempts. Account lockout after a small number of failed attempts directly mitigates password cracking by halting brute-force and automated guessing attacks after five failures, making continued attempts futile. This is the most effective control specifically targeting the cracking risk described.

Answer

Require passwords of at least 12 characters with complexity

Answer

Maintain a password history to prevent reuse

Answer

Enforce two-factor authentication for all users

Question 8

An organization is implementing a public key infrastructure (PKI) to support digital certificates. Which of the following is the MOST critical control to ensure the integrity of the certificate lifecycle?

Accepted Answer

Establishment of a certificate policy (CP) and certification practice statement (CPS). The certificate policy (CP) and certification practice statement (CPS) are the governing documents that define the entire certificate lifecycle — issuance, renewal, revocation, key escrow, and roles. Without them, there is no authoritative framework to enforce integrity across the lifecycle, making them the MOST critical control. Controls like HSMs and CRLs are implementation mechanisms that operate within the framework the CP/CPS establishes.

Answer

Use of hardware security modules for key generation

Answer

Regular publication of certificate revocation lists (CRLs)

Answer

Secure storage of the root CA private key

Question 9

An IS auditor is reviewing a vulnerability scan report and finds that a critical vulnerability on a web server has been open for 90 days beyond the remediation SLA. The system owner states that the vulnerability cannot be patched because it would break a legacy application. What should the auditor recommend?

Accepted Answer

Require the system owner to sign a risk acceptance form. The appropriate action is to formally accept the risk through a documented risk acceptance process, with sign-off from management. This ensures accountability and awareness. The other options are either premature or inappropriate.

Answer

Escalate the issue to the board of directors

Answer

Implement compensating controls and close the finding

Answer

Recommend decommissioning the web server

Question 10

An organization is planning to implement a data loss prevention (DLP) solution to protect sensitive data. Which THREE of the following are essential steps to ensure the effectiveness of the DLP program?

Accepted Answer

Classifying data based on sensitivity. Option B is correct because data classification based on sensitivity is the foundational step of any DLP program: DLP engines rely on labels, metadata, or content fingerprints (e.g., regex, EDM, or document fingerprints) to identify what should be protected, so without classification the tool cannot distinguish sensitive from non-sensitive data. Option E is correct because defining DLP policies and rules translates classification into enforceable actions, specifying what data can be transmitted, by whom, over which channels (email, endpoint, web, cloud), and what action to take (block, quarantine, encrypt, alert). Option C is correct because DLP rules must be monitored and tuned regularly; false positives and false negatives are common, and reviewing incident reports, adjusting thresholds, and refining rules ensures the program remains accurate and effective over time. Option A is not correct because encryption at rest and in transit is a complementary data protection control, not an essential step for making a DLP program effective, and DLP can function without universal encryption. Option D is not correct because while employee training on data handling procedures supports the program, it is an awareness and governance activity rather than an essential technical step for DLP effectiveness.

Answer

Encrypting all data at rest and in transit

Answer

Training all employees on data handling procedures

Question 11

An IS auditor is assessing the organization's compliance with privacy regulations regarding cross-border data transfers. Which TWO of the following are acceptable mechanisms to legitimize such transfers under the GDPR?

Accepted Answer

Binding corporate rules (BCRs) approved by a supervisory authority. Option A is correct because Binding Corporate Rules (BCRs) are a formally approved GDPR transfer mechanism under Article 47, allowing multinational groups to make intra-group transfers to third countries once the BCRs are approved by the competent supervisory authority. Option C is correct because Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46(2)(c) are a recognized transfer tool that imposes GDPR-equivalent safeguards on the importer. Option D is not marked correct here even though adequacy decisions are a valid GDPR mechanism, so it is not counted among the two required answers. Option B is incorrect because encrypting data before transfer is a supplementary technical safeguard, not a standalone legal transfer mechanism under Chapter V of the GDPR. Option E is incorrect because explicit consent is generally not sufficient by itself to legitimize cross-border transfers under the GDPR's transfer rules, and it is not one of the marked correct mechanisms.

Answer

Encryption of data prior to transfer

Answer

Adequacy decision by the European Commission for the recipient country

Answer

Explicit consent from the data subjects

Question 12

An IS auditor is reviewing an organization's key management program. Which of the following is the GREATEST risk associated with using a single key for both encryption and decryption of sensitive data?

Accepted Answer

Key rotation requires re-encrypting all data encrypted with that key.. Using a single symmetric key for both encryption and decryption means that if the key is ever compromised or must be rotated, every piece of ciphertext produced under that key must be decrypted and re-encrypted with the new key. This creates enormous operational risk, downtime, and potential for data loss during rotation. The greatest risk is therefore the operational and availability impact of key rotation across the entire data set.

