CISA Protection of Information Assets Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. An auditor notices this log entry during a review. The user john.doe does not have a legitimate business need to access executive salaries. Which of the following is the MOST likely control failure?

Accepted Answer

Inadequate access controls or role-based permissions. The log entry shows user john.doe successfully accessed executive salary data via a SELECT query. Since the user has no legitimate business need for this data, the most likely control failure is inadequate access controls or role-based permissions (RBAC). Proper RBAC would restrict access to sensitive columns or tables based on job function, preventing unauthorized queries regardless of other controls.

Answer

Database firewall misconfiguration

Answer

Audit logging is not enabled

Answer

Lack of encryption at rest

Question 2

Refer to the exhibit. A CISA is analyzing these logs. What is the MOST likely security incident?

Accepted Answer

Compromised administrator account used to establish a command and control channel. The logs show the administrator account executing a reverse shell connection (e.g., using PowerShell or netcat) to an external IP address on a non-standard port (e.g., 4444 or 8080). This outbound connection initiated by the admin account is a classic indicator of a command and control (C2) channel, where an attacker who has compromised the account uses it to maintain persistent remote access. Legitimate administrative activity would not typically involve establishing a reverse shell to an unknown external host.

Answer

Legitimate system maintenance activity

Answer

Brute force attack on the administrator account

Answer

Unauthorized installation of a critical update

Question 3

A financial institution is deploying a data loss prevention (DLP) solution. Which of the following is the MOST important prerequisite to ensure the DLP can effectively detect sensitive data?

Accepted Answer

Performing a data classification exercise. A DLP solution detects sensitive data by matching content against predefined patterns or rules. Without a data classification exercise, the organization cannot define what constitutes 'sensitive data' (e.g., PII, PCI, IP), making the DLP blind to what it should monitor. Classification provides the taxonomy and metadata (e.g., labels, tags) that the DLP engine uses to trigger alerts or blocks, ensuring detection is both accurate and aligned with policy.

Answer

Configuring incident response procedures

Answer

Installing endpoint agents on all devices

Answer

Implementing network segmentation

Question 4

A company requires employees to use smart cards for facility access. Which additional control would BEST prevent tailgating?

Accepted Answer

Install mantraps at entry points. Mantraps prevent tailgating by allowing only one person per authentication. Biometrics address identity, not tailgating. Random audits are detective. Keypad locks are simple and do not prevent tailgating.

Answer

Require biometric authentication

Answer

Use keypad locks on doors

Answer

Conduct random audits of access logs

Question 5

An organization is migrating sensitive customer data to a public cloud. Which of the following encryption strategies provides the STRONGEST protection against data exposure to the cloud provider?

Accepted Answer

Implement client-side encryption with keys managed on-premises. Client-side encryption with keys managed on-premises ensures that the cloud provider never has access to the encryption keys or the plaintext data. Even if the cloud provider's infrastructure is compromised or they have administrative access, the data remains encrypted and unreadable. This provides the strongest protection because the cloud provider is excluded from the cryptographic trust boundary.

Answer

Use transport layer security (TLS) for data in transit

Answer

Encrypt data at rest using server-side encryption with AES-256

Answer

Enable the cloud provider's key management service

Question 6

During a security audit, it was found that users in the finance department have unnecessary access to HR payroll data. Which access control principle has been violated?

Accepted Answer

Least privilege. The least privilege principle dictates that users should be granted only the minimum permissions necessary to perform their job functions. In this scenario, finance department users have unnecessary access to HR payroll data, directly violating this principle by providing more access than required.

Answer

Mandatory access control

Answer

Separation of duties

Answer

Need to know

Question 7

An organization experiences a ransomware attack that encrypts critical files. Which of the following is the BEST recovery strategy to minimize data loss?

Accepted Answer

Restore from offline backups taken before the attack. Restoring from offline backups taken before the attack ensures that the recovered data is clean and free from encryption, as the ransomware cannot modify backups that are not connected to the network. This strategy minimizes data loss by reverting to the most recent known-good state without relying on potentially compromised or incomplete system restore points.

Answer

Disconnect the network and rebuild systems from scratch

Answer

Pay the ransom to decrypt files

Answer

Use system restore points on the same network

Question 8

A company uses role-based access control (RBAC). An employee moves from one department to another but retains some previous access due to overlapping role permissions. This condition is known as:

Accepted Answer

Privilege creep. Privilege creep occurs when an employee accumulates access rights over time, often due to role changes or lateral moves, without corresponding removal of previous permissions. In RBAC, overlapping role permissions can cause this condition when old role memberships are not revoked, leading to excessive entitlements that violate the principle of least privilege.

