CISA Protection of Information Assets Practice Test 3 — 15 Questions

Question 1

Match each security control to its category.

Question 2

Match each regulatory standard to its focus area.

Question 3

Which of the following is the PRIMARY benefit of using a hardware security module (HSM) for key management?

Accepted Answer

It provides tamper-resistant storage for encryption keys.. The primary benefit of a hardware security module (HSM) is that it provides tamper-resistant, physically secured storage for encryption keys. HSMs are designed to protect keys from extraction or modification, even if an attacker gains physical access to the device, which is critical for maintaining the confidentiality and integrity of cryptographic operations. This aligns with the core purpose of an HSM: to safeguard the root of trust in a key management infrastructure.

Answer

It reduces the cost of key management.

Answer

It improves encryption speed.

Answer

It simplifies key distribution.

Question 4

An organization uses risk-based authentication (RBA) for user access. Which of the following factors would MOST likely trigger a step-up authentication?

Accepted Answer

User accessing sensitive data from an unusual location.. Risk-based authentication (RBA) evaluates the risk level of each access attempt based on contextual factors. An unusual location is a high-risk indicator because it deviates from the user's established behavioral baseline, often triggering step-up authentication (e.g., requiring a one-time passcode or biometric verification) to verify the user's identity before granting access to sensitive data.

Answer

User logging in from a known device.

Answer

User entering correct password.

Answer

User logging in during business hours.

Question 5

An IS auditor reviews the disposal process of hard drives. Which of the following methods provides the HIGHEST assurance that data cannot be recovered?

Accepted Answer

Physical shredding.. Option C is correct because physical shredding destroys the media, making data recovery virtually impossible. Option A is incorrect because quick format only removes file pointers. Option B is incorrect because degaussing may not work on SSDs. Option D is incorrect because overwriting may leave residual data.

Answer

Overwriting with zeros.

Answer

Degaussing.

Answer

Quick format.

Question 6

When implementing a data classification policy, which of the following roles is PRIMARILY responsible for assigning classification labels to data?

Accepted Answer

Data owner.. The data owner is the senior manager or business process owner who has the authority to determine the sensitivity and criticality of the data. They are primarily responsible for assigning classification labels because they understand the business impact if the data is compromised. This role defines the classification level (e.g., Public, Internal, Confidential, Restricted) based on the data's value and legal or regulatory requirements.

Answer

Data custodian.

Answer

Data user.

Answer

Data steward.

Question 7

Which of the following is the MOST effective control to prevent unauthorized USB devices from connecting to corporate workstations?

Accepted Answer

Device control software that blocks non-approved USB devices.. Device control software (e.g., endpoint DLP or USB whitelisting tools) operates at the OS kernel or driver level to enforce a hardware ID or vendor ID allowlist, blocking any USB device not explicitly approved. This is the only option that provides a preventive, automated, and continuous control against unauthorized USB connections, regardless of user behavior or physical access.

Answer

User awareness training.

Answer

Physical security guards.

Answer

Encrypting all USB devices.

Question 8

During an audit of a privileged access management (PAM) system, the auditor finds that privileged sessions are recorded but not reviewed. What is the primary risk?

Accepted Answer

Missing evidence of malicious activity after an incident.. Recording privileged sessions without review means that while a log of activities exists, it is not analyzed for signs of compromise or policy violations. The primary risk is that after a security incident, the recorded sessions may be the only source of evidence to reconstruct the attack, but without prior review, the organization may fail to identify malicious activity in a timely manner or may lose critical forensic data if logs are overwritten or deleted before an incident is discovered.

Answer

Inability to detect real-time threats.

Answer

Increased administrative overhead.

Answer

Non-compliance with licensing agreements.

Question 9

An organization is implementing a data masking solution for a non-production database. Which of the following is the MOST important requirement?

Accepted Answer

Masked data should maintain referential integrity.. In a non-production database, data masking must preserve referential integrity to ensure that relationships between tables (e.g., foreign keys) remain valid after masking. Without referential integrity, application logic that relies on these relationships would break, making the non-production environment unusable for testing or development. This is the most critical requirement because masked data must still function correctly within the database schema.

Answer

Masked data should be encrypted.

Answer

Masked data should be irreversible.

Answer

Masked data should be randomized across all columns.

Question 10

Which of the following is the BEST indicator that an organization's data security governance is effective?

Accepted Answer

Audit findings show compliance with data protection policies.. Option C is correct because audit findings showing compliance with data protection policies directly indicate that governance controls are working. Option A is incorrect because incident count is a lagging indicator. Option B is incorrect because training alone does not ensure compliance. Option D is incorrect because key count is not a measure of effectiveness.

Answer

Number of security incidents.

Answer

Percentage of employees trained.

Answer

Number of encryption keys managed.

Question 11

What is the FIRST step in implementing an identity and access management (IAM) program?

Accepted Answer

Performing a user access review.. Performing a user access review is the first step because it establishes a baseline of current access rights, identifies segregation of duties conflicts, and uncovers orphaned accounts or excessive privileges. Without this foundational assessment, subsequent IAM controls like SSO or MFA would be deployed on an insecure or non-compliant access framework, violating the principle of 'least privilege' and potentially failing audit requirements.

Answer

Selecting an IAM vendor.

Answer

Implementing multi-factor authentication.

Answer

Deploying single sign-on (SSO).

Question 12

Which TWO of the following are considered essential components of an information security policy framework? (Choose two.)

Accepted Answer

Data classification policy. A data classification policy is essential because it defines how information assets are categorized based on sensitivity and criticality (e.g., public, internal, confidential, restricted). This classification directly drives the selection and enforcement of appropriate security controls, such as encryption standards (e.g., AES-256 for confidential data) and access control mechanisms (e.g., role-based access control). Without it, security measures cannot be consistently applied across the organization, leading to gaps in protection.

Answer

Business continuity plan

Answer

Incident response plan

Answer

Network architecture diagram

Question 13

Which TWO of the following are the MOST effective controls to prevent unauthorized access to a data center's server room? (Choose two.)

Accepted Answer

Mantrap entry. Options A and D are correct because biometric authentication and mantrap entry are preventive physical controls. Option B is incorrect as CCTV is detective. Option C is incorrect as visitor logbook is administrative. Option E is incorrect as rack locks are secondary to room access.

Answer

Server rack locks

Answer

CCTV monitoring

Answer

Visitor logbook

Question 14

Which THREE of the following are commonly used data encryption standards? (Choose three.)

Accepted Answer

3DES. 3DES (Triple Data Encryption Standard) is a symmetric-key block cipher that applies the DES algorithm three times to each data block, effectively increasing the key length to 168 bits. It was widely adopted as a secure replacement for single DES, though it is now considered legacy due to performance and security limitations.

Answer

SHA-256

Answer

MD5

Question 15

An organization uses the access list above on its perimeter firewall. Which of the following is a valid conclusion?

Accepted Answer

All HTTPS traffic from the 192.168.1.0 subnet is allowed.. Option B is correct because the access list permits TCP traffic from source network 192.168.1.0/24 to destination port 443 (HTTPS). The permit statement for TCP with eq 443 explicitly allows HTTPS traffic from that subnet, and there is no subsequent deny statement blocking it.

Answer

All HTTP traffic from the 192.168.2.0 subnet is allowed.

Answer

All traffic from the 192.168.2.0 subnet is allowed.

Answer

All traffic from the Internet to internal hosts is denied.

Answer

All traffic from 192.168.1.0 subnet is allowed on any port.

Answer

All traffic from the Internet is denied.

Answer

The ACL allows SSH traffic from 192.168.1.0 subnet.