CISA Protection of Information Assets Practice Test 2 — 15 Questions

Question 1

You are an IS auditor reviewing the remote access configuration for a medium-sized enterprise. The company uses a VPN concentrator to allow employees to connect from home. The VPN is configured with IPsec using pre-shared keys (PSK) and requires no multi-factor authentication. Employees use company-issued laptops with full disk encryption. The VPN logs show that connections are coming from a wide range of IP addresses, including some from countries where the company has no business operations. The IT manager argues that the PSK is changed monthly and that full disk encryption mitigates any risk. However, during the audit, you find that the PSK is stored in a shared document on an internal file server accessible to all employees. Additionally, the VPN concentrator uses a single PSK for all users. Which of the following is the MOST critical finding?

Accepted Answer

The VPN uses a single pre-shared key for all users, increasing the risk of widespread compromise. The use of a single pre-shared key (PSK) for all VPN users is the most critical finding because it creates a single point of failure: if that key is compromised, an attacker can impersonate any authorized user and gain full network access. The fact that the PSK is stored in a shared document accessible to all employees dramatically increases the likelihood of exposure, and changing it monthly does not remediate the fundamental lack of user-level authentication. Without per-user credentials or multi-factor authentication, the VPN concentrator cannot distinguish between legitimate employees and an attacker who possesses the shared key.

Answer

The PSK is changed monthly, but the change interval is too long

Answer

Full disk encryption on laptops is not sufficient to protect VPN credentials

Answer

VPN connections from unexpected countries indicate possible unauthorized access

Question 2

You are an IS auditor for a financial institution that processes credit card payments. The organization uses a key management system (KMS) to store encryption keys for point-of-sale (POS) data. The KMS is a hardware security module (HSM) located in a secured data center. The audit reveals that the HSM is administered by two individuals who both have full access to the HSM, including the ability to export keys. The organization has a policy requiring split knowledge and dual control for key management, but in practice, the two administrators often perform key ceremonies alone due to scheduling conflicts. The logs show that one administrator exported a key last month without the other present, and the export was approved via email by the other administrator after the fact. Which of the following is the BEST corrective action?

Accepted Answer

Configure the HSM to require two administrators to be physically present for key exports. The HSM must enforce split knowledge and dual control at the technical level, not rely on procedural compliance. By configuring the HSM to require two administrators to be physically present for key exports, the organization ensures that no single individual can export keys, directly addressing the policy violation and the log evidence of a solo export. This technical control is the most effective corrective action because it prevents the bypass of dual control even if administrators attempt to circumvent procedures.

Answer

Reduce the number of administrators to one to simplify accountability

Answer

Provide training to administrators on the importance of dual control

Answer

Implement automated key rotation every 90 days

Question 3

An organization is implementing a data loss prevention (DLP) solution. Which of the following is the BEST approach to minimize false positives while ensuring sensitive data is protected?

Accepted Answer

Use contextual analysis including user roles and data classification.. Contextual analysis (Option C) is the best approach because it reduces false positives by considering user roles, data classification, and behavioral patterns, ensuring that only genuinely risky data transfers are flagged. Unlike static methods, this dynamic analysis adapts to the organization's data governance policies, allowing legitimate business communications to proceed while still protecting sensitive information.

Answer

Encrypt all outbound emails containing any attachment.

Answer

Deploy exact file matching against a database of known sensitive documents.

Answer

Apply keyword matching to all outbound emails.

Question 4

A security architect is designing a data classification schema for a multinational corporation. Which combination of factors is MOST critical for determining the classification level of a data asset?

Accepted Answer

Legal, regulatory, and business impact if disclosed.. The classification level of a data asset is primarily determined by the potential harm that could result from its unauthorized disclosure, modification, or loss. Legal, regulatory, and business impact factors—such as compliance with GDPR, HIPAA, or PCI DSS—directly dictate the required confidentiality, integrity, and availability controls. Without assessing these impacts, any classification scheme would be arbitrary and fail to align with organizational risk tolerance.

Answer

Data volume and storage location.

Answer

Data format and encryption status.

Answer

Data creation date and last access time.

Question 5

A company's security policy requires that all laptops have full disk encryption. During an audit, it is discovered that several laptops have encryption enabled but the recovery keys are stored on the local drive. What is the MOST significant risk?

Accepted Answer

Recovery keys can be used to bypass encryption.. Storing recovery keys on the local drive defeats the purpose of full disk encryption (FDE). If an attacker gains physical access to the laptop, they can simply boot an alternate OS or mount the drive and read the recovery key file, then use it to unlock the encrypted volume. This bypasses the encryption entirely, making the data vulnerable to unauthorized access despite encryption being enabled.

Answer

Performance degradation due to encryption overhead.

Answer

Unauthorized access to encrypted data.

Answer

Data corruption during encryption process.

Question 6

An organization is planning to deploy a web application firewall (WAF) to protect a critical application. Which deployment mode should be used to ensure that the WAF can block malicious traffic without introducing a single point of failure?

Accepted Answer

Inline with high-availability clustering.. Inline with high-availability clustering ensures the WAF can actively inspect and block malicious traffic in real time while eliminating a single point of failure through automatic failover between clustered appliances. This mode maintains traffic flow even if one WAF node fails, meeting both security and availability requirements.

Answer

Out-of-band monitoring only.

Answer

Transparent inline without failover.

Answer

Reverse proxy with active-passive clustering.

Question 7

Which TWO are primary objectives of an identity and access management (IAM) program? (Select exactly 2.)

Accepted Answer

Ensuring appropriate access to resources.. Option A is correct because the primary objective of an IAM program is to ensure that the right individuals have access to the appropriate resources at the right time for the right reasons. This is achieved through authentication, authorization, and access control mechanisms such as Role-Based Access Control (RBAC) or Attribute-Based Access Control (ABAC). Without this, the organization cannot enforce security policies or maintain audit trails.

