CISA Protection of Information Assets Practice Test 4 — 15 Questions

Question 1

An IS auditor is reviewing a penetration test report that shows a critical vulnerability in a web application. The IT manager states that the vulnerability will not be fixed because it requires significant code changes and the application is being decommissioned in six months. What should the auditor do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the risk has been formally accepted and compensating controls are implemented. The auditor's proper action is to verify that the risk has been formally accepted by the appropriate authority and that compensating controls are implemented (D). Risk acceptance is a legitimate management decision, but it must be documented, approved at the right level, and supported by mitigating controls given the criticality of the vulnerability. The auditor's role is to validate that this governance process occurred, not to unilaterally accept, escalate, or demand decommissioning.

Answer

Accept the decision as business risk acceptance

Answer

Escalate to senior management as a critical finding

Answer

Recommend immediate decommissioning of the application

Question 2

An organization uses shared accounts for system administration. Which of the following is the MOST significant audit concern?

Accepted Answer

Lack of individual accountability and audit trail. Shared administrative accounts break the fundamental audit principle of individual accountability because multiple administrators operate under one identity, making it impossible to attribute a specific action to a specific person. Without unique user IDs, the audit trail (logs, change records, access reviews) cannot reliably identify who performed which action, undermining non-repudiation and forensic investigation. This is the most significant concern because it defeats the purpose of logging and monitoring controls that auditors rely on.

Answer

Increased complexity of password management

Answer

Violation of segregation of duties

Answer

Higher risk of password sharing outside the team

Question 3

An IS auditor is assessing network security controls. Which TWO of the following are key elements of a firewall rule review?

Accepted Answer

Verifying that each rule has a business justification. A firewall rule review is fundamentally about validating the rulebase itself, so option B is correct: verifying that each rule has a business justification ensures no unnecessary, stale, or overly permissive rules remain, directly supporting least-privilege and reducing the attack surface. Option C is also correct because comparing the actual running rulebase against the documented/approved rules detects unauthorized changes, configuration drift, and shadowed or redundant rules, which is the core purpose of a rule review. Option A is not a rule-review element but a configuration/hardening check for default credentials, which is a separate control. Option D concerns resilience and availability testing (failover), not rule correctness, and option E addresses capacity/performance monitoring rather than the appropriateness of the rules themselves.

Answer

Checking for default passwords on firewall

Answer

Testing firewall failover capabilities

Answer

Reviewing firewall performance metrics

Question 4

An organization is implementing a privacy program to comply with GDPR. Which THREE of the following are essential elements for managing cross-border data transfers?

Accepted Answer

Standard Contractual Clauses (SCCs). Standard Contractual Clauses (SCCs) (A) are a core GDPR transfer mechanism under Article 46, providing pre-approved contractual terms that legally safeguard personal data when it moves to a third country lacking an adequacy finding. An adequacy decision by the European Commission (C) is essential because under Article 45 it declares a third country's data protection regime essentially equivalent to the EU's, allowing transfers without additional safeguards. Binding Corporate Rules (BCRs) (D) are another Article 47 mechanism, essential for multinational groups to legitimize intra-group cross-border transfers through internally binding data protection policies approved by supervisory authorities. The unmarked options do not belong: a DPIA (B) is a risk assessment tool for high-risk processing, not a transfer mechanism, and encryption at rest (E) is a security control that may supplement but does not by itself legalize a cross-border transfer.

Answer

Data Protection Impact Assessment (DPIA)

Answer

Data encryption at rest

Question 5

During an audit of physical security, the IS auditor observes that employees frequently leave confidential documents on their desks overnight. Which TWO controls should the auditor recommend?

