CISA Protection of Information Assets Practice Test 5 — 15 Questions

Question 1

During an audit of the incident response process, the IS auditor finds that the organization relies on shared accounts for system administration. Which TWO of the following are the MOST significant risks associated with shared accounts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Lack of individual accountability for actions performed. Option B is correct because shared accounts eliminate the one-to-one mapping between a user identity and an account, so when multiple administrators use the same credentials there is no way to attribute a specific action to a specific individual, destroying individual accountability. Option D is correct because the audit logs generated under a shared account record only the account name, not the actual person, so the resulting audit trail cannot reliably support forensic investigations or non-repudiation. Options A and C are operational inconveniences rather than the most significant risks, and option E describes a possible consequence of poor password hygiene rather than the core accountability and forensic integrity risks that an IS auditor would emphasize.

Answer

Increased complexity in password management

Answer

Increased overhead for account provisioning

Answer

Higher likelihood of password sharing outside the authorized group

Question 2

An IS auditor is reviewing the organization's incident management process. Which THREE of the following are essential components of an effective incident response plan?

Accepted Answer

Defined roles and responsibilities for the incident response team. Option A is correct because an effective incident response plan must clearly define roles and responsibilities for the incident response team, ensuring each member knows their specific duties and authority during an incident. Option B is correct because procedures for evidence collection and chain of custody are essential to preserve forensic integrity, support potential legal or disciplinary actions, and ensure evidence is admissible. Option C is correct because communication procedures for internal and external stakeholders are critical for timely notification, coordination, regulatory compliance, and managing public relations during and after an incident. Option D is not correct because a list of all employees and their contact information, while useful for general administration, is not an essential component of an incident response plan and may be maintained separately in a business continuity or crisis communication plan. Option E is not correct because a detailed technical guide for each software application is an operational or application-specific document, not a core component of an incident response plan, which should focus on processes, roles, and communication rather than exhaustive technical manuals.

Answer

A list of all employees and their contact information

Answer

A detailed technical guide for each software application

Question 3

An IS auditor is reviewing the user access recertification process. Which of the following findings would MOST concern the auditor regarding the effectiveness of access reviews?

Accepted Answer

Managers approve all access requests without verifying job requirements. Managers approving all access requests without verifying job requirements is the most concerning finding because it defeats the purpose of recertification: access is rubber-stamped rather than validated against least privilege. This creates a systemic risk of privilege creep and unauthorized access that no amount of process formality can offset. The other findings are either positive or minor operational issues.

Answer

The recertification report includes all users with active accounts

Answer

Reviews are performed quarterly instead of annually

Answer

Some users did not respond to the recertification request within the deadline

Question 4

During a review of the patch management process, the IS auditor finds that critical security patches are applied within 30 days, but the policy requires application within 7 days. The IT manager argues that the delay is due to testing requirements. What should the auditor recommend?

Accepted Answer

Require risk acceptance documentation for each patch that misses the SLA. The policy requires 7-day patching but actual practice is 30 days, creating a documented control gap. Rather than silently accepting the deviation or weakening the standard, the auditor should recommend that each missed SLA be formally documented as a risk acceptance so management owns the residual risk. This preserves the control baseline while providing an auditable trail of conscious risk decisions.

Answer

Escalate to senior management immediately

Answer

Update the policy to allow 30 days for critical patches

Answer

Accept the delay as necessary for stability

Question 5

An organization is implementing a key management program to protect encryption keys. Which of the following is the MOST important control to ensure the security of cryptographic keys?

Accepted Answer

Storing keys in a hardware security module (HSM). Storing keys in a hardware security module (HSM) is the most important control because HSMs provide tamper-resistant hardware that protects keys from extraction, ensures cryptographic operations occur inside a secure boundary, and enforces access controls. This directly addresses the core security objective of key protection. Other controls like separation of duties, rotation, and key wrapping are important but secondary to secure storage.

Answer

Separating key management duties

Answer

Regular key rotation

Answer

Encrypting keys with a master key

Question 6

An IS auditor is reviewing the firewall rule base. Which of the following findings would be of MOST concern?

Accepted Answer

A rule that allows any service from the Internet to the internal network. A rule that allows any service from the Internet to the internal network is the most concerning because it effectively bypasses the firewall's purpose, permitting unrestricted inbound access to internal systems. This exposes the entire internal network to external threats, including malware, unauthorized access, and exploitation of any vulnerable service. Such a rule violates the principle of least privilege and is a critical misconfiguration that auditors flag as a severe control weakness.

Answer

A rule that has not been reviewed for 18 months

Answer

A rule that permits traffic from a specific IP to a database server on port 1433

Answer

A rule that allows any source IP to access a critical server on port 443

Question 7

An IS auditor is evaluating the incident response (IR) plan. Which of the following is the BEST indicator that the plan is effective?

Accepted Answer

Lessons learned from tabletop exercises are incorporated into the plan. The best indicator of an IR plan's effectiveness is that lessons learned from tabletop exercises are incorporated into the plan. Tabletop exercises simulate real-world incidents, revealing gaps in procedures, communication, and decision-making. When findings from these exercises are fed back into the plan, it demonstrates a continuous improvement cycle—meaning the plan is not just a static document but a living, tested capability. This directly evidences that the plan works in practice and evolves to address weaknesses, which is the essence of effectiveness.

