CISA Protection of Information Assets Practice Test 6 — 15 Questions

Question 1

An organization uses shared accounts for system administration. Which of the following is the BEST control to mitigate the risk of non-repudiation?

Accepted Answer

Implementing a privileged access management (PAM) solution with session recording.. A PAM solution with session recording uniquely ties each privileged session to an authenticated individual, even when a shared account is used, because users check out credentials and their keystrokes/commands are captured under their own identity. This provides the attribution needed for non-repudiation, which is the ability to prove who performed a specific action. Password changes, logging, and MFA on the shared account do not identify which individual used it.

Answer

Changing the shared account password after each use.

Answer

Logging all commands executed by the shared account.

Answer

Requiring two-factor authentication for the shared account.

Question 2

During an audit of patch management, the IS auditor notes that several critical patches have not been applied within the defined SLA. Which of the following is the BEST approach to evaluate the risk acceptance of these unpatched vulnerabilities?

Accepted Answer

Review the risk acceptance documentation approved by the system owner and CISO.. The question asks how to evaluate the risk acceptance of unpatched vulnerabilities. Risk acceptance is a formal management decision that must be documented and approved by the appropriate authorities—typically the system owner and the CISO. Reviewing this documentation provides direct evidence that the organization has consciously accepted the risk, which is exactly what the auditor needs to evaluate. Computing a risk score or recommending patching does not address whether the risk has been formally accepted.

Answer

Compute the aggregate risk score using a vulnerability management tool.

Answer

Recommend immediate application of all missing patches.

Answer

Verify that the patches are not applicable to the environment.

Question 3

Which of the following is the PRIMARY reason for implementing network segmentation?

Accepted Answer

To contain security breaches and limit lateral movement.. The primary reason for network segmentation is to contain security breaches and limit lateral movement — by dividing the network into isolated zones, an attacker who compromises one segment cannot freely move to others. This is a foundational defense-in-depth control that reduces the blast radius of a breach and protects critical assets. While segmentation can have secondary benefits, security containment is its primary purpose in modern network design.

Answer

To comply with licensing requirements.

Answer

To simplify IP address management.

Answer

To improve network performance.

Question 4

An organization has a clean desk policy. Which of the following is the BEST audit procedure to test compliance with this policy?

Accepted Answer

Conduct unannounced walkthroughs of work areas.. Direct observation provides the most reliable evidence of compliance.

Answer

Interview employees about their understanding of the policy.

Answer

Review security awareness training records.

Answer

Review incident reports related to lost documents.

Question 5

An IS auditor is evaluating the encryption strategy for a healthcare organization subject to HIPAA. Which of the following is the MOST significant risk if the organization relies solely on encryption as a safe harbor?

Accepted Answer

Encryption keys are stored on the same server as the encrypted data.. HIPAA's encryption safe harbor only applies if ePHI is rendered unusable, unreadable, or indecipherable to unauthorized persons. If the encryption keys are stored on the same server as the encrypted data, an attacker who compromises that server obtains both the ciphertext and the keys, effectively defeating the encryption. This is the most significant risk because it nullifies the safe harbor protection entirely.

Answer

The encryption algorithm used is not FIPS 140-2 validated.

Answer

Encryption is not applied to all ePHI in transit.

Answer

The encryption key rotation policy is not documented.

Question 6

An IS auditor is reviewing the physical access controls at a data center. Which TWO of the following are the MOST effective controls to prevent unauthorized tailgating?

Accepted Answer

Mantrap with interlocking doors.. Option C, a mantrap with interlocking doors, is correct because it creates a controlled vestibule where the first door must close and the person must be authenticated before the second door opens, physically preventing a second individual from following through. Option D, turnstiles that allow only one person per authentication, is correct because the physical barrier permits exactly one authenticated entry at a time, so a tailgater cannot pass without their own valid credential. Option A, CCTV cameras, is only a detective control that records events after the fact and does not stop tailgating. Option B, security guards checking badges, is a deterrent and detective measure but is subject to human error, distraction, and social-engineering bypass. Option E, biometric authentication, verifies the identity of the person authenticating but does not by itself prevent a second person from walking through the opened door behind them.

Answer

CCTV cameras at entry points.

Answer

Security guards checking badges.

Answer

Biometric authentication.

