CISA Protection of Information Assets Practice Test 7 — 15 Questions

Question 1

An IS auditor is reviewing the endpoint security controls of a hospital that permits clinicians to use personal laptops and tablets to access the electronic health record (EHR) system. The auditor finds that the organization issued written acceptable-use agreements, but devices are not inspected, and no enrollment process exists. Which of the following is the MOST significant risk arising from this situation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Unmanaged devices may retain unencrypted copies of protected health information after a clinician leaves the organization.. The defining weakness is that personally owned devices are used for clinical work without enrollment, inspection, or technical controls. That means the organization cannot enforce encryption, remote wipe, or retention limits, so protected health information can persist on hardware it does not own or manage. Data remanence on unmanaged endpoints is the most consequential risk because it directly threatens confidentiality and creates reportable breach exposure.

Answer

Personal devices may introduce malware that spreads to the EHR application servers.

Answer

Clinicians may install unauthorized software that consumes excessive bandwidth on the hospital network.

Answer

The acceptable-use agreement may be unenforceable because it was not signed by a witness.

Question 2

An IS auditor is reviewing the backup strategy for a critical database server. The database administrator states that a full backup is performed every Sunday, and transaction log backups are performed every hour. The auditor finds that the transaction log backups are stored on the same volume as the database data files. Which of the following is the MOST significant risk associated with this configuration?

Accepted Answer

A failure of the volume containing the database and its transaction log backups could result in the loss of both the data and the backups, preventing recovery.. The most significant risk is that a single volume failure could destroy both the database and its transaction log backups, eliminating any possibility of recovery. While RPO and RTO are important, the fundamental flaw is the lack of separation between production data and backups, which violates the principle of not storing backups on the same media as the data they protect. This configuration exposes the organization to catastrophic data loss.

Answer

The backups are not stored offsite, so they would be unavailable in the event of a site-wide disaster.

Answer

The recovery time objective (RTO) may be exceeded because restoring from transaction log backups is slower than restoring from a full backup.

Answer

The recovery point objective (RPO) may not be met because transaction log backups are only taken hourly.

Question 3

An IS auditor is examining how a retail bank protects stored cardholder data. The bank encrypts the primary account number in its customer database using AES-256, but the auditor learns that the encryption keys are stored in a configuration file on the same database server, readable by the database administrator account. Which of the following is the MOST appropriate conclusion?

Accepted Answer

The encryption is ineffective for protecting confidentiality because the key is exposed wherever the data is exposed.. Strong encryption depends on keeping the key outside the reach of anyone who can access the ciphertext. When the key file sits on the database server and is readable by the database administrator, the separation of duties that gives encryption its value disappears, and a single compromised account yields both data and key. The auditor should conclude that confidentiality protection is defeated and recommend a dedicated key-management capability such as a hardware security module.

Answer

The finding is acceptable provided the database administrator's activity is logged and reviewed monthly.

Answer

The bank should migrate the keys to a hardware security module but may continue storing them with the database until the migration completes.

Answer

The encryption remains effective because AES-256 is computationally infeasible to break by brute force.

Question 4

An IS auditor is evaluating the security of an organization's wireless network. The organization uses WPA3-Enterprise with 802.1X authentication. The auditor discovers that the RADIUS server is configured to accept EAP-TLS certificates but does not validate the certificate revocation status. Which of the following is the MOST likely consequence of this configuration?

Accepted Answer

An attacker with a revoked certificate could still authenticate to the wireless network.. The lack of certificate revocation validation means the RADIUS server will accept revoked certificates, allowing devices or users whose certificates have been revoked to authenticate. This defeats a key control of PKI-based authentication, as revocation is how compromised or expired credentials are invalidated. The most likely consequence is unauthorized network access by a revoked certificate holder.

Answer

Wireless traffic could be decrypted by an attacker because the session key is not properly generated.

Answer

Clients would be unable to connect because the server would reject all certificates without revocation information.

Answer

The RADIUS server could be susceptible to a denial-of-service attack due to certificate validation overhead.

Question 5

An IS auditor is examining how a hospital enforces least privilege for its electronic health record (EHR) system. During walkthroughs, the auditor observes that nurses can access the billing module and that no formal process exists to request, approve, or periodically recertify role assignments. Which of the following is the MOST appropriate recommendation?

Accepted Answer

Implement role-based access control (RBAC) with documented request, approval, and periodic recertification of role assignments.. The observation describes excessive entitlements combined with no formal role lifecycle, which is a least-privilege and access governance failure. Role-based access control aligns permissions to job duties, and documented request, approval, and periodic recertification provide the accountability and review evidence the auditor expects. Detective monitoring, user acknowledgments, and stronger authentication do not correct or govern the underlying entitlements.

Answer

Enable database activity monitoring (DAM) to alert on any nurse queries against billing tables.