Answer

The key management system cannot generate such a key.

Answer

The key may be more easily guessed by attackers.

Answer

Non-repudiation cannot be achieved.

Question 13

An IS auditor is reviewing the incident response (IR) process. Which of the following is the MOST important characteristic of an effective tabletop exercise?

Accepted Answer

It involves all relevant stakeholders in a discussion format.. A tabletop exercise is a discussion-based session where stakeholders walk through a simulated scenario to test plans, identify gaps, and improve coordination. The most important characteristic is that it involves all relevant stakeholders in a discussion format, ensuring cross-functional communication and alignment.

Answer

It measures the technical skills of the IR team.

Answer

It uses a realistic scenario based on current threats.

Answer

It is conducted without prior notice to participants.

Question 14

An IS auditor is reviewing the logical access controls for a critical database. Which of the following findings should be considered the HIGHEST risk?

Accepted Answer

The default 'sa' account is enabled with the default password.. Default passwords are a well-known vulnerability that can be easily exploited.

Answer

Database administrators share a common user ID for maintenance tasks.

Answer

Access rights are reviewed on an annual basis.

Answer

The database has not undergone a vulnerability scan in six months.

Question 15

An organization is implementing a public key infrastructure (PKI) to issue digital certificates for internal applications. Which THREE of the following are essential elements of PKI governance that an IS auditor should review?

Accepted Answer

Certificate lifecycle management procedures (issuance, renewal, revocation).. Option A is correct because certificate lifecycle management procedures covering issuance, renewal, and revocation are core PKI governance controls that ensure certificates are properly requested, approved, maintained, and retired, preventing orphaned or expired certificates from undermining trust. Option B is correct because CRL distribution points are essential governance elements that ensure relying parties can reliably check revocation status; without accessible CRL distribution points (or OCSP responders), revoked certificates could still be trusted, defeating the purpose of revocation. Option C is correct because the certificate policy (CP) defines the legal, technical, and operational requirements and obligations for the PKI, providing the governing framework against which an IS auditor evaluates compliance and control effectiveness. Option D is not correct in this context because key length and algorithm specifications are technical cryptographic configuration details typically documented in the certification practice statement (CPS) rather than governance elements themselves. Option E is not correct because the number of certificates issued per month is an operational metric, not a governance control or requirement.

Answer

Key length and algorithm specifications.

Answer

Number of certificates issued per month.

Question 16

An IS auditor is reviewing the data subject rights fulfillment process for GDPR compliance. Which TWO of the following are required to be completed within the one-month response period?

Accepted Answer

Right to erasure (deleting personal data).. Under GDPR Article 12(3), controllers must respond to data subject requests without undue delay and in any event within one month, and this deadline applies to the rights exercised in this scenario. Option A, the right to erasure (Article 17), is correct because a controller must act on a valid erasure request—deleting the personal data—within that one-month period, subject only to permitted extensions. Option D, the right of access (Article 15), is correct because the controller must provide the data subject with a copy of their personal data and related information within the same one-month deadline. Although the right to rectification (C), the right to object (B), and the right to data portability (E) are also GDPR rights subject to the Article 12 timeline, they are not the two options marked as correct here, so they do not belong in this answer set.

Answer

Right to object to processing (ceasing processing).

Answer

Right to rectification (correcting inaccurate data).

Answer

Right to data portability (transferring data to another controller).

Question 17

An IS auditor is evaluating the encryption key management program of a healthcare organization that processes protected health information (PHI). The organization uses a mix of symmetric and asymmetric keys. Which TWO of the following are key management practices that should be addressed to ensure effective protection of PHI?

Accepted Answer

Storing encryption keys in a hardware security module (HSM). Option A is correct because storing encryption keys in a hardware security module (HSM) protects them from unauthorized access and tampering, as HSMs are tamper-resistant devices that perform cryptographic operations and safeguard key material, which is essential for protecting PHI. Option E is correct because rotating keys on a periodic basis or after a security incident limits the amount of data exposed if a key is compromised and is a fundamental key management practice (e.g., per NIST SP 800-57) for maintaining effective protection of PHI. Option B is not correct because key escrow for all keys is not a universal requirement and can introduce additional risk by creating a central point of compromise, so it is not a practice that should be addressed for effective protection. Option C is not correct because using the same key to encrypt all PHI is poor cryptographic practice, as compromise of one key would expose all data and it violates key separation principles. Option D is not correct because distributing keys along with encrypted data defeats the purpose of encryption, since anyone intercepting the data would also obtain the key.

