CISA Protection of Information Assets Practice Test 8 — 15 Questions

Question 1

An IS auditor is reviewing the access control list (ACL) on a router that connects the corporate network to the internet. The auditor notices that the ACL permits inbound traffic on port 3389 (RDP) from any source IP address to a specific internal server. Which of the following is the MOST appropriate recommendation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Restrict inbound RDP access to specific trusted IP addresses or require VPN access.. The most appropriate recommendation is to restrict inbound RDP access to specific trusted IP addresses or require VPN access. This directly reduces the exposure of the RDP service to potential attackers. While other measures like NLA or account lockout can add defense in depth, they do not address the fundamental issue of allowing RDP from any source. Restricting access is a preventive control that aligns with least privilege and reduces the attack surface.

Answer

Implement account lockout policies to prevent brute-force attacks.

Answer

Change the default RDP port to a non-standard port to obscure the service.

Answer

Enable Network Level Authentication (NLA) on the RDP server.

Question 2

An IS auditor is reviewing a data center's environmental controls and observes that the fire suppression system uses water sprinklers in the main server room. The auditor learns that the sprinkler system was installed when the facility was a general office space. Management states that the sprinklers have never activated. Which of the following should the IS auditor recommend as the MOST appropriate control improvement?

Accepted Answer

Replace the water sprinkler system with a clean agent or pre-action suppression system appropriate for IT equipment.. Water sprinklers are inappropriate for rooms housing energized IT equipment because discharge can destroy hardware and interrupt operations far beyond the fire itself. A clean agent or pre-action system provides suppression while minimizing collateral damage. Because management's justification rests only on the absence of prior activations, the auditor should recommend replacing the suppression method rather than merely inspecting or accepting it.

Answer

Document a formal exception accepting the water sprinkler system based on its clean activation history.

Answer

Increase the frequency of sprinkler head inspections to ensure they remain operational.

Answer

Install additional smoke detectors to provide earlier warning of a fire event.

Question 3

An IS auditor is assessing the security of an organization's virtualization environment. The auditor finds that the hypervisor management interface is accessible from the general corporate network and uses default credentials. Which of the following is the MOST critical risk associated with this finding?

Accepted Answer

An attacker could gain control of the hypervisor and compromise all hosted virtual machines.. The most critical risk is that an attacker could gain control of the hypervisor and compromise all hosted virtual machines. The hypervisor management interface is a privileged access point; if exposed and using default credentials, it can be easily exploited. An attacker with administrative control can manipulate all VMs, access sensitive data, and disrupt services across the entire virtual infrastructure. This represents a single point of failure with catastrophic potential.

Answer

An attacker could cause a denial of service by overwhelming the hypervisor with management requests.

Answer

An attacker could exploit a vulnerability in the hypervisor to escape to the host operating system.

Answer

An attacker could intercept network traffic between virtual machines on the same host.

Question 4

An IS auditor is assessing physical security at a data center that houses the organization's core transaction processing systems. The auditor observes that the main entrance uses a badge reader, but the door to the server hall is propped open with a box while staff move equipment. Which of the following is the auditor's GREATEST concern?

Accepted Answer

The server hall door being propped open allows unauthorized physical access to critical systems.. Physical access to core transaction systems is a foundational control, and a door propped open removes that barrier entirely, allowing anyone nearby to reach the servers. Because physical proximity enables direct compromise, theft, or sabotage that logical controls cannot prevent, this observation carries the greatest risk. Missing logs, undocumented moves, and the absence of a mantrap are lesser issues by comparison.

Answer

The data center lacks a mantrap or interlocking double-door entry at the main entrance.

Answer

Equipment is being moved without a documented change management ticket.

Answer

The badge reader at the main entrance does not record access attempts for later review.

Question 5

An IS auditor is reviewing an organization's backup and recovery procedures for a critical database. The backup policy states that full backups are performed weekly and transaction log backups every 15 minutes. The recovery point objective (RPO) for the database is 5 minutes. Which of the following is the MOST appropriate recommendation?

Accepted Answer

Increase the frequency of transaction log backups to meet the 5-minute RPO.. The RPO of 5 minutes means the organization can tolerate losing at most 5 minutes of data. Transaction log backups every 15 minutes create a potential 15-minute data loss window, exceeding the RPO. The auditor should recommend increasing the frequency of transaction log backups to 5 minutes or less to meet the stated recovery objective.

Answer

Implement database mirroring to provide a real-time copy and eliminate the need for transaction log backups.

Answer

Document the current backup schedule as an accepted risk because the RPO is only a guideline.

Answer

Perform full backups more frequently, such as daily, to reduce the potential data loss.

Question 6

An IS auditor is reviewing an organization's security monitoring architecture. The organization uses a SIEM to collect logs from servers, firewalls, and applications. Management reports that the SIEM is functioning as designed and alerts are generated. Which of the following findings would be of MOST concern to the auditor?

