CISA Protection of Information Assets Practice Test 4 — 15 Questions

Question 1

An organization has the S3 bucket policy shown. Which of the following is the MOST likely intent of this policy?

Accepted Answer

Prevent deletion of objects from the bucket over unencrypted connections.. Option A is correct because the policy denies DeleteObject when the request is not over HTTPS (SecureTransport false), thereby blocking deletion over HTTP but allowing deletion over HTTPS. Option B is incorrect because deletion over HTTPS is still allowed. Option C is incorrect because other actions like read are not restricted. Option D is incorrect because it does not specifically allow deletion only over HTTPS; it denies over HTTP, so deletion over HTTPS is allowed implicitly.

Answer

Prevent all deletion of objects from the bucket.

Answer

Prevent access to the bucket over HTTP.

Answer

Allow deletion only over HTTPS.

Question 2

An IS auditor reviews the log entry above. Which of the following is the MOST likely cause of the authentication failure?

Accepted Answer

The client certificate presented has a common name that does not match the configured expected name.. The log entry indicates an authentication failure with a client certificate. The error 'CN mismatch' or similar certificate validation failure occurs when the Common Name (CN) in the client certificate does not match the expected name configured on the server (e.g., in a RADIUS or TLS mutual authentication context). This is a specific certificate-level issue, not a password or account lockout problem.

Answer

The user's account is locked.

Answer

The user's password is incorrect.

Answer

The RADIUS server is unavailable.

Question 3

A financial institution is implementing a data classification policy. Which of the following is the most important factor in determining the classification level of a data asset?

Accepted Answer

The sensitivity and criticality to business operations. The classification level of a data asset is determined by its sensitivity and criticality to business operations because these factors directly drive the required confidentiality, integrity, and availability controls. For example, personally identifiable information (PII) or financial transaction records require higher classification due to regulatory mandates (e.g., GDPR, PCI DSS) and the potential for severe business impact if compromised. Cost, format, or location are secondary attributes that do not inherently define the risk profile or protection needs of the data.

Answer

The cost of acquiring the data

Answer

The format of the data (structured vs unstructured)

Answer

The storage location of the data

Question 4

An organization uses role-based access control (RBAC). An employee is transferred to a new department. According to best practices, what should be done regarding the employee's access rights?

Accepted Answer

Immediately revoke all previous access and assign new role permissions.. Option C is correct because RBAC mandates that access rights are strictly tied to job functions. When an employee changes departments, their previous role permissions are no longer applicable and must be immediately revoked to prevent unauthorized access, while new role permissions are granted to align with their new responsibilities. This follows the principle of least privilege and ensures that access rights are always current with the employee's role.

Answer

Remove access to the previous department's resources after a grace period.

Answer

Keep all access but log usage.

Answer

Keep previous access and grant new role permissions.

Question 5

A company is migrating its customer database to a public cloud provider. Which of the following encryption strategies best protects data while minimizing performance impact on queries?

Accepted Answer

Use column-level encryption and tokenization for sensitive fields.. Option C is correct because column-level encryption and tokenization allow sensitive fields (e.g., SSNs, credit card numbers) to be protected while leaving non-sensitive columns unencrypted, preserving query performance on indexed and frequently queried data. Tokenization replaces sensitive values with non-sensitive placeholders, enabling joins and lookups without decryption overhead, and column-level encryption limits decryption to only the required fields per query.

Answer

Encrypt the entire database at rest using AES-256, and decrypt for each query.

Answer

Encrypt the database at the application layer before storage.

Answer

Rely on the cloud provider's default encryption for the storage.

Question 6

An organization wants to protect its intellectual property from unauthorized disclosure via email. Which control should be implemented?

Accepted Answer

Implement a data loss prevention (DLP) system.. Data loss prevention (DLP) solutions can monitor and block sensitive information from being sent via email, making it the most effective control for this purpose.

Answer

Encrypt all outgoing emails.

Answer

Disable email altogether.

Answer

Require employees to sign non-disclosure agreements.

Question 7

A security auditor discovers that a server has been compromised due to an unpatched vulnerability. Which of the following would have most effectively prevented this incident?

Accepted Answer

Implementing a vulnerability management program with regular patching.. Option B is correct because a vulnerability management program with regular patching directly addresses the root cause of the compromise: the unpatched vulnerability. By systematically identifying, prioritizing, and applying security patches, the organization eliminates the known weakness that the attacker exploited. This proactive measure prevents the initial compromise, whereas other controls only detect or limit the attack after the vulnerability is exploited.

Answer

Enabling firewall rules to limit access.

Answer

Installing a host-based intrusion detection system (HIDS).

Answer

Using strong passwords on the server.

Question 8

A multinational corporation is implementing a bring your own device (BYOD) policy. Which of the following is the most important security control to ensure corporate data is protected on employee devices?

Accepted Answer

Implement mobile device management (MDM) with containerization.. Option D is correct because Mobile Device Management (MDM) with containerization creates a separate, encrypted workspace on the employee's device that isolates corporate data from personal data. This ensures that the organization can enforce security policies (e.g., remote wipe, access controls) on the corporate container without affecting the user's personal information, which is critical for BYOD environments where full-device control is not feasible.

