CISA Protection of Information Assets Practice Test 2 — 15 Questions

Question 1

An IS auditor is reviewing the data subject rights fulfillment process for GDPR compliance. Which TWO of the following are required to be completed within the one-month response period?

Accepted Answer

Right to erasure (deleting personal data).. Under GDPR Article 12(3), controllers must respond to data subject requests without undue delay and in any event within one month, and this deadline applies to the rights exercised in this scenario. Option A, the right to erasure (Article 17), is correct because a controller must act on a valid erasure request—deleting the personal data—within that one-month period, subject only to permitted extensions. Option D, the right of access (Article 15), is correct because the controller must provide the data subject with a copy of their personal data and related information within the same one-month deadline. Although the right to rectification (C), the right to object (B), and the right to data portability (E) are also GDPR rights subject to the Article 12 timeline, they are not the two options marked as correct here, so they do not belong in this answer set.

Answer

Right to object to processing (ceasing processing).

Answer

Right to rectification (correcting inaccurate data).

Answer

Right to data portability (transferring data to another controller).

Question 2

An IS auditor is evaluating the encryption key management program of a healthcare organization that processes protected health information (PHI). The organization uses a mix of symmetric and asymmetric keys. Which TWO of the following are key management practices that should be addressed to ensure effective protection of PHI?

Accepted Answer

Storing encryption keys in a hardware security module (HSM). Option A is correct because storing encryption keys in a hardware security module (HSM) protects them from unauthorized access and tampering, as HSMs are tamper-resistant devices that perform cryptographic operations and safeguard key material, which is essential for protecting PHI. Option E is correct because rotating keys on a periodic basis or after a security incident limits the amount of data exposed if a key is compromised and is a fundamental key management practice (e.g., per NIST SP 800-57) for maintaining effective protection of PHI. Option B is not correct because key escrow for all keys is not a universal requirement and can introduce additional risk by creating a central point of compromise, so it is not a practice that should be addressed for effective protection. Option C is not correct because using the same key to encrypt all PHI is poor cryptographic practice, as compromise of one key would expose all data and it violates key separation principles. Option D is not correct because distributing keys along with encrypted data defeats the purpose of encryption, since anyone intercepting the data would also obtain the key.

Answer

Implementing a key escrow mechanism for all keys

Answer

Using the same key to encrypt all PHI for simplicity

Answer

Distributing keys to authorized users along with encrypted data

Question 3

During an audit of incident management processes, the IS auditor reviews past incident reports and conducts interviews. The organization recently experienced a ransomware attack that encrypted critical systems. The incident response team was able to contain the attack but struggled with forensic collection due to lack of pre-defined procedures. Which TWO of the following should the auditor recommend as the HIGHEST priority improvements?

Accepted Answer

Conducting tabletop exercises with the incident response team. Option E is correct because the scenario explicitly states the team struggled with forensic collection due to the lack of pre-defined procedures, so developing and documenting formal forensic investigation procedures directly addresses the root cause and is a foundational, high-priority improvement. Option A is correct because tabletop exercises validate and rehearse the incident response and forensic procedures with the team, exposing gaps in roles, communication, and evidence handling before a real incident occurs, which is essential given the team's demonstrated difficulties. Option B is not the highest priority because advanced malware analysis tools are ineffective without defined processes and trained personnel to use them. Option C is not the highest priority because backup frequency addresses recovery and data availability, not the forensic collection deficiency identified in the audit. Option D is not the highest priority because chain of custody is only one component of forensic handling and should be embedded within the broader documented forensic procedures recommended in option E.

Answer

Acquiring advanced malware analysis tools

Answer

Implementing a more frequent backup schedule

Answer

Establishing a formal chain of custody process

Question 4

An IS auditor is assessing the vulnerability management program of a financial services company. The auditor reviews the latest vulnerability scan report and finds that several critical vulnerabilities have not been patched within the defined SLA of 30 days. The IT manager explains that patches could not be applied due to compatibility issues with legacy applications, and risk acceptance has been documented for some but not all. Which THREE of the following are the MOST appropriate audit findings?

Accepted Answer

Risk acceptance is not documented for all unpatched critical vulnerabilities. Option B is correct because the scenario explicitly states that risk acceptance has been documented for some but not all unpatched critical vulnerabilities, which is a clear governance and documentation gap that an IS auditor should report. Option C is correct because the IT manager's explanation that patches could not be applied due to compatibility issues with legacy applications indicates the 30-day SLA may not be achievable for those systems, making the SLA itself a valid audit finding regarding its realism and alignment with the risk profile. Option D is correct because the finding that several critical vulnerabilities remain unpatched raises the question of whether the vulnerability scanning schedule actually covers all assets, since incomplete coverage could explain why some vulnerabilities were missed or not tracked to remediation. Option A is not supported because the scenario describes management reviewing the scan report and providing explanations, so there is no evidence that reports are unreviewed. Option E is not the most appropriate finding because the unpatched critical vulnerabilities are already explained by documented compatibility issues and partial risk acceptance, making the root causes in B, C, and D the more precise audit findings rather than restating the symptom.

