CISA Protection of Information Assets Practice Test 5 — 15 Questions

Question 1

An IS auditor is reviewing the access recertification process for a financial application. The process requires users' managers to confirm access rights quarterly. Which of the following findings should MOST concern the auditor?

Accepted Answer

There is no process to act on access changes identified during recertification.. The recertification process should include a timely follow-up on access changes. Without this, outdated permissions may persist, increasing risk.

Answer

Access rights are recertified annually instead of quarterly.

Answer

Recertification forms are completed by users themselves rather than managers.

Answer

Recertification results are not documented or retained.

Question 2

During a review of firewall rule sets, an IS auditor finds a rule that allows any source IP to access any destination IP on TCP port 443. Which of the following should the auditor do FIRST?

Accepted Answer

Determine if the rule has a documented business justification.. The first step is to verify the business justification for the rule, as it may be necessary for a specific application.

Answer

Test whether the rule is actually being used.

Answer

Escalate the finding to senior management.

Answer

Recommend immediate removal of the rule.

Question 3

Which of the following is the PRIMARY purpose of conducting a privacy impact assessment (PIA) before implementing a new system that processes personal data?

Accepted Answer

To identify and mitigate privacy risks.. PIA aims to identify and mitigate privacy risks early in the project lifecycle.

Answer

To document data flows for audit purposes.

Answer

To obtain consent from data subjects.

Answer

To ensure compliance with data protection regulations.

Question 4

An IS auditor is reviewing an organization's key management program. Which of the following is the GREATEST risk associated with using a single key for both encryption and decryption of sensitive data?

Accepted Answer

Key rotation requires re-encrypting all data encrypted with that key.. Symmetric keys must be protected; if compromised, both confidentiality and integrity are at risk. However, the primary risk is the inability to rotate keys without re-encrypting all data, leading to potential exposure if the key is compromised.

Answer

The key management system cannot generate such a key.

Answer

The key may be more easily guessed by attackers.

Answer

Non-repudiation cannot be achieved.

Question 5

Which of the following is the BEST indicator of the effectiveness of a security awareness program?

Accepted Answer

Reduction in the number of successful phishing attacks.. A decrease in successful phishing attacks demonstrates behavioral change.

Answer

Positive feedback from employees about the training.

Answer

Number of employees who completed the training.

Answer

Average test scores on post-training assessments.

Question 6

An IS auditor is reviewing the incident response (IR) process. Which of the following is the MOST important characteristic of an effective tabletop exercise?

Accepted Answer

It involves all relevant stakeholders in a discussion format.. Tabletop exercises should focus on testing decision-making and communication, not just technical steps.

Answer

It measures the technical skills of the IR team.

Answer

It uses a realistic scenario based on current threats.

Answer

It is conducted without prior notice to participants.

Question 7

An organization uses shared accounts for system administration. Which of the following is the BEST control to mitigate the risk of non-repudiation?

Accepted Answer

Implementing a privileged access management (PAM) solution with session recording.. To ensure accountability, individual user authentication must be implemented before granting privileged access.

Answer

Changing the shared account password after each use.

Answer

Logging all commands executed by the shared account.

Answer

Requiring two-factor authentication for the shared account.

Question 8

During an audit of patch management, the IS auditor notes that several critical patches have not been applied within the defined SLA. Which of the following is the BEST approach to evaluate the risk acceptance of these unpatched vulnerabilities?

Accepted Answer

Review the risk acceptance documentation approved by the system owner and CISO.. Risk acceptance should be formally documented with compensating controls and management sign-off.

Answer

Compute the aggregate risk score using a vulnerability management tool.

Answer

Recommend immediate application of all missing patches.

Answer

Verify that the patches are not applicable to the environment.

Question 9

Which of the following is the PRIMARY reason for implementing network segmentation?

Accepted Answer

To contain security breaches and limit lateral movement.. Segmentation limits the spread of attacks by isolating sensitive systems.

Answer

To comply with licensing requirements.

Answer

To simplify IP address management.

Answer

To improve network performance.

Question 10

An IS auditor is reviewing the logical access controls for a critical database. Which of the following findings should be considered the HIGHEST risk?

Accepted Answer

The default 'sa' account is enabled with the default password.. Default passwords are a well-known vulnerability that can be easily exploited.

Answer

Database administrators share a common user ID for maintenance tasks.

Answer

Access rights are reviewed on an annual basis.

Answer

The database has not undergone a vulnerability scan in six months.

Question 11

An organization has a clean desk policy. Which of the following is the BEST audit procedure to test compliance with this policy?

Accepted Answer

Conduct unannounced walkthroughs of work areas.. Direct observation provides the most reliable evidence of compliance.

Answer

Interview employees about their understanding of the policy.

Answer

Review security awareness training records.

Answer

Review incident reports related to lost documents.

Question 12

An IS auditor is evaluating the encryption strategy for a healthcare organization subject to HIPAA. Which of the following is the MOST significant risk if the organization relies solely on encryption as a safe harbor?

Accepted Answer

Encryption keys are stored on the same server as the encrypted data.. Encryption safe harbor only applies if encryption meets specific standards; gaps in key management can invalidate safe harbor.

Answer

The encryption algorithm used is not FIPS 140-2 validated.

Answer

Encryption is not applied to all ePHI in transit.

Answer

The encryption key rotation policy is not documented.

Question 13

An IS auditor is reviewing the physical access controls at a data center. Which TWO of the following are the MOST effective controls to prevent unauthorized tailgating?

Accepted Answer

Mantrap with interlocking doors.. Mantraps and turnstiles are designed to prevent tailgating by allowing only one person per entry.

Answer

CCTV cameras at entry points.

Answer

Security guards checking badges.

Answer

Biometric authentication.

Question 14

An organization is implementing a public key infrastructure (PKI) to issue digital certificates for internal applications. Which THREE of the following are essential elements of PKI governance that an IS auditor should review?

Accepted Answer

Certificate lifecycle management procedures (issuance, renewal, revocation).. PKI governance includes CA policies, certificate lifecycle management, and revocation mechanisms.

Answer

Key length and algorithm specifications.

Answer

Number of certificates issued per month.

Question 15

An IS auditor is reviewing the data subject rights fulfillment process for GDPR compliance. Which TWO of the following are required to be completed within the one-month response period?

Accepted Answer

Right to erasure (deleting personal data).. GDPR requires responses to access requests and erasure requests within one month, subject to certain conditions.

Answer

Right to object to processing (ceasing processing).

Answer

Right to rectification (correcting inaccurate data).

Answer

Right to data portability (transferring data to another controller).