Accepted Answer

Log retention is set to 30 days, and the organization's incident response procedure requires investigating events up to 90 days old.. A monitoring system is only as useful as the evidence it retains. When the configured retention period is shorter than the period the incident response process requires for investigation, the organization cannot reconstruct events that are discovered late. This misalignment between a technical setting and a documented requirement directly impairs detection follow-up and forensic analysis, making it the finding that most threatens the effectiveness of security monitoring.

Answer

Log sources use different time zone settings and the SIEM normalizes timestamps at ingestion.

Answer

The SIEM is deployed on-premises rather than as a cloud-hosted service.

Answer

The SIEM generates more alerts than the security team can review in a shift.

Question 7

An IS auditor is reviewing the network segmentation of a retail company's cardholder data environment (CDE). The auditor finds that the CDE and the corporate user VLAN are separated by a firewall, but the same flat Layer 2 domain spans both segments, and no internal segmentation firewall exists between the CDE web tier and the CDE database tier. Which of the following findings should the auditor report as the GREATEST risk?

Accepted Answer

The CDE and corporate VLAN share a flat Layer 2 domain, allowing lateral movement without passing through the firewall.. The critical issue is that the CDE and corporate network share a flat Layer 2 domain, so hosts can communicate via ARP and MAC-level traffic without traversing the firewall. This silently defeats the intended segmentation and enables lateral movement from a compromised corporate workstation into the cardholder data environment. Eliminating the shared broadcast domain and forcing all inter-segment traffic through the firewall restores the control the organization believes is operating.

Answer

The corporate VLAN should be moved into the CDE so that all traffic is inspected by the same firewall policy.

Answer

The firewall separating the CDE and corporate VLAN is a single point of failure and should be deployed in a high-availability pair.

Answer

The absence of an internal segmentation firewall between the web tier and the database tier is the greatest risk.

Question 8

An IS auditor is reviewing an organization's endpoint protection controls after several employees reported slow performance on their laptops. The auditor observes that the anti-malware solution performs a full disk scan every night, and the audit log shows that the last successful signature update was 47 days ago. Which of the following is the MOST significant concern the auditor should report?

Accepted Answer

The anti-malware signature database has not been updated for 47 days, leaving endpoints exposed to recent threats.. The most significant concern is that endpoint protection is running with signatures that are 47 days old, which means the control cannot detect recently identified malware. A deployed but outdated anti-malware solution provides a false sense of security because it appears active yet fails against current threats. Performance and scheduling issues are secondary operational matters, while the stale signature database is a direct, measurable weakness in the protection of information assets.

Answer

The nightly full disk scan consumes excessive endpoint resources and degrades user productivity.

Answer

The organization has not implemented application whitelisting to complement the anti-malware solution.

Answer

The full disk scan schedule conflicts with the organization's backup window and may cause backup failures.

Question 9

An IS auditor is evaluating a wireless network deployed in a corporate headquarters. The auditor discovers that the network uses WPA2-Enterprise with 802.1X authentication, but the RADIUS server accepts any client presenting a valid domain user account, including accounts belonging to recently terminated employees that have not yet been disabled. Which of the following is the GREATEST risk arising from this configuration?

Accepted Answer

Former employees with still-valid accounts could authenticate to the internal network and access resources.. The finding is that authentication succeeds for accounts belonging to terminated employees, meaning the RADIUS server does not enforce timely deprovisioning. Because 802.1X grants network access on successful authentication, a former employee can re-enter the internal network using valid credentials. The primary risk is unauthorized internal access through a logical access control failure, not encryption weakness or rogue devices.

Answer

Rogue access points could be introduced without detection by the wireless intrusion prevention system.

Answer

Wireless traffic could be decrypted by anyone monitoring the radio frequency spectrum.

Answer

Attackers could capture and crack the pre-shared key used for wireless encryption.

Question 10

An IS auditor is reviewing a software-as-a-service (SaaS) provider that hosts a company's customer relationship management (CRM) data. The contract states the provider will maintain a SOC 2 Type II report, but the most recent report covers a period ending 14 months ago, and the provider has not responded to requests for a bridge letter. Which of the following should the auditor conclude?

Accepted Answer

Assurance over the provider's controls for the current period is inadequate and requires further action.. Third-party assurance is only valid for the period it covers. A SOC 2 Type II report ending 14 months ago, with no bridge letter explaining the intervening period, leaves the auditor without evidence that controls operated effectively during the current period. The correct conclusion is that assurance is inadequate, and the auditor should pursue a current report, a bridge letter, or alternative procedures before relying on the provider.

Answer

The provider is noncompliant with the contract and should be replaced immediately.

Answer

The company should perform a penetration test of the SaaS provider's environment to close the gap.

