CISA Protection of Information Assets Practice Test 2 — 15 Questions

Question 1

An IS auditor is reviewing an organization's logical access control processes. Which of the following is the primary purpose of conducting regular user access recertifications?

Accepted Answer

To verify that users' access rights remain appropriate for their roles. User access recertifications confirm that current access rights are still appropriate for users' job functions and that no excessive privileges exist. This ensures the principle of least privilege.

Answer

To identify inactive user accounts

Answer

To ensure compliance with password policies

Answer

To enforce segregation of duties

Question 2

During an audit of an organization's information security programme, the IS auditor finds that the security awareness training completion rate is 95% but phishing simulation tests show a 30% failure rate. What should the auditor recommend?

Accepted Answer

Revise the security awareness program content to focus on practical phishing recognition. The gap between high training completion and poor phishing test results indicates that the training content is not effective in changing behavior. The auditor should recommend reviewing and improving the training to address weaknesses.

Answer

Increase the frequency of phishing simulations to quarterly

Answer

Disciplinary action for employees who fail phishing tests

Answer

Mandate that all employees repeat the training annually

Question 3

An IS auditor is reviewing firewall rule sets and discovers a rule that permits any source IP to access the internal database server on TCP port 1433 (Microsoft SQL). The rule was documented as a temporary measure but has been in place for 18 months. What is the auditor's BEST course of action?

Accepted Answer

Determine if there is a business justification for the rule and, if not, recommend removal or restriction to specific IPs. Overly permissive rules that are not justified create significant risk. The auditor should first confirm the business need and then recommend removal or tightening of the rule. If no valid justification exists, the rule should be removed.

Answer

Report the issue to senior management as a critical finding

Answer

Recommend immediate removal of the rule

Answer

Accept the risk as a compensating control

Question 4

An organization is implementing a privileged access management (PAM) solution. Which of the following is the PRIMARY benefit of using a PAM tool?

Accepted Answer

Centralized management and monitoring of privileged account usage. PAM tools primarily help control and monitor the use of privileged accounts, thus reducing the risk of misuse by enforcing policies like session recording and just-in-time access.

Answer

Elimination of shared accounts by providing individual credentials

Answer

Enforcement of segregation of duties between IT and security teams

Answer

Automated password resets for user accounts

Question 5

An IS auditor is reviewing physical access controls at a data center. Which of the following controls is MOST effective for preventing tailgating?

Accepted Answer

Mantrap. A mantrap is a small room with two interlocking doors that prevents tailgating because only one person can pass through at a time.

Answer

CCTV cameras

Answer

Visitor log

Answer

Biometric readers

Question 6

During a review of encryption practices, the IS auditor finds that an organization uses the same encryption key for all customer data at rest. What is the PRIMARY concern?

Accepted Answer

Increased risk of data exposure if the key is compromised. Using a single key for all data increases the impact of key compromise. If the key is compromised, all data becomes accessible. Key management should include key rotation and different keys for different data sets.

Answer

Performance degradation due to key reuse

Answer

Inability to revoke access to specific data

Answer

Non-compliance with GDPR pseudonymization requirements

Question 7

An IS auditor is evaluating the patch management process. The auditor notes that critical security patches are applied within 30 days, but the policy requires 7 days. The IT manager states that the delay is due to testing requirements. What should the auditor recommend?

Accepted Answer

Implement a risk-based patching process that allows faster deployment for critical patches. The auditor should recommend a risk-based approach that allows expedited patching for critical vulnerabilities while maintaining testing for less critical ones. The process should be reviewed to balance security and stability.

Answer

Require automated patching without testing

Answer

Accept the current practice as a compensating control

Answer

Modify the policy to align with the actual patching timeline

Question 8

An organization has implemented a key management program. Which of the following is the MOST critical control for ensuring the security of cryptographic keys?

Accepted Answer

Secure key storage (e.g., HSM). Secure key storage, such as using a hardware security module (HSM) or key vault, is critical to prevent unauthorized access to keys. Without secure storage, other controls are less effective.

Answer

Key rotation policy

Answer

Key generation in a secure environment

Answer

Key destruction procedures

Question 9

An IS auditor is reviewing the incident response (IR) process. Which of the following is the BEST way to test the effectiveness of the IR plan?

Accepted Answer

Conducting a tabletop exercise. Tabletop exercises simulate real incidents and allow the team to practice their response, revealing gaps in the plan and coordination.

Answer

Checking the availability of forensic tools

Answer

Interviewing the IR team

Answer

Reviewing IR policies and procedures

Question 10

During a privacy audit, the IS auditor discovers that the organization does not have a complete data inventory. What is the PRIMARY risk associated with this finding?

Accepted Answer

Inability to fulfill data subject access requests within required timeframes. Without knowing where PII is stored and processed, the organization cannot effectively protect it, respond to data subject requests, or ensure compliance with privacy regulations like GDPR.

Answer

Increased likelihood of data breaches

Answer

Higher costs for data storage

Answer

Difficulty in encrypting data at rest

Question 11

An IS auditor is reviewing a penetration test report that shows a critical vulnerability in a web application. The IT manager states that the vulnerability will not be fixed because it requires significant code changes and the application is being decommissioned in six months. What should the auditor do?

Accepted Answer

Verify that the risk has been formally accepted and compensating controls are implemented. The auditor should verify that the risk is formally accepted by management and that compensating controls are in place to protect the application until decommissioning.

Answer

Accept the decision as business risk acceptance

Answer

Escalate to senior management as a critical finding

Answer

Recommend immediate decommissioning of the application

Question 12

An organization uses shared accounts for system administration. Which of the following is the MOST significant audit concern?

Accepted Answer

Lack of individual accountability and audit trail. Shared accounts make it impossible to attribute actions to specific individuals, leading to loss of audit trail and non-repudiation. This is critical for forensic investigations and accountability.

Answer

Increased complexity of password management

Answer

Violation of segregation of duties

Answer

Higher risk of password sharing outside the team

Question 13

An IS auditor is assessing network security controls. Which TWO of the following are key elements of a firewall rule review?

Accepted Answer

Verifying that each rule has a business justification. A firewall rule review should compare documented rules with actual configured rules and verify business justifications for each rule.

Answer

Checking for default passwords on firewall

Answer

Testing firewall failover capabilities

Answer

Reviewing firewall performance metrics

Question 14

An organization is implementing a privacy program to comply with GDPR. Which THREE of the following are essential elements for managing cross-border data transfers?

Accepted Answer

Standard Contractual Clauses (SCCs). Under GDPR, cross-border data transfers require appropriate safeguards such as Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or an adequacy decision by the European Commission.

Answer

Data Protection Impact Assessment (DPIA)

Answer

Data encryption at rest

Question 15

During an audit of physical security, the IS auditor observes that employees frequently leave confidential documents on their desks overnight. Which TWO controls should the auditor recommend?

Accepted Answer

Conduct security awareness training. A clean desk policy requires employees to secure documents at end of day, and a security awareness program reminds them of the policy and consequences.

Answer

Deploy additional CCTV cameras

Answer

Implement a visitor management system

Answer

Install motion detectors