Answer

Access aggregation

Answer

Segregation of duties conflict

Answer

Entitlement explosion

Question 9

An organization is implementing a data retention policy for personally identifiable information (PII) to comply with GDPR. Which of the following is the MOST appropriate approach?

Accepted Answer

Define retention periods based on legal and business requirements and securely delete after. Option D is correct because GDPR mandates that PII must not be kept longer than necessary for the purpose for which it was collected. Defining retention periods based on legal and business requirements ensures compliance with the storage limitation principle (Article 5(1)(e)), and secure deletion (e.g., using cryptographic erasure or overwriting with tools like shred on Linux) prevents unauthorized recovery. This approach balances regulatory compliance with operational needs.

Answer

Delete PII as soon as it is collected

Answer

Anonymize PII after a fixed period and retain indefinitely

Answer

Retain PII indefinitely for historical analysis

Question 10

An organization is evaluating a cloud-based identity as a service (IDaaS) for single sign-on (SSO). Which of the following security concerns is MOST critical to address?

Accepted Answer

Compromise of the identity provider's credentials. The compromise of the identity provider's (IdP) credentials is the most critical security concern because the IdP acts as the central trust anchor for all SSO transactions. If an attacker gains control of the IdP's signing key or administrative credentials, they can forge SAML assertions for any user, bypassing all downstream authentication and gaining unauthorized access to every connected service provider (SP). This represents a single point of failure that undermines the entire SSO trust model.

Answer

Lack of encryption for SAML assertions

Answer

Incompatibility with legacy applications

Answer

Downtime of the IDaaS provider

Question 11

Which of the following is the PRIMARY purpose of conducting a penetration test?

Accepted Answer

To exploit vulnerabilities to assess real-world impact. The primary purpose of a penetration test is to exploit vulnerabilities in a controlled manner to assess the real-world impact and business risk, not merely to list them. While vulnerability scanning identifies weaknesses, penetration testing goes further by simulating an attacker's actions to determine if and how a vulnerability can be leveraged to compromise systems, data, or operations. This aligns with the CISA focus on evaluating the effectiveness of security controls under realistic attack conditions.

Answer

To test incident response capabilities

Answer

To meet compliance requirements

Answer

To identify vulnerabilities in a system

Question 12

Refer to the exhibit. Which of the following services is accessible from the internet to host 10.1.1.100?

Accepted Answer

HTTPS and SSH. The exhibit shows an access control list (ACL) permitting TCP ports 443 (HTTPS) and 22 (SSH) from any source to host 10.1.1.100. Since the ACL is applied inbound on the internet-facing interface, only HTTPS and SSH traffic are allowed through to that host. Therefore, option C is correct.

Answer

HTTP only

Answer

Telnet only

Answer

FTP only

Question 13

Refer to the exhibit. Which of the following statements is TRUE regarding this S3 bucket policy?

Accepted Answer

Anonymous read access is allowed only over HTTPS. Option A is correct because the S3 bucket policy includes a condition `aws:SecureTransport` set to `true`, which explicitly denies any request that is not made over HTTPS. The `Effect: Allow` on the `Principal: "*"` grants anonymous read access, but the `Condition` block ensures that only HTTPS requests are permitted, making anonymous read access allowed only over HTTPS.

Answer

The bucket is fully public for all actions

Answer

Write access is allowed over HTTP

Answer

Only authenticated users can access objects

Question 14

Refer to the exhibit. This log entry MOST likely indicates:

Accepted Answer

An attempt to escalate privileges or lateral movement. The log entry shows a service account (svc_backup) executing commands that create a new local user and add it to the Administrators group, which is a classic privilege escalation technique. The use of net user and net localgroup commands from a service account indicates an attempt to gain unauthorized administrative access, often as a precursor to lateral movement. This is not normal administrative activity because service accounts are typically restricted to specific tasks and should not be creating interactive user accounts.

Answer

A scheduled backup using the service account

Answer

A brute-force attack

Answer

Normal administrative activity

Question 15

Which TWO of the following are physical security controls to prevent unauthorized access to a data center?

Accepted Answer

Mantrap. Mantraps and biometric readers are physical access controls. Fire suppression and UPS are environmental controls. Cable locks secure equipment but do not prevent entry to the data center.

Answer

Uninterruptible power supply

Answer

Cable locks

Answer

Fire suppression system

CISA Protection of Information Assets Practice Test 6 — 15 Questions

Exhibit

CISA Protection of Information Assets Practice Test 6 — 15 Questions

Exhibit