Answer

Encrypting data at rest and in transit.

Answer

Patching software vulnerabilities.

Answer

Monitoring network traffic for anomalies.

Question 8

Which THREE are commonly used techniques to protect sensitive data in a cloud environment? (Select exactly 3.)

Accepted Answer

Tokenization of sensitive fields.. Tokenization replaces sensitive data (e.g., credit card numbers) with a non-sensitive placeholder (token) that has no exploitable value. This technique is commonly used in cloud environments to reduce the scope of compliance (e.g., PCI DSS) because the token can be stored and processed without exposing the original sensitive value, even if the cloud storage is compromised.

Answer

Code obfuscation for application logic.

Answer

Network segmentation between tiers.

Question 9

Based on the exhibit, what is the MOST likely compliance issue requiring immediate remediation?

Accepted Answer

Backup media lacks encryption.. The exhibit shows backup tapes stored in an unsecured cabinet without any indication of encryption. Since backup media often contains sensitive data, the lack of encryption exposes the organization to data breaches if the media is lost or stolen. This is a direct violation of data protection requirements and requires immediate remediation.

Answer

Access is not properly restricted.

Answer

Compliance checks are not being performed.

Answer

Retention period is too short.

Question 10

A healthcare organization has implemented a data classification policy with three levels: Public, Internal, and Restricted. The IT department recently received a report of a potential data breach. An internal auditor discovered that a database containing Protected Health Information (PHI) classified as Restricted was accessible via a web application that did not enforce encryption in transit. The web application uses HTTPS, but the auditor found that the connection was downgraded to HTTP due to a misconfiguration in the load balancer. Additionally, the database logs show that an external IP address queried the database for thousands of patient records over a two-hour period. The database was configured to allow only specific internal application servers, but the firewall rule was incorrectly set to allow connections from any IP address. The security team needs to determine the most effective immediate action to prevent further unauthorized access and protect the data. Which course of action should the security team take FIRST?

Accepted Answer

Correct the firewall rule to restrict database access to only the application servers.. The firewall rule is the root cause of the unauthorized access — it allowed connections from any IP address, directly enabling the external attacker to query the database. Correcting this rule immediately cuts off all external access to the database, stopping the ongoing breach at the network layer. This is the most effective immediate action because it addresses the misconfiguration that allowed the attack to succeed, regardless of the encryption or web application issues.

Answer

Redesign the network architecture to place the database in a separate subnet.

Answer

Block the external IP address at the network perimeter.

Answer

Apply a security patch to the web application to enforce HTTPS.

Question 11

An organization is implementing a data loss prevention (DLP) solution. Which TWO of the following are key considerations for effective DLP deployment?

Accepted Answer

Implementing DLP in monitoring mode initially to baseline traffic. Options A and B are correct. A: Classifying data based on sensitivity is fundamental to DLP policy creation. B: Starting with monitoring before blocking reduces false positives. C: DLP is not a replacement for user training; it is a technical control. D: DLP should be deployed in phases, not organization-wide at once. E: Encryption is separate; DLP can detect but not enforce encryption for all data.

Answer

Deploying DLP agents on all endpoints before defining policies

Answer

Encrypting all data at rest and in transit as a prerequisite

Answer

Replacing user security awareness training with automated DLP

Question 12

Refer to the exhibit. A security analyst notices that users on the INSIDE network (10.1.1.0/24) can browse HTTPS websites but cannot resolve domain names. What is the most likely cause?

Accepted Answer

The ACL only permits DNS traffic to host 10.2.2.10, but users need to query a different DNS server. The exhibit shows an ACL that permits DNS traffic (UDP port 53) only to host 10.2.2.10. Since users can browse HTTPS (TCP/443) but cannot resolve domain names, the ACL is blocking DNS queries to any other DNS server. Option B correctly identifies that the ACL restricts DNS to a single server, and if users are configured to query a different DNS server, resolution fails.

Answer

The ACL denies TCP traffic to port 443

Answer

The DNS server at 10.2.2.10 is unreachable

Answer

The OUTSIDE interface has no security-level configured correctly

Question 13

A multinational corporation is deploying a new cloud-based collaboration platform for its 5,000 employees. The platform will store sensitive project data and intellectual property. The CISO mandates that all data must be encrypted at rest and in transit, and that access must be controlled via the company's identity provider (IdP) using SAML 2.0. During a pilot with the R&D department, the security team discovers that the platform's audit logs do not record failed login attempts from the IdP. The platform vendor states that the IdP is responsible for authentication, so the platform only logs successful assertions. The CISO is concerned about the lack of visibility into brute-force attacks. The company already has a SIEM that receives logs from the IdP and other sources. What is the BEST course of action?

Accepted Answer

Enable detailed logging on the IdP for all authentication attempts and forward those logs to the SIEM for monitoring. Option B is correct because the IdP is the authoritative source for authentication events in a SAML 2.0 federated identity model. The cloud platform only receives and logs successful SAML assertions, so it cannot log failed login attempts. Enabling detailed logging on the IdP for all authentication attempts (successes and failures) and forwarding those logs to the SIEM provides the necessary visibility into brute-force attacks without changing the platform or architecture.

Answer

Replace the cloud platform with one that provides built-in authentication logging

Answer

Configure the cloud platform to require re-authentication for every session and log all authentication events locally

Answer

Implement a stricter password policy for the IdP to reduce the risk of brute-force attacks

Question 14

Order the steps for responding to a security incident in the correct sequence.

Question 15

Arrange the steps to set up a virtual private network (VPN) for remote access in the correct order.