Answer

Vulnerability scan reports are not reviewed by management

Answer

Critical vulnerabilities are not being patched within the defined SLA

Question 5

An IS auditor is evaluating the privacy controls of an e-commerce company that collects and processes personal data from customers in multiple jurisdictions, including the European Union (GDPR). The company has a data inventory but has not conducted a privacy impact assessment (PIA) for a new customer analytics platform that processes sensitive data. Which THREE of the following are the MOST critical deficiencies that the auditor should report?

Accepted Answer

Lack of a privacy impact assessment (PIA) for the new platform. The scenario explicitly states that no privacy impact assessment (PIA) was conducted for the new customer analytics platform processing sensitive data, so option B is a critical deficiency because GDPR Article 35 requires a DPIA before processing that is likely to result in a high risk to data subjects, especially for sensitive data and large-scale analytics. Option D is correct because the company processes personal data from multiple jurisdictions including the EU, and without cross-border transfer mechanisms such as Standard Contractual Clauses (SCCs) or an adequacy decision, transfers of EU personal data to third countries would violate GDPR Chapter V. Option E is correct because insufficient consent management processes undermine the lawful basis for processing, and GDPR Articles 6 and 7 require valid, specific, informed, and unambiguous consent where consent is relied upon, along with easy withdrawal. Option A is not among the marked correct answers because, although data minimization is a GDPR principle under Article 5(1)(c), the question asks for the most critical deficiencies given the stated facts, and the scenario does not specifically identify inadequate data minimization in the platform design. Option C is not marked correct because, while an up-to-date privacy notice is required under GDPR Articles 13 and 14, the scenario does not state that the website privacy notice is outdated or missing, making it less directly supported by the facts than the three identified deficiencies.

Answer

Inadequate data minimization practices in the platform design

Answer

Lack of an up-to-date privacy notice on the website

Question 6

An IS auditor is assessing the security of an organization's virtualization platform that hosts production workloads. The auditor is concerned about risks that arise specifically from the hypervisor layer. Which TWO of the following are the MOST significant risks unique to the virtualized environment? (Choose two.)

Accepted Answer

Virtual machine sprawl can result in unmanaged, unpatched guests that expand the attack surface.. Virtualization concentrates control in the hypervisor and makes provisioning trivial. A compromised hypervisor can read memory and traffic belonging to every guest on the host, an exposure without a direct physical-server equivalent. Equally, easy creation of guests leads to sprawl and unmanaged, unpatched virtual machines that quietly enlarge the attack surface. Shared hardware, patch cadence, and snapshot retention are concerns, but they are not the risks most characteristic of the hypervisor layer itself.

Answer

Snapshots and templates can retain sensitive data and credentials that persist after systems are decommissioned.

Answer

Virtual machines require more frequent operating system patching than physical servers.

Answer

Guests on the same host share physical network interface cards, so a failure of one NIC affects all guests.

Question 7

An IS auditor is evaluating the security of an organization's wireless network. The auditor discovers that the network uses WPA2-Enterprise with PEAP and MSCHAPv2 for authentication. Which of the following is the MOST significant security weakness in this configuration?

Accepted Answer

MSCHAPv2 is vulnerable to dictionary attacks and does not provide strong protection for credentials.. MSCHAPv2 is a legacy authentication protocol with well-documented vulnerabilities, particularly its susceptibility to offline dictionary attacks. When used as the inner authentication method in PEAP, it exposes user credentials to recovery if an attacker captures the authentication handshake. For wireless networks, where eavesdropping is relatively easy, this poses a significant risk. Stronger alternatives like EAP-TLS or PEAP with EAP-MSCHAPv2 with strong password policies and certificate validation should be considered.

Answer

WPA2-Enterprise does not support the use of digital certificates for client authentication.

Answer

PEAP does not provide mutual authentication between the client and the authentication server.

Answer

The wireless network is not using a RADIUS server for centralized authentication.

Question 8

An IS auditor is reviewing the logical access controls for a financial application. The auditor notices that user access reviews are performed annually by the application owner, but there is no documentation indicating that managers confirm the continued need for access. Which of the following is the MOST significant risk associated with this finding?

Accepted Answer

Unauthorized access to sensitive data due to excessive privileges. The most significant risk is unauthorized access to sensitive data due to excessive privileges, because the absence of manager confirmation means access rights may persist after role changes or terminations, accumulating unnecessary entitlements. Annual reviews by the application owner alone, without manager validation, fail to verify that each user still requires access for their current duties. This directly enables the accumulation of excessive privileges, which is the primary threat to data confidentiality in a financial application.