Accepted Answer

Conduct security awareness training. Option B (Conduct security awareness training) is correct because the root cause of documents being left out overnight is employee behavior, and awareness training directly educates staff on their security responsibilities, the risks of leaving confidential information exposed, and proper handling and storage procedures. Option C (Implement a clean desk policy) is correct because it establishes a formal, enforceable requirement that all sensitive documents be secured or locked away at the end of the workday, directly addressing the observed weakness and providing a basis for audits and disciplinary action. Option A (Deploy additional CCTV cameras) is not appropriate because cameras only provide detective/monitoring capability and do not prevent employees from leaving documents on desks. Option D (Implement a visitor management system) does not belong because the issue involves employees, not visitors, and visitor control does not address internal document handling. Option E (Install motion detectors) is not relevant because motion detection is an intrusion-detection control for after-hours physical access, not a control over how employees handle confidential documents.

Answer

Deploy additional CCTV cameras

Answer

Implement a visitor management system

Answer

Install motion detectors

Question 6

An IS auditor is reviewing the logical access controls for a critical financial application. Which of the following is the MOST important control to ensure that user access rights remain appropriate over time?

Accepted Answer

Conducting periodic access recertification. Periodic access recertification is the most important control to ensure user access rights remain appropriate over time because it forces business owners to review and confirm each user's entitlements on a scheduled basis. It detects and removes accumulated privileges from role changes, transfers, or terminations. Other controls like SSO, password rules, and RBAC support access management but do not verify ongoing appropriateness.

Answer

Implementing single sign-on (SSO)

Answer

Enforcing password complexity rules

Answer

Using role-based access control (RBAC)

Question 7

An IS auditor is reviewing the process for granting privileged access in a large organization. Which of the following findings should be of MOST concern?

Accepted Answer

Privileged access is granted without approval from the system owner. Granting privileged access without approval from the system owner is the most serious finding because it removes the fundamental authorization control that ensures only legitimate, accountable requests receive elevated rights. Without owner approval, there is no business justification, no accountability trail, and no way to verify that the access is appropriate for the user's role. This directly undermines the principle of least privilege and creates an uncontrolled pathway to critical systems.

Answer

Privileged accounts are not monitored in real-time

Answer

Privileged access is reviewed quarterly

Answer

There is no segregation of duties for privileged users

Question 8

During an audit of network security controls, the IS auditor reviews firewall rule sets and identifies a rule that allows any-to-any traffic from the internal network to the Internet. The rule has a business justification. What is the auditor's BEST recommendation?

Accepted Answer

Implement a more restrictive rule set based on specific IP addresses and ports. An any-to-any rule from internal to Internet is overly permissive and violates the principle of least privilege, even if a business justification exists. The auditor's best recommendation is to implement a more restrictive rule set based on specific IP addresses, ports, and protocols, which enforces least privilege while still meeting business needs. A business justification does not make an overly broad rule acceptable; the control should be tightened to the minimum necessary access.

Answer

Add an intrusion prevention system (IPS) to monitor the traffic

Answer

Require all traffic to go through a proxy server

Answer

Accept the risk because there is a business justification

Question 9

Which of the following is the PRIMARY purpose of conducting a privacy impact assessment (PIA)?

Accepted Answer

To identify privacy risks and recommend mitigations. The PRIMARY purpose of a Privacy Impact Assessment (PIA) is to systematically identify and assess privacy risks associated with a project, system, or process, and to recommend mitigation measures. It is a proactive risk management tool that helps organizations understand how personal information is collected, used, shared, and retained, and to address potential privacy harms before they occur. While compliance with laws and documenting processing activities are outcomes or components, the core objective is risk identification and mitigation.

Answer

To document the data processing activities

Answer

To obtain consent from data subjects

Answer

To ensure compliance with data protection laws

Question 10

During an audit of the incident management process, the IS auditor finds that tabletop exercises have not been conducted in the past two years. What is the MOST significant risk associated with this finding?

