CISA Protection of Information Assets Practice Test 3 — 15 Questions

Question 1

An IS auditor is reviewing the logical access controls for a critical financial application. Which of the following is the MOST important control to ensure that user access rights remain appropriate over time?

Accepted Answer

Conducting periodic access recertification. Periodic access recertification ensures that users' access rights are reviewed and confirmed by managers, reducing the risk of excessive or inappropriate access.

Answer

Implementing single sign-on (SSO)

Answer

Enforcing password complexity rules

Answer

Using role-based access control (RBAC)

Question 2

During an audit of a healthcare organization's information security program, the IS auditor finds that the security awareness training is conducted only at hire. Which of the following is the MOST significant risk associated with this practice?

Accepted Answer

Employees may not be aware of new security threats and vulnerabilities. Without ongoing training, employees are less likely to stay informed about evolving threats, increasing the risk of security incidents due to human error.

Answer

Failure to comply with regulatory data protection requirements

Answer

Increased cost of incident response due to lack of preparedness

Answer

Increased likelihood of password sharing among employees

Question 3

An IS auditor is reviewing the process for granting privileged access in a large organization. Which of the following findings should be of MOST concern?

Accepted Answer

Privileged access is granted without approval from the system owner. Privileged access requests must be properly authorized to prevent unauthorized elevation of privileges.

Answer

Privileged accounts are not monitored in real-time

Answer

Privileged access is reviewed quarterly

Answer

There is no segregation of duties for privileged users

Question 4

During an audit of network security controls, the IS auditor reviews firewall rule sets and identifies a rule that allows any-to-any traffic from the internal network to the Internet. The rule has a business justification. What is the auditor's BEST recommendation?

Accepted Answer

Implement a more restrictive rule set based on specific IP addresses and ports. Overly permissive rules should be tightened to reduce risk; the auditor should recommend implementing more specific rules based on actual needs.

Answer

Add an intrusion prevention system (IPS) to monitor the traffic

Answer

Require all traffic to go through a proxy server

Answer

Accept the risk because there is a business justification

Question 5

An IS auditor is reviewing the key management program for an organization's encryption systems. Which of the following is the MOST critical control to ensure the security of encryption keys?

Accepted Answer

Implementing key rotation at defined intervals. Regular key rotation limits the amount of data compromised if a key is exposed.

Answer

Storing keys on hardware security modules (HSMs)

Answer

Using strong encryption algorithms

Answer

Ensuring keys are backed up

Question 6

Which of the following is the PRIMARY purpose of conducting a privacy impact assessment (PIA)?

Accepted Answer

To identify privacy risks and recommend mitigations. A PIA identifies and mitigates privacy risks associated with the processing of personal data.

Answer

To document the data processing activities

Answer

To obtain consent from data subjects

Answer

To ensure compliance with data protection laws

Question 7

During an audit of the incident management process, the IS auditor finds that tabletop exercises have not been conducted in the past two years. What is the MOST significant risk associated with this finding?

Accepted Answer

Employees may not know their roles during an incident. Without regular testing, the incident response team may not be prepared to effectively handle a real incident.

Answer

The organization may fail to detect an incident in a timely manner

Answer

The organization may not comply with regulatory reporting requirements

Answer

The incident response plan may be outdated

Question 8

An IS auditor is reviewing an organization's vulnerability management program. The auditor notes that a critical vulnerability in a key application has not been patched for 90 days, and there is no documented risk acceptance. What should the auditor do FIRST?

Accepted Answer

Determine if compensating controls exist to mitigate the vulnerability. The auditor should determine if compensating controls are in place to mitigate the risk, as this information is essential to assess the residual risk.

Answer

Report the finding as a non-compliance with the patch management policy

Answer

Discuss with management the absence of a risk acceptance

Answer

Escalate the issue to senior management immediately

Question 9

An organization has implemented a clean desk policy. Which of the following is the BEST audit procedure to verify compliance?

Accepted Answer

Conducting unannounced inspections of workstations. Surprise walkthroughs provide a realistic view of daily compliance, unlike scheduled inspections.

Answer

Reviewing security camera footage of office areas

Answer

Reviewing the policy document and employee acknowledgments

Answer

Interviewing employees about the policy

Question 10

Which of the following is the PRIMARY objective of a penetration test?

Accepted Answer

To identify vulnerabilities that could be exploited by an attacker. Penetration testing aims to identify exploitable vulnerabilities that could be used by an attacker.

Answer

To test the incident response capability

Answer

To validate the effectiveness of security controls

Answer

To ensure compliance with security standards

Question 11

An IS auditor is reviewing the physical access controls at a data center. Which of the following is the MOST effective control to prevent tailgating?

Accepted Answer

Mantrap with two interlocking doors. A mantrap allows only one person to pass at a time, preventing unauthorized individuals from following an authorized person.

Answer

Biometric access controls

Answer

CCTV cameras at entrances

Answer

Security guards at the entrance

Question 12

During an audit of a public key infrastructure (PKI), the IS auditor finds that certificate revocation lists (CRLs) are only updated weekly. Which of the following is the MOST significant risk?

Accepted Answer

Revoked certificates may be accepted as valid. Delays in CRL updates increase the window during which a revoked certificate may be accepted, potentially allowing unauthorized access.

Answer

Certificate authorities may become unavailable

Answer

Increased network traffic due to large CRLs

Answer

Users may experience delays in certificate validation

Question 13

An IS auditor is assessing the data inventory of a financial institution to ensure compliance with privacy regulations. Which TWO of the following are essential elements that should be included in the data inventory?

Accepted Answer

The location (systems and physical) where PII is stored. A data inventory should identify where PII is stored and the business purpose for processing, as these are critical for managing privacy risks.

Answer

The encryption algorithm used to protect the data

Answer

The cost of storing the data

Answer

The names of all employees who process the data

Question 14

During an audit of the incident response process, the IS auditor finds that the organization relies on shared accounts for system administration. Which TWO of the following are the MOST significant risks associated with shared accounts?

Accepted Answer

Lack of individual accountability for actions performed. Shared accounts make it difficult to attribute actions to specific individuals and can lead to loss of audit trail, increasing the risk of undetected misuse.

Answer

Increased complexity in password management

Answer

Increased overhead for account provisioning

Answer

Higher likelihood of password sharing outside the authorized group

Question 15

An IS auditor is reviewing the organization's incident management process. Which THREE of the following are essential components of an effective incident response plan?

Accepted Answer

Defined roles and responsibilities for the incident response team. An effective IR plan must include clear roles, communication procedures, and criteria for escalation and severity classification to ensure timely and coordinated response.

Answer

A list of all employees and their contact information

Answer

A detailed technical guide for each software application