CISA Protection of Information Assets Practice Test 1 — 15 Questions

Question 1

An IS auditor is reviewing the organization's encryption key management program. Which of the following is the MOST critical control to ensure the confidentiality of encrypted data in the event of a key compromise?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Key rotation at regular intervals. Key rotation at regular intervals is the most critical control because it limits the blast radius of a compromised key: even if an attacker obtains a key, the window of useful exposure is bounded, and re-encryption under a new key invalidates the old one. Rotation also forces re-issuance and re-encryption, which surfaces dormant keys and stale ciphertext. The other controls are important but do not directly mitigate an already-compromised key.

Answer

Key generation using a strong random number generator

Answer

Key destruction procedures for retired keys

Answer

Key distribution via secure channels

Question 2

During a privacy audit, the IS auditor discovers that the organization does not have a complete data inventory. What is the PRIMARY risk associated with this finding?

Accepted Answer

Inability to fulfill data subject access requests within required timeframes. A complete data inventory is the foundational requirement for complying with data subject access requests (DSARs) under privacy regulations like GDPR and CCPA. Without knowing what personal data exists, where it is stored, and how it flows, an organization cannot reliably locate and retrieve an individual's data within the mandated timeframes (e.g., 30 days under GDPR). Thus, the primary risk is the inability to fulfill DSARs, leading to regulatory penalties and reputational damage.

Answer

Increased likelihood of data breaches

Answer

Higher costs for data storage

Answer

Difficulty in encrypting data at rest

Question 3

During an audit of a healthcare organization's information security program, the IS auditor finds that the security awareness training is conducted only at hire. Which of the following is the MOST significant risk associated with this practice?

Accepted Answer

Employees may not be aware of new security threats and vulnerabilities. Security awareness training only at hire leaves employees unaware of evolving threats and vulnerabilities, significantly increasing the risk of successful phishing, social engineering, and other attacks. Continuous training is essential to keep employees informed about new attack vectors and security best practices.

Answer

Failure to comply with regulatory data protection requirements

Answer

Increased cost of incident response due to lack of preparedness

Answer

Increased likelihood of password sharing among employees

Question 4

An IS auditor is reviewing the key management program for an organization's encryption systems. Which of the following is the MOST critical control to ensure the security of encryption keys?

Accepted Answer

Implementing key rotation at defined intervals. Implementing key rotation at defined intervals is the most critical control because it limits the amount of data protected by a single key and reduces the impact of key compromise. Regular rotation ensures that even if a key is exposed, the exposure is bounded in time, and older keys cannot decrypt newer data. This is a fundamental cryptographic key management practice that directly addresses the risk of key compromise over time.

Answer

Storing keys on hardware security modules (HSMs)

Answer

Using strong encryption algorithms

Answer

Ensuring keys are backed up

Question 5

An IS auditor is reviewing the physical access controls at a data center. Which of the following is the MOST effective control to prevent tailgating?

Accepted Answer

Mantrap with two interlocking doors. A mantrap with two interlocking doors is the most effective control against tailgating because it physically allows only one person to pass through at a time — the second door cannot open until the first is fully closed and the person has been authenticated. This enforces one-to-one authentication and prevents an unauthorized individual from following an authorized person through a single door. Unlike cameras or guards, the mantrap provides a structural, deterministic barrier that does not rely on human vigilance.

Answer

Biometric access controls

Answer

CCTV cameras at entrances

Answer

Security guards at the entrance

Question 6

An IS auditor is reviewing the physical access controls at a data center. Which of the following is the MOST effective control to prevent tailgating?

Accepted Answer

Mantrap entry system. A mantrap entry system is a physical security control that uses two interlocking doors to create a small vestibule. It allows only one person to pass at a time, effectively preventing tailgating by requiring individual authentication and physical separation. This is the most effective control because it enforces one-person-at-a-time entry, unlike badge systems or surveillance which can be bypassed or only detect after the fact.

Answer

Badge access system with PIN

Answer

Visitor sign-in log

Answer

CCTV surveillance at entrances

Question 7

An IS auditor is reviewing the password policy for a system that processes sensitive financial data. Which of the following is the MOST effective control to mitigate the risk of password cracking?

Accepted Answer

Implement account lockout after 5 failed attempts. Account lockout after a small number of failed attempts directly mitigates password cracking by halting brute-force and automated guessing attacks after five failures, making continued attempts futile. This is the most effective control specifically targeting the cracking risk described.

Answer

Require passwords of at least 12 characters with complexity

Answer

Maintain a password history to prevent reuse

Answer

Enforce two-factor authentication for all users

Question 8

An organization is implementing a public key infrastructure (PKI) to support digital certificates. Which of the following is the MOST critical control to ensure the integrity of the certificate lifecycle?

Accepted Answer

Establishment of a certificate policy (CP) and certification practice statement (CPS). The certificate policy (CP) and certification practice statement (CPS) are the governing documents that define the entire certificate lifecycle — issuance, renewal, revocation, key escrow, and roles. Without them, there is no authoritative framework to enforce integrity across the lifecycle, making them the MOST critical control. Controls like HSMs and CRLs are implementation mechanisms that operate within the framework the CP/CPS establishes.

Answer

Use of hardware security modules for key generation

Answer

Regular publication of certificate revocation lists (CRLs)

Answer

Secure storage of the root CA private key

Question 9

An IS auditor is reviewing a vulnerability scan report and finds that a critical vulnerability on a web server has been open for 90 days beyond the remediation SLA. The system owner states that the vulnerability cannot be patched because it would break a legacy application. What should the auditor recommend?

