CISA Protection of Information Assets Practice Test 4 — 15 Questions

Question 1

An IS auditor is reviewing the physical access controls at a data center. Which of the following is the MOST effective control to prevent tailgating?

Accepted Answer

Mantrap entry system. A mantrap is a small room with two sets of interlocking doors, designed to prevent tailgating by allowing only one person to enter at a time. CCTV, badge access, and visitor logs are supportive but do not directly prevent tailgating.

Answer

Badge access system with PIN

Answer

Visitor sign-in log

Answer

CCTV surveillance at entrances

Question 2

An IS auditor is reviewing the user access recertification process. Which of the following findings would MOST concern the auditor regarding the effectiveness of access reviews?

Accepted Answer

Managers approve all access requests without verifying job requirements. If managers approve access without verifying actual job requirements, the recertification process is ineffective. This indicates a rubber-stamping issue. The other options are less critical or address different aspects.

Answer

The recertification report includes all users with active accounts

Answer

Reviews are performed quarterly instead of annually

Answer

Some users did not respond to the recertification request within the deadline

Question 3

During a review of the patch management process, the IS auditor finds that critical security patches are applied within 30 days, but the policy requires application within 7 days. The IT manager argues that the delay is due to testing requirements. What should the auditor recommend?

Accepted Answer

Require risk acceptance documentation for each patch that misses the SLA. The best course is to document the risk acceptance for each delayed patch, ensuring management is aware and accepts the risk. This formalizes the deviation and maintains accountability.

Answer

Escalate to senior management immediately

Answer

Update the policy to allow 30 days for critical patches

Answer

Accept the delay as necessary for stability

Question 4

An IS auditor is reviewing the password policy for a system that processes sensitive financial data. Which of the following is the MOST effective control to mitigate the risk of password cracking?

Accepted Answer

Implement account lockout after 5 failed attempts. Account lockout after a few failed attempts is the most effective control to prevent brute-force password cracking. Complexity and length help but do not prevent automated attacks; 2FA is strong but not specifically for cracking; password history prevents reuse but not cracking.

Answer

Require passwords of at least 12 characters with complexity

Answer

Maintain a password history to prevent reuse

Answer

Enforce two-factor authentication for all users

Question 5

An organization is implementing a key management program to protect encryption keys. Which of the following is the MOST important control to ensure the security of cryptographic keys?

Accepted Answer

Storing keys in a hardware security module (HSM). Using a hardware security module (HSM) provides tamper-resistant storage and management of keys, which is the most important control for key security. Other controls are important but secondary.

Answer

Separating key management duties

Answer

Regular key rotation

Answer

Encrypting keys with a master key

Question 6

An IS auditor is reviewing the firewall rule base. Which of the following findings would be of MOST concern?

Accepted Answer

A rule that allows any service from the Internet to the internal network. An allow rule from any to any (any-any) is overly permissive and poses a significant security risk. The other options are also problems but are less severe than a wide-open rule.

Answer

A rule that has not been reviewed for 18 months

Answer

A rule that permits traffic from a specific IP to a database server on port 1433

Answer

A rule that allows any source IP to access a critical server on port 443

Question 7

An IS auditor is evaluating the incident response (IR) plan. Which of the following is the BEST indicator that the plan is effective?

Accepted Answer

Lessons learned from tabletop exercises are incorporated into the plan. Lessons learned from tabletop exercises demonstrate that the plan is tested and improved. Other options are components but do not directly indicate effectiveness.

Answer

The plan is approved by senior management

Answer

The plan is updated annually

Answer

The plan includes contact information for key stakeholders

Question 8

During an audit of privacy controls, the IS auditor discovers that the organization processes personal data of EU residents but has not appointed a Data Protection Officer (DPO). Which regulation is MOST likely being violated?

Accepted Answer

GDPR. GDPR requires mandatory appointment of a DPO for organizations that process special categories of data or engage in large-scale systematic monitoring. The other regulations do not have a DPO requirement.

Answer

PCI DSS

Answer

SOX

Answer

HIPAA

Question 9

An organization has implemented a security awareness training program. Which of the following metrics would BEST indicate that the program is effective?

