CISA Protection of Information Assets Practice Test 3 — 15 Questions

Question 1

An organization processes personal data of EU residents and has implemented pseudonymisation as a privacy control. The IS auditor is reviewing the effectiveness of this control in meeting GDPR requirements. Which of the following is the MOST important limitation of pseudonymisation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pseudonymised data is still considered personal data under GDPR. Under GDPR Article 4(5), pseudonymisation is a technique where personal data can no longer be attributed to a specific data subject without additional information kept separately. However, because re-identification remains possible with that additional information, pseudonymised data is still legally considered personal data under GDPR, meaning data subject rights, breach notification, and other obligations continue to apply. This is the most important limitation an IS auditor must recognize when assessing the control's effectiveness.

Answer

Pseudonymisation eliminates the need for data subject rights

Answer

Pseudonymisation is not recognized by GDPR

Answer

Pseudonymisation cannot be applied to structured data

Question 2

An IS auditor is reviewing the process for granting access to a critical financial system. The auditor finds that access requests are approved by the system owner but there is no segregation between the request and approval functions for emergency access. Which of the following is the BEST control to mitigate this risk?

Accepted Answer

Implement a break-glass procedure with post-event review. A break-glass procedure with post-event review directly addresses the lack of segregation between request and approval for emergency access by allowing immediate access while ensuring independent retrospective review. This compensates for the missing preventive segregation with a detective control that validates the emergency was legitimate. It preserves the ability to respond to incidents without waiting for standard approvals.

Answer

Require two-factor authentication for emergency access

Answer

Disable emergency access and require standard approval

Answer

Log all emergency access activities without review

Question 3

An IS auditor is reviewing the vulnerability management program. The auditor notes that a critical vulnerability was identified in a production system six months ago and has not been patched due to a business impact assessment. Which of the following should the auditor examine NEXT?

Accepted Answer

Whether a formal risk acceptance and compensating controls are in place. When a critical vulnerability remains unpatched due to a business impact assessment, the auditor's next step is to verify whether a formal risk acceptance and compensating controls are in place, because unpatched critical vulnerabilities require documented management approval and mitigating measures. This ensures the organization has consciously accepted the risk with proper governance rather than leaving it unaddressed. The auditor must confirm that the decision was authorized, documented, and supported by controls that reduce the residual risk to an acceptable level.

Answer

The technical details of the vulnerability

Answer

The patch deployment schedule for the next quarter

Answer

The vendor's patch release notes

Question 4

An IS auditor is reviewing the organization's data inventory process for privacy compliance. Which TWO of the following are the MOST important elements that should be included in the data inventory?

Accepted Answer

Data elements or fields containing personal data. Option A is correct because a data inventory must identify the specific data elements or fields that contain personal data, since this is the foundational step for determining what privacy obligations (e.g., GDPR, CCPA) apply and where protection controls are needed. Option C is correct because knowing the location of personal data storage and processing—whether on-premises, in the cloud, or across jurisdictions—is essential for assessing cross-border transfer restrictions, access controls, and regulatory applicability. Options B, D, and E, while useful attributes that may be recorded in a mature inventory, are not the most important core elements; classification labels, retention periods, and consent status are downstream details that depend on first knowing what personal data exists and where it resides.

Answer

Data classification labels

Answer

Data retention periods

Answer

Data subject consent status

Question 5

During a firewall rule review, an IS auditor identifies several rules that allow any-to-any traffic. Which THREE of the following should the auditor recommend as the MOST appropriate actions?

Accepted Answer

Obtain business justification for each any-to-any rule. Option A is correct because an IS auditor must first obtain business justification for each any-to-any rule, since a rule may be required for a legitimate business or technical purpose and cannot be judged in isolation. Option B is correct because the fundamental remediation for overly permissive rules is to replace any-to-any rules with specific source, destination, port, and protocol rules that enforce least privilege and reduce the attack surface. Option E is correct because any any-to-any rule that lacks a valid business justification should be removed, as it represents unnecessary exposure with no documented need. Option C is not appropriate because immediately deleting all any-to-any rules without review could disrupt legitimate business traffic and cause outages, violating change management and availability requirements. Option D is not the most appropriate action because increasing logging only detects misuse after the fact; it does not remediate the excessive permissiveness that the auditor should recommend eliminating.