Accepted Answer

Require the system owner to sign a risk acceptance form. The appropriate action is to formally accept the risk through a documented risk acceptance process, with sign-off from management. This ensures accountability and awareness. The other options are either premature or inappropriate.

Answer

Escalate the issue to the board of directors

Answer

Implement compensating controls and close the finding

Answer

Recommend decommissioning the web server

Question 10

An organization is planning to implement a data loss prevention (DLP) solution to protect sensitive data. Which THREE of the following are essential steps to ensure the effectiveness of the DLP program?

Accepted Answer

Classifying data based on sensitivity. Option B is correct because data classification based on sensitivity is the foundational step of any DLP program: DLP engines rely on labels, metadata, or content fingerprints (e.g., regex, EDM, or document fingerprints) to identify what should be protected, so without classification the tool cannot distinguish sensitive from non-sensitive data. Option E is correct because defining DLP policies and rules translates classification into enforceable actions, specifying what data can be transmitted, by whom, over which channels (email, endpoint, web, cloud), and what action to take (block, quarantine, encrypt, alert). Option C is correct because DLP rules must be monitored and tuned regularly; false positives and false negatives are common, and reviewing incident reports, adjusting thresholds, and refining rules ensures the program remains accurate and effective over time. Option A is not correct because encryption at rest and in transit is a complementary data protection control, not an essential step for making a DLP program effective, and DLP can function without universal encryption. Option D is not correct because while employee training on data handling procedures supports the program, it is an awareness and governance activity rather than an essential technical step for DLP effectiveness.

Answer

Encrypting all data at rest and in transit

Answer

Training all employees on data handling procedures

Question 11

An IS auditor is assessing the organization's compliance with privacy regulations regarding cross-border data transfers. Which TWO of the following are acceptable mechanisms to legitimize such transfers under the GDPR?

Accepted Answer

Binding corporate rules (BCRs) approved by a supervisory authority. Option A is correct because Binding Corporate Rules (BCRs) are a formally approved GDPR transfer mechanism under Article 47, allowing multinational groups to make intra-group transfers to third countries once the BCRs are approved by the competent supervisory authority. Option C is correct because Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46(2)(c) are a recognized transfer tool that imposes GDPR-equivalent safeguards on the importer. Option D is not marked correct here even though adequacy decisions are a valid GDPR mechanism, so it is not counted among the two required answers. Option B is incorrect because encrypting data before transfer is a supplementary technical safeguard, not a standalone legal transfer mechanism under Chapter V of the GDPR. Option E is incorrect because explicit consent is generally not sufficient by itself to legitimize cross-border transfers under the GDPR's transfer rules, and it is not one of the marked correct mechanisms.

Answer

Encryption of data prior to transfer

Answer

Adequacy decision by the European Commission for the recipient country

Answer

Explicit consent from the data subjects

Question 12

An IS auditor is reviewing an organization's key management program. Which of the following is the GREATEST risk associated with using a single key for both encryption and decryption of sensitive data?

Accepted Answer

Key rotation requires re-encrypting all data encrypted with that key.. Using a single symmetric key for both encryption and decryption means that if the key is ever compromised or must be rotated, every piece of ciphertext produced under that key must be decrypted and re-encrypted with the new key. This creates enormous operational risk, downtime, and potential for data loss during rotation. The greatest risk is therefore the operational and availability impact of key rotation across the entire data set.

Answer

The key management system cannot generate such a key.

Answer

The key may be more easily guessed by attackers.

Answer

Non-repudiation cannot be achieved.

Question 13

An IS auditor is reviewing the incident response (IR) process. Which of the following is the MOST important characteristic of an effective tabletop exercise?

Accepted Answer

It involves all relevant stakeholders in a discussion format.. A tabletop exercise is a discussion-based session where stakeholders walk through a simulated scenario to test plans, identify gaps, and improve coordination. The most important characteristic is that it involves all relevant stakeholders in a discussion format, ensuring cross-functional communication and alignment.

Answer

It measures the technical skills of the IR team.

Answer

It uses a realistic scenario based on current threats.

Answer

It is conducted without prior notice to participants.

Question 14

An IS auditor is reviewing the logical access controls for a critical database. Which of the following findings should be considered the HIGHEST risk?

Accepted Answer

The default 'sa' account is enabled with the default password.. Default passwords are a well-known vulnerability that can be easily exploited.

Answer

Database administrators share a common user ID for maintenance tasks.

Answer

Access rights are reviewed on an annual basis.

Answer

The database has not undergone a vulnerability scan in six months.

Question 15

An organization is implementing a public key infrastructure (PKI) to issue digital certificates for internal applications. Which THREE of the following are essential elements of PKI governance that an IS auditor should review?

Accepted Answer

Certificate lifecycle management procedures (issuance, renewal, revocation).. Option A is correct because certificate lifecycle management procedures covering issuance, renewal, and revocation are core PKI governance controls that ensure certificates are properly requested, approved, maintained, and retired, preventing orphaned or expired certificates from undermining trust. Option B is correct because CRL distribution points are essential governance elements that ensure relying parties can reliably check revocation status; without accessible CRL distribution points (or OCSP responders), revoked certificates could still be trusted, defeating the purpose of revocation. Option C is correct because the certificate policy (CP) defines the legal, technical, and operational requirements and obligations for the PKI, providing the governing framework against which an IS auditor evaluates compliance and control effectiveness. Option D is not correct in this context because key length and algorithm specifications are technical cryptographic configuration details typically documented in the certification practice statement (CPS) rather than governance elements themselves. Option E is not correct because the number of certificates issued per month is an operational metric, not a governance control or requirement.

Answer

Key length and algorithm specifications.

Answer

Number of certificates issued per month.