Answer

Deploy multifactor authentication (MFA) for all EHR logins by clinical staff.

Answer

Require nurses to sign an acceptable use policy (AUP) acknowledging that billing data is confidential.

Question 6

An IS auditor is evaluating the network segmentation of a manufacturing company that separates its corporate network from the industrial control system (ICS) environment. The auditor finds that a firewall exists between the zones, but engineering workstations on the corporate network can reach programmable logic controllers directly over several open ports. Which TWO of the following findings should the auditor report as the MOST significant weaknesses? (Choose two.)

Accepted Answer

Multiple ports are open through the firewall between the corporate and ICS zones, expanding the attack surface.. Effective segmentation depends on preventing corporate systems from initiating sessions with control devices and on keeping the boundary rule set as narrow as operations allow. Direct reachability from engineering workstations to programmable logic controllers defeats the zone design, and a broad set of open ports gives attackers multiple paths into the ICS environment. Together these findings show that the firewall exists in name only and does not enforce the intended separation.

Answer

Engineering workstations are not running the same endpoint protection version as corporate desktops.

Answer

The firewall between the corporate and ICS zones does not perform deep packet inspection of industrial protocols.

Answer

The ICS network uses the same directory services as the corporate network for authentication.

Question 7

An IS auditor is reviewing the physical security controls for a data center. The auditor observes that the data center has a raised floor, a fire suppression system, and biometric access controls. The auditor also notes that the data center is located in a region prone to flooding. Which of the following controls is MOST important to mitigate the risk of flooding?

Accepted Answer

Elevating the data center floor above the expected flood level.. Elevating the data center floor above the expected flood level is the most important control because it prevents floodwater from reaching critical equipment. It is a preventive measure that directly addresses the flood risk, whereas other options like sensors or pumps are detective or mitigating. In flood-prone areas, physical elevation is a fundamental design consideration for data center resilience.

Answer

A sump pump system in the basement.

Answer

Water detection sensors under the raised floor.

Answer

A fire suppression system that also removes water.

Question 8

An IS auditor is reviewing how a retail company protects stored payment card data. The company states it encrypts card numbers using AES-256, but the auditor finds that the database encryption keys are stored in a plaintext configuration file on the same application server as the encrypted data. Which of the following is the auditor's PRIMARY concern?

Accepted Answer

Storing the key with the encrypted data on the same server defeats the protection the encryption is meant to provide.. Encryption only reduces risk if the key is protected independently of the ciphertext and the host that processes it. A plaintext key file on the same application server means a single compromise exposes both data and key, nullifying the protection. Proper key management places keys in a dedicated key management system or hardware security module with strict access controls, separation from data, and documented lifecycle procedures.

Answer

Cardholder data should be tokenized instead of encrypted.

Answer

AES-256 is insufficient for protecting cardholder data at rest.

Answer

The encryption keys are not rotated frequently enough.

Question 9

An IS auditor is reviewing the physical security controls at a data center. The auditor observes that entry to the data center requires a smart card and a PIN, and that the door is a single-leaf door with a standard lock. Which of the following is the MOST important physical security control that the auditor should recommend?

Accepted Answer

Implement a mantrap or double-door entry system to prevent tailgating.. The most important physical security control to recommend is a mantrap or double-door entry system to prevent tailgating. While the data center uses smart card and PIN for authentication, a single door allows multiple people to enter on one authentication. A mantrap ensures that each person is individually authenticated and prevents unauthorized individuals from following authorized personnel. This is a fundamental control for high-security areas like data centers.

Answer

Require employees to sign a logbook upon entry and exit.

Answer

Replace the standard lock with a biometric lock for all employees.

Answer

Install security cameras inside the data center to monitor activity.

Question 10

An IS auditor is reviewing an organization's data loss prevention (DLP) deployment. The auditor finds that the DLP solution is configured to monitor outbound email traffic at the network gateway, but endpoint agents are not installed on any workstations. Management states that this configuration is sufficient because all sensitive data leaves through email. Which of the following is the MOST significant risk arising from this configuration?

Accepted Answer

Sensitive data could be copied to removable media or transmitted through unmonitored channels that never traverse the email gateway.. A DLP solution that only monitors the email gateway has a fundamental coverage gap: any data leaving through endpoints—USB drives, printing, cloud sync, or non-email network protocols—is invisible. Management's assumption that all sensitive data leaves via email is unverified and likely incorrect, so the auditor should flag the absence of endpoint agents as the most significant risk to the control objective.

Answer

Email encryption will prevent the DLP solution from identifying sensitive content in outbound messages.

Answer

The DLP solution will generate an excessive number of false positives because it cannot correlate with endpoint activity.

Answer

Sensitive data could be exfiltrated through encrypted webmail sessions that the network gateway cannot inspect.

