CISA Protection of Information Assets — 30 Questions

Question 1

An IS auditor is reviewing the logical access controls for a financial application. The auditor notices that user access reviews are performed annually by the application owner, but there is no documentation indicating that managers confirm the continued need for access. Which of the following is the MOST significant risk associated with this finding?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Unauthorized access to sensitive data due to excessive privileges. Without manager confirmation, access may remain for users who no longer need it, leading to segregation of duties conflicts or unauthorized access. Annual reviews without manager sign-off increase the risk that access is not appropriately revoked when roles change.

Answer

Increased likelihood of successful social engineering attacks

Answer

Non-compliance with regulatory requirements for access controls

Answer

Inability to detect insider threats in a timely manner

Question 2

During an audit of the information security program, the IS auditor reviews the organization's information security policy. Which of the following is the PRIMARY purpose of an information security policy?

Accepted Answer

To communicate management's commitment and direction for information security. An information security policy sets the high-level direction and principles for the security program, outlining management's commitment and expectations.

Answer

To provide detailed step-by-step instructions for implementing security controls

Answer

To specify the technical configurations for security devices

Answer

To define the roles and responsibilities for information security

Question 3

An IS auditor is reviewing the privileged access management (PAM) process. The auditor finds that shared administrative accounts are used for critical system maintenance and that passwords are changed quarterly. Which of the following is the BEST recommendation to mitigate the risk of audit trail loss?

Accepted Answer

Implement individual accounts with privilege escalation for administrative tasks. Shared accounts make it impossible to attribute actions to specific individuals. Implementing individual accounts with privilege escalation (e.g., sudo) allows for accountability and detailed audit trails.

Answer

Implement a password vault with automatic checkout and check-in

Answer

Increase the frequency of password changes to monthly

Answer

Require two-factor authentication for shared account usage

Question 4

An IS auditor is evaluating the effectiveness of a security awareness program. Which of the following metrics would BEST indicate that the program is achieving its objectives?

Accepted Answer

Reduction in the number of successful phishing attacks. A reduction in the number of successful phishing attacks over time demonstrates that employees are better at recognizing and reporting phishing attempts, indicating improved security awareness.

Answer

Scores on post-training quizzes

Answer

Percentage of employees who completed the annual training

Answer

Number of security incidents reported by employees

Question 5

An organization uses a public key infrastructure (PKI) to issue digital certificates. The IS auditor is reviewing the certificate lifecycle management. Which of the following is the GREATEST risk if certificate revocation lists (CRLs) are not updated in a timely manner?

Accepted Answer

Compromised certificates could still be used to establish trust. If CRLs are stale, revoked certificates may still be trusted, allowing unauthorized parties to impersonate legitimate entities or access encrypted data.

Answer

Certificate authorities may lose their root key

Answer

Certificates may expire without renewal

Answer

Users may not be able to verify certificate signatures

Question 6

An IS auditor is reviewing the physical access controls at a data center. Which of the following is the MOST effective control to prevent tailgating?

Accepted Answer

Mantrap. A mantrap requires one person to enter at a time and prevents unauthorized individuals from following an authorized person through a door.

Answer

Security guards at the entrance

Answer

CCTV cameras at the entrance

Answer

Biometric readers at all entrances

Question 7

During a review of the incident management process, the IS auditor finds that the incident response (IR) team conducts tabletop exercises annually, but the scenarios are limited to malware outbreaks. Which of the following should be the auditor's GREATEST concern?

Accepted Answer

The IR plan may not address all relevant incident types. Limited scenarios mean the IR team may not be prepared for other types of incidents, such as data breaches or insider threats, which require different response procedures.

Answer

The IR team may not have adequate forensic capabilities

Answer

The exercises are not conducted quarterly

Answer

The IR team is not following the defined procedures

Question 8

An IS auditor is reviewing the organization's encryption key management program. Which of the following is the MOST critical control to ensure the confidentiality of encrypted data in the event of a key compromise?

Accepted Answer

Key rotation at regular intervals. Key rotation ensures that if a key is compromised, only data encrypted with that key after a certain point is at risk; data encrypted with previous keys remains protected if those keys are properly destroyed.

Answer

Key generation using a strong random number generator

Answer

Key destruction procedures for retired keys

Answer

Key distribution via secure channels

Question 9

An IS auditor is assessing the effectiveness of network segmentation for a payment card processing environment. Which of the following is the PRIMARY benefit of network segmentation in meeting PCI DSS requirements?

Accepted Answer

Reduced scope of the PCI DSS assessment. Network segmentation reduces the scope of the PCI DSS assessment by isolating the cardholder data environment from other networks, so only systems that handle card data need to comply with PCI DSS.

Answer

Improved network performance

Answer

Elimination of the need for firewalls

Answer

Simplified patch management

Question 10

An organization processes personal data of EU residents and has implemented pseudonymisation as a privacy control. The IS auditor is reviewing the effectiveness of this control in meeting GDPR requirements. Which of the following is the MOST important limitation of pseudonymisation?

Accepted Answer

Pseudonymised data is still considered personal data under GDPR. Pseudonymisation reduces the link between data and an individual but does not fully anonymize the data; the pseudonymised data remains personal data if the pseudonym can be reversed using additional information held separately.