Answer

The provider's controls are effective because a SOC 2 Type II report was previously issued.

Question 11

An IS auditor is examining how a financial services firm enforces data loss prevention (DLP) for outbound email. The firm uses a network DLP appliance that inspects SMTP traffic and blocks messages containing unencrypted account numbers. The auditor discovers that employees can bypass the appliance by using a personal webmail account over HTTPS. Which of the following should the auditor recommend FIRST?

Accepted Answer

Block access to personal webmail and other unauthorized exfiltration channels at the web gateway, then extend DLP coverage to those channels.. The DLP appliance only inspects SMTP, so employees who use personal webmail over HTTPS bypass it entirely. The most effective first step is to block unauthorized exfiltration channels at the web gateway and extend DLP coverage so the control cannot be trivially circumvented. Closing the unmonitored path addresses the root cause, whereas tuning detection patterns or relying on policy alone leaves the bypass intact.

Answer

Require employees to sign an acceptable use policy acknowledging that personal webmail use is prohibited.

Answer

Increase the sensitivity of the DLP appliance's pattern matching so it detects account numbers in more formats.

Answer

Deploy TLS inspection at the perimeter so the DLP appliance can examine HTTPS sessions to webmail providers.

Question 12

An IS auditor is reviewing the physical security controls at a data center. The auditor observes that the data center has a single entrance with a biometric scanner, but the door is propped open by a cleaning cart while the cleaning staff works inside. Which of the following is the MOST appropriate action for the auditor to take?

Accepted Answer

Document the observation as a finding because the propped door defeats the access control and allows unauthorized entry.. A propped door completely bypasses the biometric access control, creating a path for unauthorized entry. The auditor should document this as a finding because it represents a failure of the physical access control objective. The appropriate recommendation would be to implement compensating controls such as door alarms, mantrap entrances, or strict policy enforcement to prevent doors from being held open.

Answer

Ignore the observation because the cleaning staff are authorized personnel who have undergone background checks.

Answer

Recommend replacing the biometric scanner with a more robust access control system.

Answer

Report the issue to the cleaning supervisor and consider the matter resolved.

Question 13

An IS auditor is assessing how an organization manages the risk of malicious code on employee workstations. The organization has deployed endpoint detection and response (EDR) agents on all workstations and maintains a centralized console. Which of the following is the MOST important factor in determining whether the EDR deployment effectively reduces malicious code risk?

Accepted Answer

Whether the EDR agents are configured to update their detection signatures and behavioral models automatically.. EDR reduces malicious code risk by detecting known and unknown threats through signatures and behavioral analysis. That capability degrades rapidly if the agent's detection logic is stale. Automatic updates keep both signature databases and behavioral models current, allowing the agent to recognize new variants and techniques. Configuration and response integration matter, but without current detection logic the agent cannot identify the threats it is deployed to stop, so update configuration is the most important factor.

Answer

Whether the EDR agents are installed on servers in addition to workstations.

Answer

Whether the EDR vendor has a large market share among similar organizations.

Answer

Whether the EDR console is hosted in the same data center as the workstations it monitors.

Question 14

An IS auditor is reviewing the logical access controls of a legacy payroll application that authenticates users directly against its own internal user table rather than the corporate directory. Management states that this was a deliberate design choice by the vendor. Which of the following is the MOST significant audit concern with this arrangement?

Accepted Answer

Password policy enforcement may be inconsistent with the corporate standard and orphaned accounts may persist.. A locally maintained user table sits outside the corporate directory, so provisioning, modification, and timely revocation depend on manual processes that frequently fail. The result is inconsistent password standards and accounts that survive termination or role change. Auditors should focus on whether identity lifecycle controls still cover the application, since that determines whether access remains authorized, least-privileged, and auditable over time.

Answer

The application's database may not be able to support concurrent user sessions at peak payroll processing times.

Answer

Users may need to remember an additional password, which could increase help desk call volume.

Answer

Vendor support for the authentication module may lapse if the application is not upgraded to the current release.

Question 15

An IS auditor is assessing how an organization classifies and handles its information assets. The auditor finds that a data classification policy exists but is inconsistently applied across business units. Which TWO of the following are the MOST important elements the auditor should verify are present to support effective data classification? (Choose two.)

Accepted Answer

A documented mapping of classification levels to specific handling and protection requirements.. Effective classification depends on two foundational elements: an accountable owner for each information asset and a documented mapping from classification levels to specific handling requirements. Ownership drives consistent labeling and review, while the mapping translates labels into enforceable controls. Absent either element, business units interpret classification differently, which explains the inconsistency the auditor observed.

Answer

Use of a commercial data loss prevention tool to enforce labels.

Answer

Annual penetration testing of systems that store classified data.

Answer

A requirement that all data be stored in a single centralized repository.