Answer

Increased likelihood of successful social engineering attacks

Answer

Non-compliance with regulatory requirements for access controls

Answer

Inability to detect insider threats in a timely manner

Question 9

During an audit of the information security program, the IS auditor reviews the organization's information security policy. Which of the following is the PRIMARY purpose of an information security policy?

Accepted Answer

To communicate management's commitment and direction for information security. The primary purpose of an information security policy is to communicate management's commitment, intent, and direction for information security across the organization. It is a high-level governance document that establishes the mandate from which standards, procedures, and guidelines flow. It is not intended to be technically prescriptive or operational.

Answer

To provide detailed step-by-step instructions for implementing security controls

Answer

To specify the technical configurations for security devices

Answer

To define the roles and responsibilities for information security

Question 10

An IS auditor is reviewing the privileged access management (PAM) process. The auditor finds that shared administrative accounts are used for critical system maintenance and that passwords are changed quarterly. Which of the following is the BEST recommendation to mitigate the risk of audit trail loss?

Accepted Answer

Implement individual accounts with privilege escalation for administrative tasks. Individual accounts with privilege escalation ensure that every administrative action is tied to a unique user identity, which is the only way to preserve a reliable, attributable audit trail. Shared accounts inherently destroy accountability because the log records the account, not the person. Privilege escalation (e.g., sudo, just-in-time elevation) grants elevated rights only when needed, so the audit trail captures who performed each privileged action.

Answer

Implement a password vault with automatic checkout and check-in

Answer

Increase the frequency of password changes to monthly

Answer

Require two-factor authentication for shared account usage

Question 11

An IS auditor is evaluating the effectiveness of a security awareness program. Which of the following metrics would BEST indicate that the program is achieving its objectives?

Accepted Answer

Reduction in the number of successful phishing attacks. The primary objective of a security awareness program is to change employee behavior to reduce security risks. A reduction in successful phishing attacks directly measures whether employees are applying what they learned to avoid real-world threats, making it the best outcome-based metric. Post-training quiz scores, completion rates, and incident reporting numbers are activity or output metrics that do not necessarily reflect actual behavioral change or risk reduction.

Answer

Scores on post-training quizzes

Answer

Percentage of employees who completed the annual training

Answer

Number of security incidents reported by employees

Question 12

An organization uses a public key infrastructure (PKI) to issue digital certificates. The IS auditor is reviewing the certificate lifecycle management. Which of the following is the GREATEST risk if certificate revocation lists (CRLs) are not updated in a timely manner?

Accepted Answer

Compromised certificates could still be used to establish trust. If CRLs are not updated in a timely manner, a certificate that has been revoked due to compromise or misuse will still appear valid to relying parties, allowing it to be used to establish trust. This defeats the purpose of revocation and can enable man-in-the-middle or impersonation attacks. Timely CRL publication is essential for the integrity of the PKI trust model.

Answer

Certificate authorities may lose their root key

Answer

Certificates may expire without renewal

Answer

Users may not be able to verify certificate signatures

Question 13

An IS auditor is reviewing the physical access controls at a data center. Which of the following is the MOST effective control to prevent tailgating?

Accepted Answer

Mantrap. A mantrap is a physical security control consisting of a small vestibule with two interlocking doors, where the first door must close and the person must be authenticated before the second door opens. This design physically prevents tailgating because only one person can occupy the space at a time, and unauthorized individuals cannot slip through behind an authorized person. It is the most effective preventive control specifically engineered to defeat tailgating.

Answer

Security guards at the entrance

Answer

CCTV cameras at the entrance

Answer

Biometric readers at all entrances

Question 14

During a review of the incident management process, the IS auditor finds that the incident response (IR) team conducts tabletop exercises annually, but the scenarios are limited to malware outbreaks. Which of the following should be the auditor's GREATEST concern?

Accepted Answer

The IR plan may not address all relevant incident types. If tabletop exercises only cover malware outbreaks, the incident response plan may not be validated against other relevant incident types such as ransomware, insider threats, DDoS, or data breaches. The greatest concern is that the IR plan has untested gaps for scenarios the organization is likely to face. This is a coverage and validation issue, not a frequency or capability issue.

Answer

The IR team may not have adequate forensic capabilities

Answer

The exercises are not conducted quarterly

Answer

The IR team is not following the defined procedures

Question 15

An IS auditor is assessing the effectiveness of network segmentation for a payment card processing environment. Which of the following is the PRIMARY benefit of network segmentation in meeting PCI DSS requirements?

Accepted Answer

Reduced scope of the PCI DSS assessment. Network segmentation reduces the scope of the PCI DSS assessment by isolating the cardholder data environment from other networks, so only systems that handle card data need to comply with PCI DSS.

Answer

Improved network performance

Answer

Elimination of the need for firewalls

Answer

Simplified patch management