Answer

Immediately delete all any-to-any rules without review

Answer

Increase logging for any-to-any rules to detect misuse

Question 6

An IS auditor is reviewing the process for granting access to a sensitive financial application. Which TWO of the following are the MOST important controls to ensure appropriate access?

Accepted Answer

Quarterly recertification of access by managers. Option C is correct because quarterly recertification of access by managers ensures that users' privileges are periodically reviewed and revoked when no longer needed, directly supporting the principle of least privilege and preventing privilege creep in a sensitive financial application. Option E is correct because access requests approved by the data owner enforce proper authorization by the individual accountable for the data, ensuring that only legitimate business needs grant access to sensitive financial information. Biometric authentication (A) strengthens identity verification but does not by itself ensure that access rights are appropriate or authorized. Single sign-on (B) improves convenience and can centralize authentication, but it can also broaden exposure if not tightly controlled and does not validate the appropriateness of access. Automatic provisioning upon hire (D) speeds onboarding but risks granting excessive or unauthorized access without proper approval, making it a weaker control for ensuring appropriate access.

Answer

Use of biometric authentication

Answer

Single sign-on for all applications

Answer

Automatic provisioning upon employee hire

Question 7

An IS auditor is reviewing an organization's logical access control processes. Which of the following is the primary purpose of conducting regular user access recertifications?

Accepted Answer

To verify that users' access rights remain appropriate for their roles. The primary purpose of user access recertification is to verify that each user's access rights remain appropriate for their current role and responsibilities (B). It is a detective governance control that catches privilege creep, role changes, and orphaned entitlements that accumulate over time. While recertification can surface inactive accounts, that is a byproduct rather than the primary objective; the core intent is validating the ongoing business need for access.

Answer

To identify inactive user accounts

Answer

To ensure compliance with password policies

Answer

To enforce segregation of duties

Question 8

During an audit of an organization's information security programme, the IS auditor finds that the security awareness training completion rate is 95% but phishing simulation tests show a 30% failure rate. What should the auditor recommend?

Accepted Answer

Revise the security awareness program content to focus on practical phishing recognition. The high training completion rate (95%) but high phishing failure rate (30%) indicates that the current training is not effectively translating into practical skills. Therefore, the most appropriate recommendation is to revise the content to focus on practical phishing recognition, making it more hands-on and relevant. This addresses the root cause: the training may be too theoretical or not engaging enough to change behavior.

Answer

Increase the frequency of phishing simulations to quarterly

Answer

Disciplinary action for employees who fail phishing tests

Answer

Mandate that all employees repeat the training annually

Question 9

An IS auditor is reviewing firewall rule sets and discovers a rule that permits any source IP to access the internal database server on TCP port 1433 (Microsoft SQL). The rule was documented as a temporary measure but has been in place for 18 months. What is the auditor's BEST course of action?

Accepted Answer

Determine if there is a business justification for the rule and, if not, recommend removal or restriction to specific IPs. The auditor's best course of action is to determine if there is a business justification for the rule and, if not, recommend removal or restriction to specific IPs, because audit findings must be based on evidence and business context rather than assumptions. A rule permitting any source IP to access TCP port 1433 is a significant security risk, but the auditor must first understand why it exists before recommending action. This approach ensures the recommendation is appropriate, justified, and aligned with business needs.

Answer

Report the issue to senior management as a critical finding

Answer

Recommend immediate removal of the rule

Answer

Accept the risk as a compensating control

Question 10

An organization is implementing a privileged access management (PAM) solution. Which of the following is the PRIMARY benefit of using a PAM tool?

