hardMultiple ChoiceObjective-mapped
CISA Practice Question: A financial services organization recently…
A financial services organization recently experienced a data breach where customer financial records were exfiltrated. The investigation reveals that an attacker gained access through a compromised privileged account belonging to a database administrator. The attacker used valid credentials to log into the database server and then exported a large volume of data using native database tools. The security team notes that the organization has multi-factor authentication (MFA) enabled for all remote access, but the database server was accessed from an internal IP address. The organization also has a data loss prevention (DLP) system, but it did not alert on the export because the traffic was encrypted. The database activity monitoring (DAM) system did log the export, but alerts were not reviewed due to high volume and many false positives. Which of the following would have been most effective in preventing this breach?
⚠ Common exam trap
The trap here is that candidates often focus on detection or network controls (DLP, segmentation, DAM) instead of recognizing that the root cause is the abuse of valid privileged credentials, which requires a preventive control like PAM that manages and monitors privileged access at the point of action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing a privileged access management (PAM) solution that requires approval for elevated actions and records sessions
The breach occurred because a privileged database administrator account was compromised, and the attacker used native database tools to export data from an internal IP address, bypassing MFA. A privileged access management (PAM) solution would have required approval for elevated actions (e.g., exporting large volumes of data) and recorded the session, providing both preventive control (approval workflow) and detective control (session recording) to stop or immediately detect the abuse of valid credentials. This directly addresses the root cause—compromised privileged credentials—rather than relying on network or alerting controls that were circumvented.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploying a DLP solution that can inspect encrypted traffic via SSL interception
Why it's wrong here
SSL interception can be bypassed and may not detect native database exports.
- ✓
Implementing a privileged access management (PAM) solution that requires approval for elevated actions and records sessions
Why this is correct
PAM controls and monitors privileged access, reducing the risk of misuse.
- ✗
Segmenting the database server onto a separate network with strict firewall rules
Why it's wrong here
Segmentation limits lateral movement but does not prevent authorized access misuse.
- ✗
Improving the database activity monitoring (DAM) alerting to reduce false positives
Why it's wrong here
Better alerting is detective, not preventive.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.