Accepted Answer

Reduction in the number of successful phishing attacks. A reduced number of successful phishing attacks indicates that employees are applying the training to recognize and avoid threats. The other metrics are useful but less direct indicators of behavioral change.

Answer

Percentage of employees who completed the training

Answer

Average score on post-training quiz

Answer

Number of reported phishing emails

Question 10

An IS auditor is reviewing logical access controls for a critical application. Which of the following is the MOST important control to detect unauthorized access?

Accepted Answer

Audit logging of access attempts. Audit logs of successful and failed access attempts provide the evidence needed to detect unauthorized access. Other controls prevent or limit access but do not detect it after the fact.

Answer

Strong password policy

Answer

Monthly access recertification

Answer

Role-based access control (RBAC)

Question 11

An organization is implementing a public key infrastructure (PKI) to support digital certificates. Which of the following is the MOST critical control to ensure the integrity of the certificate lifecycle?

Accepted Answer

Establishment of a certificate policy (CP) and certification practice statement (CPS). A robust certificate policy (CP) and certification practice statement (CPS) define the rules and procedures for certificate management, ensuring consistency and security. Other controls are important but are defined within the CP/CPS.

Answer

Use of hardware security modules for key generation

Answer

Regular publication of certificate revocation lists (CRLs)

Answer

Secure storage of the root CA private key

Question 12

An IS auditor is reviewing a vulnerability scan report and finds that a critical vulnerability on a web server has been open for 90 days beyond the remediation SLA. The system owner states that the vulnerability cannot be patched because it would break a legacy application. What should the auditor recommend?

Accepted Answer

Require the system owner to sign a risk acceptance form. The appropriate action is to formally accept the risk through a documented risk acceptance process, with sign-off from management. This ensures accountability and awareness. The other options are either premature or inappropriate.

Answer

Escalate the issue to the board of directors

Answer

Implement compensating controls and close the finding

Answer

Recommend decommissioning the web server

Question 13

An IS auditor is reviewing the privileged access management (PAM) process. Which TWO of the following are the MOST effective controls to prevent misuse of privileged accounts?

Accepted Answer

Session recording and monitoring of privileged activities. Session recording and monitoring (A) allows audit and review of all actions, deterring misuse. Just-in-time (JIT) privileged access (B) grants temporary permissions only when needed, reducing the attack surface. Quarterly review (C) is detective, not preventive. Generic accounts assigned to multiple users (D) increase risk of unauthorized use and lack accountability. Shared passwords for emergency access (E) also reduce accountability and can be misused.

Answer

Quarterly review of privileged account access

Answer

Assignment of generic administrative accounts to multiple users

Answer

Use of shared passwords for emergency access

Question 14

An organization is planning to implement a data loss prevention (DLP) solution to protect sensitive data. Which THREE of the following are essential steps to ensure the effectiveness of the DLP program?

Accepted Answer

Classifying data based on sensitivity. Classifying data based on sensitivity (B) is foundational to know what to protect. Defining DLP policies and rules (E) dictates the rules to enforce. Monitoring and tuning DLP rules regularly (C) ensures policies remain effective. Encrypting all data at rest and in transit (A) is not always feasible or appropriate and is not an essential step. Training all employees on data handling procedures (D) is important but not an essential step for the effectiveness of the DLP program.

Answer

Encrypting all data at rest and in transit

Answer

Training all employees on data handling procedures

Question 15

An IS auditor is assessing the organization's compliance with privacy regulations regarding cross-border data transfers. Which TWO of the following are acceptable mechanisms to legitimize such transfers under the GDPR?

Accepted Answer

Binding corporate rules (BCRs) approved by a supervisory authority. Under GDPR, the two primary mechanisms for legitimizing cross-border data transfers are Binding Corporate Rules (BCRs) approved by a supervisory authority and Standard Contractual Clauses (SCCs) adopted by the European Commission. Adequacy decisions, while a valid basis for transfers to specific countries, are not a mechanism that organizations can directly implement; they are a determination by the European Commission. Encryption does not legitimize a transfer, and explicit consent alone is generally not considered sufficient as a transfer mechanism under GDPR.

Answer

Encryption of data prior to transfer

Answer

Adequacy decision by the European Commission for the recipient country

Answer

Explicit consent from the data subjects