Question 7

An IS auditor is reviewing the access recertification process for a financial institution. The process requires users and their managers to confirm access rights quarterly. During the review, the auditor finds that recertifications are consistently completed late, with an average delay of 45 days. Additionally, terminated employees' access is not always removed promptly, and there are no compensating controls. Which of the following is the MOST significant risk arising from these findings?

Accepted Answer

Higher probability of unauthorized access to sensitive information. The most significant risk is unauthorized access to sensitive information because late recertifications and failure to promptly remove terminated employees' access increase the window for misuse. Without compensating controls, this directly threatens data confidentiality. Thus, C is correct.

Answer

Increased likelihood of audit findings for non-compliance with internal policies

Answer

Difficulty in tracking user access history

Answer

Potential loss of audit trails for access changes

Question 8

During a review of firewall rule sets, an IS auditor identifies a rule that allows 'any-any' traffic from an internal subnet to the DMZ. The rule was implemented six months ago based on a business request that has since been completed. The firewall administrator explains that the rule was kept for convenience. Which of the following is the BEST audit recommendation?

Accepted Answer

Remove the rule immediately and verify no impact. The rule is overly permissive, no longer justified by business need, and poses an unnecessary risk. The best recommendation is to remove the rule immediately and verify no impact, as it aligns with the principle of least privilege and reduces the attack surface.

Answer

Conduct a penetration test to assess the risk

Answer

Document the rule with a risk acceptance signed by management

Answer

Modify the rule to allow only specific ports and protocols

Question 9

An IS auditor is reviewing physical security controls at a data center. The data center hosts critical servers and uses a badge access system with PINs, CCTV cameras, and a mantrap entry. The auditor observes that employees sometimes hold the door open for others without badging. Which TWO of the following are the MOST effective controls to address this tailgating risk?

Accepted Answer

Conducting security awareness training on tailgating risks. Option A is correct because security awareness training directly targets the human behavior observed—employees deliberately holding the door for unbadged individuals—by educating staff on tailgating risks and reinforcing the policy that every person must badge individually, which is the root cause of the failure. Option E is correct because upgrading the existing mantrap to biometric authentication enforces one-person-at-a-time entry tied to an immutable physical characteristic, making it technically infeasible to piggyback through on another person's credentials and providing a preventive rather than detective control. Option B does not belong because longer or more complex PINs only strengthen the credential itself and do nothing to stop an unauthorized person from walking through a door held open by an authenticated employee. Option C does not belong because adding access points increases the number of entry portals and thus potentially widens the attack surface rather than preventing piggybacking. Option D does not belong because additional CCTV cameras are a detective control that only records the tailgating after the fact and does not prevent unauthorized entry.

Answer

Requiring longer and more complex PINs

Answer

Installing additional access points

Answer

Increasing the number of CCTV cameras

Question 10

An IS auditor is reviewing the logical access controls for a cloud-based HR system. The system contains sensitive employee data. The auditor notes that user provisioning is performed by the HR department without IT involvement, and there is no formal access request or approval process. Which THREE of the following are the MOST significant risks?

Accepted Answer

There is no audit trail of who granted access and why. Option A is correct because provisioning without a formal access request or approval process means there is no documented record of who authorized or granted each user's access, eliminating the audit trail needed to trace accountability for access decisions. Option B is correct because HR performing user provisioning without IT involvement removes the segregation of duties between the department that owns the employee data and the function that administers system access, allowing a single group to both request and grant privileges. Option D is correct because without a formal request and approval workflow, there is no validation against job roles, so users can be provisioned with rights exceeding their job requirements (excessive privileges). Options C and E are not among the most significant risks here because password policy enforcement and account lockout after failed logins are authentication controls configured within the system itself, and nothing in the scenario indicates these controls are absent or affected by the HR provisioning process.

Answer

Password policies may not be enforced

Answer

User accounts may not be locked after multiple failed login attempts

Question 11

An IS auditor is reviewing how a data center protects its backup tapes while they are in transit to an offsite storage facility. Management states that tapes are encrypted before shipment and that a courier transports them in sealed containers. Which of the following is the MOST appropriate evidence to confirm that the tapes are protected in transit?

