CISA Protection of Information Assets Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. An auditor finds that users are able to reuse previous passwords easily. Which setting should be modified to address this weakness?

Accepted Answer

Increase the password history to 10. Increasing the password history setting (e.g., to 10) prevents users from reusing their most recent passwords by storing a specified number of previous password hashes. When a user attempts to change their password, the system compares the new password against the stored history and rejects it if it matches any of the remembered passwords. This directly addresses the weakness of easy password reuse.

Answer

Increase the minimum password age to 7 days

Answer

Enable password expiration notifications

Answer

Increase the maximum password age to 30 days

Question 2

Refer to the exhibit. During a penetration test, a security analyst captures this SAML response. Which of the following security weaknesses is most evident?

Accepted Answer

The assertion is not encrypted. The SAML response shows the assertion is sent in plaintext (no xenc:EncryptedData element), meaning the authentication assertion is not encrypted. This allows an attacker who intercepts the SAML response to extract the assertion and reuse it in a replay or impersonation attack, violating the confidentiality requirement for sensitive authentication tokens.

Answer

The name identifier format is inappropriate

Answer

The session is too short

Answer

The authentication context is weak

Question 3

An organization is implementing a data loss prevention (DLP) solution. Which of the following is the MOST important step to ensure the DLP rules are effective?

Accepted Answer

Classify data based on sensitivity. Data classification is the foundational step for effective DLP rules because it defines which data is sensitive and how it should be handled. Without classification, DLP policies cannot accurately identify or enforce rules on sensitive content, leading to false positives or missed detections. Classification enables the DLP system to apply context-aware rules (e.g., regex patterns for PII, keywords for confidential documents) that align with the organization's data governance requirements.

Answer

Encrypt all data at rest

Answer

Establish an incident response team

Answer

Create user awareness training

Question 4

During a security assessment, an auditor discovers that employees are sharing passwords to access a critical system. Which of the following controls would BEST mitigate this risk?

Accepted Answer

Implement multi-factor authentication. Multi-factor authentication (MFA) mitigates the risk of password sharing because even if credentials are shared, an attacker cannot authenticate without the second factor (e.g., a one-time passcode from a hardware token or authenticator app). MFA decouples authentication from a single shared secret, making shared passwords insufficient for access. This directly addresses the root cause—reliance on passwords alone—rather than attempting to prevent sharing behavior.

Answer

Provide security awareness training

Answer

Log all authentication attempts

Answer

Enforce complex password policies

Question 5

A company is designing a public cloud-based application that processes highly sensitive personal data. Which of the following data protection strategies provides the STRONGEST assurance that data remains confidential even if the cloud provider's infrastructure is compromised?

Accepted Answer

Implement client-side encryption with customer managed keys. Client-side encryption with customer managed keys ensures that data is encrypted before it leaves the client environment, and the cloud provider never has access to the plaintext data or the encryption keys. Even if the cloud provider's infrastructure is fully compromised, the attacker cannot decrypt the data because the keys are never stored or processed by the provider. This provides the strongest assurance of confidentiality because the data remains encrypted end-to-end, independent of the provider's security controls.

Answer

Use server-side encryption with cloud provider managed keys

Answer

Enable encryption in transit using TLS 1.3

Answer

Apply data masking at the application layer

Question 6

An IT manager is reviewing the access control model for a financial application. The policy requires that no single person can approve a transaction. Which access control principle does this policy enforce?

Accepted Answer

Separation of duties. The policy that no single person can approve a transaction enforces the separation of duties (SoD) principle. In financial applications, SoD requires that critical tasks, such as initiating and approving a transaction, be divided among multiple individuals to prevent fraud or error. This control ensures that no single user has the authority to complete a high-risk action alone, directly aligning with the requirement stated.

Answer

Least privilege

Answer

Mandatory access control

Answer

Need to know

Question 7

A company's security policy requires that all laptops have full-disk encryption. During an audit, 10% of laptops are found without encryption. Which of the following is the MOST effective corrective action?

Accepted Answer

Deploy centralized endpoint management to enforce encryption. Centralized endpoint management (e.g., Microsoft Intune, SCCM, or a third-party MDM) allows administrators to enforce full-disk encryption (such as BitLocker or FileVault) via policy, automatically encrypting non-compliant laptops and preventing users from disabling encryption. This is the most effective corrective action because it addresses the root cause—lack of enforcement—rather than relying on user action or manual processes.

Answer

Require users to manually enable encryption

Answer

Distribute encryption keys to users

Answer

Conduct security awareness training on encryption

Question 8

An organization plan to integrate a third-party payment gateway into its e-commerce platform. Which of the following is the MOST critical security control to implement before going live?

