The answer is implementing a privileged access management (PAM) solution that requires approval for elevated actions and records sessions. This is the most effective control because the breach exploited a compromised privileged account to exfiltrate data using native database tools from an internal IP, bypassing MFA and encrypted traffic that evaded DLP. PAM directly prevents data exfiltration by enforcing just-in-time elevation workflows, so exporting large volumes of data would require explicit approval, and session recording provides immediate forensic visibility to stop or detect abuse of valid credentials. On the CISA exam, this scenario tests your understanding that privileged access management is a preventive and detective control for insider threats and credential theft, often appearing in questions where network-based controls like MFA or DLP are bypassed. A common trap is choosing MFA or DAM tuning, but remember that compromised privileged accounts require identity-centric controls, not just monitoring. Memory tip: PAM = “Prevent Approval Monitor” for privileged actions.
CISA Protection of Information Assets Practice Question
This CISA practice question tests your understanding of protection of information assets. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A financial services organization recently experienced a data breach where customer financial records were exfiltrated. The investigation reveals that an attacker gained access through a compromised privileged account belonging to a database administrator. The attacker used valid credentials to log into the database server and then exported a large volume of data using native database tools. The security team notes that the organization has multi-factor authentication (MFA) enabled for all remote access, but the database server was accessed from an internal IP address. The organization also has a data loss prevention (DLP) system, but it did not alert on the export because the traffic was encrypted. The database activity monitoring (DAM) system did log the export, but alerts were not reviewed due to high volume and many false positives. Which of the following would have been most effective in preventing this breach?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing a privileged access management (PAM) solution that requires approval for elevated actions and records sessions
The breach occurred because a privileged database administrator account was compromised, and the attacker used native database tools to export data from an internal IP address, bypassing MFA. A privileged access management (PAM) solution would have required approval for elevated actions (e.g., exporting large volumes of data) and recorded the session, providing both preventive control (approval workflow) and detective control (session recording) to stop or immediately detect the abuse of valid credentials. This directly addresses the root cause—compromised privileged credentials—rather than relying on network or alerting controls that were circumvented.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Deploying a DLP solution that can inspect encrypted traffic via SSL interception
Why it's wrong here
SSL interception can be bypassed and may not detect native database exports.
✓
Implementing a privileged access management (PAM) solution that requires approval for elevated actions and records sessions
Why this is correct
PAM controls and monitors privileged access, reducing the risk of misuse.
Related concept
Read the scenario before looking for a memorised answer.
✗
Segmenting the database server onto a separate network with strict firewall rules
Why it's wrong here
Segmentation limits lateral movement but does not prevent authorized access misuse.
✗
Improving the database activity monitoring (DAM) alerting to reduce false positives
Why it's wrong here
Better alerting is detective, not preventive.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often focus on detection or network controls (DLP, segmentation, DAM) instead of recognizing that the root cause is the abuse of valid privileged credentials, which requires a preventive control like PAM that manages and monitors privileged access at the point of action.
Detailed technical explanation
How to think about this question
PAM solutions typically implement a 'just-in-time' (JIT) privilege elevation model, where privileged accounts are granted temporary access only after approval, and all sessions are recorded via protocols like RDP or SSH proxy. In this scenario, even with valid credentials, the attacker would have needed to request and receive approval for the database export action, and the session recording would have captured the exact commands (e.g., `mysqldump` or `bcp`) used for exfiltration, providing an audit trail for immediate investigation. Real-world implementations like CyberArk or BeyondTrust also enforce time-bound access and can require secondary approval for sensitive operations like bulk data export.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Protection of Information Assets — This question tests Protection of Information Assets — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Implementing a privileged access management (PAM) solution that requires approval for elevated actions and records sessions — The breach occurred because a privileged database administrator account was compromised, and the attacker used native database tools to export data from an internal IP address, bypassing MFA. A privileged access management (PAM) solution would have required approval for elevated actions (e.g., exporting large volumes of data) and recorded the session, providing both preventive control (approval workflow) and detective control (session recording) to stop or immediately detect the abuse of valid credentials. This directly addresses the root cause—compromised privileged credentials—rather than relying on network or alerting controls that were circumvented.
What should I do if I get this CISA question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.