Question 11

An IS auditor is assessing the security of an organization's virtualized environment. The organization uses a type 1 hypervisor and has multiple virtual machines (VMs) running on a single physical host. The auditor is concerned about the risk of VM escape, where an attacker compromises the hypervisor from within a VM. Which of the following controls are MOST effective in mitigating this risk? (Choose two.)

Accepted Answer

Ensuring the hypervisor is kept up to date with the latest security patches.. The most effective controls to mitigate VM escape are patching the hypervisor and hardening VM configurations by disabling unnecessary virtual hardware and shared folders. Patching addresses known vulnerabilities that could be exploited for escape, while reducing the attack surface limits the vectors an attacker can use. Together, these preventive measures significantly reduce the risk of a VM compromising the hypervisor.

Answer

Using a host-based intrusion detection system (HIDS) on each VM.

Answer

Regularly backing up VM images to a separate storage system.

Answer

Enabling promiscuous mode on the virtual switch to monitor all traffic.

Question 12

An IS auditor is evaluating a data loss prevention (DLP) deployment intended to stop sensitive customer records from leaving a bank's network. Management wants assurance that the solution is operating effectively. Which TWO of the following are the MOST important factors for the auditor to assess? (Choose two.)

Accepted Answer

Whether alerts generated by the DLP solution are investigated and resolved through a defined incident process.. To judge whether DLP stops sensitive records from leaving, the auditor must confirm the rules reflect the bank's data classifications and workflows, and that generated alerts are investigated and resolved through a defined incident process. These two factors together establish that the control both detects the right events and triggers action. Platform patching, endpoint encryption, and vendor certifications address adjacent concerns but not the operational effectiveness of the DLP control itself.

Answer

Whether the DLP solution supports encryption of data at rest on endpoint devices.

Answer

Whether the DLP vendor is certified to an internationally recognized quality management standard.

Answer

Whether the DLP server's operating system has the latest vendor-recommended patch level.

Question 13

An IS auditor is reviewing an organization's data loss prevention (DLP) strategy. The organization has implemented a network DLP solution but has not yet deployed endpoint DLP. Which TWO of the following are the MOST significant risks of relying solely on network DLP? (Choose two.)

Accepted Answer

Data copied to removable media such as USB drives may not be detected.. The two most significant risks of relying solely on network DLP are that data copied to removable media may not be detected and that encrypted data traversing the network may not be inspected. Network DLP monitors data in motion across network boundaries but lacks visibility into endpoint actions like USB copying and often cannot decrypt traffic without interception. Endpoint DLP complements network DLP by monitoring data at the endpoint, closing these gaps.

Answer

Network DLP does not provide visibility into data stored on file servers.

Answer

Network DLP cannot prevent data leakage via email attachments.

Answer

Network DLP cannot monitor traffic between internal network segments.

Question 14

An IS auditor is evaluating the security of an organization's wireless network. The organization uses WPA3-Enterprise with 802.1X authentication against a RADIUS server. The auditor discovers that the RADIUS server is configured to accept EAP-MD5 as an authentication method for legacy devices. Which of the following is the MOST significant security concern with this configuration?

Accepted Answer

EAP-MD5 does not support mutual authentication, allowing a rogue access point to capture user credentials.. EAP-MD5 is a legacy EAP method that authenticates only the client to the server, not the server to the client. Without mutual authentication, an attacker can deploy a rogue access point to impersonate the legitimate network, capture the client's MD5-hashed credentials, and crack them offline. Enabling EAP-MD5 on a RADIUS server for WPA3-Enterprise therefore introduces a serious credential theft vector.

Answer

EAP-MD5 requires the use of a public key infrastructure (PKI) that the organization may not have deployed.

Answer

EAP-MD5 is incompatible with WPA3-Enterprise and will cause the wireless network to fall back to WPA2.

Answer

EAP-MD5 transmits credentials in cleartext, exposing them to eavesdropping on the wireless medium.

Question 15

An IS auditor is examining how a data center protects its backup tapes while they are transported to an offsite vault. Management states that tapes are encrypted at rest using AES-256. Which of the following is the MOST important control the auditor should verify to protect the tapes during transit?

Accepted Answer

A chain-of-custody log with tamper-evident seals and dual custody is maintained for each shipment.. Because transport places media outside the controlled data center, the auditor should focus on physical custody controls. A documented chain of custody with tamper-evident seals and dual custody provides accountability and detects unauthorized access or substitution. Encryption protects confidentiality of data on the tape, but it does not prevent loss of the media or a denial of recovery capability, so custody controls are the most important complement.

Answer

The offsite vault maintains a temperature and humidity-controlled environment.

Answer

The encryption keys are stored in a hardware security module (HSM) at the primary data center.

Answer

Backup jobs are scheduled outside business hours to reduce contention with production systems.