Answer

Require employees to install antivirus software.

Answer

Prohibit the use of personal devices for work.

Answer

Mandate full-device encryption.

Question 9

During an incident response, the IT team isolates a compromised system from the network. Which of the following is the primary purpose of this action?

Accepted Answer

To prevent further damage and contain the incident.. Isolating a compromised system from the network (e.g., by disconnecting the Ethernet cable, disabling the switch port, or applying a host-based firewall rule to drop all traffic) immediately stops the system from communicating with other hosts. This containment action prevents the attacker from moving laterally, exfiltrating data, or deploying additional malware, thereby limiting the blast radius and stopping ongoing damage.

Answer

To preserve evidence for forensic analysis.

Answer

To allow the system to be patched offline.

Answer

To comply with regulatory requirements.

Question 10

A company is implementing a cloud-based identity and access management (IAM) system. Which of the following best describes the principle of least privilege in this context?

Accepted Answer

Permissions should be granted based on the user's role and need-to-know.. Option D is correct because the principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions, based on their role and need-to-know. In a cloud-based IAM system, this is typically implemented through role-based access control (RBAC) or attribute-based access control (ABAC), ensuring minimal exposure to sensitive resources and reducing the attack surface.

Answer

Users should have administrative rights for troubleshooting.

Answer

Permissions should be revoked only when an employee leaves the company.

Answer

All users should have the same level of access for consistency.

Question 11

A company stores sensitive customer data in a database. To comply with privacy regulations, the data must be anonymized for analytics. Which technique provides the strongest anonymization while preserving data utility?

Accepted Answer

Differential privacy with calibrated noise.. Differential privacy with calibrated noise is the strongest anonymization technique because it provides a formal mathematical guarantee that the output of a query does not reveal whether any specific individual's data was included. By adding carefully calibrated noise to query results, it preserves statistical utility for analytics while ensuring that re-identification is provably infeasible, meeting strict privacy regulations like GDPR or CCPA.

Answer

Tokenization with a reversible mapping.

Answer

Removing direct identifiers like names and SSNs.

Answer

Data masking with static substitution.

Question 12

Which TWO of the following are key components of an effective information security awareness program?

Accepted Answer

Mandatory training for all employees. Option C is correct because mandatory training for all employees ensures that every user understands their security responsibilities, recognizes threats like phishing, and follows organizational policies. This is a foundational element of an awareness program as defined by frameworks such as NIST SP 800-50, which emphasizes that awareness and training must be tailored to roles and delivered to all personnel. Without mandatory participation, coverage gaps leave the organization vulnerable to social engineering and policy violations.

Answer

Periodic review of security logs

Answer

Annual password change policy

Answer

Regular vulnerability scans

Question 13

Which THREE of the following are commonly accepted practices for securing mobile devices in an enterprise environment?

Accepted Answer

Use containerization for corporate data. Containerization (Option B) is a commonly accepted practice for securing mobile devices in an enterprise environment because it creates a separate, encrypted workspace on the device that isolates corporate data and applications from personal data. This approach, often implemented through Mobile Device Management (MDM) or Enterprise Mobility Management (EMM) solutions, uses technologies like sandboxing and per-container encryption (e.g., AES-256) to prevent data leakage between the corporate and personal environments. It allows the enterprise to enforce security policies (e.g., remote wipe of only the container) without compromising the user's personal privacy, which is a key requirement for BYOD (Bring Your Own Device) programs.

Answer

Install antivirus on all devices

Answer

Disable all third-party apps

Question 14

Which TWO of the following are primary objectives of a data loss prevention (DLP) strategy?

Accepted Answer

Identify and classify sensitive data. Option B is correct because identifying and classifying sensitive data is the foundational step in a DLP strategy. Without knowing where sensitive data resides (e.g., PII, PCI, IP), DLP policies cannot accurately detect or prevent unauthorized transfers. Classification enables the DLP system to apply context-aware rules, such as blocking credit card numbers in email attachments or flagging confidential documents uploaded to cloud storage.

Answer

Encrypt all data in transit

Answer

Replace all existing security controls

Answer

Ensure compliance with all regulations

Question 15

Refer to the exhibit. An auditor reviews the ACL and notes that it allows traffic from a specific host while blocking other IPs in the same subnet. What is the most likely security issue?

Accepted Answer

The ACL is misconfigured because the permit any at the end bypasses the deny.. Option B is correct because the ACL has a 'permit any' statement at the end, which overrides the preceding 'deny' statements. In Cisco ACLs, packets are processed sequentially from top to bottom; once a match is found, no further rules are evaluated. Therefore, the 'deny' for the subnet is never reached, and all traffic (including from the blocked subnet) is permitted, defeating the intended restriction.

Answer

The ACL blocks all traffic from the subnet except the host, which is desired.

Answer

The ACL allows all traffic from the specific host, which is a risk.

Answer

The ACL should be reversed to deny first.

CISA Protection of Information Assets Practice Test 4 — 15 Questions

Exhibit

CISA Protection of Information Assets Practice Test 4 — 15 Questions

Exhibit