The answer is to correct the firewall rule to restrict database access to only the application servers. This is the most effective immediate containment action because the misconfigured firewall rule is the root cause enabling the external attacker to directly query the database from any IP address, bypassing all other controls. By correcting this rule, the security team cuts off unauthorized network access at the network layer, stopping the ongoing data exfiltration regardless of the encryption or web application issues. On the CISA exam, this scenario tests your understanding of the incident response priority: containment first, and specifically that network-layer controls (firewall rules) take precedence over encryption or application fixes when they are the direct vector of the breach. A common trap is to focus on enabling HTTPS or fixing the load balancer, but those address data-in-transit exposure, not the immediate unauthorized access. Memory tip: “Fix the gate before patching the window”—stop the direct path of the attacker first.
CISA Protection of Information Assets Practice Question
This CISA practice question tests your understanding of protection of information assets. Examine the command output carefully: the correct answer depends on what the output actually shows, not on general recall alone. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A healthcare organization has implemented a data classification policy with three levels: Public, Internal, and Restricted. The IT department recently received a report of a potential data breach. An internal auditor discovered that a database containing Protected Health Information (PHI) classified as Restricted was accessible via a web application that did not enforce encryption in transit. The web application uses HTTPS, but the auditor found that the connection was downgraded to HTTP due to a misconfiguration in the load balancer. Additionally, the database logs show that an external IP address queried the database for thousands of patient records over a two-hour period. The database was configured to allow only specific internal application servers, but the firewall rule was incorrectly set to allow connections from any IP address. The security team needs to determine the most effective immediate action to prevent further unauthorized access and protect the data. Which course of action should the security team take FIRST?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Correct the firewall rule to restrict database access to only the application servers.
The firewall rule is the root cause of the unauthorized access — it allowed connections from any IP address, directly enabling the external attacker to query the database. Correcting this rule immediately cuts off all external access to the database, stopping the ongoing breach at the network layer. This is the most effective immediate action because it addresses the misconfiguration that allowed the attack to succeed, regardless of the encryption or web application issues.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Correct the firewall rule to restrict database access to only the application servers.
Why this is correct
Directly addresses the misconfiguration that allowed exposure.
Clue confirmation
The clue word "first" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Redesign the network architecture to place the database in a separate subnet.
Why it's wrong here
Long-term solution, not immediate.
✗
Block the external IP address at the network perimeter.
Why it's wrong here
Temporary measure; attacker can change IP.
✗
Apply a security patch to the web application to enforce HTTPS.
Why it's wrong here
Does not address the database access issue.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates focus on the encryption downgrade (HTTPS to HTTP) or the external IP address, but the core vulnerability is the misconfigured firewall rule that allows any IP to access the database directly — a classic 'defense in depth' failure where the network layer control was missing.
Detailed technical explanation
How to think about this question
The firewall rule allowing any source IP to reach the database is a classic example of a missing access control list (ACL) on the database port (typically TCP 1433 for SQL Server or 3306 for MySQL). Even with encryption in transit (TLS), if the database is exposed to the internet, an attacker can bypass the web application entirely and perform a direct database query, as seen in this scenario. The immediate fix is to apply a stateful firewall rule that restricts source IPs to only the application servers' IP addresses, effectively creating a network segmentation boundary.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Protection of Information Assets — This question tests Protection of Information Assets — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Correct the firewall rule to restrict database access to only the application servers. — The firewall rule is the root cause of the unauthorized access — it allowed connections from any IP address, directly enabling the external attacker to query the database. Correcting this rule immediately cuts off all external access to the database, stopping the ongoing breach at the network layer. This is the most effective immediate action because it addresses the misconfiguration that allowed the attack to succeed, regardless of the encryption or web application issues.
What should I do if I get this CISA question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "first". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are an information security manager for a global financial services company. The organization maintains a hybrid infrastructure with critical customer data stored on an on-premises Oracle database server (DB-SRV-01) and in an AWS S3 bucket (customer-data-prod). At 10:00 AM, the security operations center (SOC) alerts you to an anomalous outbound data transfer from DB-SRV-01 to an unknown IP address in a high-risk country. The transfer started at 9:45 AM and involves 500 MB of data, likely including personally identifiable information (PII). The SOC has already quarantined the server's network egress by blocking all outbound traffic from DB-SRV-01, but the server remains connected to the internal production network. Meanwhile, a separate analysis indicates that the S3 bucket has been accessed via an IAM key that was stolen from a compromised developer workstation three days ago. The key has not been rotated. The incident response team is preparing to act. The primary objective is to protect information assets and minimize data exposure. Given this scenario, which of the following actions should the team take FIRST?
medium
A.Restore DB-SRV-01 from a clean backup taken before the incident and change the IAM keys for the S3 bucket.
B.Notify the appropriate data protection authority within the required 72-hour timeframe.
C.Patch the Oracle database server to the latest version to close any known vulnerabilities.
✓ D.Isolate DB-SRV-01 from the internal network by disconnecting its network cable or disabling the virtual switch port.
Why D: Option C is correct because immediately isolating the affected server from the internal network is the most critical first step to prevent lateral movement and further data exfiltration. Option A is incorrect because patching the server without understanding the attack vector could destroy forensic evidence and may not address the active compromise. Option B is incorrect because notifying the data protection authority is a legal requirement but not an immediate containment action. Option D is incorrect because restoring from backup would eliminate any forensic evidence and may reintroduce the same vulnerability, and it does not address the S3 bucket issue.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.