Answer

Pseudonymisation eliminates the need for data subject rights

Answer

Pseudonymisation is not recognized by GDPR

Answer

Pseudonymisation cannot be applied to structured data

Question 11

An IS auditor is reviewing the process for granting access to a critical financial system. The auditor finds that access requests are approved by the system owner but there is no segregation between the request and approval functions for emergency access. Which of the following is the BEST control to mitigate this risk?

Accepted Answer

Implement a break-glass procedure with post-event review. For emergency access, a break-glass procedure with post-event review ensures that urgent access is granted quickly but is later reviewed for appropriateness and accountability.

Answer

Require two-factor authentication for emergency access

Answer

Disable emergency access and require standard approval

Answer

Log all emergency access activities without review

Question 12

An IS auditor is reviewing the vulnerability management program. The auditor notes that a critical vulnerability was identified in a production system six months ago and has not been patched due to a business impact assessment. Which of the following should the auditor examine NEXT?

Accepted Answer

Whether a formal risk acceptance and compensating controls are in place. The auditor should verify that the risk acceptance is formally documented and approved by the appropriate management, including compensating controls, to ensure the risk is managed.

Answer

The technical details of the vulnerability

Answer

The patch deployment schedule for the next quarter

Answer

The vendor's patch release notes

Question 13

An IS auditor is reviewing the organization's data inventory process for privacy compliance. Which TWO of the following are the MOST important elements that should be included in the data inventory?

Accepted Answer

Data elements or fields containing personal data. Data inventory must identify what personal data is held, where it is stored, and how it flows. Legal basis and retention are also important, but location and data elements are foundational.

Answer

Data classification labels

Answer

Data retention periods

Answer

Data subject consent status

Question 14

During a firewall rule review, an IS auditor identifies several rules that allow any-to-any traffic. Which THREE of the following should the auditor recommend as the MOST appropriate actions?

Accepted Answer

Obtain business justification for each any-to-any rule. Overly permissive rules should be reviewed to determine if they are needed, and if so, should be tightened. If no business justification exists, they should be removed. If needed, they should be replaced with specific rules.

Answer

Immediately delete all any-to-any rules without review

Answer

Increase logging for any-to-any rules to detect misuse

Question 15

An IS auditor is reviewing the process for granting access to a sensitive financial application. Which TWO of the following are the MOST important controls to ensure appropriate access?

Accepted Answer

Quarterly recertification of access by managers. Formal approval from the data owner ensures that access is authorized based on business need, and periodic recertification ensures that access remains appropriate over time.

Answer

Use of biometric authentication

Answer

Single sign-on for all applications

Answer

Automatic provisioning upon employee hire

Question 16

An IS auditor is reviewing an organization's logical access control processes. Which of the following is the primary purpose of conducting regular user access recertifications?

Accepted Answer

To verify that users' access rights remain appropriate for their roles. User access recertifications confirm that current access rights are still appropriate for users' job functions and that no excessive privileges exist. This ensures the principle of least privilege.

Answer

To identify inactive user accounts

Answer

To ensure compliance with password policies

Answer

To enforce segregation of duties

Question 17

During an audit of an organization's information security programme, the IS auditor finds that the security awareness training completion rate is 95% but phishing simulation tests show a 30% failure rate. What should the auditor recommend?

Accepted Answer

Revise the security awareness program content to focus on practical phishing recognition. The gap between high training completion and poor phishing test results indicates that the training content is not effective in changing behavior. The auditor should recommend reviewing and improving the training to address weaknesses.

Answer

Increase the frequency of phishing simulations to quarterly

Answer

Disciplinary action for employees who fail phishing tests

Answer

Mandate that all employees repeat the training annually

Question 18

An IS auditor is reviewing firewall rule sets and discovers a rule that permits any source IP to access the internal database server on TCP port 1433 (Microsoft SQL). The rule was documented as a temporary measure but has been in place for 18 months. What is the auditor's BEST course of action?

Accepted Answer

Determine if there is a business justification for the rule and, if not, recommend removal or restriction to specific IPs. Overly permissive rules that are not justified create significant risk. The auditor should first confirm the business need and then recommend removal or tightening of the rule. If no valid justification exists, the rule should be removed.

Answer

Report the issue to senior management as a critical finding

Answer

Recommend immediate removal of the rule

Answer

Accept the risk as a compensating control

Question 19

An organization is implementing a privileged access management (PAM) solution. Which of the following is the PRIMARY benefit of using a PAM tool?

Accepted Answer

Centralized management and monitoring of privileged account usage. PAM tools primarily help control and monitor the use of privileged accounts, thus reducing the risk of misuse by enforcing policies like session recording and just-in-time access.

Answer

Elimination of shared accounts by providing individual credentials

Answer

Enforcement of segregation of duties between IT and security teams

Answer

Automated password resets for user accounts

Question 20

An IS auditor is reviewing physical access controls at a data center. Which of the following controls is MOST effective for preventing tailgating?

Accepted Answer

Mantrap. A mantrap is a small room with two interlocking doors that prevents tailgating because only one person can pass through at a time.

Answer

CCTV cameras

Answer

Visitor log

Answer

Biometric readers