Accepted Answer

Perform a penetration test on the integration. A penetration test on the integration is the most critical control because it actively validates the security of the API endpoints, data flows, and authentication mechanisms between the e-commerce platform and the third-party gateway. Unlike passive controls like encryption or logging, a penetration test can uncover exploitable vulnerabilities such as injection flaws, broken authentication, or insecure direct object references that could lead to financial fraud or data breach before the system is exposed to live transactions.

Answer

Ensure all data is encrypted in transit and at rest

Answer

Implement detailed logging of payment transactions

Answer

Configure network firewalls to restrict traffic

Question 9

A small business wants to protect customer data stored on a local file server. Which of the following is the MOST cost-effective control to prevent unauthorized access?

Accepted Answer

Configure file-level permissions. Configuring file-level permissions (e.g., NTFS permissions on Windows or POSIX ACLs on Linux) is the most cost-effective control because it directly restricts which users or groups can read, write, or modify specific files and folders on the server. This granular access control prevents unauthorized access without requiring additional hardware or complex management, making it ideal for a small business with limited budget.

Answer

Enable detailed audit logs

Answer

Implement full-disk encryption

Answer

Deploy biometric authentication

Question 10

An auditor is reviewing the encryption strategy for a healthcare application that stores protected health information (PHI) in a database. The database currently uses transparent data encryption (TDE). What is a key risk associated with TDE?

Accepted Answer

It does not protect against privileged database users. TDE generally does not protect data from users with database admin privileges because the decryption occurs at the database level and authorized users can access plaintext. Option A is wrong because performance impact is typically minor. Option C is wrong because key management is a consideration but not the key risk related to user access. Option D is wrong because TDE can be implemented.

Answer

It requires complex key management

Answer

It significantly degrades database performance

Answer

It cannot be used with column-level encryption

Question 11

An organization has implemented a role-based access control (RBAC) system. A user complains that they cannot access a file needed to complete a critical task. The file's permission indicates that only the 'Manager' role has read access. The user is assigned to the 'Analyst' role. Which of the following is the BEST course of action?

Accepted Answer

Submit a request for temporary access approval via change management. Option B is correct because in a properly implemented RBAC system, access changes must follow the principle of least privilege and be formally approved through change management to maintain audit trails and security controls. Granting temporary access via a documented change request ensures that the access is justified, time-bound, and reviewed, preventing unauthorized privilege escalation. This aligns with the CISA domain of Protection of Information Assets, where access control changes must be controlled and monitored.

Answer

Assign the user to the Manager role temporarily

Answer

Create a new role with only read access to that file

Answer

Change the file permissions to include Analyst role

Question 12

Which of the following are effective controls to protect sensitive data in use? (Choose TWO.)

Accepted Answer

Homomorphic encryption. Homomorphic encryption allows computations to be performed directly on encrypted data without decrypting it first, thereby protecting the data while it is in use. This is a critical control for scenarios where sensitive data must be processed by untrusted environments, as the plaintext is never exposed during processing.

Answer

Transport Layer Security (TLS)

Answer

Access control lists (ACLs)

Answer

Hashing

Question 13

Which of the following are key considerations when implementing a data classification policy? (Choose THREE.)

Accepted Answer

Definition of classification categories. Option B is correct because defining classification categories (e.g., Public, Internal, Confidential, Restricted) is the foundational step in a data classification policy. These categories establish the criteria for labeling and handling data based on sensitivity and criticality, directly enabling consistent protection controls across the organization.

Answer

Encryption key management

Answer

Backup frequency requirements

Question 14

An organization has implemented a database activity monitoring (DAM) solution. Which of the following are BEST practices for tuning the DAM to reduce false positives? (Choose TWO.)

Accepted Answer

Implement exclusions for routine maintenance activities. Implementing exclusions for routine maintenance activities (Option A) is a best practice because these activities often generate predictable database queries that are not indicative of security threats. By excluding them, the DAM solution avoids alerting on benign operations, thereby reducing false positives without compromising security coverage.

Answer

Enable alerts for all database queries

Answer

Increase the sensitivity of all detection rules

Answer

Review alerts in real-time only

Question 15

Refer to the exhibit. A CISA is reviewing this S3 bucket policy. What is the PRIMARY security concern?

Accepted Answer

The bucket is configured for public read access. The bucket policy explicitly grants `s3:GetObject` to `Principal: "*"` with `Effect: "Allow"`, which means any unauthenticated user on the internet can read objects in the bucket. This is a classic misconfiguration that leads to public read access, exposing sensitive data. While encryption and versioning are important security controls, the immediate and most severe risk is unauthorized data disclosure via public read.

Answer

Encryption is not enforced on the bucket

Answer

The policy allows unauthorized write access

Answer

Versioning is not enabled on the bucket

CISA Protection of Information Assets Practice Test 5 — 15 Questions

Exhibit

CISA Protection of Information Assets Practice Test 5 — 15 Questions

Exhibit