Accepted Answer

Inspect the courier's chain-of-custody logs and verify the sealed-container handoff signatures.. The scenario tests physical media protection during transit, so the auditor needs evidence covering the movement of tapes between sites. Signed chain-of-custody documentation with sealed-container handoffs directly evidences that custody was maintained and containers stayed intact from pickup to delivery, which is the specific control objective. Encryption, interviews, and vendor-side reports each address different phases of the media lifecycle and cannot substitute for transit custody records.

Answer

Review the encryption algorithm and key length used for the backup tapes.

Answer

Interview the backup administrator about the tape pickup schedule.

Answer

Examine the offsite storage vendor's SOC 2 report.

Question 12

An IS auditor is reviewing an organization's network segmentation design. The organization states that its cardholder data environment is isolated from the corporate network. During testing, the auditor discovers that a management VLAN can reach both environments and that the firewall permits administrative protocols from the management VLAN to any host. Which of the following is the auditor's BEST conclusion?

Accepted Answer

Segmentation is ineffective because the management VLAN provides a path that bypasses the intended isolation.. Segmentation depends on preventing any path between environments that should not communicate. A management VLAN with administrative protocol access to any host in both the cardholder data environment and the corporate network creates exactly such a path, so the isolation claim fails. Encryption, internal origin, and presumed trust of administrative traffic do not remove the reachability that allows lateral movement, and the auditor should report the design as ineffective.

Answer

Segmentation is effective because administrative traffic is trusted and exempt from segmentation controls.

Answer

The finding is not significant because the management VLAN is internal to the organization.

Answer

The finding is acceptable if management traffic is encrypted with strong ciphers.

Question 13

An IS auditor is evaluating how an organization detects unauthorized changes to the configuration of its internet-facing web servers. The organization runs a file integrity monitoring tool that hashes critical configuration files hourly and alerts on any hash mismatch. Which of the following is the MOST important factor in determining whether this control provides effective detection?

Accepted Answer

Alerts generated by the tool are routed to a monitored queue that is reviewed and acted upon.. Detection controls create value only when their alerts are reviewed and acted upon. A file integrity monitoring tool can hash files perfectly and still provide no protection if mismatches are logged to an unmonitored queue. Routing alerts to a staffed queue with defined response procedures connects detection to action, making it the most important factor. Algorithm strength, polling frequency, and baseline placement matter, but each is secondary to whether someone responds to the alert.

Answer

The tool uses a well-known cryptographic hash algorithm such as SHA-256.

Answer

The baseline of approved file hashes is stored on the same server being monitored.

Answer

The tool hashes files every hour rather than in real time.

Question 14

An IS auditor is reviewing a biometric access control system used to protect a data center. The system uses fingerprint recognition and is configured so that any single enrolled user who fails three consecutive attempts is locked out and must be re-enrolled by security staff. Which of the following is the MOST significant security concern with this configuration?

Accepted Answer

The lockout and re-enrollment process creates a denial-of-service and administrative burden risk.. The configuration described makes repeated lockouts easy to trigger and requires security staff to re-enroll affected users, which can deny access to legitimate personnel and create an administrative bottleneck. That operational and availability exposure is more significant than general biometric tuning questions such as false acceptance rate, skin variability, or the absence of a second factor, none of which are uniquely highlighted by the configuration as described.

Answer

The system does not combine biometrics with a second authentication factor.

Answer

The false acceptance rate may be too high for a high-security environment.

Answer

Fingerprint biometrics can be affected by changes in the user's skin condition.

Question 15

An IS auditor is reviewing the data backup strategy for a hospital's electronic health record (EHR) system. The auditor finds that full backups are performed weekly, with daily incremental backups, but the backup tapes are stored in the same server room as the production system. Which of the following is the MOST significant finding?

Accepted Answer

The backup tapes are stored in the same location as the production system, creating a single point of failure.. Storing backup media in the same physical location as the production system creates a single point of failure. A disaster such as a fire or flood could destroy both the original data and the backups, rendering recovery impossible. Best practice requires that backups be stored offsite or in a geographically separate location to ensure availability and support disaster recovery objectives.

Answer

The backup process lacks a documented restoration testing procedure.

Answer

The backup schedule does not meet the recovery point objective (RPO) for the EHR system.

Answer

The backup tapes are not encrypted, exposing sensitive patient data.