CISA Protection of Information Assets — Timed 20 Questions

Question 1

An organization is implementing a data loss prevention (DLP) solution. Which of the following is the BEST approach to reduce false positives during initial deployment?

Accepted Answer

Deploy in monitor-only mode and analyze alerts for a period. Deploying a DLP solution in monitor-only mode allows the organization to observe what data is being transmitted and generate alerts without blocking any traffic. This enables security teams to analyze the alerts against actual business workflows, fine-tune policies, and eliminate false positives before moving to an active enforcement mode. It is a best practice for initial deployment to avoid disrupting legitimate business operations.

Answer

Use default policies without modification

Answer

Limit scope to one department to minimize noise

Answer

Block all sensitive data transmissions immediately

Question 2

During an audit, an IS auditor finds that the organization uses a cloud-based identity provider (IdP) for single sign-on (SSO) but does not enforce multi-factor authentication (MFA) for all users. Which of the following is the BEST recommendation to reduce risk?

Accepted Answer

Enforce MFA for all users accessing any application. Enforcing MFA for all users accessing any application is the best recommendation because it directly addresses the lack of a second authentication factor, which is the primary control to mitigate credential theft and unauthorized access. In a cloud-based IdP SSO environment, a single compromised password grants access to all integrated applications, so MFA must be applied universally to protect the entire trust boundary, not just external-facing apps. This aligns with NIST SP 800-63B and zero-trust principles, ensuring that every authentication request is verified with something the user knows and something they have.

Answer

Require MFA only for external-facing applications

Answer

Disable SSO and require separate passwords for each application

Answer

Reduce session timeout to 15 minutes

Question 3

An organization has implemented role-based access control (RBAC). Which of the following is the PRIMARY benefit of RBAC?

Accepted Answer

Simplified user permission management. RBAC simplifies user permission management by assigning permissions to roles rather than individuals, allowing administrators to grant or revoke access by modifying role memberships. This reduces administrative overhead and the risk of permission errors, as changes propagate automatically to all users in a role. The primary benefit is operational efficiency in access control, not direct security features like encryption or malware protection.

Answer

Encryption of sensitive data at rest

Answer

Elimination of compliance requirements

Answer

Improved protection against malware

Question 4

An IS auditor is reviewing an organization's data classification policy. Which of the following findings is MOST critical?

Accepted Answer

Data owners have not been identified for most data assets. Without identified data owners, no one is accountable for classifying, protecting, or granting access to data assets. This foundational gap undermines the entire data classification policy, making it impossible to enforce controls like encryption or access reviews. The CISA emphasizes that data owner assignment is the first step in any data governance framework.

Answer

Employees receive data classification training only once per year

Answer

Data classification is performed manually without automated tools

Answer

Sensitive data is not encrypted at rest

Question 5

A company is implementing a privileged access management (PAM) system. Which of the following is the MOST important control to prevent lateral movement after a privileged account is compromised?

Accepted Answer

Implement just-in-time (JIT) privilege elevation. Just-in-time (JIT) privilege elevation is the most important control to prevent lateral movement because it eliminates standing privileged access. By granting temporary, time-bound privileges only when needed, JIT reduces the attack surface and ensures that even if an attacker compromises a privileged account, they cannot use those credentials to move laterally to other systems after the access window expires. This directly addresses the root cause of lateral movement: persistent privileged credentials that can be reused across the network.

Answer

Enforce multi-factor authentication for all privileged accounts

Answer

Monitor and record all privileged sessions

Answer

Rotate passwords after each use

Question 6

An organization wants to ensure that data is not retained longer than necessary. Which of the following is the BEST control to implement?

Accepted Answer

Define and enforce data retention schedules. Defining and enforcing data retention schedules directly addresses the requirement to not retain data longer than necessary by specifying precise timeframes for data deletion or archival. This control ensures compliance with legal, regulatory, and business needs by automating the lifecycle management of data, such as through expiration policies in object storage (e.g., S3 Lifecycle rules) or database TTL (time-to-live) settings. Without such schedules, data may persist indefinitely, increasing storage costs and regulatory risk.

Answer

Encrypt all data at rest

Answer

Implement a backup retention policy

Answer

Use role-based access controls

Question 7

During a penetration test, a tester discovers that an application stores passwords using a reversible encryption algorithm. Which of the following is the BEST remediation?

Accepted Answer

Implement a strong one-way hashing algorithm such as bcrypt. Storing passwords using reversible encryption is fundamentally flawed because any encryption key can be compromised, allowing an attacker to decrypt all passwords. The best remediation is to use a strong, one-way hashing algorithm like bcrypt, which is designed to be computationally expensive and includes a built-in salt to resist rainbow table attacks and brute-force attempts. Unlike encryption, hashing is irreversible, so even if the database is breached, the original passwords cannot be recovered.