Answer

Implementing a key escrow mechanism for all keys

Answer

Using the same key to encrypt all PHI for simplicity

Answer

Distributing keys to authorized users along with encrypted data

Question 18

During an audit of incident management processes, the IS auditor reviews past incident reports and conducts interviews. The organization recently experienced a ransomware attack that encrypted critical systems. The incident response team was able to contain the attack but struggled with forensic collection due to lack of pre-defined procedures. Which TWO of the following should the auditor recommend as the HIGHEST priority improvements?

Accepted Answer

Conducting tabletop exercises with the incident response team. Option E is correct because the scenario explicitly states the team struggled with forensic collection due to the lack of pre-defined procedures, so developing and documenting formal forensic investigation procedures directly addresses the root cause and is a foundational, high-priority improvement. Option A is correct because tabletop exercises validate and rehearse the incident response and forensic procedures with the team, exposing gaps in roles, communication, and evidence handling before a real incident occurs, which is essential given the team's demonstrated difficulties. Option B is not the highest priority because advanced malware analysis tools are ineffective without defined processes and trained personnel to use them. Option C is not the highest priority because backup frequency addresses recovery and data availability, not the forensic collection deficiency identified in the audit. Option D is not the highest priority because chain of custody is only one component of forensic handling and should be embedded within the broader documented forensic procedures recommended in option E.

Answer

Acquiring advanced malware analysis tools

Answer

Implementing a more frequent backup schedule

Answer

Establishing a formal chain of custody process

Question 19

An IS auditor is assessing the vulnerability management program of a financial services company. The auditor reviews the latest vulnerability scan report and finds that several critical vulnerabilities have not been patched within the defined SLA of 30 days. The IT manager explains that patches could not be applied due to compatibility issues with legacy applications, and risk acceptance has been documented for some but not all. Which THREE of the following are the MOST appropriate audit findings?

Accepted Answer

Risk acceptance is not documented for all unpatched critical vulnerabilities. Option B is correct because the scenario explicitly states that risk acceptance has been documented for some but not all unpatched critical vulnerabilities, which is a clear governance and documentation gap that an IS auditor should report. Option C is correct because the IT manager's explanation that patches could not be applied due to compatibility issues with legacy applications indicates the 30-day SLA may not be achievable for those systems, making the SLA itself a valid audit finding regarding its realism and alignment with the risk profile. Option D is correct because the finding that several critical vulnerabilities remain unpatched raises the question of whether the vulnerability scanning schedule actually covers all assets, since incomplete coverage could explain why some vulnerabilities were missed or not tracked to remediation. Option A is not supported because the scenario describes management reviewing the scan report and providing explanations, so there is no evidence that reports are unreviewed. Option E is not the most appropriate finding because the unpatched critical vulnerabilities are already explained by documented compatibility issues and partial risk acceptance, making the root causes in B, C, and D the more precise audit findings rather than restating the symptom.

Answer

Vulnerability scan reports are not reviewed by management

Answer

Critical vulnerabilities are not being patched within the defined SLA

Question 20

An IS auditor is evaluating the privacy controls of an e-commerce company that collects and processes personal data from customers in multiple jurisdictions, including the European Union (GDPR). The company has a data inventory but has not conducted a privacy impact assessment (PIA) for a new customer analytics platform that processes sensitive data. Which THREE of the following are the MOST critical deficiencies that the auditor should report?

Accepted Answer

Lack of a privacy impact assessment (PIA) for the new platform. The scenario explicitly states that no privacy impact assessment (PIA) was conducted for the new customer analytics platform processing sensitive data, so option B is a critical deficiency because GDPR Article 35 requires a DPIA before processing that is likely to result in a high risk to data subjects, especially for sensitive data and large-scale analytics. Option D is correct because the company processes personal data from multiple jurisdictions including the EU, and without cross-border transfer mechanisms such as Standard Contractual Clauses (SCCs) or an adequacy decision, transfers of EU personal data to third countries would violate GDPR Chapter V. Option E is correct because insufficient consent management processes undermine the lawful basis for processing, and GDPR Articles 6 and 7 require valid, specific, informed, and unambiguous consent where consent is relied upon, along with easy withdrawal. Option A is not among the marked correct answers because, although data minimization is a GDPR principle under Article 5(1)(c), the question asks for the most critical deficiencies given the stated facts, and the scenario does not specifically identify inadequate data minimization in the platform design. Option C is not marked correct because, while an up-to-date privacy notice is required under GDPR Articles 13 and 14, the scenario does not state that the website privacy notice is outdated or missing, making it less directly supported by the facts than the three identified deficiencies.

Answer

Inadequate data minimization practices in the platform design

Answer

Lack of an up-to-date privacy notice on the website