Answer

The plan is approved by senior management

Answer

The plan is updated annually

Answer

The plan includes contact information for key stakeholders

Question 8

During an audit of privacy controls, the IS auditor discovers that the organization processes personal data of EU residents but has not appointed a Data Protection Officer (DPO). Which regulation is MOST likely being violated?

Accepted Answer

GDPR. The GDPR (EU Regulation 2016/679) governs the processing of personal data of EU residents and mandates the appointment of a Data Protection Officer (DPO) in specific circumstances—such as large-scale systematic monitoring or large-scale processing of special categories of data by public authorities or core-activity organizations. Processing EU residents' personal data without a required DPO is a direct GDPR Article 37 violation. The other regulations listed address payment card data, financial reporting integrity, and US healthcare information, none of which impose a DPO requirement for EU personal data.

Answer

PCI DSS

Answer

SOX

Answer

HIPAA

Question 9

An organization has implemented a security awareness training program. Which of the following metrics would BEST indicate that the program is effective?

Accepted Answer

Reduction in the number of successful phishing attacks. A reduced number of successful phishing attacks indicates that employees are applying the training to recognize and avoid threats. The other metrics are useful but less direct indicators of behavioral change.

Answer

Percentage of employees who completed the training

Answer

Average score on post-training quiz

Answer

Number of reported phishing emails

Question 10

An IS auditor is reviewing logical access controls for a critical application. Which of the following is the MOST important control to detect unauthorized access?

Accepted Answer

Audit logging of access attempts. Audit logging of access attempts is the most important control to detect unauthorized access because it creates a chronological record of who attempted to access what, when, and whether the attempt succeeded or failed. Detection requires evidence of events, and only logging provides that evidence after the fact. Strong passwords, recertification, and RBAC are preventive or administrative controls that reduce the likelihood of unauthorized access but do not detect it when it occurs.

Answer

Strong password policy

Answer

Monthly access recertification

Answer

Role-based access control (RBAC)

Question 11

An IS auditor is reviewing the privileged access management (PAM) process. Which TWO of the following are the MOST effective controls to prevent misuse of privileged accounts?

Accepted Answer

Session recording and monitoring of privileged activities. Option A is correct because session recording and monitoring of privileged activities creates a tamper-evident audit trail and real-time oversight, which deters misuse and enables detection and accountability for every privileged action. Option B is correct because just-in-time (JIT) privileged access grants elevated rights only for a limited, approved window and revokes them automatically, drastically shrinking the standing attack surface and the opportunity for misuse. Option C is not the most effective preventive control because a quarterly review is a detective, after-the-fact activity that can leave misuse undetected for up to three months. Option D is wrong because generic administrative accounts shared by multiple users destroy individual accountability and make attribution of actions impossible. Option E is wrong because shared passwords for emergency access eliminate non-repudiation and cannot be traced to a specific individual, increasing the risk of undetected misuse.

Answer

Quarterly review of privileged account access

Answer

Assignment of generic administrative accounts to multiple users

Answer

Use of shared passwords for emergency access

Question 12

An IS auditor is reviewing the access recertification process for a financial application. The process requires users' managers to confirm access rights quarterly. Which of the following findings should MOST concern the auditor?

Accepted Answer

There is no process to act on access changes identified during recertification.. The most concerning finding is that there is no process to act on access changes identified during recertification. Even if recertification is performed, without follow-up to revoke or modify access, the process is ineffective and leaves inappropriate access in place, increasing the risk of unauthorized access. This directly undermines the control's purpose.

Answer

Access rights are recertified annually instead of quarterly.

Answer

Recertification forms are completed by users themselves rather than managers.

Answer

Recertification results are not documented or retained.

Question 13

During a review of firewall rule sets, an IS auditor finds a rule that allows any source IP to access any destination IP on TCP port 443. Which of the following should the auditor do FIRST?

Accepted Answer

Determine if the rule has a documented business justification.. When an IS auditor identifies a potentially risky firewall rule, the first step is to determine whether the rule has a documented business justification before taking any action. Auditors must gather evidence and understand the context — a rule allowing TCP 443 from any source may be legitimate for a public-facing web server. Only after establishing whether the rule is justified can the auditor decide on escalation or remediation.

Answer

Test whether the rule is actually being used.

Answer

Escalate the finding to senior management.

Answer

Recommend immediate removal of the rule.

Question 14

Which of the following is the PRIMARY purpose of conducting a privacy impact assessment (PIA) before implementing a new system that processes personal data?

Accepted Answer

To identify and mitigate privacy risks.. PIA aims to identify and mitigate privacy risks early in the project lifecycle.

Answer

To document data flows for audit purposes.

Answer

To obtain consent from data subjects.

Answer

To ensure compliance with data protection regulations.

Question 15

Which of the following is the BEST indicator of the effectiveness of a security awareness program?

Accepted Answer

Reduction in the number of successful phishing attacks.. A decrease in successful phishing attacks demonstrates behavioral change.

Answer

Positive feedback from employees about the training.

Answer

Number of employees who completed the training.

Answer

Average test scores on post-training assessments.