Accepted Answer

Employees may not know their roles during an incident. Tabletop exercises are primarily designed to validate and practice the incident response plan by walking participants through simulated scenarios, which reveals whether employees understand their roles, responsibilities, and decision-making authority during an incident. Without them, the most significant risk is that staff will be unprepared and confused when a real incident occurs, leading to delayed or ineffective response.

Answer

The organization may fail to detect an incident in a timely manner

Answer

The organization may not comply with regulatory reporting requirements

Answer

The incident response plan may be outdated

Question 11

An IS auditor is reviewing an organization's vulnerability management program. The auditor notes that a critical vulnerability in a key application has not been patched for 90 days, and there is no documented risk acceptance. What should the auditor do FIRST?

Accepted Answer

Determine if compensating controls exist to mitigate the vulnerability. The auditor should first determine if compensating controls exist to mitigate the vulnerability, because the presence of effective compensating controls may reduce the residual risk to an acceptable level even without patching. This step gathers evidence before concluding on the adequacy of risk treatment. Only after understanding the control environment can the auditor assess whether the lack of patching and risk acceptance constitutes a significant finding.

Answer

Report the finding as a non-compliance with the patch management policy

Answer

Discuss with management the absence of a risk acceptance

Answer

Escalate the issue to senior management immediately

Question 12

An organization has implemented a clean desk policy. Which of the following is the BEST audit procedure to verify compliance?

Accepted Answer

Conducting unannounced inspections of workstations. Surprise walkthroughs provide a realistic view of daily compliance, unlike scheduled inspections.

Answer

Reviewing security camera footage of office areas

Answer

Reviewing the policy document and employee acknowledgments

Answer

Interviewing employees about the policy

Question 13

Which of the following is the PRIMARY objective of a penetration test?

Accepted Answer

To identify vulnerabilities that could be exploited by an attacker. The primary objective of a penetration test is to identify vulnerabilities that could be exploited by an attacker, simulating real-world attack techniques to uncover weaknesses before malicious actors do. While penetration tests can inform control validation and compliance, their core purpose is offensive discovery of exploitable weaknesses, which then feeds remediation and risk management. This distinguishes them from vulnerability scans, which are automated and broader but less deep.

Answer

To test the incident response capability

Answer

To validate the effectiveness of security controls

Answer

To ensure compliance with security standards

Question 14

During an audit of a public key infrastructure (PKI), the IS auditor finds that certificate revocation lists (CRLs) are only updated weekly. Which of the following is the MOST significant risk?

Accepted Answer

Revoked certificates may be accepted as valid. If CRLs are only updated weekly, revoked certificates may still be accepted as valid during the interval between revocation and CRL publication, allowing compromised or misused certificates to be trusted. This is the most significant risk because it undermines the revocation mechanism and can enable impersonation or man-in-the-middle attacks. Timely revocation is critical to PKI trust.

Answer

Certificate authorities may become unavailable

Answer

Increased network traffic due to large CRLs

Answer

Users may experience delays in certificate validation

Question 15

An IS auditor is assessing the data inventory of a financial institution to ensure compliance with privacy regulations. Which TWO of the following are essential elements that should be included in the data inventory?

Accepted Answer

The location (systems and physical) where PII is stored. Option B is correct because a data inventory must record where PII resides—both the systems (applications, databases, cloud services) and physical locations—so the organization can apply appropriate safeguards and respond to access, breach, or deletion requests under privacy regulations. Option D is correct because documenting the retention period for each type of PII ensures data is kept only as long as legally or operationally necessary and is securely disposed of when that period ends, which is a core privacy compliance requirement. Option A is not essential to the inventory itself; encryption algorithms are security controls recorded in system documentation, not identifying attributes of a data inventory. Option C is irrelevant to privacy compliance, as storage cost is a financial metric rather than a data-governance attribute. Option E is unnecessary and impractical, since the inventory should identify processing activities and roles, not list every individual employee who handles the data.

Answer

The encryption algorithm used to protect the data

Answer

The cost of storing the data

Answer

The names of all employees who process the data