Answer

Use MD5 hashing with a salt

Answer

Replace the encryption algorithm with AES-256

Answer

Add a random salt before encryption

Question 8

An organization uses a third-party cloud service for data storage. Which of the following is the BEST way to ensure data confidentiality in the event of a cloud provider breach?

Accepted Answer

Implement client-side encryption before uploading data. Client-side encryption ensures that data is encrypted before it leaves the organization's control, so the cloud provider never has access to the plaintext or the encryption keys. In the event of a provider breach, the encrypted data remains confidential because only the organization holds the keys to decrypt it. This is the only option that guarantees confidentiality regardless of the cloud provider's security posture.

Answer

Rely on the cloud provider's encryption at rest

Answer

Use TLS for data in transit

Answer

Deploy a cloud access security broker (CASB) with DLP

Question 9

Which of the following is the PRIMARY purpose of a data classification scheme?

Accepted Answer

To ensure appropriate security controls are applied based on data sensitivity. A data classification scheme assigns sensitivity labels (e.g., public, internal, confidential, restricted) to information assets. Its primary purpose is to ensure that appropriate security controls—such as access control lists, encryption strength, and monitoring—are applied proportionally to the data's sensitivity. Without classification, controls would be either insufficient for high-risk data or overly restrictive for low-risk data, undermining both security and operational efficiency.

Answer

To enable encryption of all sensitive data

Answer

To meet regulatory compliance requirements

Answer

To define data retention periods

Question 10

Which TWO of the following are effective controls to prevent unauthorized access to sensitive data in a database? (Choose two.)

Accepted Answer

Database activity monitoring (DAM). Options B and D are correct. Encryption at rest protects data if storage is accessed. Database activity monitoring (DAM) detects and can block unauthorized queries. Option A is wrong because network segmentation alone does not prevent access if credentials are compromised. Option C is wrong because strong passwords are good but not sufficient. Option E is wrong because regular patching addresses vulnerabilities but not access control.

Answer

Strong password policy

Answer

Regular patch management

Answer

Network segmentation

Question 11

Which THREE of the following are key components of an effective information security awareness program? (Choose three.)

Accepted Answer

Phishing simulation exercises. Phishing simulation exercises are a key component of an effective information security awareness program because they provide hands-on, practical experience in identifying and responding to real-world phishing attempts. By simulating attacks, organizations can measure employee susceptibility, reinforce training, and reduce the risk of successful social engineering attacks. This proactive approach helps build a security-conscious culture and directly addresses the human factor in cybersecurity.

Answer

Reward program for reporting incidents

Answer

Annual one-time training for all employees

Question 12

Which TWO of the following are examples of administrative controls for information security? (Choose two.)

Accepted Answer

Incident response policy. Option C is correct because an incident response policy is a documented set of procedures that defines roles, responsibilities, and steps to be taken when a security incident occurs. This is an administrative control as it governs human behavior and organizational processes, not technology. It aligns with the CISA domain of Protection of Information Assets by establishing a framework for detecting, responding to, and recovering from security events.

Answer

Encryption of data at rest

Answer

Biometric access controls

Answer

Firewall configuration

Question 13

Based on the exhibit, which user account poses the HIGHEST security risk?

Accepted Answer

admin. The 'admin' account poses the highest security risk because it typically has elevated privileges (e.g., sudo or administrator group membership) and is often configured with a default or weak password. Unlike 'root', which can be locked or disabled for direct SSH login, the 'admin' account is commonly used for day-to-day administrative tasks and may have password-based authentication enabled, making it a prime target for brute-force attacks. In many Linux/Unix systems, 'admin' is a standard user with UID 0 or sudo rights, and its compromise grants full system control.

Answer

root

Answer

test

Answer

None of the accounts are risky

Question 14

Based on the exhibit, which of the following is the MOST likely result of the current firewall configuration?

Accepted Answer

Remote SSH connections are permitted from any IP address. The exhibit shows an access control list (ACL) that permits TCP traffic on port 22 (SSH) from any source IP address (0.0.0.0/0) to the destination IP address of the firewall's external interface. Since there is no source restriction, remote SSH connections are allowed from any IP address on the internet. This is a significant security risk because it exposes the firewall's management interface to brute-force attacks from the entire internet.

Answer

SSH access is restricted to the internal network

Answer

HTTPS traffic from the internal network is blocked

Answer

HTTPS traffic from the internet is allowed

Question 15

Based on the exhibit, what is the security risk of this bucket policy?

Accepted Answer

The bucket is publicly readable. The bucket policy grants public read access by setting `"Principal": "*"` and `"Effect": "Allow"` with `"Action": "s3:GetObject"`. This means any unauthenticated user on the internet can list and retrieve objects in the bucket, making it publicly readable. The policy does not require any authentication or authorization checks, which is a common misconfiguration leading to data exposure.

