mediumMultiple ChoiceObjective-mapped
CISA Practice Question: A company's backup policy requires that backup…
A company's backup policy requires that backup tapes be stored offsite for at least one year. During an audit, the auditor finds that the offsite storage facility is not access-controlled and backup tapes are not encrypted. Which of the following is the auditor's BEST recommendation?
⚠ Common exam trap
The trap here is that candidates often focus on physical security controls (like logs or moving tapes) rather than recognizing that data confidentiality is the paramount risk, and encryption is the only option that directly protects the data itself regardless of physical security failures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encrypt all backup tapes before sending them offsite
The core issue is that backup tapes contain sensitive data and are stored in an uncontrolled environment. Encrypting the tapes before transport ensures that even if the physical security of the offsite facility is compromised, the data remains confidential. This directly addresses the risk of unauthorized access to the data, which is the primary concern, and is a cost-effective, immediate control that does not disrupt operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Negotiate a new contract with a different offsite storage provider
Why it's wrong here
This is a longer-term solution; immediate risk should be addressed first.
- ✗
Move the tapes back to the primary site until the offsite facility is secured
Why it's wrong here
This violates the offsite storage policy and increases risk from a site disaster.
- ✗
Implement a check-in/check-out log for the offsite facility
Why it's wrong here
This is a detective control but does not protect the data if tapes are stolen.
- ✓
Encrypt all backup tapes before sending them offsite
Why this is correct
Encryption mitigates the risk of unauthorized access to data on the tapes.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.