Accepted Answer

Centralized management and monitoring of privileged account usage. The primary benefit of a PAM solution is centralized management and monitoring of privileged account usage — it vaults credentials, controls who can check out which privileged accounts, records sessions, and provides audit trails. This addresses the core risk that privileged accounts (root, admin, service accounts) are the most sought-after targets for attackers and the hardest to oversee when scattered across systems. While PAM can support the other options to varying degrees, centralized management and monitoring is the defining, primary purpose.

Answer

Elimination of shared accounts by providing individual credentials

Answer

Enforcement of segregation of duties between IT and security teams

Answer

Automated password resets for user accounts

Question 11

An IS auditor is reviewing physical access controls at a data center. Which of the following controls is MOST effective for preventing tailgating?

Accepted Answer

Mantrap. A mantrap (C) is the most effective control for preventing tailgating because it physically admits only one person at a time through an interlocking door system, using weight sensors, biometrics, or access cards to verify each individual before the second door opens. It enforces one-person-per-entry at the physical layer, which no camera or log can do. CCTV and visitor logs are detective controls, and biometric readers authenticate individuals but do not by themselves prevent a second person from slipping through behind an authorized user.

Answer

CCTV cameras

Answer

Visitor log

Answer

Biometric readers

Question 12

During a review of encryption practices, the IS auditor finds that an organization uses the same encryption key for all customer data at rest. What is the PRIMARY concern?

Accepted Answer

Increased risk of data exposure if the key is compromised. Using the same encryption key for all customer data at rest creates a single point of failure: if that key is compromised, all encrypted data becomes exposed. This is the primary concern because it violates the principle of key separation and significantly amplifies the impact of a key breach. While other issues like performance or compliance may exist, the immediate and severe risk is the potential for mass data exposure.

Answer

Performance degradation due to key reuse

Answer

Inability to revoke access to specific data

Answer

Non-compliance with GDPR pseudonymization requirements

Question 13

An IS auditor is evaluating the patch management process. The auditor notes that critical security patches are applied within 30 days, but the policy requires 7 days. The IT manager states that the delay is due to testing requirements. What should the auditor recommend?

Accepted Answer

Implement a risk-based patching process that allows faster deployment for critical patches. A risk-based patching process prioritizes critical patches for immediate deployment while allowing less critical patches to undergo standard testing. This balances security needs with operational stability, addressing the policy violation without sacrificing testing entirely. The auditor should recommend this approach because it aligns with industry best practices (e.g., NIST, ISO 27001) and enables faster remediation of high-risk vulnerabilities.

Answer

Require automated patching without testing

Answer

Accept the current practice as a compensating control

Answer

Modify the policy to align with the actual patching timeline

Question 14

An organization has implemented a key management program. Which of the following is the MOST critical control for ensuring the security of cryptographic keys?

Accepted Answer

Secure key storage (e.g., HSM). Secure key storage, typically in a hardware security module (HSM), is the most critical control because it protects keys at rest from extraction, tampering, and unauthorized access throughout their lifecycle. If keys can be stolen from storage, every other control — generation, rotation, destruction — is undermined, since the attacker gains the key material itself. HSMs provide tamper resistance, cryptographic isolation, and access controls that software storage cannot match.

Answer

Key rotation policy

Answer

Key generation in a secure environment

Answer

Key destruction procedures

Question 15

An IS auditor is reviewing the incident response (IR) process. Which of the following is the BEST way to test the effectiveness of the IR plan?

Accepted Answer

Conducting a tabletop exercise. A tabletop exercise is the best way to test the effectiveness of an incident response plan because it simulates a realistic incident scenario and requires the IR team to walk through their roles, decisions, and communications in a facilitated discussion. This reveals gaps in the plan, unclear responsibilities, and coordination breakdowns without the risk or cost of a live simulation. It directly tests whether the plan works in practice, not just whether it exists on paper.

Answer

Checking the availability of forensic tools

Answer

Interviewing the IR team

Answer

Reviewing IR policies and procedures