Answer

The bucket allows public write access

Answer

The bucket policy restricts access to a specific IAM role

Answer

The bucket policy is not encrypted

Question 16

You are an IS auditor reviewing the remote access configuration for a medium-sized enterprise. The company uses a VPN concentrator to allow employees to connect from home. The VPN is configured with IPsec using pre-shared keys (PSK) and requires no multi-factor authentication. Employees use company-issued laptops with full disk encryption. The VPN logs show that connections are coming from a wide range of IP addresses, including some from countries where the company has no business operations. The IT manager argues that the PSK is changed monthly and that full disk encryption mitigates any risk. However, during the audit, you find that the PSK is stored in a shared document on an internal file server accessible to all employees. Additionally, the VPN concentrator uses a single PSK for all users. Which of the following is the MOST critical finding?

Accepted Answer

The VPN uses a single pre-shared key for all users, increasing the risk of widespread compromise. The use of a single pre-shared key (PSK) for all VPN users is the most critical finding because it creates a single point of failure: if that key is compromised, an attacker can impersonate any authorized user and gain full network access. The fact that the PSK is stored in a shared document accessible to all employees dramatically increases the likelihood of exposure, and changing it monthly does not remediate the fundamental lack of user-level authentication. Without per-user credentials or multi-factor authentication, the VPN concentrator cannot distinguish between legitimate employees and an attacker who possesses the shared key.

Answer

The PSK is changed monthly, but the change interval is too long

Answer

Full disk encryption on laptops is not sufficient to protect VPN credentials

Answer

VPN connections from unexpected countries indicate possible unauthorized access

Question 17

You are an IS auditor for a financial institution that processes credit card payments. The organization uses a key management system (KMS) to store encryption keys for point-of-sale (POS) data. The KMS is a hardware security module (HSM) located in a secured data center. The audit reveals that the HSM is administered by two individuals who both have full access to the HSM, including the ability to export keys. The organization has a policy requiring split knowledge and dual control for key management, but in practice, the two administrators often perform key ceremonies alone due to scheduling conflicts. The logs show that one administrator exported a key last month without the other present, and the export was approved via email by the other administrator after the fact. Which of the following is the BEST corrective action?

Accepted Answer

Configure the HSM to require two administrators to be physically present for key exports. The HSM must enforce split knowledge and dual control at the technical level, not rely on procedural compliance. By configuring the HSM to require two administrators to be physically present for key exports, the organization ensures that no single individual can export keys, directly addressing the policy violation and the log evidence of a solo export. This technical control is the most effective corrective action because it prevents the bypass of dual control even if administrators attempt to circumvent procedures.

Answer

Reduce the number of administrators to one to simplify accountability

Answer

Provide training to administrators on the importance of dual control

Answer

Implement automated key rotation every 90 days

Question 18

An organization is implementing a data loss prevention (DLP) solution. Which of the following is the BEST approach to minimize false positives while ensuring sensitive data is protected?

Accepted Answer

Use contextual analysis including user roles and data classification.. Contextual analysis (Option C) is the best approach because it reduces false positives by considering user roles, data classification, and behavioral patterns, ensuring that only genuinely risky data transfers are flagged. Unlike static methods, this dynamic analysis adapts to the organization's data governance policies, allowing legitimate business communications to proceed while still protecting sensitive information.

Answer

Encrypt all outbound emails containing any attachment.

Answer

Deploy exact file matching against a database of known sensitive documents.

Answer

Apply keyword matching to all outbound emails.

Question 19

A security architect is designing a data classification schema for a multinational corporation. Which combination of factors is MOST critical for determining the classification level of a data asset?

Accepted Answer

Legal, regulatory, and business impact if disclosed.. The classification level of a data asset is primarily determined by the potential harm that could result from its unauthorized disclosure, modification, or loss. Legal, regulatory, and business impact factors—such as compliance with GDPR, HIPAA, or PCI DSS—directly dictate the required confidentiality, integrity, and availability controls. Without assessing these impacts, any classification scheme would be arbitrary and fail to align with organizational risk tolerance.

Answer

Data volume and storage location.

Answer

Data format and encryption status.

Answer

Data creation date and last access time.

Question 20

A company's security policy requires that all laptops have full disk encryption. During an audit, it is discovered that several laptops have encryption enabled but the recovery keys are stored on the local drive. What is the MOST significant risk?

Accepted Answer

Recovery keys can be used to bypass encryption.. Storing recovery keys on the local drive defeats the purpose of full disk encryption (FDE). If an attacker gains physical access to the laptop, they can simply boot an alternate OS or mount the drive and read the recovery key file, then use it to unlock the encrypted volume. This bypasses the encryption entirely, making the data vulnerable to unauthorized access despite encryption being enabled.

Answer

Performance degradation due to encryption overhead.

Answer

Unauthorized access to encrypted data.

Answer

Data corruption during encryption process.